--- title: Access --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/go) [Zero Trust](https://developers.cloudflare.com/api/go/resources/zero_trust) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Access #### AccessAI Controls #### AccessAI ControlsMcp #### AccessAI ControlsMcpPortals ##### [List MCP Portals](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/list) client.ZeroTrust.Access.AIControls.Mcp.Portals.List(ctx, params) (\*V4PagePaginationArray\[[AccessAIControlMcpPortalListResponse]()], error) GET/accounts/{account\_id}/access/ai-controls/mcp/portals ##### [Create a new MCP Portal](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/create) client.ZeroTrust.Access.AIControls.Mcp.Portals.New(ctx, params) (\*[AccessAIControlMcpPortalNewResponse](), error) POST/accounts/{account\_id}/access/ai-controls/mcp/portals ##### [Read details of an MCP Portal](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/read) client.ZeroTrust.Access.AIControls.Mcp.Portals.Read(ctx, id, query) (\*[AccessAIControlMcpPortalReadResponse](), error) GET/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### [Update an MCP Portal](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/update) client.ZeroTrust.Access.AIControls.Mcp.Portals.Update(ctx, id, params) (\*[AccessAIControlMcpPortalUpdateResponse](), error) PUT/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### [Delete an MCP Portal](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/delete) client.ZeroTrust.Access.AIControls.Mcp.Portals.Delete(ctx, id, body) (\*[AccessAIControlMcpPortalDeleteResponse](), error) DELETE/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} #### AccessAI ControlsMcpServers ##### [List MCP Servers](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/list) client.ZeroTrust.Access.AIControls.Mcp.Servers.List(ctx, params) (\*V4PagePaginationArray\[[AccessAIControlMcpServerListResponse]()], error) GET/accounts/{account\_id}/access/ai-controls/mcp/servers ##### [Create a new MCP Server](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/create) client.ZeroTrust.Access.AIControls.Mcp.Servers.New(ctx, params) (\*[AccessAIControlMcpServerNewResponse](), error) POST/accounts/{account\_id}/access/ai-controls/mcp/servers ##### [Read the details of an MCP Server](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/read) client.ZeroTrust.Access.AIControls.Mcp.Servers.Read(ctx, id, query) (\*[AccessAIControlMcpServerReadResponse](), error) GET/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Update an MCP Server](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/update) client.ZeroTrust.Access.AIControls.Mcp.Servers.Update(ctx, id, params) (\*[AccessAIControlMcpServerUpdateResponse](), error) PUT/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Delete an MCP Server](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/delete) client.ZeroTrust.Access.AIControls.Mcp.Servers.Delete(ctx, id, body) (\*[AccessAIControlMcpServerDeleteResponse](), error) DELETE/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Sync MCP Server Capabilities](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/sync) client.ZeroTrust.Access.AIControls.Mcp.Servers.Sync(ctx, id, body) (\*[AccessAIControlMcpServerSyncResponse](), error) POST/accounts/{account\_id}/access/ai-controls/mcp/servers/{id}/sync #### AccessGateway CA ##### [List SSH Certificate Authorities (CA)](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/list) client.ZeroTrust.Access.GatewayCA.List(ctx, query) (\*SinglePage\[[AccessGatewayCAListResponse]()], error) GET/accounts/{account\_id}/access/gateway\_ca ##### [Add a new SSH Certificate Authority (CA)](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/create) client.ZeroTrust.Access.GatewayCA.New(ctx, body) (\*[AccessGatewayCANewResponse](), error) POST/accounts/{account\_id}/access/gateway\_ca ##### [Delete an SSH Certificate Authority (CA)](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/delete) client.ZeroTrust.Access.GatewayCA.Delete(ctx, certificateID, body) (\*[AccessGatewayCADeleteResponse](), error) DELETE/accounts/{account\_id}/access/gateway\_ca/{certificate\_id} #### AccessIdP Federation Grants ##### [List IdP federation grants](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/list) client.ZeroTrust.Access.IdPFederationGrants.List(ctx, query) (\*\[] [IdPFederationGrant](), error) GET/accounts/{account\_id}/access/idp\_federation\_grants ##### [Create an IdP federation grant](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/create) client.ZeroTrust.Access.IdPFederationGrants.New(ctx, params) (\*[IdPFederationGrant](), error) POST/accounts/{account\_id}/access/idp\_federation\_grants ##### [Get an IdP federation grant](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/get) client.ZeroTrust.Access.IdPFederationGrants.Get(ctx, grantID, query) (\*[IdPFederationGrant](), error) GET/accounts/{account\_id}/access/idp\_federation\_grants/{grant\_id} ##### [Delete an IdP federation grant](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/delete) client.ZeroTrust.Access.IdPFederationGrants.Delete(ctx, grantID, body) (\*[AccessIdPFederationGrantDeleteResponse](), error) DELETE/accounts/{account\_id}/access/idp\_federation\_grants/{grant\_id} ##### ModelsExpand Collapse
type IdPFederationGrant struct{…} ID string UID of the IdP federation grant. maxLength32 Link to this property IdPID string UID of the identity provider being federated. formatuuid Link to this property
[Link to this property](<#(resource)%20zero_trust.access.idp_federation_grants%20%3E%20(model)%20idp_federation_grant%20%3E%20(schema)>) #### AccessSAML Certificates ##### [List SAML certificate sets](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/list) client.ZeroTrust.Access.SAMLCertificates.List(ctx, params) (\*V4PagePaginationArray\[[AccessSAMLCertificateListResponse]()], error) GET/accounts/{account\_id}/access/saml\_certificates ##### [Get SAML certificate set](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/get) client.ZeroTrust.Access.SAMLCertificates.Get(ctx, samlCERTSetID, query) (\*[AccessSAMLCertificateGetResponse](), error) GET/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id} ##### [Rotate SAML certificate](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/rotate) client.ZeroTrust.Access.SAMLCertificates.Rotate(ctx, samlCERTSetID, body) (\*[AccessSAMLCertificateRotateResponse](), error) POST/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id}/rotate ##### [Download current certificate in PEM format](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/get_pem) client.ZeroTrust.Access.SAMLCertificates.GetPem(ctx, samlCERTSetID, query) (\*Response, error) GET/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id}/pem #### AccessInfrastructure #### AccessInfrastructureTargets ##### [List all targets](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/list) client.ZeroTrust.Access.Infrastructure.Targets.List(ctx, params) (\*V4PagePaginationArray\[[AccessInfrastructureTargetListResponse]()], error) GET/accounts/{account\_id}/infrastructure/targets ##### [Get target](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/get) client.ZeroTrust.Access.Infrastructure.Targets.Get(ctx, targetID, query) (\*[AccessInfrastructureTargetGetResponse](), error) GET/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Create new target](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/create) client.ZeroTrust.Access.Infrastructure.Targets.New(ctx, params) (\*[AccessInfrastructureTargetNewResponse](), error) POST/accounts/{account\_id}/infrastructure/targets ##### [Update target](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/update) client.ZeroTrust.Access.Infrastructure.Targets.Update(ctx, targetID, params) (\*[AccessInfrastructureTargetUpdateResponse](), error) PUT/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Delete target](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/delete) client.ZeroTrust.Access.Infrastructure.Targets.Delete(ctx, targetID, body) error DELETE/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Create new targets](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_update) client.ZeroTrust.Access.Infrastructure.Targets.BulkUpdate(ctx, params) (\*SinglePage\[[AccessInfrastructureTargetBulkUpdateResponse]()], error) PUT/accounts/{account\_id}/infrastructure/targets/batch ##### [Delete targets (Deprecated)](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_delete) Deprecated client.ZeroTrust.Access.Infrastructure.Targets.BulkDelete(ctx, body) error DELETE/accounts/{account\_id}/infrastructure/targets/batch ##### [Delete targets](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_delete_v2) client.ZeroTrust.Access.Infrastructure.Targets.BulkDeleteV2(ctx, params) error POST/accounts/{account\_id}/infrastructure/targets/batch\_delete #### AccessApplications ##### [List Access applications](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/methods/list) client.ZeroTrust.Access.Applications.List(ctx, params) (\*V4PagePaginationArray\[[AccessApplicationListResponse]()], error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps ##### [Get an Access application](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/methods/get) client.ZeroTrust.Access.Applications.Get(ctx, appID, query) (\*[AccessApplicationGetResponse](), error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Add an Access application](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/methods/create) client.ZeroTrust.Access.Applications.New(ctx, params) (\*[AccessApplicationNewResponse](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps ##### [Update an Access application](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/methods/update) client.ZeroTrust.Access.Applications.Update(ctx, appID, params) (\*[AccessApplicationUpdateResponse](), error) PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Delete an Access application](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/methods/delete) client.ZeroTrust.Access.Applications.Delete(ctx, appID, body) (\*[AccessApplicationDeleteResponse](), error) DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Revoke application tokens](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/methods/revoke_tokens) client.ZeroTrust.Access.Applications.RevokeTokens(ctx, appID, body) (\*[AccessApplicationRevokeTokensResponse](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/revoke\_tokens ##### ModelsExpand Collapse type AllowedHeaders string [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_headers%20%3E%20(schema)>) type AllowedIdPs string The identity providers selected for application. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_idps%20%3E%20(schema)>)
type AllowedMethods string One of the following: const AllowedMethodsGet AllowedMethods = "GET" Link to this property const AllowedMethodsPost AllowedMethods = "POST" Link to this property const AllowedMethodsHead AllowedMethods = "HEAD" Link to this property const AllowedMethodsPut AllowedMethods = "PUT" Link to this property const AllowedMethodsDelete AllowedMethods = "DELETE" Link to this property const AllowedMethodsConnect AllowedMethods = "CONNECT" Link to this property const AllowedMethodsOptions AllowedMethods = "OPTIONS" Link to this property const AllowedMethodsTrace AllowedMethods = "TRACE" Link to this property const AllowedMethodsPatch AllowedMethods = "PATCH" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_methods%20%3E%20(schema)>) type AllowedOrigins string [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_origins%20%3E%20(schema)>) type AppID string Identifier. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20app_id%20%3E%20(schema)>)
type Application interface{…} One of the following:
ApplicationSelfHostedApplication Domain string The domain and path that Access will secure. Link to this property Type string The application type. Link to this property ID stringOptional UUID. maxLength36 Link to this property AllowIframe boolOptional Enables loading application content in an iFrame. Link to this property AllowedIdPs \[]AllowedIdPsOptional The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property AppLauncherVisible boolOptional Displays the application in the App Launcher. Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property CORSHeaders CORSHeadersOptional Link to this property CreatedAt TimeOptional formatdate-time Link to this property CustomDenyMessage stringOptional The custom error message shown to a user when they are denied access to the application. Link to this property CustomDenyURL stringOptional The custom URL a user is redirected to when they are denied access to the application. Link to this property EagerRedirectCookieSetting boolOptional Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property EnableBindingCookie boolOptional Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property HTTPOnlyCookieAttribute boolOptional Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property LogoURL stringOptional The image URL for the logo shown in the App Launcher dashboard. Link to this property Name stringOptional The name of the application. Link to this property OptionsPreflightBypass boolOptional Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property SameSiteCookieAttribute stringOptional Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
SCIMConfig ApplicationSelfHostedApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationSelfHostedApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property ServiceAuth401Redirect boolOptional Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property SessionDuration stringOptional The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property SkipInterstitial boolOptional Enables automatic authentication through cloudflared. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property UseClientlessIsolationAppLauncherURL boolOptional Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
ApplicationSaaSApplication ID stringOptional UUID. maxLength36 Link to this property AllowedIdPs \[]AllowedIdPsOptional The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property AppLauncherVisible boolOptional Displays the application in the App Launcher. Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property CreatedAt TimeOptional formatdate-time Link to this property LogoURL stringOptional The image URL for the logo shown in the App Launcher dashboard. Link to this property Name stringOptional The name of the application. Link to this property
SaaSApp ApplicationSaaSApplicationSaaSAppOptional One of the following:
ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2
AuthType ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2AuthTypeOptional Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml” One of the following: const ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2AuthTypeSAML ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2AuthType = "saml" Link to this property const ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2AuthTypeOIDC ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2AuthType = "oidc" Link to this property
Link to this property ConsumerServiceURL stringOptional The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion. Link to this property CreatedAt TimeOptional formatdate-time Link to this property
CustomAttributes \[]ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributeOptional FriendlyName stringOptional The SAML FriendlyName of the attribute. Link to this property Name stringOptional The name of the attribute. Link to this property
NameFormat ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesNameFormatOptional A globally unique name for an identity or service provider. One of the following: const ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesNameFormatUrnOasisNamesTcSAML2\_0AttrnameFormatUnspecified ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" Link to this property const ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesNameFormatUrnOasisNamesTcSAML2\_0AttrnameFormatBasic ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Link to this property const ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesNameFormatUrnOasisNamesTcSAML2\_0AttrnameFormatURI ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Link to this property
Link to this property Required boolOptional If the attribute is required when building a SAML assertion. Link to this property
Source ApplicationSaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributesSourceOptional Name stringOptional The name of the IdP attribute. Link to this property NameByIdP map\[string, string]Optional A mapping from IdP ID to attribute name. Link to this property
Link to this property
Link to this property IdPEntityID stringOptional The unique identifier for your SaaS application. Link to this property NameIDFormat SaaSAppNameIDFormatOptional The format of the name identifier sent to the SaaS application. Link to this property NameIDTransformJsonata stringOptional A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting. Link to this property PublicKey stringOptional The Access public certificate that will be used to verify your identity. Link to this property SPEntityID stringOptional A globally unique name for an identity or service provider. Link to this property SSOEndpoint stringOptional The endpoint where your SaaS application will send login requests. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2 AccessTokenLifetime stringOptional The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h. Link to this property AllowPKCEWithoutClientSecret boolOptional If client secret should be required on the token endpoint when authorization\_code\_with\_pkce grant is used. Link to this property AppLauncherURL stringOptional The URL where this applications tile redirects users Link to this property
AuthType ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2AuthTypeOptional Identifier of the authentication protocol used for the saas app. Required for OIDC. One of the following: const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2AuthTypeSAML ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2AuthType = "saml" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2AuthTypeOIDC ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2AuthType = "oidc" Link to this property
Link to this property ClientID stringOptional The application client id Link to this property ClientSecret stringOptional The application client secret, only returned on POST request. Link to this property CreatedAt TimeOptional formatdate-time Link to this property
CustomClaims \[]ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimOptional Name stringOptional The name of the claim. Link to this property Required boolOptional If the claim is required when building an OIDC token. Link to this property
Scope ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScopeOptional The scope of the claim. One of the following: const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScopeGroups ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScope = "groups" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScopeProfile ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScope = "profile" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScopeEmail ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScope = "email" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScopeOpenid ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsScope = "openid" Link to this property
Link to this property
Source ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsSourceOptional Name stringOptional The name of the IdP claim. Link to this property
NameByIdP \[]ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimsSourceNameByIdPOptional A mapping from IdP ID to attribute name. IdPID stringOptional The UID of the IdP. Link to this property SourceName stringOptional The name of the IdP provided attribute. Link to this property
Link to this property
Link to this property
Link to this property
GrantTypes \[]ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantTypeOptional The OIDC flows supported by this application One of the following: const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantTypeAuthorizationCode ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantType = "authorization\_code" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantTypeAuthorizationCodeWithPKCE ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantType = "authorization\_code\_with\_pkce" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantTypeRefreshTokens ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantType = "refresh\_tokens" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantTypeHybrid ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantType = "hybrid" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantTypeImplicit ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2GrantType = "implicit" Link to this property
Link to this property GroupFilterRegex stringOptional A regex to filter Cloudflare groups returned in ID token and userinfo endpoint. Link to this property
HybridAndImplicitOptions ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2HybridAndImplicitOptionsOptional ReturnAccessTokenFromAuthorizationEndpoint boolOptional If an Access Token should be returned from the OIDC Authorization endpoint Link to this property ReturnIDTokenFromAuthorizationEndpoint boolOptional If an ID Token should be returned from the OIDC Authorization endpoint Link to this property
Link to this property PublicKey stringOptional The Access public certificate that will be used to verify your identity. Link to this property RedirectURIs \[]stringOptional The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens Link to this property
RefreshTokenOptions ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2RefreshTokenOptionsOptional Lifetime stringOptional How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m. Link to this property
Link to this property
Scopes \[]ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2ScopeOptional Define the user information shared with access, “offline\_access” scope will be automatically enabled if refresh tokens are enabled One of the following: const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2ScopeOpenid ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2Scope = "openid" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2ScopeGroups ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2Scope = "groups" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2ScopeEmail ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2Scope = "email" Link to this property const ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2ScopeProfile ApplicationSaaSApplicationSaaSAppAccessOIDCSaaSApp2Scope = "profile" Link to this property
Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
Link to this property
SCIMConfig ApplicationSaaSApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationSaaSApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property Type stringOptional The application type. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
ApplicationBrowserSSHApplication Domain string The domain and path that Access will secure. Link to this property Type string The application type. Link to this property ID stringOptional UUID. maxLength36 Link to this property AllowIframe boolOptional Enables loading application content in an iFrame. Link to this property AllowedIdPs \[]AllowedIdPsOptional The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property AppLauncherVisible boolOptional Displays the application in the App Launcher. Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property CORSHeaders CORSHeadersOptional Link to this property CreatedAt TimeOptional formatdate-time Link to this property CustomDenyMessage stringOptional The custom error message shown to a user when they are denied access to the application. Link to this property CustomDenyURL stringOptional The custom URL a user is redirected to when they are denied access to the application. Link to this property EagerRedirectCookieSetting boolOptional Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property EnableBindingCookie boolOptional Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property HTTPOnlyCookieAttribute boolOptional Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property LogoURL stringOptional The image URL for the logo shown in the App Launcher dashboard. Link to this property Name stringOptional The name of the application. Link to this property OptionsPreflightBypass boolOptional Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property SameSiteCookieAttribute stringOptional Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
SCIMConfig ApplicationBrowserSSHApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationBrowserSSHApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property ServiceAuth401Redirect boolOptional Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property SessionDuration stringOptional The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property SkipInterstitial boolOptional Enables automatic authentication through cloudflared. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property UseClientlessIsolationAppLauncherURL boolOptional Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
ApplicationBrowserVNCApplication Domain string The domain and path that Access will secure. Link to this property Type string The application type. Link to this property ID stringOptional UUID. maxLength36 Link to this property AllowIframe boolOptional Enables loading application content in an iFrame. Link to this property AllowedIdPs \[]AllowedIdPsOptional The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property AppLauncherVisible boolOptional Displays the application in the App Launcher. Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property CORSHeaders CORSHeadersOptional Link to this property CreatedAt TimeOptional formatdate-time Link to this property CustomDenyMessage stringOptional The custom error message shown to a user when they are denied access to the application. Link to this property CustomDenyURL stringOptional The custom URL a user is redirected to when they are denied access to the application. Link to this property EagerRedirectCookieSetting boolOptional Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property EnableBindingCookie boolOptional Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property HTTPOnlyCookieAttribute boolOptional Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property LogoURL stringOptional The image URL for the logo shown in the App Launcher dashboard. Link to this property Name stringOptional The name of the application. Link to this property OptionsPreflightBypass boolOptional Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property SameSiteCookieAttribute stringOptional Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
SCIMConfig ApplicationBrowserVNCApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationBrowserVNCApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property ServiceAuth401Redirect boolOptional Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property SessionDuration stringOptional The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property SkipInterstitial boolOptional Enables automatic authentication through cloudflared. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property UseClientlessIsolationAppLauncherURL boolOptional Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
ApplicationAppLauncherApplication
Type ApplicationAppLauncherApplicationType The application type. One of the following: const ApplicationAppLauncherApplicationTypeSelfHosted ApplicationAppLauncherApplicationType = "self\_hosted" Link to this property const ApplicationAppLauncherApplicationTypeSaaS ApplicationAppLauncherApplicationType = "saas" Link to this property const ApplicationAppLauncherApplicationTypeSSH ApplicationAppLauncherApplicationType = "ssh" Link to this property const ApplicationAppLauncherApplicationTypeVNC ApplicationAppLauncherApplicationType = "vnc" Link to this property const ApplicationAppLauncherApplicationTypeAppLauncher ApplicationAppLauncherApplicationType = "app\_launcher" Link to this property const ApplicationAppLauncherApplicationTypeWARP ApplicationAppLauncherApplicationType = "warp" Link to this property const ApplicationAppLauncherApplicationTypeBISO ApplicationAppLauncherApplicationType = "biso" Link to this property const ApplicationAppLauncherApplicationTypeBookmark ApplicationAppLauncherApplicationType = "bookmark" Link to this property const ApplicationAppLauncherApplicationTypeDashSSO ApplicationAppLauncherApplicationType = "dash\_sso" Link to this property
Link to this property ID stringOptional UUID. maxLength36 Link to this property AllowedIdPs \[]AllowedIdPsOptional The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property CreatedAt TimeOptional formatdate-time Link to this property Domain stringOptional The domain and path that Access will secure. Link to this property Name stringOptional The name of the application. Link to this property
SCIMConfig ApplicationAppLauncherApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationAppLauncherApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationAppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property SessionDuration stringOptional The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
ApplicationDeviceEnrollmentPermissionsApplication
Type ApplicationDeviceEnrollmentPermissionsApplicationType The application type. One of the following: const ApplicationDeviceEnrollmentPermissionsApplicationTypeSelfHosted ApplicationDeviceEnrollmentPermissionsApplicationType = "self\_hosted" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeSaaS ApplicationDeviceEnrollmentPermissionsApplicationType = "saas" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeSSH ApplicationDeviceEnrollmentPermissionsApplicationType = "ssh" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeVNC ApplicationDeviceEnrollmentPermissionsApplicationType = "vnc" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeAppLauncher ApplicationDeviceEnrollmentPermissionsApplicationType = "app\_launcher" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeWARP ApplicationDeviceEnrollmentPermissionsApplicationType = "warp" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeBISO ApplicationDeviceEnrollmentPermissionsApplicationType = "biso" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeBookmark ApplicationDeviceEnrollmentPermissionsApplicationType = "bookmark" Link to this property const ApplicationDeviceEnrollmentPermissionsApplicationTypeDashSSO ApplicationDeviceEnrollmentPermissionsApplicationType = "dash\_sso" Link to this property
Link to this property ID stringOptional UUID. maxLength36 Link to this property AllowedIdPs \[]AllowedIdPsOptional The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property CreatedAt TimeOptional formatdate-time Link to this property Domain stringOptional The domain and path that Access will secure. Link to this property Name stringOptional The name of the application. Link to this property
SCIMConfig ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationDeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property SessionDuration stringOptional The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
ApplicationBrowserIsolationPermissionsApplication
Type ApplicationBrowserIsolationPermissionsApplicationType The application type. One of the following: const ApplicationBrowserIsolationPermissionsApplicationTypeSelfHosted ApplicationBrowserIsolationPermissionsApplicationType = "self\_hosted" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeSaaS ApplicationBrowserIsolationPermissionsApplicationType = "saas" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeSSH ApplicationBrowserIsolationPermissionsApplicationType = "ssh" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeVNC ApplicationBrowserIsolationPermissionsApplicationType = "vnc" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeAppLauncher ApplicationBrowserIsolationPermissionsApplicationType = "app\_launcher" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeWARP ApplicationBrowserIsolationPermissionsApplicationType = "warp" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeBISO ApplicationBrowserIsolationPermissionsApplicationType = "biso" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeBookmark ApplicationBrowserIsolationPermissionsApplicationType = "bookmark" Link to this property const ApplicationBrowserIsolationPermissionsApplicationTypeDashSSO ApplicationBrowserIsolationPermissionsApplicationType = "dash\_sso" Link to this property
Link to this property ID stringOptional UUID. maxLength36 Link to this property AllowedIdPs \[]AllowedIdPsOptional The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property AutoRedirectToIdentity boolOptional When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property CreatedAt TimeOptional formatdate-time Link to this property Domain stringOptional The domain and path that Access will secure. Link to this property Name stringOptional The name of the application. Link to this property
SCIMConfig ApplicationBrowserIsolationPermissionsApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property SessionDuration stringOptional The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
ApplicationBookmarkApplication Domain string The URL or domain of the bookmark. Link to this property Type string The application type. Link to this property ID stringOptional UUID. maxLength36 Link to this property AppLauncherVisible boolOptional Link to this property AUD stringOptional Audience tag. maxLength64 Link to this property CreatedAt TimeOptional formatdate-time Link to this property LogoURL stringOptional The image URL for the logo shown in the App Launcher dashboard. Link to this property Name stringOptional The name of the application. Link to this property
SCIMConfig ApplicationBookmarkApplicationSCIMConfigOptional Configuration for provisioning to this application via SCIM. This is currently in closed beta. IdPUID string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property RemoteURI string The base URI for the application’s SCIM-compatible API. Link to this property
Authentication ApplicationBookmarkApplicationSCIMConfigAuthenticationUnionOptional Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2 One of the following:
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2 Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken ClientID string Client ID of the Access service token used to authenticate with the remote service. Link to this property ClientSecret string Client secret of the Access service token used to authenticate with the remote service. Link to this property Scheme ApplicationBookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property DeactivateOnDelete boolOptional If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property Enabled boolOptional Whether SCIM provisioning is turned on for this application. Link to this property
Mappings \[]SCIMConfigMappingOptional A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application%20%3E%20(schema)>)
type ApplicationPolicy struct{…} ID stringOptional The UUID of the policy maxLength36 Link to this property
ApprovalGroups \[]ApprovalGroupOptional Administrators who can approve a temporary authentication request. ApprovalsNeeded float64 The number of approvals needed to obtain access. minimum0 Link to this property EmailAddresses \[]stringOptional A list of emails that can approve the access request. Link to this property EmailListUUID stringOptional The UUID of an re-usable email list. Link to this property
Link to this property ApprovalRequired boolOptional Requires the user to request access from an administrator at the start of each session. Link to this property
ConnectionRules ApplicationPolicyConnectionRulesOptional The rules that define how users may connect to targets secured by your application.
RDP ApplicationPolicyConnectionRulesRDPOptional The RDP-specific rules that define clipboard behavior for RDP connections.
AllowedClipboardLocalToRemoteFormats \[]ApplicationPolicyConnectionRulesRDPAllowedClipboardLocalToRemoteFormatOptional Clipboard formats allowed when copying from local machine to remote RDP session. One of the following: const ApplicationPolicyConnectionRulesRDPAllowedClipboardLocalToRemoteFormatText ApplicationPolicyConnectionRulesRDPAllowedClipboardLocalToRemoteFormat = "text" Link to this property const ApplicationPolicyConnectionRulesRDPAllowedClipboardLocalToRemoteFormatFile ApplicationPolicyConnectionRulesRDPAllowedClipboardLocalToRemoteFormat = "file" Link to this property
Link to this property
AllowedClipboardRemoteToLocalFormats \[]ApplicationPolicyConnectionRulesRDPAllowedClipboardRemoteToLocalFormatOptional Clipboard formats allowed when copying from remote RDP session to local machine. One of the following: const ApplicationPolicyConnectionRulesRDPAllowedClipboardRemoteToLocalFormatText ApplicationPolicyConnectionRulesRDPAllowedClipboardRemoteToLocalFormat = "text" Link to this property const ApplicationPolicyConnectionRulesRDPAllowedClipboardRemoteToLocalFormatFile ApplicationPolicyConnectionRulesRDPAllowedClipboardRemoteToLocalFormat = "file" Link to this property
Link to this property
Link to this property
Link to this property CreatedAt TimeOptional formatdate-time Link to this property Decision DecisionOptional The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Link to this property
Exclude \[]AccessRuleOptional Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules. One of the following:
type GroupRule struct{…} Matches an Access group.
Group GroupRuleGroup ID string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
type AnyValidServiceTokenRule struct{…} Matches any valid Access Service Token AnyValidServiceToken AnyValidServiceTokenRuleAnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
type AccessRuleAccessAuthContextRule struct{…} Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthContext AccessRuleAccessAuthContextRuleAuthContext ID string The ID of an Authentication context. Link to this property AcID string The ACID of an Authentication context. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type AuthenticationMethodRule struct{…} Enforce different MFA options
AuthMethod AuthenticationMethodRuleAuthMethod AuthMethod string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
type AzureGroupRule struct{…} Matches an Azure group. Requires an Azure identity provider.
AzureAD AzureGroupRuleAzureAD ID string The ID of an Azure group. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type CertificateRule struct{…} Matches any valid client certificate. Certificate CertificateRuleCertificate Link to this property
Link to this property
type AccessRuleAccessCommonNameRule struct{…} Matches a specific common name.
CommonName AccessRuleAccessCommonNameRuleCommonName CommonName string The common name to match. Link to this property
Link to this property
Link to this property
type CountryRule struct{…} Matches a specific country
Geo CountryRuleGeo CountryCode string The country code that should be matched. Link to this property
Link to this property
Link to this property
type AccessDevicePostureRule struct{…} Enforces a device posture rule has run successfully
DevicePosture AccessDevicePostureRuleDevicePosture IntegrationUID string The ID of a device posture integration. Link to this property AccountID stringOptional The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
type DomainRule struct{…} Match an entire email domain.
EmailDomain DomainRuleEmailDomain Domain string The email domain to match. Link to this property
Link to this property
Link to this property
type EmailListRule struct{…} Matches an email address from a list.
EmailList EmailListRuleEmailList ID string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
type EmailRule struct{…} Matches a specific email.
Email EmailRuleEmail Email string The email of the user. formatemail Link to this property
Link to this property
Link to this property
type EveryoneRule struct{…} Matches everyone. Everyone EveryoneRuleEveryone An empty object which matches on all users. Link to this property
Link to this property
type ExternalEvaluationRule struct{…} Create Allow or Block policies which evaluate the user based on custom criteria.
ExternalEvaluation ExternalEvaluationRuleExternalEvaluation EvaluateURL string The API endpoint containing your business logic. Link to this property KeysURL string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
type GitHubOrganizationRule struct{…} Matches a Github organization. Requires a Github identity provider.
GitHubOrganization GitHubOrganizationRuleGitHubOrganization IdentityProviderID string The ID of your Github identity provider. Link to this property Name string The name of the organization. Link to this property Team stringOptional The name of the team Link to this property
Link to this property
Link to this property
type GSuiteGroupRule struct{…} Matches a group in Google Workspace. Requires a Google Workspace identity provider.
GSuite GSuiteGroupRuleGSuite Email string The email of the Google Workspace group. Link to this property IdentityProviderID string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLoginMethodRule struct{…} Matches a specific identity provider id.
LoginMethod AccessRuleAccessLoginMethodRuleLoginMethod ID string The ID of an identity provider. Link to this property
Link to this property
Link to this property
type IPListRule struct{…} Matches an IP address from a list.
IPList IPListRuleIPList ID string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
type IPRule struct{…} Matches an IP address block.
IP IPRuleIP IP string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
type OktaGroupRule struct{…} Matches an Okta group. Requires an Okta identity provider.
Okta OktaGroupRuleOkta IdentityProviderID string The ID of your Okta identity provider. Link to this property Name string The name of the Okta group. Link to this property
Link to this property
Link to this property
type SAMLGroupRule struct{…} Matches a SAML group. Requires a SAML identity provider.
SAML SAMLGroupRuleSAML AttributeName string The name of the SAML attribute. Link to this property AttributeValue string The SAML attribute value to look for. Link to this property IdentityProviderID string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessOIDCClaimRule struct{…} Matches an OIDC claim. Requires an OIDC identity provider.
OIDC AccessRuleAccessOIDCClaimRuleOIDC ClaimName string The name of the OIDC claim. Link to this property ClaimValue string The OIDC claim value to look for. Link to this property IdentityProviderID string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
type ServiceTokenRule struct{…} Matches a specific Access Service Token
ServiceToken ServiceTokenRuleServiceToken TokenID string The ID of a Service Token. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLinkedAppTokenRule struct{…} Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
LinkedAppToken AccessRuleAccessLinkedAppTokenRuleLinkedAppToken AppUID string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
type AccessRuleAccessUserRiskScoreRule struct{…} Matches a user’s risk score.
UserRiskScore AccessRuleAccessUserRiskScoreRuleUserRiskScore
UserRiskScore \[]AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreLow AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "low" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreMedium AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "medium" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreHigh AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "high" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreUnscored AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "unscored" Link to this property
Link to this property
Link to this property
Link to this property
type AccessRuleAccessCloudflareAccountMemberRule struct{…} Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
CloudflareAccountMember AccessRuleAccessCloudflareAccountMemberRuleCloudflareAccountMember AccountID stringOptional Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property
Include \[]AccessRuleOptional Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. One of the following:
type GroupRule struct{…} Matches an Access group.
Group GroupRuleGroup ID string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
type AnyValidServiceTokenRule struct{…} Matches any valid Access Service Token AnyValidServiceToken AnyValidServiceTokenRuleAnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
type AccessRuleAccessAuthContextRule struct{…} Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthContext AccessRuleAccessAuthContextRuleAuthContext ID string The ID of an Authentication context. Link to this property AcID string The ACID of an Authentication context. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type AuthenticationMethodRule struct{…} Enforce different MFA options
AuthMethod AuthenticationMethodRuleAuthMethod AuthMethod string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
type AzureGroupRule struct{…} Matches an Azure group. Requires an Azure identity provider.
AzureAD AzureGroupRuleAzureAD ID string The ID of an Azure group. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type CertificateRule struct{…} Matches any valid client certificate. Certificate CertificateRuleCertificate Link to this property
Link to this property
type AccessRuleAccessCommonNameRule struct{…} Matches a specific common name.
CommonName AccessRuleAccessCommonNameRuleCommonName CommonName string The common name to match. Link to this property
Link to this property
Link to this property
type CountryRule struct{…} Matches a specific country
Geo CountryRuleGeo CountryCode string The country code that should be matched. Link to this property
Link to this property
Link to this property
type AccessDevicePostureRule struct{…} Enforces a device posture rule has run successfully
DevicePosture AccessDevicePostureRuleDevicePosture IntegrationUID string The ID of a device posture integration. Link to this property AccountID stringOptional The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
type DomainRule struct{…} Match an entire email domain.
EmailDomain DomainRuleEmailDomain Domain string The email domain to match. Link to this property
Link to this property
Link to this property
type EmailListRule struct{…} Matches an email address from a list.
EmailList EmailListRuleEmailList ID string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
type EmailRule struct{…} Matches a specific email.
Email EmailRuleEmail Email string The email of the user. formatemail Link to this property
Link to this property
Link to this property
type EveryoneRule struct{…} Matches everyone. Everyone EveryoneRuleEveryone An empty object which matches on all users. Link to this property
Link to this property
type ExternalEvaluationRule struct{…} Create Allow or Block policies which evaluate the user based on custom criteria.
ExternalEvaluation ExternalEvaluationRuleExternalEvaluation EvaluateURL string The API endpoint containing your business logic. Link to this property KeysURL string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
type GitHubOrganizationRule struct{…} Matches a Github organization. Requires a Github identity provider.
GitHubOrganization GitHubOrganizationRuleGitHubOrganization IdentityProviderID string The ID of your Github identity provider. Link to this property Name string The name of the organization. Link to this property Team stringOptional The name of the team Link to this property
Link to this property
Link to this property
type GSuiteGroupRule struct{…} Matches a group in Google Workspace. Requires a Google Workspace identity provider.
GSuite GSuiteGroupRuleGSuite Email string The email of the Google Workspace group. Link to this property IdentityProviderID string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLoginMethodRule struct{…} Matches a specific identity provider id.
LoginMethod AccessRuleAccessLoginMethodRuleLoginMethod ID string The ID of an identity provider. Link to this property
Link to this property
Link to this property
type IPListRule struct{…} Matches an IP address from a list.
IPList IPListRuleIPList ID string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
type IPRule struct{…} Matches an IP address block.
IP IPRuleIP IP string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
type OktaGroupRule struct{…} Matches an Okta group. Requires an Okta identity provider.
Okta OktaGroupRuleOkta IdentityProviderID string The ID of your Okta identity provider. Link to this property Name string The name of the Okta group. Link to this property
Link to this property
Link to this property
type SAMLGroupRule struct{…} Matches a SAML group. Requires a SAML identity provider.
SAML SAMLGroupRuleSAML AttributeName string The name of the SAML attribute. Link to this property AttributeValue string The SAML attribute value to look for. Link to this property IdentityProviderID string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessOIDCClaimRule struct{…} Matches an OIDC claim. Requires an OIDC identity provider.
OIDC AccessRuleAccessOIDCClaimRuleOIDC ClaimName string The name of the OIDC claim. Link to this property ClaimValue string The OIDC claim value to look for. Link to this property IdentityProviderID string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
type ServiceTokenRule struct{…} Matches a specific Access Service Token
ServiceToken ServiceTokenRuleServiceToken TokenID string The ID of a Service Token. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLinkedAppTokenRule struct{…} Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
LinkedAppToken AccessRuleAccessLinkedAppTokenRuleLinkedAppToken AppUID string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
type AccessRuleAccessUserRiskScoreRule struct{…} Matches a user’s risk score.
UserRiskScore AccessRuleAccessUserRiskScoreRuleUserRiskScore
UserRiskScore \[]AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreLow AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "low" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreMedium AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "medium" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreHigh AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "high" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreUnscored AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "unscored" Link to this property
Link to this property
Link to this property
Link to this property
type AccessRuleAccessCloudflareAccountMemberRule struct{…} Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
CloudflareAccountMember AccessRuleAccessCloudflareAccountMemberRuleCloudflareAccountMember AccountID stringOptional Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property IsolationRequired boolOptional Require this application to be served in an isolated browser for users matching this policy. ‘Client Web Isolation’ must be on for the account in order to use this feature. Link to this property
MfaConfig ApplicationPolicyMfaConfigOptional Configures multi-factor authentication (MFA) settings.
AllowedAuthenticators \[]ApplicationPolicyMfaConfigAllowedAuthenticatorOptional Lists the MFA methods that users can authenticate with. One of the following: const ApplicationPolicyMfaConfigAllowedAuthenticatorTotp ApplicationPolicyMfaConfigAllowedAuthenticator = "totp" Link to this property const ApplicationPolicyMfaConfigAllowedAuthenticatorBiometrics ApplicationPolicyMfaConfigAllowedAuthenticator = "biometrics" Link to this property const ApplicationPolicyMfaConfigAllowedAuthenticatorSecurityKey ApplicationPolicyMfaConfigAllowedAuthenticator = "security\_key" Link to this property
Link to this property MfaDisabled boolOptional Indicates whether to disable MFA for this resource. This option is available at the application and policy level. Link to this property SessionDuration stringOptional Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property Name stringOptional The name of the Access policy. Link to this property PurposeJustificationPrompt stringOptional A custom message that will appear on the purpose justification screen. Link to this property PurposeJustificationRequired boolOptional Require users to enter a justification when they log in to the application. Link to this property
Require \[]AccessRuleOptional Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules. One of the following:
type GroupRule struct{…} Matches an Access group.
Group GroupRuleGroup ID string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
type AnyValidServiceTokenRule struct{…} Matches any valid Access Service Token AnyValidServiceToken AnyValidServiceTokenRuleAnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
type AccessRuleAccessAuthContextRule struct{…} Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthContext AccessRuleAccessAuthContextRuleAuthContext ID string The ID of an Authentication context. Link to this property AcID string The ACID of an Authentication context. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type AuthenticationMethodRule struct{…} Enforce different MFA options
AuthMethod AuthenticationMethodRuleAuthMethod AuthMethod string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
type AzureGroupRule struct{…} Matches an Azure group. Requires an Azure identity provider.
AzureAD AzureGroupRuleAzureAD ID string The ID of an Azure group. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type CertificateRule struct{…} Matches any valid client certificate. Certificate CertificateRuleCertificate Link to this property
Link to this property
type AccessRuleAccessCommonNameRule struct{…} Matches a specific common name.
CommonName AccessRuleAccessCommonNameRuleCommonName CommonName string The common name to match. Link to this property
Link to this property
Link to this property
type CountryRule struct{…} Matches a specific country
Geo CountryRuleGeo CountryCode string The country code that should be matched. Link to this property
Link to this property
Link to this property
type AccessDevicePostureRule struct{…} Enforces a device posture rule has run successfully
DevicePosture AccessDevicePostureRuleDevicePosture IntegrationUID string The ID of a device posture integration. Link to this property AccountID stringOptional The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
type DomainRule struct{…} Match an entire email domain.
EmailDomain DomainRuleEmailDomain Domain string The email domain to match. Link to this property
Link to this property
Link to this property
type EmailListRule struct{…} Matches an email address from a list.
EmailList EmailListRuleEmailList ID string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
type EmailRule struct{…} Matches a specific email.
Email EmailRuleEmail Email string The email of the user. formatemail Link to this property
Link to this property
Link to this property
type EveryoneRule struct{…} Matches everyone. Everyone EveryoneRuleEveryone An empty object which matches on all users. Link to this property
Link to this property
type ExternalEvaluationRule struct{…} Create Allow or Block policies which evaluate the user based on custom criteria.
ExternalEvaluation ExternalEvaluationRuleExternalEvaluation EvaluateURL string The API endpoint containing your business logic. Link to this property KeysURL string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
type GitHubOrganizationRule struct{…} Matches a Github organization. Requires a Github identity provider.
GitHubOrganization GitHubOrganizationRuleGitHubOrganization IdentityProviderID string The ID of your Github identity provider. Link to this property Name string The name of the organization. Link to this property Team stringOptional The name of the team Link to this property
Link to this property
Link to this property
type GSuiteGroupRule struct{…} Matches a group in Google Workspace. Requires a Google Workspace identity provider.
GSuite GSuiteGroupRuleGSuite Email string The email of the Google Workspace group. Link to this property IdentityProviderID string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLoginMethodRule struct{…} Matches a specific identity provider id.
LoginMethod AccessRuleAccessLoginMethodRuleLoginMethod ID string The ID of an identity provider. Link to this property
Link to this property
Link to this property
type IPListRule struct{…} Matches an IP address from a list.
IPList IPListRuleIPList ID string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
type IPRule struct{…} Matches an IP address block.
IP IPRuleIP IP string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
type OktaGroupRule struct{…} Matches an Okta group. Requires an Okta identity provider.
Okta OktaGroupRuleOkta IdentityProviderID string The ID of your Okta identity provider. Link to this property Name string The name of the Okta group. Link to this property
Link to this property
Link to this property
type SAMLGroupRule struct{…} Matches a SAML group. Requires a SAML identity provider.
SAML SAMLGroupRuleSAML AttributeName string The name of the SAML attribute. Link to this property AttributeValue string The SAML attribute value to look for. Link to this property IdentityProviderID string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessOIDCClaimRule struct{…} Matches an OIDC claim. Requires an OIDC identity provider.
OIDC AccessRuleAccessOIDCClaimRuleOIDC ClaimName string The name of the OIDC claim. Link to this property ClaimValue string The OIDC claim value to look for. Link to this property IdentityProviderID string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
type ServiceTokenRule struct{…} Matches a specific Access Service Token
ServiceToken ServiceTokenRuleServiceToken TokenID string The ID of a Service Token. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLinkedAppTokenRule struct{…} Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
LinkedAppToken AccessRuleAccessLinkedAppTokenRuleLinkedAppToken AppUID string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
type AccessRuleAccessUserRiskScoreRule struct{…} Matches a user’s risk score.
UserRiskScore AccessRuleAccessUserRiskScoreRuleUserRiskScore
UserRiskScore \[]AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreLow AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "low" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreMedium AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "medium" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreHigh AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "high" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreUnscored AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "unscored" Link to this property
Link to this property
Link to this property
Link to this property
type AccessRuleAccessCloudflareAccountMemberRule struct{…} Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
CloudflareAccountMember AccessRuleAccessCloudflareAccountMemberRuleCloudflareAccountMember AccountID stringOptional Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property SessionDuration stringOptional The amount of time that tokens issued for the application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application_policy%20%3E%20(schema)>)
type ApplicationType string The application type. One of the following: const ApplicationTypeSelfHosted ApplicationType = "self\_hosted" Link to this property const ApplicationTypeEndUser ApplicationType = "end\_user" Link to this property const ApplicationTypeSaaS ApplicationType = "saas" Link to this property const ApplicationTypeSSH ApplicationType = "ssh" Link to this property const ApplicationTypeVNC ApplicationType = "vnc" Link to this property const ApplicationTypeAppLauncher ApplicationType = "app\_launcher" Link to this property const ApplicationTypeWARP ApplicationType = "warp" Link to this property const ApplicationTypeBISO ApplicationType = "biso" Link to this property const ApplicationTypeBookmark ApplicationType = "bookmark" Link to this property const ApplicationTypeDashSSO ApplicationType = "dash\_sso" Link to this property const ApplicationTypeInfrastructure ApplicationType = "infrastructure" Link to this property const ApplicationTypeRDP ApplicationType = "rdp" Link to this property const ApplicationTypeMcp ApplicationType = "mcp" Link to this property const ApplicationTypeMcpPortal ApplicationType = "mcp\_portal" Link to this property const ApplicationTypeProxyEndpoint ApplicationType = "proxy\_endpoint" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application_type%20%3E%20(schema)>)
type CORSHeaders struct{…} AllowAllHeaders boolOptional Allows all HTTP request headers. Link to this property AllowAllMethods boolOptional Allows all HTTP request methods. Link to this property AllowAllOrigins boolOptional Allows all origins. Link to this property AllowCredentials boolOptional When set to true, includes credentials (cookies, authorization headers, or TLS client certificates) with requests. Link to this property AllowedHeaders \[]AllowedHeadersOptional Allowed HTTP request headers. Link to this property
AllowedMethods \[]AllowedMethodsOptional Allowed HTTP request methods. One of the following: const AllowedMethodsGet AllowedMethods = "GET" Link to this property const AllowedMethodsPost AllowedMethods = "POST" Link to this property const AllowedMethodsHead AllowedMethods = "HEAD" Link to this property const AllowedMethodsPut AllowedMethods = "PUT" Link to this property const AllowedMethodsDelete AllowedMethods = "DELETE" Link to this property const AllowedMethodsConnect AllowedMethods = "CONNECT" Link to this property const AllowedMethodsOptions AllowedMethods = "OPTIONS" Link to this property const AllowedMethodsTrace AllowedMethods = "TRACE" Link to this property const AllowedMethodsPatch AllowedMethods = "PATCH" Link to this property
Link to this property AllowedOrigins \[]AllowedOriginsOptional Allowed origins. Link to this property MaxAge float64Optional The maximum number of seconds the results of a preflight request can be cached. maximum86400 minimum-1 Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20cors_headers%20%3E%20(schema)>)
type Decision string The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. One of the following: const DecisionAllow Decision = "allow" Link to this property const DecisionDeny Decision = "deny" Link to this property const DecisionNonIdentity Decision = "non\_identity" Link to this property const DecisionBypass Decision = "bypass" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20decision%20%3E%20(schema)>)
type OIDCSaaSApp struct{…} AccessTokenLifetime stringOptional The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h. Link to this property AllowPKCEWithoutClientSecret boolOptional If client secret should be required on the token endpoint when authorization\_code\_with\_pkce grant is used. Link to this property AppLauncherURL stringOptional The URL where this applications tile redirects users Link to this property
AuthType OIDCSaaSAppAuthTypeOptional Identifier of the authentication protocol used for the saas app. Required for OIDC. One of the following: const OIDCSaaSAppAuthTypeSAML OIDCSaaSAppAuthType = "saml" Link to this property const OIDCSaaSAppAuthTypeOIDC OIDCSaaSAppAuthType = "oidc" Link to this property
Link to this property ClientID stringOptional The application client id Link to this property ClientSecret stringOptional The application client secret, only returned on POST request. Link to this property
CustomClaims \[]OIDCSaaSAppCustomClaimOptional Name stringOptional The name of the claim. Link to this property Required boolOptional If the claim is required when building an OIDC token. Link to this property
Scope OIDCSaaSAppCustomClaimsScopeOptional The scope of the claim. One of the following: const OIDCSaaSAppCustomClaimsScopeGroups OIDCSaaSAppCustomClaimsScope = "groups" Link to this property const OIDCSaaSAppCustomClaimsScopeProfile OIDCSaaSAppCustomClaimsScope = "profile" Link to this property const OIDCSaaSAppCustomClaimsScopeEmail OIDCSaaSAppCustomClaimsScope = "email" Link to this property const OIDCSaaSAppCustomClaimsScopeOpenid OIDCSaaSAppCustomClaimsScope = "openid" Link to this property
Link to this property
Source OIDCSaaSAppCustomClaimsSourceOptional Name stringOptional The name of the IdP claim. Link to this property NameByIdP map\[string, string]Optional A mapping from IdP ID to claim name. Link to this property
Link to this property
Link to this property
GrantTypes \[]OIDCSaaSAppGrantTypeOptional The OIDC flows supported by this application One of the following: const OIDCSaaSAppGrantTypeAuthorizationCode OIDCSaaSAppGrantType = "authorization\_code" Link to this property const OIDCSaaSAppGrantTypeAuthorizationCodeWithPKCE OIDCSaaSAppGrantType = "authorization\_code\_with\_pkce" Link to this property const OIDCSaaSAppGrantTypeRefreshTokens OIDCSaaSAppGrantType = "refresh\_tokens" Link to this property const OIDCSaaSAppGrantTypeHybrid OIDCSaaSAppGrantType = "hybrid" Link to this property const OIDCSaaSAppGrantTypeImplicit OIDCSaaSAppGrantType = "implicit" Link to this property
Link to this property GroupFilterRegex stringOptional A regex to filter Cloudflare groups returned in ID token and userinfo endpoint Link to this property
HybridAndImplicitOptions OIDCSaaSAppHybridAndImplicitOptionsOptional ReturnAccessTokenFromAuthorizationEndpoint boolOptional If an Access Token should be returned from the OIDC Authorization endpoint Link to this property ReturnIDTokenFromAuthorizationEndpoint boolOptional If an ID Token should be returned from the OIDC Authorization endpoint Link to this property
Link to this property PublicKey stringOptional The Access public certificate that will be used to verify your identity. Link to this property RedirectURIs \[]stringOptional The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens Link to this property
RefreshTokenOptions OIDCSaaSAppRefreshTokenOptionsOptional Lifetime stringOptional How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m. Link to this property
Link to this property
Scopes \[]OIDCSaaSAppScopeOptional Define the user information shared with access, “offline\_access” scope will be automatically enabled if refresh tokens are enabled One of the following: const OIDCSaaSAppScopeOpenid OIDCSaaSAppScope = "openid" Link to this property const OIDCSaaSAppScopeGroups OIDCSaaSAppScope = "groups" Link to this property const OIDCSaaSAppScopeEmail OIDCSaaSAppScope = "email" Link to this property const OIDCSaaSAppScopeProfile OIDCSaaSAppScope = "profile" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20oidc_saas_app%20%3E%20(schema)>)
type SaaSAppNameIDFormat string The format of the name identifier sent to the SaaS application. One of the following: const SaaSAppNameIDFormatID SaaSAppNameIDFormat = "id" Link to this property const SaaSAppNameIDFormatEmail SaaSAppNameIDFormat = "email" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20saas_app_name_id_format%20%3E%20(schema)>)
type SAMLSaaSApp struct{…}
AuthType SAMLSaaSAppAuthTypeOptional Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml” One of the following: const SAMLSaaSAppAuthTypeSAML SAMLSaaSAppAuthType = "saml" Link to this property const SAMLSaaSAppAuthTypeOIDC SAMLSaaSAppAuthType = "oidc" Link to this property
Link to this property ConsumerServiceURL stringOptional The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion. Link to this property
CustomAttributes \[]SAMLSaaSAppCustomAttributeOptional FriendlyName stringOptional The SAML FriendlyName of the attribute. Link to this property Name stringOptional The name of the attribute. Link to this property
NameFormat SAMLSaaSAppCustomAttributesNameFormatOptional A globally unique name for an identity or service provider. One of the following: const SAMLSaaSAppCustomAttributesNameFormatUrnOasisNamesTcSAML2\_0AttrnameFormatUnspecified SAMLSaaSAppCustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" Link to this property const SAMLSaaSAppCustomAttributesNameFormatUrnOasisNamesTcSAML2\_0AttrnameFormatBasic SAMLSaaSAppCustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Link to this property const SAMLSaaSAppCustomAttributesNameFormatUrnOasisNamesTcSAML2\_0AttrnameFormatURI SAMLSaaSAppCustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Link to this property
Link to this property Required boolOptional If the attribute is required when building a SAML assertion. Link to this property
Source SAMLSaaSAppCustomAttributesSourceOptional Name stringOptional The name of the IdP attribute. Link to this property
NameByIdP \[]SAMLSaaSAppCustomAttributesSourceNameByIdPOptional A mapping from IdP ID to attribute name. IdPID stringOptional The UID of the IdP. Link to this property SourceName stringOptional The name of the IdP provided attribute. Link to this property
Link to this property
Link to this property
Link to this property DefaultRelayState stringOptional The URL that the user will be redirected to after a successful login for IDP initiated logins. Link to this property IdPEntityID stringOptional The unique identifier for your SaaS application. Link to this property NameIDFormat SaaSAppNameIDFormatOptional The format of the name identifier sent to the SaaS application. Link to this property NameIDTransformJsonata stringOptional A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting. Link to this property PublicKey stringOptional The Access public certificate that will be used to verify your identity. Link to this property SAMLAttributeTransformJsonata stringOptional A \[JSONata] (https://jsonata.org/) expression that transforms an application’s user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml\_attributes or oidc\_fields of the identity provider used to authenticate. The output of this expression must be a JSON object. Link to this property SPEntityID stringOptional A globally unique name for an identity or service provider. Link to this property SSOEndpoint stringOptional The endpoint where your SaaS application will send login requests. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20saml_saas_app%20%3E%20(schema)>)
type SCIMConfigAuthenticationHTTPBasic struct{…} Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. Password string Password used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationHTTPBasicScheme The authentication scheme to use when making SCIM requests to this application. Link to this property User string User name used to authenticate with the remote SCIM service. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_http_basic%20%3E%20(schema)>)
type SCIMConfigAuthenticationOAuthBearerToken struct{…} Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. Token string Token used to authenticate with the remote SCIM service. Link to this property Scheme SCIMConfigAuthenticationOAuthBearerTokenScheme The authentication scheme to use when making SCIM requests to this application. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_oauth_bearer_token%20%3E%20(schema)>)
type SCIMConfigAuthenticationOauth2 struct{…} Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. AuthorizationURL string URL used to generate the auth code used during token generation. Link to this property ClientID string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property ClientSecret string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property Scheme SCIMConfigAuthenticationOauth2Scheme The authentication scheme to use when making SCIM requests to this application. Link to this property TokenURL string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property Scopes \[]stringOptional The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_oauth2%20%3E%20(schema)>)
type SCIMConfigMapping struct{…} Transformations and filters applied to resources before they are provisioned in the remote SCIM service. Schema string Which SCIM resource type this mapping applies to. Link to this property Enabled boolOptional Whether or not this mapping is enabled. Link to this property Filter stringOptional A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
Operations SCIMConfigMappingOperationsOptional Whether or not this mapping applies to creates, updates, or deletes. Create boolOptional Whether or not this mapping applies to create (POST) operations. Link to this property Delete boolOptional Whether or not this mapping applies to DELETE operations. Link to this property Update boolOptional Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
Strictness SCIMConfigMappingStrictnessOptional The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: const SCIMConfigMappingStrictnessStrict SCIMConfigMappingStrictness = "strict" Link to this property const SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough" Link to this property
Link to this property TransformJsonata stringOptional A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_mapping%20%3E%20(schema)>) type SelfHostedDomains string A domain that Access will secure. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20self_hosted_domains%20%3E%20(schema)>) #### AccessApplicationsCAs ##### [List short-lived certificate CAs](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/cas/methods/list) client.ZeroTrust.Access.Applications.CAs.List(ctx, params) (\*V4PagePaginationArray\[[CA]()], error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/ca ##### [Get a short-lived certificate CA](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/cas/methods/get) client.ZeroTrust.Access.Applications.CAs.Get(ctx, appID, query) (\*[CA](), error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/ca ##### [Create a short-lived certificate CA](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/cas/methods/create) client.ZeroTrust.Access.Applications.CAs.New(ctx, appID, body) (\*[CA](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/ca ##### [Delete a short-lived certificate CA](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/cas/methods/delete) client.ZeroTrust.Access.Applications.CAs.Delete(ctx, appID, body) (\*[AccessApplicationCADeleteResponse](), error) DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/ca ##### ModelsExpand Collapse
type CA struct{…} ID stringOptional The ID of the CA. maxLength48 Link to this property AUD stringOptional The Application Audience (AUD) tag. Identifies the application associated with the CA. maxLength64 Link to this property PublicKey stringOptional The public key to add to your SSH server configuration. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.cas%20%3E%20(model)%20ca%20%3E%20(schema)>) #### AccessApplicationsUser Policy Checks ##### [Test Access policies](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/user_policy_checks/methods/list) client.ZeroTrust.Access.Applications.UserPolicyChecks.List(ctx, appID, query) (\*[AccessApplicationUserPolicyCheckListResponse](), error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/user\_policy\_checks #### AccessApplicationsPolicies ##### [List Access application policies](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/policies/methods/list) client.ZeroTrust.Access.Applications.Policies.List(ctx, appID, params) (\*V4PagePaginationArray\[[AccessApplicationPolicyListResponse]()], error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/policies ##### [Get an Access application policy](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/policies/methods/get) client.ZeroTrust.Access.Applications.Policies.Get(ctx, appID, policyID, query) (\*[AccessApplicationPolicyGetResponse](), error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/policies/{policy\_id} ##### [Create an Access application policy](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/policies/methods/create) client.ZeroTrust.Access.Applications.Policies.New(ctx, appID, params) (\*[AccessApplicationPolicyNewResponse](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/policies ##### [Update an Access application policy](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/policies/methods/update) client.ZeroTrust.Access.Applications.Policies.Update(ctx, appID, policyID, params) (\*[AccessApplicationPolicyUpdateResponse](), error) PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/policies/{policy\_id} ##### [Delete an Access application policy](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/policies/methods/delete) client.ZeroTrust.Access.Applications.Policies.Delete(ctx, appID, policyID, body) (\*[AccessApplicationPolicyDeleteResponse](), error) DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/policies/{policy\_id} ##### ModelsExpand Collapse
type AccessDevicePostureRule struct{…} Enforces a device posture rule has run successfully
DevicePosture AccessDevicePostureRuleDevicePosture IntegrationUID string The ID of a device posture integration. Link to this property AccountID stringOptional The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20access_device_posture_rule%20%3E%20(schema)>)
type AccessRule interface{…} Matches an Access group. One of the following:
type GroupRule struct{…} Matches an Access group.
Group GroupRuleGroup ID string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
type AnyValidServiceTokenRule struct{…} Matches any valid Access Service Token AnyValidServiceToken AnyValidServiceTokenRuleAnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
type AccessRuleAccessAuthContextRule struct{…} Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthContext AccessRuleAccessAuthContextRuleAuthContext ID string The ID of an Authentication context. Link to this property AcID string The ACID of an Authentication context. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type AuthenticationMethodRule struct{…} Enforce different MFA options
AuthMethod AuthenticationMethodRuleAuthMethod AuthMethod string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
type AzureGroupRule struct{…} Matches an Azure group. Requires an Azure identity provider.
AzureAD AzureGroupRuleAzureAD ID string The ID of an Azure group. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type CertificateRule struct{…} Matches any valid client certificate. Certificate CertificateRuleCertificate Link to this property
Link to this property
type AccessRuleAccessCommonNameRule struct{…} Matches a specific common name.
CommonName AccessRuleAccessCommonNameRuleCommonName CommonName string The common name to match. Link to this property
Link to this property
Link to this property
type CountryRule struct{…} Matches a specific country
Geo CountryRuleGeo CountryCode string The country code that should be matched. Link to this property
Link to this property
Link to this property
type AccessDevicePostureRule struct{…} Enforces a device posture rule has run successfully
DevicePosture AccessDevicePostureRuleDevicePosture IntegrationUID string The ID of a device posture integration. Link to this property AccountID stringOptional The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
type DomainRule struct{…} Match an entire email domain.
EmailDomain DomainRuleEmailDomain Domain string The email domain to match. Link to this property
Link to this property
Link to this property
type EmailListRule struct{…} Matches an email address from a list.
EmailList EmailListRuleEmailList ID string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
type EmailRule struct{…} Matches a specific email.
Email EmailRuleEmail Email string The email of the user. formatemail Link to this property
Link to this property
Link to this property
type EveryoneRule struct{…} Matches everyone. Everyone EveryoneRuleEveryone An empty object which matches on all users. Link to this property
Link to this property
type ExternalEvaluationRule struct{…} Create Allow or Block policies which evaluate the user based on custom criteria.
ExternalEvaluation ExternalEvaluationRuleExternalEvaluation EvaluateURL string The API endpoint containing your business logic. Link to this property KeysURL string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
type GitHubOrganizationRule struct{…} Matches a Github organization. Requires a Github identity provider.
GitHubOrganization GitHubOrganizationRuleGitHubOrganization IdentityProviderID string The ID of your Github identity provider. Link to this property Name string The name of the organization. Link to this property Team stringOptional The name of the team Link to this property
Link to this property
Link to this property
type GSuiteGroupRule struct{…} Matches a group in Google Workspace. Requires a Google Workspace identity provider.
GSuite GSuiteGroupRuleGSuite Email string The email of the Google Workspace group. Link to this property IdentityProviderID string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLoginMethodRule struct{…} Matches a specific identity provider id.
LoginMethod AccessRuleAccessLoginMethodRuleLoginMethod ID string The ID of an identity provider. Link to this property
Link to this property
Link to this property
type IPListRule struct{…} Matches an IP address from a list.
IPList IPListRuleIPList ID string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
type IPRule struct{…} Matches an IP address block.
IP IPRuleIP IP string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
type OktaGroupRule struct{…} Matches an Okta group. Requires an Okta identity provider.
Okta OktaGroupRuleOkta IdentityProviderID string The ID of your Okta identity provider. Link to this property Name string The name of the Okta group. Link to this property
Link to this property
Link to this property
type SAMLGroupRule struct{…} Matches a SAML group. Requires a SAML identity provider.
SAML SAMLGroupRuleSAML AttributeName string The name of the SAML attribute. Link to this property AttributeValue string The SAML attribute value to look for. Link to this property IdentityProviderID string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessOIDCClaimRule struct{…} Matches an OIDC claim. Requires an OIDC identity provider.
OIDC AccessRuleAccessOIDCClaimRuleOIDC ClaimName string The name of the OIDC claim. Link to this property ClaimValue string The OIDC claim value to look for. Link to this property IdentityProviderID string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
type ServiceTokenRule struct{…} Matches a specific Access Service Token
ServiceToken ServiceTokenRuleServiceToken TokenID string The ID of a Service Token. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLinkedAppTokenRule struct{…} Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
LinkedAppToken AccessRuleAccessLinkedAppTokenRuleLinkedAppToken AppUID string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
type AccessRuleAccessUserRiskScoreRule struct{…} Matches a user’s risk score.
UserRiskScore AccessRuleAccessUserRiskScoreRuleUserRiskScore
UserRiskScore \[]AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreLow AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "low" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreMedium AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "medium" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreHigh AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "high" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreUnscored AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "unscored" Link to this property
Link to this property
Link to this property
Link to this property
type AccessRuleAccessCloudflareAccountMemberRule struct{…} Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
CloudflareAccountMember AccessRuleAccessCloudflareAccountMemberRuleCloudflareAccountMember AccountID stringOptional Identifier. maxLength32 Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20access_rule%20%3E%20(schema)>)
type AnyValidServiceTokenRule struct{…} Matches any valid Access Service Token AnyValidServiceToken AnyValidServiceTokenRuleAnyValidServiceToken An empty object which matches on all service tokens. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20any_valid_service_token_rule%20%3E%20(schema)>)
type AuthenticationMethodRule struct{…} Enforce different MFA options
AuthMethod AuthenticationMethodRuleAuthMethod AuthMethod string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20authentication_method_rule%20%3E%20(schema)>)
type AzureGroupRule struct{…} Matches an Azure group. Requires an Azure identity provider.
AzureAD AzureGroupRuleAzureAD ID string The ID of an Azure group. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20azure_group_rule%20%3E%20(schema)>)
type CertificateRule struct{…} Matches any valid client certificate. Certificate CertificateRuleCertificate Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20certificate_rule%20%3E%20(schema)>)
type CountryRule struct{…} Matches a specific country
Geo CountryRuleGeo CountryCode string The country code that should be matched. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20country_rule%20%3E%20(schema)>)
type DomainRule struct{…} Match an entire email domain.
EmailDomain DomainRuleEmailDomain Domain string The email domain to match. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20domain_rule%20%3E%20(schema)>)
type EmailListRule struct{…} Matches an email address from a list.
EmailList EmailListRuleEmailList ID string The ID of a previously created email list. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20email_list_rule%20%3E%20(schema)>)
type EmailRule struct{…} Matches a specific email.
Email EmailRuleEmail Email string The email of the user. formatemail Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20email_rule%20%3E%20(schema)>)
type EveryoneRule struct{…} Matches everyone. Everyone EveryoneRuleEveryone An empty object which matches on all users. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20everyone_rule%20%3E%20(schema)>)
type ExternalEvaluationRule struct{…} Create Allow or Block policies which evaluate the user based on custom criteria.
ExternalEvaluation ExternalEvaluationRuleExternalEvaluation EvaluateURL string The API endpoint containing your business logic. Link to this property KeysURL string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20external_evaluation_rule%20%3E%20(schema)>)
type GitHubOrganizationRule struct{…} Matches a Github organization. Requires a Github identity provider.
GitHubOrganization GitHubOrganizationRuleGitHubOrganization IdentityProviderID string The ID of your Github identity provider. Link to this property Name string The name of the organization. Link to this property Team stringOptional The name of the team Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20github_organization_rule%20%3E%20(schema)>)
type GroupRule struct{…} Matches an Access group.
Group GroupRuleGroup ID string The ID of a previously created Access group. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20group_rule%20%3E%20(schema)>)
type GSuiteGroupRule struct{…} Matches a group in Google Workspace. Requires a Google Workspace identity provider.
GSuite GSuiteGroupRuleGSuite Email string The email of the Google Workspace group. Link to this property IdentityProviderID string The ID of your Google Workspace identity provider. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20gsuite_group_rule%20%3E%20(schema)>)
type IPListRule struct{…} Matches an IP address from a list.
IPList IPListRuleIPList ID string The ID of a previously created IP list. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20ip_list_rule%20%3E%20(schema)>)
type IPRule struct{…} Matches an IP address block.
IP IPRuleIP IP string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20ip_rule%20%3E%20(schema)>)
type OktaGroupRule struct{…} Matches an Okta group. Requires an Okta identity provider.
Okta OktaGroupRuleOkta IdentityProviderID string The ID of your Okta identity provider. Link to this property Name string The name of the Okta group. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20okta_group_rule%20%3E%20(schema)>)
type SAMLGroupRule struct{…} Matches a SAML group. Requires a SAML identity provider.
SAML SAMLGroupRuleSAML AttributeName string The name of the SAML attribute. Link to this property AttributeValue string The SAML attribute value to look for. Link to this property IdentityProviderID string The ID of your SAML identity provider. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20saml_group_rule%20%3E%20(schema)>)
type ServiceTokenRule struct{…} Matches a specific Access Service Token
ServiceToken ServiceTokenRuleServiceToken TokenID string The ID of a Service Token. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications.policies%20%3E%20(model)%20service_token_rule%20%3E%20(schema)>) #### AccessApplicationsPolicy Tests ##### [Get the current status of a given Access policy test](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/policy_tests/methods/get) client.ZeroTrust.Access.Applications.PolicyTests.Get(ctx, policyTestID, query) (\*[AccessApplicationPolicyTestGetResponse](), error) GET/accounts/{account\_id}/access/policy-tests/{policy\_test\_id} ##### [Start Access policy test](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/policy_tests/methods/create) client.ZeroTrust.Access.Applications.PolicyTests.New(ctx, params) (\*[AccessApplicationPolicyTestNewResponse](), error) POST/accounts/{account\_id}/access/policy-tests #### AccessApplicationsPolicy TestsUsers ##### [Get an Access policy test users page](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/policy_tests/subresources/users/methods/list) client.ZeroTrust.Access.Applications.PolicyTests.Users.List(ctx, policyTestID, params) (\*V4PagePaginationArray\[[AccessApplicationPolicyTestUserListResponse]()], error) GET/accounts/{account\_id}/access/policy-tests/{policy\_test\_id}/users #### AccessApplicationsSettings ##### [Update Access application settings](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/settings/methods/update) client.ZeroTrust.Access.Applications.Settings.Update(ctx, appID, params) (\*[AccessApplicationSettingUpdateResponse](), error) PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/settings ##### [Update Access application settings](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/applications/subresources/settings/methods/edit) client.ZeroTrust.Access.Applications.Settings.Edit(ctx, appID, params) (\*[AccessApplicationSettingEditResponse](), error) PATCH/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/settings #### AccessCertificates ##### [List mTLS certificates](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/certificates/methods/list) client.ZeroTrust.Access.Certificates.List(ctx, params) (\*V4PagePaginationArray\[[Certificate]()], error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/certificates ##### [Get an mTLS certificate](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/certificates/methods/get) client.ZeroTrust.Access.Certificates.Get(ctx, certificateID, query) (\*[Certificate](), error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/certificates/{certificate\_id} ##### [Add an mTLS certificate](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/certificates/methods/create) client.ZeroTrust.Access.Certificates.New(ctx, params) (\*[Certificate](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/certificates ##### [Update an mTLS certificate](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/certificates/methods/update) client.ZeroTrust.Access.Certificates.Update(ctx, certificateID, params) (\*[Certificate](), error) PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/certificates/{certificate\_id} ##### [Delete an mTLS certificate](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/certificates/methods/delete) client.ZeroTrust.Access.Certificates.Delete(ctx, certificateID, body) (\*[AccessCertificateDeleteResponse](), error) DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/certificates/{certificate\_id} ##### ModelsExpand Collapse type AssociatedHostnames string A fully-qualified domain name (FQDN). [Link to this property](<#(resource)%20zero_trust.access.certificates%20%3E%20(model)%20associated_hostnames%20%3E%20(schema)>)
type Certificate struct{…} ID stringOptional The ID of the application that will use this certificate. Link to this property AssociatedHostnames \[]AssociatedHostnamesOptional The hostnames of the applications that will use this certificate. Link to this property ExpiresOn TimeOptional formatdate-time Link to this property Fingerprint stringOptional The MD5 fingerprint of the certificate. Link to this property Name stringOptional The name of the certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.certificates%20%3E%20(model)%20certificate%20%3E%20(schema)>) #### AccessCertificatesSettings ##### [List all mTLS hostname settings](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/certificates/subresources/settings/methods/get) client.ZeroTrust.Access.Certificates.Settings.Get(ctx, query) (\*SinglePage\[[CertificateSettings]()], error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/certificates/settings ##### [Update an mTLS certificate's hostname settings](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/certificates/subresources/settings/methods/update) client.ZeroTrust.Access.Certificates.Settings.Update(ctx, params) (\*SinglePage\[[CertificateSettings]()], error) PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/certificates/settings ##### ModelsExpand Collapse
type CertificateSettings struct{…} ChinaNetwork bool Request client certificates for this hostname in China. Can only be set to true if this zone is china network enabled. Link to this property ClientCertificateForwarding bool Client Certificate Forwarding is a feature that takes the client cert provided by the eyeball to the edge, and forwards it to the origin as a HTTP header to allow logging on the origin. Link to this property Hostname string The hostname that these settings apply to. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.certificates.settings%20%3E%20(model)%20certificate_settings%20%3E%20(schema)>) #### AccessGroups ##### [List Access groups](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/groups/methods/list) client.ZeroTrust.Access.Groups.List(ctx, params) (\*V4PagePaginationArray\[[AccessGroupListResponse]()], error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/groups ##### [Get an Access group](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/groups/methods/get) client.ZeroTrust.Access.Groups.Get(ctx, groupID, query) (\*[AccessGroupGetResponse](), error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/groups/{group\_id} ##### [Create an Access group](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/groups/methods/create) client.ZeroTrust.Access.Groups.New(ctx, params) (\*[AccessGroupNewResponse](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/groups ##### [Update an Access group](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/groups/methods/update) client.ZeroTrust.Access.Groups.Update(ctx, groupID, params) (\*[AccessGroupUpdateResponse](), error) PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/groups/{group\_id} ##### [Delete an Access group](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/groups/methods/delete) client.ZeroTrust.Access.Groups.Delete(ctx, groupID, body) (\*[AccessGroupDeleteResponse](), error) DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/groups/{group\_id} ##### ModelsExpand Collapse
type ZeroTrustGroup struct{…} ID stringOptional The unique Cloudflare-generated Id of the SCIM resource. Link to this property DisplayName stringOptional The display name of the SCIM Group resource. Link to this property ExternalID stringOptional The IdP-generated Id of the SCIM resource. Link to this property
Meta ZeroTrustGroupMetaOptional The metadata of the SCIM resource. Created TimeOptional The timestamp of when the SCIM resource was created. formatdate-time Link to this property LastModified TimeOptional The timestamp of when the SCIM resource was last modified. formatdate-time Link to this property
Link to this property Schemas \[]stringOptional The list of URIs which indicate the attributes contained within a SCIM resource. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.groups%20%3E%20(model)%20zero_trust_group%20%3E%20(schema)>) #### AccessService Tokens ##### [List service tokens](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/service_tokens/methods/list) client.ZeroTrust.Access.ServiceTokens.List(ctx, params) (\*V4PagePaginationArray\[[ServiceToken]()], error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/service\_tokens ##### [Get a service token](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/service_tokens/methods/get) client.ZeroTrust.Access.ServiceTokens.Get(ctx, serviceTokenID, query) (\*[ServiceToken](), error) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/service\_tokens/{service\_token\_id} ##### [Create a service token](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/service_tokens/methods/create) client.ZeroTrust.Access.ServiceTokens.New(ctx, params) (\*[AccessServiceTokenNewResponse](), error) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/service\_tokens ##### [Update a service token](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/service_tokens/methods/update) client.ZeroTrust.Access.ServiceTokens.Update(ctx, serviceTokenID, params) (\*[ServiceToken](), error) PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/service\_tokens/{service\_token\_id} ##### [Delete a service token](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/service_tokens/methods/delete) client.ZeroTrust.Access.ServiceTokens.Delete(ctx, serviceTokenID, body) (\*[ServiceToken](), error) DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/service\_tokens/{service\_token\_id} ##### [Refresh a service token](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/service_tokens/methods/refresh) client.ZeroTrust.Access.ServiceTokens.Refresh(ctx, serviceTokenID, body) (\*[ServiceToken](), error) POST/accounts/{account\_id}/access/service\_tokens/{service\_token\_id}/refresh ##### [Rotate a service token](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/service_tokens/methods/rotate) client.ZeroTrust.Access.ServiceTokens.Rotate(ctx, serviceTokenID, params) (\*[AccessServiceTokenRotateResponse](), error) POST/accounts/{account\_id}/access/service\_tokens/{service\_token\_id}/rotate ##### ModelsExpand Collapse
type ServiceToken struct{…} ID stringOptional The ID of the service token. maxLength36 Link to this property ClientID stringOptional The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header. Link to this property Duration stringOptional The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h). Link to this property Enabled boolOptional Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous client_secret stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create. Link to this property ExpiresAt TimeOptional formatdate-time Link to this property Name stringOptional The name of the service token. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.service_tokens%20%3E%20(model)%20service_token%20%3E%20(schema)>) #### AccessBookmarks ##### [List Bookmark applications](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/bookmarks/methods/list) Deprecated client.ZeroTrust.Access.Bookmarks.List(ctx, query) (\*SinglePage\[[Bookmark]()], error) GET/accounts/{account\_id}/access/bookmarks ##### [Get a Bookmark application](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/bookmarks/methods/get) Deprecated client.ZeroTrust.Access.Bookmarks.Get(ctx, bookmarkID, query) (\*[Bookmark](), error) GET/accounts/{account\_id}/access/bookmarks/{bookmark\_id} ##### [Create a Bookmark application](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/bookmarks/methods/create) Deprecated client.ZeroTrust.Access.Bookmarks.New(ctx, bookmarkID, body) (\*[Bookmark](), error) POST/accounts/{account\_id}/access/bookmarks/{bookmark\_id} ##### [Update a Bookmark application](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/bookmarks/methods/update) Deprecated client.ZeroTrust.Access.Bookmarks.Update(ctx, bookmarkID, body) (\*[Bookmark](), error) PUT/accounts/{account\_id}/access/bookmarks/{bookmark\_id} ##### [Delete a Bookmark application](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/bookmarks/methods/delete) Deprecated client.ZeroTrust.Access.Bookmarks.Delete(ctx, bookmarkID, body) (\*[AccessBookmarkDeleteResponse](), error) DELETE/accounts/{account\_id}/access/bookmarks/{bookmark\_id} ##### ModelsExpand Collapse
type Bookmark struct{…} ID stringOptional The unique identifier for the Bookmark application. Link to this property AppLauncherVisible boolOptional Displays the application in the App Launcher. Link to this property Domain stringOptional The domain of the Bookmark application. Link to this property LogoURL stringOptional The image URL for the logo shown in the App Launcher dashboard. Link to this property Name stringOptional The name of the Bookmark application. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.bookmarks%20%3E%20(model)%20bookmark%20%3E%20(schema)>) #### AccessKeys ##### [Get the Access key configuration](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/keys/methods/get) client.ZeroTrust.Access.Keys.Get(ctx, query) (\*[AccessKeyGetResponse](), error) GET/accounts/{account\_id}/access/keys ##### [Update the Access key configuration](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/keys/methods/update) client.ZeroTrust.Access.Keys.Update(ctx, params) (\*[AccessKeyUpdateResponse](), error) PUT/accounts/{account\_id}/access/keys ##### [Rotate Access keys](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/keys/methods/rotate) client.ZeroTrust.Access.Keys.Rotate(ctx, body) (\*[AccessKeyRotateResponse](), error) POST/accounts/{account\_id}/access/keys/rotate #### AccessLogs #### AccessLogsAccess Requests ##### [Get Access authentication logs](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/logs/subresources/access_requests/methods/list) client.ZeroTrust.Access.Logs.AccessRequests.List(ctx, params) (\*\[] [AccessRequest](), error) GET/accounts/{account\_id}/access/logs/access\_requests #### AccessLogsSCIM ##### ModelsExpand Collapse
type AccessRequest struct{…} Action stringOptional The event that occurred, such as a login attempt. Link to this property Allowed boolOptional The result of the authentication event. Link to this property AppDomain stringOptional The URL of the Access application. Link to this property AppUID stringOptional The unique identifier for the Access application. Link to this property Connection stringOptional The IdP used to authenticate. Link to this property CreatedAt TimeOptional formatdate-time Link to this property IPAddress stringOptional The IP address of the authenticating user. Link to this property RayID stringOptional The unique identifier for the request to Cloudflare. maxLength16 Link to this property UserEmail stringOptional The email address of the authenticating user. formatemail Link to this property
[Link to this property](<#(resource)%20zero_trust.access.logs.scim%20%3E%20(model)%20access_request%20%3E%20(schema)>) #### AccessLogsSCIMUpdates ##### [List Access SCIM update logs](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/logs/subresources/scim/subresources/updates/methods/list) client.ZeroTrust.Access.Logs.SCIM.Updates.List(ctx, params) (\*V4PagePaginationArray\[[AccessLogSCIMUpdateListResponse]()], error) GET/accounts/{account\_id}/access/logs/scim/updates #### AccessUsers ##### [Get users](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/users/methods/list) client.ZeroTrust.Access.Users.List(ctx, params) (\*V4PagePaginationArray\[[AccessUserListResponse]()], error) GET/accounts/{account\_id}/access/users ##### [Get a user](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/users/methods/get) client.ZeroTrust.Access.Users.Get(ctx, userID, query) (\*[AccessUserGetResponse](), error) GET/accounts/{account\_id}/access/users/{user\_id} ##### [Create a user](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/users/methods/create) client.ZeroTrust.Access.Users.New(ctx, params) (\*[AccessUserNewResponse](), error) POST/accounts/{account\_id}/access/users ##### [Update a user](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/users/methods/update) client.ZeroTrust.Access.Users.Update(ctx, userID, params) (\*[AccessUserUpdateResponse](), error) PUT/accounts/{account\_id}/access/users/{user\_id} ##### [Delete a user](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/users/methods/delete) client.ZeroTrust.Access.Users.Delete(ctx, userID, body) (\*[AccessUserDeleteResponse](), error) DELETE/accounts/{account\_id}/access/users/{user\_id} ##### ModelsExpand Collapse
type AccessUser struct{…} ID stringOptional The unique Cloudflare-generated Id of the SCIM resource. Link to this property Active boolOptional Determines the status of the SCIM User resource. Link to this property DisplayName stringOptional The name of the SCIM User resource. Link to this property
Emails \[]AccessUserEmailOptional Primary boolOptional Indicates if the email address is the primary email belonging to the SCIM User resource. Link to this property Type stringOptional Indicates the type of the email address. Link to this property Value stringOptional The email address of the SCIM User resource. formatemail Link to this property
Link to this property ExternalID stringOptional The IdP-generated Id of the SCIM resource. Link to this property
Meta AccessUserMetaOptional The metadata of the SCIM resource. Created TimeOptional The timestamp of when the SCIM resource was created. formatdate-time Link to this property LastModified TimeOptional The timestamp of when the SCIM resource was last modified. formatdate-time Link to this property
Link to this property Schemas \[]stringOptional The list of URIs which indicate the attributes contained within a SCIM resource. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.users%20%3E%20(model)%20access_user%20%3E%20(schema)>) #### AccessUsersActive Sessions ##### [Get active sessions](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/users/subresources/active_sessions/methods/list) client.ZeroTrust.Access.Users.ActiveSessions.List(ctx, userID, query) (\*SinglePage\[[AccessUserActiveSessionListResponse]()], error) GET/accounts/{account\_id}/access/users/{user\_id}/active\_sessions ##### [Get single active session](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/users/subresources/active_sessions/methods/get) client.ZeroTrust.Access.Users.ActiveSessions.Get(ctx, userID, nonce, query) (\*[AccessUserActiveSessionGetResponse](), error) GET/accounts/{account\_id}/access/users/{user\_id}/active\_sessions/{nonce} #### AccessUsersLast Seen Identity ##### [Get last seen identity](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/users/subresources/last_seen_identity/methods/get) client.ZeroTrust.Access.Users.LastSeenIdentity.Get(ctx, userID, query) (\*[AccessUserLastSeenIdentityGetResponse](), error) GET/accounts/{account\_id}/access/users/{user\_id}/last\_seen\_identity ##### ModelsExpand Collapse
type Identity struct{…} AccountID stringOptional Link to this property AuthStatus stringOptional Link to this property CommonName stringOptional Link to this property DeviceID stringOptional Link to this property
DeviceSessions map\[string, IdentityDeviceSession]Optional LastAuthenticated float64Optional Link to this property
Link to this property
DevicePosture map\[string, IdentityDevicePosture]Optional ID stringOptional Link to this property
Check IdentityDevicePostureCheckOptional Exists boolOptional Link to this property Path stringOptional Link to this property
Link to this property Data unknownOptional Link to this property Description stringOptional Link to this property Error stringOptional Link to this property RuleName stringOptional Link to this property Success boolOptional Link to this property Timestamp stringOptional Link to this property Type stringOptional Link to this property
Link to this property Email stringOptional Link to this property
Geo IdentityGeoOptional Country stringOptional Link to this property
Link to this property Iat float64Optional Link to this property
IdP IdentityIdPOptional ID stringOptional Link to this property Type stringOptional Link to this property
Link to this property IP stringOptional Link to this property IsGateway boolOptional Link to this property IsWARP boolOptional Link to this property
MTLSAuth IdentityMTLSAuthOptional AuthStatus stringOptional Link to this property CERTIssuerDn stringOptional Link to this property CERTIssuerSki stringOptional Link to this property CERTPresented boolOptional Link to this property CERTSerial stringOptional Link to this property
Link to this property ServiceTokenID stringOptional Link to this property ServiceTokenStatus boolOptional Link to this property UserUUID stringOptional Link to this property Version float64Optional Link to this property
[Link to this property](<#(resource)%20zero_trust.access.users.last_seen_identity%20%3E%20(model)%20identity%20%3E%20(schema)>) #### AccessUsersFailed Logins ##### [Get failed logins](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/users/subresources/failed_logins/methods/list) client.ZeroTrust.Access.Users.FailedLogins.List(ctx, userID, query) (\*SinglePage\[[AccessUserFailedLoginListResponse]()], error) GET/accounts/{account\_id}/access/users/{user\_id}/failed\_logins #### AccessCustom Pages ##### [List custom pages](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/custom_pages/methods/list) client.ZeroTrust.Access.CustomPages.List(ctx, params) (\*V4PagePaginationArray\[[CustomPageWithoutHTML]()], error) GET/accounts/{account\_id}/access/custom\_pages ##### [Get a custom page](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/custom_pages/methods/get) client.ZeroTrust.Access.CustomPages.Get(ctx, customPageID, query) (\*[CustomPage](), error) GET/accounts/{account\_id}/access/custom\_pages/{custom\_page\_id} ##### [Create a custom page](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/custom_pages/methods/create) client.ZeroTrust.Access.CustomPages.New(ctx, params) (\*[CustomPageWithoutHTML](), error) POST/accounts/{account\_id}/access/custom\_pages ##### [Update a custom page](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/custom_pages/methods/update) client.ZeroTrust.Access.CustomPages.Update(ctx, customPageID, params) (\*[CustomPageWithoutHTML](), error) PUT/accounts/{account\_id}/access/custom\_pages/{custom\_page\_id} ##### [Delete a custom page](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/custom_pages/methods/delete) client.ZeroTrust.Access.CustomPages.Delete(ctx, customPageID, body) (\*[AccessCustomPageDeleteResponse](), error) DELETE/accounts/{account\_id}/access/custom\_pages/{custom\_page\_id} ##### ModelsExpand Collapse
type CustomPage struct{…} CustomHTML string Custom page HTML. Link to this property Name string Custom page name. Link to this property
Type CustomPageType Custom page type. One of the following: const CustomPageTypeIdentityDenied CustomPageType = "identity\_denied" Link to this property const CustomPageTypeForbidden CustomPageType = "forbidden" Link to this property const CustomPageTypeLogin CustomPageType = "login" Link to this property const CustomPageTypeInterstitial CustomPageType = "interstitial" Link to this property
Link to this property ContractVersion int64Optional Contract version of the page’s Liquid template. Present (>= 1) marks a sanitized template; absent or 0 marks a legacy page served verbatim. Link to this property UID stringOptional UUID. maxLength36 Link to this property
[Link to this property](<#(resource)%20zero_trust.access.custom_pages%20%3E%20(model)%20custom_page%20%3E%20(schema)>)
type CustomPageWithoutHTML struct{…} Name string Custom page name. Link to this property
Type CustomPageWithoutHTMLType Custom page type. One of the following: const CustomPageWithoutHTMLTypeIdentityDenied CustomPageWithoutHTMLType = "identity\_denied" Link to this property const CustomPageWithoutHTMLTypeForbidden CustomPageWithoutHTMLType = "forbidden" Link to this property const CustomPageWithoutHTMLTypeLogin CustomPageWithoutHTMLType = "login" Link to this property const CustomPageWithoutHTMLTypeInterstitial CustomPageWithoutHTMLType = "interstitial" Link to this property
Link to this property ContractVersion int64Optional Contract version of the page’s Liquid template. Present (>= 1) marks a sanitized template; absent or 0 marks a legacy page served verbatim. Link to this property UID stringOptional UUID. maxLength36 Link to this property
Warnings \[]CustomPageWithoutHTMLWarningOptional Advisory validation findings returned when creating or updating a template. Omitted when empty. Message string Human-readable description of the finding. Link to this property Tier string The validation tier that produced the finding (e.g. html, liquid). Link to this property Ref stringOptional Optional pointer to the part of the template the finding refers to. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.custom_pages%20%3E%20(model)%20custom_page_without_html%20%3E%20(schema)>) #### AccessTags ##### [List tags](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/tags/methods/list) client.ZeroTrust.Access.Tags.List(ctx, params) (\*V4PagePaginationArray\[[Tag]()], error) GET/accounts/{account\_id}/access/tags ##### [Get a tag](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/tags/methods/get) client.ZeroTrust.Access.Tags.Get(ctx, tagName, query) (\*[Tag](), error) GET/accounts/{account\_id}/access/tags/{tag\_name} ##### [Create a tag](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/tags/methods/create) client.ZeroTrust.Access.Tags.New(ctx, params) (\*[Tag](), error) POST/accounts/{account\_id}/access/tags ##### [Update a tag](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/tags/methods/update) client.ZeroTrust.Access.Tags.Update(ctx, tagName, params) (\*[Tag](), error) PUT/accounts/{account\_id}/access/tags/{tag\_name} ##### [Delete a tag](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/tags/methods/delete) client.ZeroTrust.Access.Tags.Delete(ctx, tagName, body) (\*[AccessTagDeleteResponse](), error) DELETE/accounts/{account\_id}/access/tags/{tag\_name} ##### ModelsExpand Collapse
type Tag struct{…} A tag Name string The name of the tag Link to this property
[Link to this property](<#(resource)%20zero_trust.access.tags%20%3E%20(model)%20tag%20%3E%20(schema)>) #### AccessPolicies ##### [List Access reusable policies](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/policies/methods/list) client.ZeroTrust.Access.Policies.List(ctx, params) (\*V4PagePaginationArray\[[AccessPolicyListResponse]()], error) GET/accounts/{account\_id}/access/policies ##### [Get an Access reusable policy](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/policies/methods/get) client.ZeroTrust.Access.Policies.Get(ctx, policyID, query) (\*[AccessPolicyGetResponse](), error) GET/accounts/{account\_id}/access/policies/{policy\_id} ##### [Create an Access reusable policy](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/policies/methods/create) client.ZeroTrust.Access.Policies.New(ctx, params) (\*[AccessPolicyNewResponse](), error) POST/accounts/{account\_id}/access/policies ##### [Update an Access reusable policy](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/policies/methods/update) client.ZeroTrust.Access.Policies.Update(ctx, policyID, params) (\*[AccessPolicyUpdateResponse](), error) PUT/accounts/{account\_id}/access/policies/{policy\_id} ##### [Delete an Access reusable policy](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/access/subresources/policies/methods/delete) client.ZeroTrust.Access.Policies.Delete(ctx, policyID, body) (\*[AccessPolicyDeleteResponse](), error) DELETE/accounts/{account\_id}/access/policies/{policy\_id} ##### ModelsExpand Collapse
type ApprovalGroup struct{…} A group of email addresses that can approve a temporary authentication request. ApprovalsNeeded float64 The number of approvals needed to obtain access. minimum0 Link to this property EmailAddresses \[]stringOptional A list of emails that can approve the access request. Link to this property EmailListUUID stringOptional The UUID of an re-usable email list. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.policies%20%3E%20(model)%20approval_group%20%3E%20(schema)>)
type Policy struct{…} ID stringOptional UUID. maxLength36 Link to this property
ApprovalGroups \[]ApprovalGroupOptional Administrators who can approve a temporary authentication request. ApprovalsNeeded float64 The number of approvals needed to obtain access. minimum0 Link to this property EmailAddresses \[]stringOptional A list of emails that can approve the access request. Link to this property EmailListUUID stringOptional The UUID of an re-usable email list. Link to this property
Link to this property ApprovalRequired boolOptional Requires the user to request access from an administrator at the start of each session. Link to this property CreatedAt TimeOptional formatdate-time Link to this property
Decision PolicyDecisionOptional The action Access will take if a user matches this policy. One of the following: const PolicyDecisionAllow PolicyDecision = "allow" Link to this property const PolicyDecisionDeny PolicyDecision = "deny" Link to this property const PolicyDecisionNonIdentity PolicyDecision = "non\_identity" Link to this property const PolicyDecisionBypass PolicyDecision = "bypass" Link to this property
Link to this property
Exclude \[]AccessRuleOptional Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules. One of the following:
type GroupRule struct{…} Matches an Access group.
Group GroupRuleGroup ID string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
type AnyValidServiceTokenRule struct{…} Matches any valid Access Service Token AnyValidServiceToken AnyValidServiceTokenRuleAnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
type AccessRuleAccessAuthContextRule struct{…} Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthContext AccessRuleAccessAuthContextRuleAuthContext ID string The ID of an Authentication context. Link to this property AcID string The ACID of an Authentication context. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type AuthenticationMethodRule struct{…} Enforce different MFA options
AuthMethod AuthenticationMethodRuleAuthMethod AuthMethod string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
type AzureGroupRule struct{…} Matches an Azure group. Requires an Azure identity provider.
AzureAD AzureGroupRuleAzureAD ID string The ID of an Azure group. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type CertificateRule struct{…} Matches any valid client certificate. Certificate CertificateRuleCertificate Link to this property
Link to this property
type AccessRuleAccessCommonNameRule struct{…} Matches a specific common name.
CommonName AccessRuleAccessCommonNameRuleCommonName CommonName string The common name to match. Link to this property
Link to this property
Link to this property
type CountryRule struct{…} Matches a specific country
Geo CountryRuleGeo CountryCode string The country code that should be matched. Link to this property
Link to this property
Link to this property
type AccessDevicePostureRule struct{…} Enforces a device posture rule has run successfully
DevicePosture AccessDevicePostureRuleDevicePosture IntegrationUID string The ID of a device posture integration. Link to this property AccountID stringOptional The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
type DomainRule struct{…} Match an entire email domain.
EmailDomain DomainRuleEmailDomain Domain string The email domain to match. Link to this property
Link to this property
Link to this property
type EmailListRule struct{…} Matches an email address from a list.
EmailList EmailListRuleEmailList ID string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
type EmailRule struct{…} Matches a specific email.
Email EmailRuleEmail Email string The email of the user. formatemail Link to this property
Link to this property
Link to this property
type EveryoneRule struct{…} Matches everyone. Everyone EveryoneRuleEveryone An empty object which matches on all users. Link to this property
Link to this property
type ExternalEvaluationRule struct{…} Create Allow or Block policies which evaluate the user based on custom criteria.
ExternalEvaluation ExternalEvaluationRuleExternalEvaluation EvaluateURL string The API endpoint containing your business logic. Link to this property KeysURL string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
type GitHubOrganizationRule struct{…} Matches a Github organization. Requires a Github identity provider.
GitHubOrganization GitHubOrganizationRuleGitHubOrganization IdentityProviderID string The ID of your Github identity provider. Link to this property Name string The name of the organization. Link to this property Team stringOptional The name of the team Link to this property
Link to this property
Link to this property
type GSuiteGroupRule struct{…} Matches a group in Google Workspace. Requires a Google Workspace identity provider.
GSuite GSuiteGroupRuleGSuite Email string The email of the Google Workspace group. Link to this property IdentityProviderID string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLoginMethodRule struct{…} Matches a specific identity provider id.
LoginMethod AccessRuleAccessLoginMethodRuleLoginMethod ID string The ID of an identity provider. Link to this property
Link to this property
Link to this property
type IPListRule struct{…} Matches an IP address from a list.
IPList IPListRuleIPList ID string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
type IPRule struct{…} Matches an IP address block.
IP IPRuleIP IP string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
type OktaGroupRule struct{…} Matches an Okta group. Requires an Okta identity provider.
Okta OktaGroupRuleOkta IdentityProviderID string The ID of your Okta identity provider. Link to this property Name string The name of the Okta group. Link to this property
Link to this property
Link to this property
type SAMLGroupRule struct{…} Matches a SAML group. Requires a SAML identity provider.
SAML SAMLGroupRuleSAML AttributeName string The name of the SAML attribute. Link to this property AttributeValue string The SAML attribute value to look for. Link to this property IdentityProviderID string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessOIDCClaimRule struct{…} Matches an OIDC claim. Requires an OIDC identity provider.
OIDC AccessRuleAccessOIDCClaimRuleOIDC ClaimName string The name of the OIDC claim. Link to this property ClaimValue string The OIDC claim value to look for. Link to this property IdentityProviderID string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
type ServiceTokenRule struct{…} Matches a specific Access Service Token
ServiceToken ServiceTokenRuleServiceToken TokenID string The ID of a Service Token. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLinkedAppTokenRule struct{…} Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
LinkedAppToken AccessRuleAccessLinkedAppTokenRuleLinkedAppToken AppUID string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
type AccessRuleAccessUserRiskScoreRule struct{…} Matches a user’s risk score.
UserRiskScore AccessRuleAccessUserRiskScoreRuleUserRiskScore
UserRiskScore \[]AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreLow AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "low" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreMedium AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "medium" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreHigh AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "high" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreUnscored AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "unscored" Link to this property
Link to this property
Link to this property
Link to this property
type AccessRuleAccessCloudflareAccountMemberRule struct{…} Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
CloudflareAccountMember AccessRuleAccessCloudflareAccountMemberRuleCloudflareAccountMember AccountID stringOptional Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property
Include \[]AccessRuleOptional Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. One of the following:
type GroupRule struct{…} Matches an Access group.
Group GroupRuleGroup ID string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
type AnyValidServiceTokenRule struct{…} Matches any valid Access Service Token AnyValidServiceToken AnyValidServiceTokenRuleAnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
type AccessRuleAccessAuthContextRule struct{…} Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthContext AccessRuleAccessAuthContextRuleAuthContext ID string The ID of an Authentication context. Link to this property AcID string The ACID of an Authentication context. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type AuthenticationMethodRule struct{…} Enforce different MFA options
AuthMethod AuthenticationMethodRuleAuthMethod AuthMethod string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
type AzureGroupRule struct{…} Matches an Azure group. Requires an Azure identity provider.
AzureAD AzureGroupRuleAzureAD ID string The ID of an Azure group. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type CertificateRule struct{…} Matches any valid client certificate. Certificate CertificateRuleCertificate Link to this property
Link to this property
type AccessRuleAccessCommonNameRule struct{…} Matches a specific common name.
CommonName AccessRuleAccessCommonNameRuleCommonName CommonName string The common name to match. Link to this property
Link to this property
Link to this property
type CountryRule struct{…} Matches a specific country
Geo CountryRuleGeo CountryCode string The country code that should be matched. Link to this property
Link to this property
Link to this property
type AccessDevicePostureRule struct{…} Enforces a device posture rule has run successfully
DevicePosture AccessDevicePostureRuleDevicePosture IntegrationUID string The ID of a device posture integration. Link to this property AccountID stringOptional The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
type DomainRule struct{…} Match an entire email domain.
EmailDomain DomainRuleEmailDomain Domain string The email domain to match. Link to this property
Link to this property
Link to this property
type EmailListRule struct{…} Matches an email address from a list.
EmailList EmailListRuleEmailList ID string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
type EmailRule struct{…} Matches a specific email.
Email EmailRuleEmail Email string The email of the user. formatemail Link to this property
Link to this property
Link to this property
type EveryoneRule struct{…} Matches everyone. Everyone EveryoneRuleEveryone An empty object which matches on all users. Link to this property
Link to this property
type ExternalEvaluationRule struct{…} Create Allow or Block policies which evaluate the user based on custom criteria.
ExternalEvaluation ExternalEvaluationRuleExternalEvaluation EvaluateURL string The API endpoint containing your business logic. Link to this property KeysURL string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
type GitHubOrganizationRule struct{…} Matches a Github organization. Requires a Github identity provider.
GitHubOrganization GitHubOrganizationRuleGitHubOrganization IdentityProviderID string The ID of your Github identity provider. Link to this property Name string The name of the organization. Link to this property Team stringOptional The name of the team Link to this property
Link to this property
Link to this property
type GSuiteGroupRule struct{…} Matches a group in Google Workspace. Requires a Google Workspace identity provider.
GSuite GSuiteGroupRuleGSuite Email string The email of the Google Workspace group. Link to this property IdentityProviderID string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLoginMethodRule struct{…} Matches a specific identity provider id.
LoginMethod AccessRuleAccessLoginMethodRuleLoginMethod ID string The ID of an identity provider. Link to this property
Link to this property
Link to this property
type IPListRule struct{…} Matches an IP address from a list.
IPList IPListRuleIPList ID string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
type IPRule struct{…} Matches an IP address block.
IP IPRuleIP IP string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
type OktaGroupRule struct{…} Matches an Okta group. Requires an Okta identity provider.
Okta OktaGroupRuleOkta IdentityProviderID string The ID of your Okta identity provider. Link to this property Name string The name of the Okta group. Link to this property
Link to this property
Link to this property
type SAMLGroupRule struct{…} Matches a SAML group. Requires a SAML identity provider.
SAML SAMLGroupRuleSAML AttributeName string The name of the SAML attribute. Link to this property AttributeValue string The SAML attribute value to look for. Link to this property IdentityProviderID string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessOIDCClaimRule struct{…} Matches an OIDC claim. Requires an OIDC identity provider.
OIDC AccessRuleAccessOIDCClaimRuleOIDC ClaimName string The name of the OIDC claim. Link to this property ClaimValue string The OIDC claim value to look for. Link to this property IdentityProviderID string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
type ServiceTokenRule struct{…} Matches a specific Access Service Token
ServiceToken ServiceTokenRuleServiceToken TokenID string The ID of a Service Token. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLinkedAppTokenRule struct{…} Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
LinkedAppToken AccessRuleAccessLinkedAppTokenRuleLinkedAppToken AppUID string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
type AccessRuleAccessUserRiskScoreRule struct{…} Matches a user’s risk score.
UserRiskScore AccessRuleAccessUserRiskScoreRuleUserRiskScore
UserRiskScore \[]AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreLow AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "low" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreMedium AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "medium" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreHigh AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "high" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreUnscored AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "unscored" Link to this property
Link to this property
Link to this property
Link to this property
type AccessRuleAccessCloudflareAccountMemberRule struct{…} Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
CloudflareAccountMember AccessRuleAccessCloudflareAccountMemberRuleCloudflareAccountMember AccountID stringOptional Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property IsolationRequired boolOptional Require this application to be served in an isolated browser for users matching this policy. Link to this property Name stringOptional The name of the Access policy. Link to this property Precedence int64Optional The order of execution for this policy. Must be unique for each policy. Link to this property PurposeJustificationPrompt stringOptional A custom message that will appear on the purpose justification screen. Link to this property PurposeJustificationRequired boolOptional Require users to enter a justification when they log in to the application. Link to this property
Require \[]AccessRuleOptional Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules. One of the following:
type GroupRule struct{…} Matches an Access group.
Group GroupRuleGroup ID string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
type AnyValidServiceTokenRule struct{…} Matches any valid Access Service Token AnyValidServiceToken AnyValidServiceTokenRuleAnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
type AccessRuleAccessAuthContextRule struct{…} Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthContext AccessRuleAccessAuthContextRuleAuthContext ID string The ID of an Authentication context. Link to this property AcID string The ACID of an Authentication context. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type AuthenticationMethodRule struct{…} Enforce different MFA options
AuthMethod AuthenticationMethodRuleAuthMethod AuthMethod string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
type AzureGroupRule struct{…} Matches an Azure group. Requires an Azure identity provider.
AzureAD AzureGroupRuleAzureAD ID string The ID of an Azure group. Link to this property IdentityProviderID string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
type CertificateRule struct{…} Matches any valid client certificate. Certificate CertificateRuleCertificate Link to this property
Link to this property
type AccessRuleAccessCommonNameRule struct{…} Matches a specific common name.
CommonName AccessRuleAccessCommonNameRuleCommonName CommonName string The common name to match. Link to this property
Link to this property
Link to this property
type CountryRule struct{…} Matches a specific country
Geo CountryRuleGeo CountryCode string The country code that should be matched. Link to this property
Link to this property
Link to this property
type AccessDevicePostureRule struct{…} Enforces a device posture rule has run successfully
DevicePosture AccessDevicePostureRuleDevicePosture IntegrationUID string The ID of a device posture integration. Link to this property AccountID stringOptional The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
type DomainRule struct{…} Match an entire email domain.
EmailDomain DomainRuleEmailDomain Domain string The email domain to match. Link to this property
Link to this property
Link to this property
type EmailListRule struct{…} Matches an email address from a list.
EmailList EmailListRuleEmailList ID string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
type EmailRule struct{…} Matches a specific email.
Email EmailRuleEmail Email string The email of the user. formatemail Link to this property
Link to this property
Link to this property
type EveryoneRule struct{…} Matches everyone. Everyone EveryoneRuleEveryone An empty object which matches on all users. Link to this property
Link to this property
type ExternalEvaluationRule struct{…} Create Allow or Block policies which evaluate the user based on custom criteria.
ExternalEvaluation ExternalEvaluationRuleExternalEvaluation EvaluateURL string The API endpoint containing your business logic. Link to this property KeysURL string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
type GitHubOrganizationRule struct{…} Matches a Github organization. Requires a Github identity provider.
GitHubOrganization GitHubOrganizationRuleGitHubOrganization IdentityProviderID string The ID of your Github identity provider. Link to this property Name string The name of the organization. Link to this property Team stringOptional The name of the team Link to this property
Link to this property
Link to this property
type GSuiteGroupRule struct{…} Matches a group in Google Workspace. Requires a Google Workspace identity provider.
GSuite GSuiteGroupRuleGSuite Email string The email of the Google Workspace group. Link to this property IdentityProviderID string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLoginMethodRule struct{…} Matches a specific identity provider id.
LoginMethod AccessRuleAccessLoginMethodRuleLoginMethod ID string The ID of an identity provider. Link to this property
Link to this property
Link to this property
type IPListRule struct{…} Matches an IP address from a list.
IPList IPListRuleIPList ID string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
type IPRule struct{…} Matches an IP address block.
IP IPRuleIP IP string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
type OktaGroupRule struct{…} Matches an Okta group. Requires an Okta identity provider.
Okta OktaGroupRuleOkta IdentityProviderID string The ID of your Okta identity provider. Link to this property Name string The name of the Okta group. Link to this property
Link to this property
Link to this property
type SAMLGroupRule struct{…} Matches a SAML group. Requires a SAML identity provider.
SAML SAMLGroupRuleSAML AttributeName string The name of the SAML attribute. Link to this property AttributeValue string The SAML attribute value to look for. Link to this property IdentityProviderID string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
type AccessRuleAccessOIDCClaimRule struct{…} Matches an OIDC claim. Requires an OIDC identity provider.
OIDC AccessRuleAccessOIDCClaimRuleOIDC ClaimName string The name of the OIDC claim. Link to this property ClaimValue string The OIDC claim value to look for. Link to this property IdentityProviderID string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
type ServiceTokenRule struct{…} Matches a specific Access Service Token
ServiceToken ServiceTokenRuleServiceToken TokenID string The ID of a Service Token. Link to this property
Link to this property
Link to this property
type AccessRuleAccessLinkedAppTokenRule struct{…} Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
LinkedAppToken AccessRuleAccessLinkedAppTokenRuleLinkedAppToken AppUID string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
type AccessRuleAccessUserRiskScoreRule struct{…} Matches a user’s risk score.
UserRiskScore AccessRuleAccessUserRiskScoreRuleUserRiskScore
UserRiskScore \[]AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreLow AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "low" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreMedium AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "medium" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreHigh AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "high" Link to this property const AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScoreUnscored AccessRuleAccessUserRiskScoreRuleUserRiskScoreUserRiskScore = "unscored" Link to this property
Link to this property
Link to this property
Link to this property
type AccessRuleAccessCloudflareAccountMemberRule struct{…} Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
CloudflareAccountMember AccessRuleAccessCloudflareAccountMemberRuleCloudflareAccountMember AccountID stringOptional Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.access.policies%20%3E%20(model)%20policy%20%3E%20(schema)>)