--- title: Gateway --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/go) [Zero Trust](https://developers.cloudflare.com/api/go/resources/zero_trust) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Gateway ##### [Get Zero Trust account information](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/methods/list) client.ZeroTrust.Gateway.List(ctx, query) (\*[GatewayListResponse](), error) GET/accounts/{account\_id}/gateway ##### [Create Zero Trust account](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/methods/create) client.ZeroTrust.Gateway.New(ctx, body) (\*[GatewayNewResponse](), error) POST/accounts/{account\_id}/gateway #### GatewayAudit SSH Settings ##### [Get Zero Trust SSH settings](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/audit_ssh_settings/methods/get) client.ZeroTrust.Gateway.AuditSSHSettings.Get(ctx, query) (\*[GatewaySettings](), error) GET/accounts/{account\_id}/gateway/audit\_ssh\_settings ##### [Update Zero Trust SSH settings](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/audit_ssh_settings/methods/update) client.ZeroTrust.Gateway.AuditSSHSettings.Update(ctx, params) (\*[GatewaySettings](), error) PUT/accounts/{account\_id}/gateway/audit\_ssh\_settings ##### [Rotate Zero Trust SSH account seed](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/audit_ssh_settings/methods/rotate_seed) client.ZeroTrust.Gateway.AuditSSHSettings.RotateSeed(ctx, body) (\*[GatewaySettings](), error) POST/accounts/{account\_id}/gateway/audit\_ssh\_settings/rotate\_seed ##### ModelsExpand Collapse
type GatewaySettings struct{…} CreatedAt TimeOptional formatdate-time Link to this property PublicKey stringOptional Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging. Link to this property SeedID stringOptional Identify the seed ID. maxLength36 Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.audit_ssh_settings%20%3E%20(model)%20gateway_settings%20%3E%20(schema)>) #### GatewayCategories ##### [List categories](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/categories/methods/list) client.ZeroTrust.Gateway.Categories.List(ctx, query) (\*SinglePage\[[Category]()], error) GET/accounts/{account\_id}/gateway/categories ##### ModelsExpand Collapse
type Category struct{…} ID int64Optional Identify this category. Only one category per ID. Link to this property Beta boolOptional Indicate whether the category is in beta and subject to change. Link to this property
Class CategoryClassOptional Specify which account types can create policies for this category. blocked Blocks unconditionally for all accounts. removalPending Allows removal from policies but disables addition. noBlock Prevents blocking. One of the following: const CategoryClassFree CategoryClass = "free" Link to this property const CategoryClassPremium CategoryClass = "premium" Link to this property const CategoryClassBlocked CategoryClass = "blocked" Link to this property const CategoryClassRemovalPending CategoryClass = "removalPending" Link to this property const CategoryClassNoBlock CategoryClass = "noBlock" Link to this property
Link to this property Description stringOptional Provide a short summary of domains in the category. Link to this property Name stringOptional Specify the category name. Link to this property
Subcategories \[]CategorySubcategoryOptional Provide all subcategories for this category. ID int64Optional Identify this category. Only one category per ID. Link to this property Beta boolOptional Indicate whether the category is in beta and subject to change. Link to this property
Class CategorySubcategoriesClassOptional Specify which account types can create policies for this category. blocked Blocks unconditionally for all accounts. removalPending Allows removal from policies but disables addition. noBlock Prevents blocking. One of the following: const CategorySubcategoriesClassFree CategorySubcategoriesClass = "free" Link to this property const CategorySubcategoriesClassPremium CategorySubcategoriesClass = "premium" Link to this property const CategorySubcategoriesClassBlocked CategorySubcategoriesClass = "blocked" Link to this property const CategorySubcategoriesClassRemovalPending CategorySubcategoriesClass = "removalPending" Link to this property const CategorySubcategoriesClassNoBlock CategorySubcategoriesClass = "noBlock" Link to this property
Link to this property Description stringOptional Provide a short summary of domains in the category. Link to this property Name stringOptional Specify the category name. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.categories%20%3E%20(model)%20category%20%3E%20(schema)>) #### GatewayApp Types ##### [List application and application type mappings](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/app_types/methods/list) client.ZeroTrust.Gateway.AppTypes.List(ctx, query) (\*SinglePage\[[AppType]()], error) GET/accounts/{account\_id}/gateway/app\_types ##### ModelsExpand Collapse
type AppType interface{…} One of the following:
type AppTypeZeroTrustGatewayApplication struct{…} ID int64Optional Identify this application. Only one application per ID. Link to this property ApplicationTypeID int64Optional Identify the type of this application. Multiple applications can share the same type. Refers to the id of a returned application type. Link to this property CreatedAt TimeOptional formatdate-time Link to this property Name stringOptional Specify the name of the application or application type. Link to this property
Link to this property
type AppTypeZeroTrustGatewayApplicationType struct{…} ID int64Optional Identify the type of this application. Multiple applications can share the same type. Refers to the id of a returned application type. Link to this property CreatedAt TimeOptional formatdate-time Link to this property Description stringOptional Provide a short summary of applications with this type. Link to this property Name stringOptional Specify the name of the application or application type. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.app_types%20%3E%20(model)%20app_type%20%3E%20(schema)>) #### GatewayConfigurations ##### [Get Zero Trust account configuration](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/configurations/methods/get) client.ZeroTrust.Gateway.Configurations.Get(ctx, query) (\*[GatewayConfigurationGetResponse](), error) GET/accounts/{account\_id}/gateway/configuration ##### [Update Zero Trust account configuration](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/configurations/methods/update) client.ZeroTrust.Gateway.Configurations.Update(ctx, params) (\*[GatewayConfigurationUpdateResponse](), error) PUT/accounts/{account\_id}/gateway/configuration ##### [Patch Zero Trust account configuration](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/configurations/methods/edit) client.ZeroTrust.Gateway.Configurations.Edit(ctx, params) (\*[GatewayConfigurationEditResponse](), error) PATCH/accounts/{account\_id}/gateway/configuration ##### ModelsExpand Collapse
type ActivityLogSettings struct{…} Specify activity log settings. Enabled boolOptional Specify whether to log activity. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20activity_log_settings%20%3E%20(schema)>)
type AntiVirusSettings struct{…} Specify anti-virus settings. EnabledDownloadPhase boolOptional Specify whether to enable anti-virus scanning on downloads. Link to this property EnabledUploadPhase boolOptional Specify whether to enable anti-virus scanning on uploads. Link to this property FailClosed boolOptional Specify whether to block requests for unscannable files. Link to this property NotificationSettings NotificationSettingsOptional Configure the message the user’s device shows during an antivirus scan. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20anti_virus_settings%20%3E%20(schema)>)
type BlockPageSettings struct{…} Specify block page layout settings. BackgroundColor stringOptional Specify the block page background color in #rrggbb format when the mode is customized\_block\_page. Link to this property Enabled boolOptional Specify whether to enable the custom block page. Link to this property FooterText stringOptional Specify the block page footer text when the mode is customized\_block\_page. Link to this property HeaderText stringOptional Specify the block page header text when the mode is customized\_block\_page. Link to this property IncludeContext boolOptional Specify whether to append context to target\_uri as query parameters. This applies only when the mode is redirect\_uri. Link to this property LogoPath stringOptional Specify the full URL to the logo file when the mode is customized\_block\_page. Link to this property MailtoAddress stringOptional Specify the admin email for users to contact when the mode is customized\_block\_page. Link to this property MailtoSubject stringOptional Specify the subject line for emails created from the block page when the mode is customized\_block\_page. Link to this property
Mode BlockPageSettingsModeOptional Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI. One of the following: const BlockPageSettingsModeEmpty BlockPageSettingsMode = "" Link to this property const BlockPageSettingsModeCustomizedBlockPage BlockPageSettingsMode = "customized\_block\_page" Link to this property const BlockPageSettingsModeRedirectURI BlockPageSettingsMode = "redirect\_uri" Link to this property
Link to this property Name stringOptional Specify the block page title when the mode is customized\_block\_page. Link to this property ReadOnly boolOptional Indicate that this setting was shared via the Orgs API and read only for the current account. Link to this property SourceAccount stringOptional Indicate the account tag of the account that shared this setting. Link to this property SuppressFooter boolOptional Specify whether to suppress detailed information at the bottom of the block page when the mode is customized\_block\_page. Link to this property TargetURI stringOptional Specify the URI to redirect users to when the mode is redirect\_uri. formaturi Link to this property Version int64Optional Indicate the version number of the setting. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20block_page_settings%20%3E%20(schema)>)
type BodyScanningSettings struct{…} Specify the DLP inspection mode.
InspectionMode BodyScanningSettingsInspectionModeOptional Specify the inspection mode as either deep or shallow. One of the following: const BodyScanningSettingsInspectionModeDeep BodyScanningSettingsInspectionMode = "deep" Link to this property const BodyScanningSettingsInspectionModeShallow BodyScanningSettingsInspectionMode = "shallow" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20body_scanning_settings%20%3E%20(schema)>)
type BrowserIsolationSettings struct{…} Specify Clientless Browser Isolation settings. NonIdentityEnabled boolOptional Specify whether to enable non-identity onramp support for Browser Isolation. Link to this property URLBrowserIsolationEnabled boolOptional Specify whether to enable Clientless Browser Isolation. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20browser_isolation_settings%20%3E%20(schema)>)
type CustomCertificateSettings struct{…} Specify custom certificate settings for BYO-PKI. This field is deprecated; use certificate instead. Enabled bool Specify whether to enable a custom certificate authority for signing Gateway traffic. Link to this property ID stringOptional Specify the UUID of the certificate (ID from MTLS certificate store). Link to this property BindingStatus stringOptional Indicate the internal certificate status. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20custom_certificate_settings%20%3E%20(schema)>)
type ExtendedEmailMatching struct{…} Configures user email settings for firewall policies. When you enable this, the system standardizes email addresses in the identity portion of the rule to match extended email variants in firewall policies. When you disable this setting, the system matches email addresses exactly as you provide them. Enable this setting if your email uses . or + modifiers. Enabled boolOptional Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies. Link to this property ReadOnly boolOptional Indicate that this setting was shared via the Orgs API and read only for the current account. Link to this property SourceAccount stringOptional Indicate the account tag of the account that shared this setting. Link to this property Version int64Optional Indicate the version number of the setting. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20extended_email_matching%20%3E%20(schema)>)
type FipsSettings struct{…} Specify FIPS settings. TLS boolOptional Enforce cipher suites and TLS versions compliant with FIPS 140-2. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20fips_settings%20%3E%20(schema)>)
type GatewayConfigurationSettings struct{…} Specify account settings. ActivityLog ActivityLogSettingsOptional Specify activity log settings. Link to this property Antivirus AntiVirusSettingsOptional Specify anti-virus settings. Link to this property BlockPage BlockPageSettingsOptional Specify block page layout settings. Link to this property BodyScanning BodyScanningSettingsOptional Specify the DLP inspection mode. Link to this property BrowserIsolation BrowserIsolationSettingsOptional Specify Clientless Browser Isolation settings. Link to this property
Certificate GatewayConfigurationSettingsCertificateOptional Specify certificate settings for Gateway TLS interception. If unset, the Cloudflare Root CA handles interception. ID string Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called ‘active’). A nil UUID directs Cloudflare to use the Root CA. Link to this property
Link to this property DeprecatedCustomCertificate CustomCertificateSettingsOptional Specify custom certificate settings for BYO-PKI. This field is deprecated; use certificate instead. Link to this property ExtendedEmailMatching ExtendedEmailMatchingOptional Configures user email settings for firewall policies. When you enable this, the system standardizes email addresses in the identity portion of the rule to match extended email variants in firewall policies. When you disable this setting, the system matches email addresses exactly as you provide them. Enable this setting if your email uses . or + modifiers. Link to this property Fips FipsSettingsOptional Specify FIPS settings. Link to this property
HostSelector GatewayConfigurationSettingsHostSelectorOptional Enable host selection in egress policies. Enabled boolOptional Specify whether to enable filtering via hosts for egress policies. Link to this property
Link to this property
Inspection GatewayConfigurationSettingsInspectionOptional Define the proxy inspection mode.
Mode GatewayConfigurationSettingsInspectionModeOptional Define the proxy inspection mode. 1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443). 2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic. One of the following: const GatewayConfigurationSettingsInspectionModeStatic GatewayConfigurationSettingsInspectionMode = "static" Link to this property const GatewayConfigurationSettingsInspectionModeDynamic GatewayConfigurationSettingsInspectionMode = "dynamic" Link to this property
Link to this property
Link to this property MaxTTLSecs int64Optional Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location max_ttl setting. maximum36000 minimum60 Link to this property ProtocolDetection ProtocolDetectionOptional Specify whether to detect protocols from the initial bytes of client traffic. Link to this property
Sandbox GatewayConfigurationSettingsSandboxOptional Specify whether to enable the sandbox. Enabled boolOptional Specify whether to enable the sandbox. Link to this property
FallbackAction GatewayConfigurationSettingsSandboxFallbackActionOptional Specify the action to take when the system cannot scan the file. One of the following: const GatewayConfigurationSettingsSandboxFallbackActionAllow GatewayConfigurationSettingsSandboxFallbackAction = "allow" Link to this property const GatewayConfigurationSettingsSandboxFallbackActionBlock GatewayConfigurationSettingsSandboxFallbackAction = "block" Link to this property
Link to this property
Link to this property TLSDecrypt TLSSettingsOptional Specify whether to inspect encrypted HTTP traffic. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20gateway_configuration_settings%20%3E%20(schema)>)
type NotificationSettings struct{…} Configure the message the user’s device shows during an antivirus scan. Enabled boolOptional Specify whether to enable notifications. Link to this property IncludeContext boolOptional Specify whether to include context information as query parameters. Link to this property Msg stringOptional Specify the message to show in the notification. Link to this property SupportURL stringOptional Specify a URL that directs users to more information. If unset, the notification opens a block page. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20notification_settings%20%3E%20(schema)>)
type ProtocolDetection struct{…} Specify whether to detect protocols from the initial bytes of client traffic. Enabled boolOptional Specify whether to detect protocols from the initial bytes of client traffic. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20protocol_detection%20%3E%20(schema)>)
type TLSSettings struct{…} Specify whether to inspect encrypted HTTP traffic. Enabled boolOptional Specify whether to inspect encrypted HTTP traffic. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20tls_settings%20%3E%20(schema)>) #### GatewayConfigurationsCustom Certificate ##### [Get Zero Trust certificate configuration](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/configurations/subresources/custom_certificate/methods/get) Deprecated client.ZeroTrust.Gateway.Configurations.CustomCertificate.Get(ctx, query) (\*[CustomCertificateSettings](), error) GET/accounts/{account\_id}/gateway/configuration/custom\_certificate #### GatewayLists ##### [List Zero Trust lists](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/lists/methods/list) client.ZeroTrust.Gateway.Lists.List(ctx, params) (\*SinglePage\[[GatewayList]()], error) GET/accounts/{account\_id}/gateway/lists ##### [Get Zero Trust list details](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/lists/methods/get) client.ZeroTrust.Gateway.Lists.Get(ctx, listID, query) (\*[GatewayList](), error) GET/accounts/{account\_id}/gateway/lists/{list\_id} ##### [Create Zero Trust list](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/lists/methods/create) client.ZeroTrust.Gateway.Lists.New(ctx, params) (\*[GatewayListNewResponse](), error) POST/accounts/{account\_id}/gateway/lists ##### [Update Zero Trust list](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/lists/methods/update) client.ZeroTrust.Gateway.Lists.Update(ctx, listID, params) (\*[GatewayList](), error) PUT/accounts/{account\_id}/gateway/lists/{list\_id} ##### [Patch Zero Trust list.](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/lists/methods/edit) client.ZeroTrust.Gateway.Lists.Edit(ctx, listID, params) (\*[GatewayList](), error) PATCH/accounts/{account\_id}/gateway/lists/{list\_id} ##### [Delete Zero Trust list](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/lists/methods/delete) client.ZeroTrust.Gateway.Lists.Delete(ctx, listID, body) (\*[GatewayListDeleteResponse](), error) DELETE/accounts/{account\_id}/gateway/lists/{list\_id} ##### ModelsExpand Collapse
type GatewayItem struct{…} CreatedAt TimeOptional formatdate-time Link to this property Description stringOptional Provide the list item description (optional). minimum0 Link to this property Value stringOptional Specify the item value. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.lists%20%3E%20(model)%20gateway_item%20%3E%20(schema)>)
type GatewayList struct{…} ID stringOptional Identify the API resource with a UUID. maxLength36 Link to this property Count float64Optional Indicate the number of items in the list. Link to this property CreatedAt TimeOptional formatdate-time Link to this property Description stringOptional Provide the list description. Link to this property
Items \[]GatewayItemOptional Provide the list items. CreatedAt TimeOptional formatdate-time Link to this property Description stringOptional Provide the list item description (optional). minimum0 Link to this property Value stringOptional Specify the item value. Link to this property
Link to this property Name stringOptional Specify the list name. Link to this property
Type GatewayListTypeOptional Specify the list type. One of the following: const GatewayListTypeSerial GatewayListType = "SERIAL" Link to this property const GatewayListTypeURL GatewayListType = "URL" Link to this property const GatewayListTypeDomain GatewayListType = "DOMAIN" Link to this property const GatewayListTypeEmail GatewayListType = "EMAIL" Link to this property const GatewayListTypeIP GatewayListType = "IP" Link to this property const GatewayListTypeCategory GatewayListType = "CATEGORY" Link to this property const GatewayListTypeLocation GatewayListType = "LOCATION" Link to this property const GatewayListTypeDevice GatewayListType = "DEVICE" Link to this property const GatewayListTypeAaguid GatewayListType = "AAGUID" Link to this property
Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.lists%20%3E%20(model)%20gateway_list%20%3E%20(schema)>) #### GatewayListsItems ##### [Get Zero Trust list items](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/lists/subresources/items/methods/list) client.ZeroTrust.Gateway.Lists.Items.List(ctx, listID, params) (\*V4PagePaginationArray\[[GatewayItem]()], error) GET/accounts/{account\_id}/gateway/lists/{list\_id}/items #### GatewayLocations ##### [List Zero Trust Gateway locations](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/locations/methods/list) client.ZeroTrust.Gateway.Locations.List(ctx, params) (\*SinglePage\[[Location]()], error) GET/accounts/{account\_id}/gateway/locations ##### [Get Zero Trust Gateway location details](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/locations/methods/get) client.ZeroTrust.Gateway.Locations.Get(ctx, locationID, query) (\*[Location](), error) GET/accounts/{account\_id}/gateway/locations/{location\_id} ##### [Create a Zero Trust Gateway location](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/locations/methods/create) client.ZeroTrust.Gateway.Locations.New(ctx, params) (\*[Location](), error) POST/accounts/{account\_id}/gateway/locations ##### [Update a Zero Trust Gateway location](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/locations/methods/update) client.ZeroTrust.Gateway.Locations.Update(ctx, locationID, params) (\*[Location](), error) PUT/accounts/{account\_id}/gateway/locations/{location\_id} ##### [Delete a Zero Trust Gateway location](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/locations/methods/delete) client.ZeroTrust.Gateway.Locations.Delete(ctx, locationID, body) (\*[GatewayLocationDeleteResponse](), error) DELETE/accounts/{account\_id}/gateway/locations/{location\_id} ##### ModelsExpand Collapse
type DOHEndpoint struct{…} Enabled boolOptional Indicate whether the DOH endpoint is enabled for this location. Link to this property
Networks \[]IPNetworkOptional Specify the list of allowed source IP network ranges for this endpoint. When the list is empty, the endpoint allows all source IPs. The list takes effect only if the endpoint is enabled for this location. Network string Specify the IP address or IP CIDR. Link to this property
Link to this property RequireToken boolOptional Specify whether the DOH endpoint requires user identity authentication. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20doh_endpoint%20%3E%20(schema)>)
type DOTEndpoint struct{…} Enabled boolOptional Indicate whether the DOT endpoint is enabled for this location. Link to this property
Networks \[]IPNetworkOptional Specify the list of allowed source IP network ranges for this endpoint. When the list is empty, the endpoint allows all source IPs. The list takes effect only if the endpoint is enabled for this location. Network string Specify the IP address or IP CIDR. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20dot_endpoint%20%3E%20(schema)>)
type Endpoint struct{…} Configure the destination endpoints for this location. DOH DOHEndpoint Link to this property DOT DOTEndpoint Link to this property IPV4 IPV4Endpoint Link to this property IPV6 IPV6Endpoint Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20endpoint%20%3E%20(schema)>)
type IPNetwork struct{…} Network string Specify the IP address or IP CIDR. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20ip_network%20%3E%20(schema)>)
type IPV4Endpoint struct{…} Enabled boolOptional Indicate whether the IPv4 endpoint is enabled for this location. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20ipv4_endpoint%20%3E%20(schema)>)
type IPV6Endpoint struct{…} Enabled boolOptional Indicate whether the IPV6 endpoint is enabled for this location. Link to this property
Networks \[]IPV6NetworkOptional Specify the list of allowed source IPv6 network ranges for this endpoint. When the list is empty, the endpoint allows all source IPs. The list takes effect only if the endpoint is enabled for this location. Network string Specify the IPv6 address or IPv6 CIDR. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20ipv6_endpoint%20%3E%20(schema)>)
type IPV6Network struct{…} Network string Specify the IPv6 address or IPv6 CIDR. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20ipv6_network%20%3E%20(schema)>)
type Location struct{…} ID stringOptional Link to this property ClientDefault boolOptional Indicate whether this location is the default location. Link to this property CreatedAt TimeOptional formatdate-time Link to this property DNSDestinationIPsID stringOptional Indicate the identifier of the pair of IPv4 addresses assigned to this location. Link to this property DNSDestinationIPV6BlockID stringOptional Specify the UUID of the IPv6 block brought to the gateway so that this location’s IPv6 address is allocated from the Bring Your Own IPv6 (BYOIPv6) block rather than the standard Cloudflare IPv6 block. Link to this property DOHSubdomain stringOptional Specify the DNS over HTTPS domain that receives DNS requests. Gateway automatically generates this value. Link to this property ECSSupport boolOptional Indicate whether the location must resolve EDNS queries. Link to this property Endpoints EndpointOptional Configure the destination endpoints for this location. Link to this property IP stringOptional Defines the automatically generated IPv6 destination IP assigned to this location. Gateway counts all DNS requests sent to this IP as requests under this location. Link to this property IPV4Destination stringOptional Show the primary destination IPv4 address from the pair identified dns\_destination\_ips\_id. This field read-only. Link to this property IPV4DestinationBackup stringOptional Show the backup destination IPv4 address from the pair identified dns\_destination\_ips\_id. This field read-only. Link to this property
MaxTTL LocationMaxTTLOptional Controls how DNS response TTLs are capped for this location relative to the account max_ttl_secs setting. Omitting max_ttl on update resets it to inherit.
Mode LocationMaxTTLMode inherit uses the account max_ttl_secs. override uses this location’s ttl_secs. disabled leaves returned TTLs unchanged. One of the following: const LocationMaxTTLModeInherit LocationMaxTTLMode = "inherit" Link to this property const LocationMaxTTLModeOverride LocationMaxTTLMode = "override" Link to this property const LocationMaxTTLModeDisabled LocationMaxTTLMode = "disabled" Link to this property
Link to this property TTLSecs int64Optional Location-specific cap on DNS response TTLs, in seconds. Required when mode is override. Must be omitted when mode is inherit or disabled. maximum36000 minimum60 Link to this property
Link to this property Name stringOptional Specify the location name. Link to this property
Networks \[]LocationNetworkOptional Specify the list of network ranges from which requests at this location originate. The list takes effect only if it is non-empty and the IPv4 endpoint is enabled for this location. Network string Specify the IPv4 address or IPv4 CIDR. Limit IPv4 CIDRs to a maximum of /24. Link to this property
Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20location%20%3E%20(schema)>) #### GatewayLogging ##### [Get logging settings for the Zero Trust account](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/logging/methods/get) client.ZeroTrust.Gateway.Logging.Get(ctx, query) (\*[LoggingSetting](), error) GET/accounts/{account\_id}/gateway/logging ##### [Update Zero Trust account logging settings](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/logging/methods/update) client.ZeroTrust.Gateway.Logging.Update(ctx, params) (\*[LoggingSetting](), error) PUT/accounts/{account\_id}/gateway/logging ##### ModelsExpand Collapse
type LoggingSetting struct{…} RedactPii boolOptional Indicate whether to redact personally identifiable information from activity logging (PII fields include source IP, user email, user ID, device ID, URL, referrer, and user agent). Link to this property
SettingsByRuleType LoggingSettingSettingsByRuleTypeOptional Configure logging settings for each rule type.
DNS LoggingSettingSettingsByRuleTypeDNSOptional Configure logging settings for DNS firewall. LogAll boolOptional Specify whether to log all requests to this service. Link to this property LogBlocks boolOptional Specify whether to log only blocking requests to this service. Link to this property
Link to this property
HTTP LoggingSettingSettingsByRuleTypeHTTPOptional Configure logging settings for HTTP/HTTPS firewall. LogAll boolOptional Specify whether to log all requests to this service. Link to this property LogBlocks boolOptional Specify whether to log only blocking requests to this service. Link to this property
Link to this property
L4 LoggingSettingSettingsByRuleTypeL4Optional Configure logging settings for Network firewall. LogAll boolOptional Specify whether to log all requests to this service. Link to this property LogBlocks boolOptional Specify whether to log only blocking requests to this service. Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.logging%20%3E%20(model)%20logging_setting%20%3E%20(schema)>) #### GatewayProxy Endpoints ##### [List proxy endpoints](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/list) client.ZeroTrust.Gateway.ProxyEndpoints.List(ctx, params) (\*SinglePage\[[ProxyEndpoint]()], error) GET/accounts/{account\_id}/gateway/proxy\_endpoints ##### [Get a proxy endpoint](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/get) client.ZeroTrust.Gateway.ProxyEndpoints.Get(ctx, proxyEndpointID, query) (\*[ProxyEndpoint](), error) GET/accounts/{account\_id}/gateway/proxy\_endpoints/{proxy\_endpoint\_id} ##### [Create a proxy endpoint](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/create) client.ZeroTrust.Gateway.ProxyEndpoints.New(ctx, params) (\*[ProxyEndpoint](), error) POST/accounts/{account\_id}/gateway/proxy\_endpoints ##### [Update a proxy endpoint](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/edit) client.ZeroTrust.Gateway.ProxyEndpoints.Edit(ctx, proxyEndpointID, params) (\*[ProxyEndpoint](), error) PATCH/accounts/{account\_id}/gateway/proxy\_endpoints/{proxy\_endpoint\_id} ##### [Delete a proxy endpoint](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/delete) client.ZeroTrust.Gateway.ProxyEndpoints.Delete(ctx, proxyEndpointID, body) (\*[GatewayProxyEndpointDeleteResponse](), error) DELETE/accounts/{account\_id}/gateway/proxy\_endpoints/{proxy\_endpoint\_id} ##### ModelsExpand Collapse type GatewayIPs string Specify an IPv4 or IPv6 CIDR. Limit IPv6 to a maximum of /109 and IPv4 to a maximum of /25. [Link to this property](<#(resource)%20zero_trust.gateway.proxy_endpoints%20%3E%20(model)%20gateway_ips%20%3E%20(schema)>)
type ProxyEndpoint interface{…} One of the following:
type ProxyEndpointZeroTrustGatewayProxyEndpointIP struct{…} IPs \[]GatewayIPs Specify the list of CIDRs to restrict ingress connections. Link to this property Name string Specify the name of the proxy endpoint. Link to this property ID stringOptional Link to this property CreatedAt TimeOptional formatdate-time Link to this property Kind ProxyEndpointZeroTrustGatewayProxyEndpointIPKindOptional The proxy endpoint kind Link to this property Subdomain stringOptional Specify the subdomain to use as the destination in the proxy client. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
type ProxyEndpointZeroTrustGatewayProxyEndpointIdentity struct{…} Kind ProxyEndpointZeroTrustGatewayProxyEndpointIdentityKind The proxy endpoint kind Link to this property Name string Specify the name of the proxy endpoint. Link to this property ID stringOptional Link to this property CreatedAt TimeOptional formatdate-time Link to this property Subdomain stringOptional Specify the subdomain to use as the destination in the proxy client. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.proxy_endpoints%20%3E%20(model)%20proxy_endpoint%20%3E%20(schema)>) #### GatewayRules ##### [List Zero Trust Gateway rules](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/rules/methods/list) client.ZeroTrust.Gateway.Rules.List(ctx, params) (\*SinglePage\[[GatewayRule]()], error) GET/accounts/{account\_id}/gateway/rules ##### [Get Zero Trust Gateway rule details.](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/rules/methods/get) client.ZeroTrust.Gateway.Rules.Get(ctx, ruleID, query) (\*[GatewayRule](), error) GET/accounts/{account\_id}/gateway/rules/{rule\_id} ##### [Create a Zero Trust Gateway rule](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/rules/methods/create) client.ZeroTrust.Gateway.Rules.New(ctx, params) (\*[GatewayRule](), error) POST/accounts/{account\_id}/gateway/rules ##### [Update a Zero Trust Gateway rule](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/rules/methods/update) client.ZeroTrust.Gateway.Rules.Update(ctx, ruleID, params) (\*[GatewayRule](), error) PUT/accounts/{account\_id}/gateway/rules/{rule\_id} ##### [Delete a Zero Trust Gateway rule](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/rules/methods/delete) client.ZeroTrust.Gateway.Rules.Delete(ctx, ruleID, body) (\*[GatewayRuleDeleteResponse](), error) DELETE/accounts/{account\_id}/gateway/rules/{rule\_id} ##### [List Zero Trust Gateway rules inherited from the parent account](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/rules/methods/list_tenant) client.ZeroTrust.Gateway.Rules.ListTenant(ctx, query) (\*SinglePage\[[GatewayRule]()], error) GET/accounts/{account\_id}/gateway/rules/tenant ##### [Reset the expiration of a Zero Trust Gateway Rule](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/rules/methods/reset_expiration) client.ZeroTrust.Gateway.Rules.ResetExpiration(ctx, ruleID, body) (\*[GatewayRule](), error) POST/accounts/{account\_id}/gateway/rules/{rule\_id}/reset\_expiration ##### ModelsExpand Collapse
type DNSResolverSettingsV4 struct{…} IP string Specify the IPv4 address of the upstream resolver. Link to this property Port int64Optional Specify a port number to use for the upstream resolver. Defaults to 53 if unspecified. Link to this property RouteThroughPrivateNetwork boolOptional Indicate whether to connect to this resolver over a private network. Must set when vnet\_id set. Link to this property VnetID stringOptional Specify an optional virtual network for this resolver. Uses default virtual network id if omitted. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20dns_resolver_settings_v4%20%3E%20(schema)>)
type DNSResolverSettingsV6 struct{…} IP string Specify the IPv6 address of the upstream resolver. Link to this property Port int64Optional Specify a port number to use for the upstream resolver. Defaults to 53 if unspecified. Link to this property RouteThroughPrivateNetwork boolOptional Indicate whether to connect to this resolver over a private network. Must set when vnet\_id set. Link to this property VnetID stringOptional Specify an optional virtual network for this resolver. Uses default virtual network id if omitted. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20dns_resolver_settings_v6%20%3E%20(schema)>)
type GatewayFilter string Specify the protocol or layer to use. One of the following: const GatewayFilterHTTP GatewayFilter = "http" Link to this property const GatewayFilterDNS GatewayFilter = "dns" Link to this property const GatewayFilterL4 GatewayFilter = "l4" Link to this property const GatewayFilterEgress GatewayFilter = "egress" Link to this property const GatewayFilterDNSResolver GatewayFilter = "dns\_resolver" Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20gateway_filter%20%3E%20(schema)>)
type GatewayRule struct{…}
Action GatewayRuleAction Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to true. One of the following: const GatewayRuleActionOn GatewayRuleAction = "on" Link to this property const GatewayRuleActionOff GatewayRuleAction = "off" Link to this property const GatewayRuleActionAllow GatewayRuleAction = "allow" Link to this property const GatewayRuleActionBlock GatewayRuleAction = "block" Link to this property const GatewayRuleActionScan GatewayRuleAction = "scan" Link to this property const GatewayRuleActionNoscan GatewayRuleAction = "noscan" Link to this property const GatewayRuleActionSafesearch GatewayRuleAction = "safesearch" Link to this property const GatewayRuleActionYtrestricted GatewayRuleAction = "ytrestricted" Link to this property const GatewayRuleActionIsolate GatewayRuleAction = "isolate" Link to this property const GatewayRuleActionNoisolate GatewayRuleAction = "noisolate" Link to this property const GatewayRuleActionOverride GatewayRuleAction = "override" Link to this property const GatewayRuleActionL4Override GatewayRuleAction = "l4\_override" Link to this property const GatewayRuleActionEgress GatewayRuleAction = "egress" Link to this property const GatewayRuleActionResolve GatewayRuleAction = "resolve" Link to this property const GatewayRuleActionQuarantine GatewayRuleAction = "quarantine" Link to this property const GatewayRuleActionRedirect GatewayRuleAction = "redirect" Link to this property
Link to this property Enabled bool Specify whether the rule is enabled. Link to this property
Filters \[]GatewayFilter Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value. One of the following: const GatewayFilterHTTP GatewayFilter = "http" Link to this property const GatewayFilterDNS GatewayFilter = "dns" Link to this property const GatewayFilterL4 GatewayFilter = "l4" Link to this property const GatewayFilterEgress GatewayFilter = "egress" Link to this property const GatewayFilterDNSResolver GatewayFilter = "dns\_resolver" Link to this property
Link to this property Name string Specify the rule name. Link to this property Precedence int64 Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to Order of enforcement to manage precedence via Terraform. Link to this property Traffic string Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response. Link to this property ID stringOptional Identify the API resource with a UUID. formatuuid maxLength36 Link to this property CreatedAt TimeOptional formatdate-time Link to this property DeletedAt TimeOptional Indicate the date of deletion, if any. formatdate-time Link to this property Description stringOptional Specify the rule description. Link to this property DevicePosture stringOptional Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response. Link to this property
Expiration GatewayRuleExpirationOptional Defines the expiration time stamp and default duration of a DNS policy. Takes precedence over the policy’s schedule configuration, if any. This does not apply to HTTP or network policies. Settable only for dns rules. ExpiresAt Time Show the timestamp when the policy expires and stops applying. The value must follow RFC 3339 and include a UTC offset. The system accepts non-zero offsets but converts them to the equivalent UTC+00:00 value and returns timestamps with a trailing Z. Expiration policies ignore client timezones and expire globally at the specified expires\_at time. formatdate-time Link to this property Duration int64Optional Defines the default duration a policy active in minutes. Must set in order to use the reset_expiration endpoint on this rule. minimum5 Link to this property Expired boolOptional Indicates whether the policy is expired. Link to this property
Link to this property Identity stringOptional Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response. Link to this property ReadOnly boolOptional Indicate that this rule is shared via the Orgs API and read only. Link to this property RuleSettings RuleSettingOptional Defines settings for this rule. Settings apply only to specific rule types and must use compatible selectors. If Terraform detects drift, confirm the setting supports your rule type and check whether the API modifies the value. Use API-returned values in your configuration to prevent drift. Link to this property Schedule ScheduleOptional Defines the schedule for activating DNS policies. Settable only for dns and dns_resolver rules. Link to this property Sharable boolOptional Indicate that this rule is sharable via the Orgs API. Link to this property SourceAccount stringOptional Provide the account tag of the account that created the rule. Link to this property UpdatedAt TimeOptional formatdate-time Link to this property Version int64Optional Indicate the version number of the rule(read-only). Link to this property WarningStatus stringOptional Indicate a warning for a misconfigured rule, if any. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20gateway_rule%20%3E%20(schema)>)
type RuleSetting struct{…} Defines settings for this rule. Settings apply only to specific rule types and must use compatible selectors. If Terraform detects drift, confirm the setting supports your rule type and check whether the API modifies the value. Use API-returned values in your configuration to prevent drift. AddHeaders map\[string, \[]string]Optional Add custom headers to allowed requests as key-value pairs. Use header names as keys that map to arrays of header values. Header values may contain @{selector.name} variable references that are interpolated at the edge. Use @@{ to escape a literal @{. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes and each header value may not exceed 4 KB. Settable only for http rules with the action set to allow. Link to this property AllowChildBypass boolOptional Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules. Link to this property
AuditSSH RuleSettingAuditSSHOptional Define the settings for the Audit SSH action. Settable only for l4 rules with audit_ssh action. CommandLogging boolOptional Enable SSH command logging. Link to this property
Link to this property
BISOAdminControls RuleSettingBISOAdminControlsOptional Configure browser isolation behavior. Settable only for http rules with the action set to isolate.
Copy RuleSettingBISOAdminControlsCopyOptional Configure copy behavior. If set to remote\_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == “v2”. One of the following: const RuleSettingBISOAdminControlsCopyEnabled RuleSettingBISOAdminControlsCopy = "enabled" Link to this property const RuleSettingBISOAdminControlsCopyDisabled RuleSettingBISOAdminControlsCopy = "disabled" Link to this property const RuleSettingBISOAdminControlsCopyRemoteOnly RuleSettingBISOAdminControlsCopy = "remote\_only" Link to this property
Link to this property DCP boolOptional Set to false to enable copy-pasting. Only applies when version == "v1". Link to this property DD boolOptional Set to false to enable downloading. Only applies when version == "v1". Link to this property DK boolOptional Set to false to enable keyboard usage. Only applies when version == "v1". Link to this property
Download RuleSettingBISOAdminControlsDownloadOptional Configure download behavior. When set to remote\_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == “v2”. One of the following: const RuleSettingBISOAdminControlsDownloadEnabled RuleSettingBISOAdminControlsDownload = "enabled" Link to this property const RuleSettingBISOAdminControlsDownloadDisabled RuleSettingBISOAdminControlsDownload = "disabled" Link to this property const RuleSettingBISOAdminControlsDownloadRemoteOnly RuleSettingBISOAdminControlsDownload = "remote\_only" Link to this property
Link to this property DP boolOptional Set to false to enable printing. Only applies when version == "v1". Link to this property DU boolOptional Set to false to enable uploading. Only applies when version == "v1". Link to this property
Keyboard RuleSettingBISOAdminControlsKeyboardOptional Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == “v2”. One of the following: const RuleSettingBISOAdminControlsKeyboardEnabled RuleSettingBISOAdminControlsKeyboard = "enabled" Link to this property const RuleSettingBISOAdminControlsKeyboardDisabled RuleSettingBISOAdminControlsKeyboard = "disabled" Link to this property
Link to this property
Paste RuleSettingBISOAdminControlsPasteOptional Configure paste behavior. If set to remote\_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == “v2”. One of the following: const RuleSettingBISOAdminControlsPasteEnabled RuleSettingBISOAdminControlsPaste = "enabled" Link to this property const RuleSettingBISOAdminControlsPasteDisabled RuleSettingBISOAdminControlsPaste = "disabled" Link to this property const RuleSettingBISOAdminControlsPasteRemoteOnly RuleSettingBISOAdminControlsPaste = "remote\_only" Link to this property
Link to this property
Printing RuleSettingBISOAdminControlsPrintingOptional Configure print behavior. Default, Printing is enabled. Applies only when version == “v2”. One of the following: const RuleSettingBISOAdminControlsPrintingEnabled RuleSettingBISOAdminControlsPrinting = "enabled" Link to this property const RuleSettingBISOAdminControlsPrintingDisabled RuleSettingBISOAdminControlsPrinting = "disabled" Link to this property
Link to this property
Upload RuleSettingBISOAdminControlsUploadOptional Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == “v2”. One of the following: const RuleSettingBISOAdminControlsUploadEnabled RuleSettingBISOAdminControlsUpload = "enabled" Link to this property const RuleSettingBISOAdminControlsUploadDisabled RuleSettingBISOAdminControlsUpload = "disabled" Link to this property
Link to this property
Version RuleSettingBISOAdminControlsVersionOptional Indicate which version of the browser isolation controls should apply. One of the following: const RuleSettingBISOAdminControlsVersionV1 RuleSettingBISOAdminControlsVersion = "v1" Link to this property const RuleSettingBISOAdminControlsVersionV2 RuleSettingBISOAdminControlsVersion = "v2" Link to this property
Link to this property WmID stringOptional Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser. formatuuid maxLength36 minLength1 Link to this property
Link to this property
BlockPage RuleSettingBlockPageOptional Configure custom block page settings. If missing or null, use the account settings. Settable only for http rules with the action set to block. TargetURI string Specify the URI to which the user is redirected. formaturi Link to this property IncludeContext boolOptional Specify whether to pass the context information as query parameters. Link to this property
Link to this property BlockPageEnabled boolOptional Enable the custom block page. Settable only for dns rules with action block. Link to this property BlockReason stringOptional Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for dns, l4, and http rules when the action set to block. Link to this property BypassParentRule boolOptional Set to enable MSP accounts to bypass their parent’s rules. Only MSP child accounts can set this. Settable for all types of rules. Link to this property
CheckSession RuleSettingCheckSessionOptional Configure session check behavior. Settable only for l4 and http rules with the action set to allow. Duration stringOptional Sets the required session freshness threshold. The API returns a normalized version of this value. Link to this property Enforce boolOptional Enable session enforcement. Link to this property
Link to this property DeleteHeaders \[]stringOptional Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for http rules with the action set to allow. Link to this property
DNSResolvers RuleSettingDNSResolversOptional Configure custom resolvers to route queries that match the resolver policy. Unused with ‘resolve\_dns\_through\_cloudflare’ or ‘resolve\_dns\_internally’ settings. DNS queries get routed to the address closest to their origin. Only valid when a rule’s action set to ‘resolve’. Settable only for dns_resolver rules.
IPV4 \[]DNSResolverSettingsV4Optional IP string Specify the IPv4 address of the upstream resolver. Link to this property Port int64Optional Specify a port number to use for the upstream resolver. Defaults to 53 if unspecified. Link to this property RouteThroughPrivateNetwork boolOptional Indicate whether to connect to this resolver over a private network. Must set when vnet\_id set. Link to this property VnetID stringOptional Specify an optional virtual network for this resolver. Uses default virtual network id if omitted. Link to this property
Link to this property
IPV6 \[]DNSResolverSettingsV6Optional IP string Specify the IPv6 address of the upstream resolver. Link to this property Port int64Optional Specify a port number to use for the upstream resolver. Defaults to 53 if unspecified. Link to this property RouteThroughPrivateNetwork boolOptional Indicate whether to connect to this resolver over a private network. Must set when vnet\_id set. Link to this property VnetID stringOptional Specify an optional virtual network for this resolver. Uses default virtual network id if omitted. Link to this property
Link to this property
Link to this property
Egress RuleSettingEgressOptional Configure how Gateway Proxy traffic egresses. You can enable this setting for rules with Egress actions and filters, or omit it to indicate local egress via WARP IPs. Settable only for egress rules. IPV4 stringOptional Specify the IPv4 address to use for egress. Link to this property IPV4Fallback stringOptional Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set ‘0.0.0.0’ to indicate local egress via WARP IPs. Link to this property IPV6 stringOptional Specify the IPv6 range to use for egress. Link to this property
Link to this property
ForensicCopy RuleSettingForensicCopyOptional Configure whether a copy of the HTTP request will be sent to storage when the rule matches. Enabled boolOptional Enable sending the copy to storage. Link to this property
Link to this property IgnoreCNAMECategoryMatches boolOptional Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for dns and dns_resolver rules. Link to this property InsecureDisableDNSSECValidation boolOptional Specify whether to disable DNSSEC validation (for Allow actions) \[INSECURE]. Settable only for dns rules. Link to this property IPCategories boolOptional Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for dns and dns_resolver rules. Link to this property IPIndicatorFeeds boolOptional Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for dns and dns_resolver rules. Link to this property
L4override RuleSettingL4overrideOptional Send matching traffic to the supplied destination IP address and port. Settable only for l4 rules with the action set to l4_override. IP stringOptional Defines the IPv4 or IPv6 address. Link to this property Port int64Optional Defines a port number to use for TCP/UDP overrides. Link to this property
Link to this property
NotificationSettings RuleSettingNotificationSettingsOptional Configure a notification to display on the user’s device when this rule matched. Settable for all types of rules with the action set to block. Enabled boolOptional Enable notification. Link to this property IncludeContext boolOptional Indicates whether to pass the context information as query parameters. Link to this property Msg stringOptional Customize the message shown in the notification. Link to this property SupportURL stringOptional Defines an optional URL to direct users to additional information. If unset, the notification opens a block page. Link to this property
Link to this property OverrideHost stringOptional Defines a hostname for override, for the matching DNS queries. Settable only for dns rules with the action set to override. Link to this property OverrideIPs \[]stringOptional Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for dns rules with the action set to override. Link to this property
PayloadLog RuleSettingPayloadLogOptional Configure DLP payload logging. Settable only for http rules. Enabled boolOptional Enable DLP payload logging for this rule. Link to this property
Link to this property
Quarantine RuleSettingQuarantineOptional Configure settings that apply to quarantine rules. Settable only for http rules.
FileTypes \[]RuleSettingQuarantineFileTypeOptional Specify the types of files to sandbox. One of the following: const RuleSettingQuarantineFileTypeExe RuleSettingQuarantineFileType = "exe" Link to this property const RuleSettingQuarantineFileTypePDF RuleSettingQuarantineFileType = "pdf" Link to this property const RuleSettingQuarantineFileTypeDoc RuleSettingQuarantineFileType = "doc" Link to this property const RuleSettingQuarantineFileTypeDocm RuleSettingQuarantineFileType = "docm" Link to this property const RuleSettingQuarantineFileTypeDocx RuleSettingQuarantineFileType = "docx" Link to this property const RuleSettingQuarantineFileTypeRtf RuleSettingQuarantineFileType = "rtf" Link to this property const RuleSettingQuarantineFileTypePpt RuleSettingQuarantineFileType = "ppt" Link to this property const RuleSettingQuarantineFileTypePptx RuleSettingQuarantineFileType = "pptx" Link to this property const RuleSettingQuarantineFileTypeXls RuleSettingQuarantineFileType = "xls" Link to this property const RuleSettingQuarantineFileTypeXlsm RuleSettingQuarantineFileType = "xlsm" Link to this property const RuleSettingQuarantineFileTypeXlsx RuleSettingQuarantineFileType = "xlsx" Link to this property const RuleSettingQuarantineFileTypeZip RuleSettingQuarantineFileType = "zip" Link to this property const RuleSettingQuarantineFileTypeRar RuleSettingQuarantineFileType = "rar" Link to this property
Link to this property
Link to this property
Redirect RuleSettingRedirectOptional Apply settings to redirect rules. Settable only for http rules with the action set to redirect. TargetURI string Specify the URI to which the user is redirected. formaturi Link to this property IncludeContext boolOptional Specify whether to pass the context information as query parameters. Link to this property PreservePathAndQuery boolOptional Specify whether to append the path and query parameters from the original request to target\_uri. Link to this property
Link to this property
ResolveDNSInternally RuleSettingResolveDNSInternallyOptional Configure to forward the query to the internal DNS service, passing the specified ‘view\_id’ as input. Not used when ‘dns\_resolvers’ is specified or ‘resolve\_dns\_through\_cloudflare’ is set. Only valid when a rule’s action set to ‘resolve’. Settable only for dns_resolver rules.
Fallback RuleSettingResolveDNSInternallyFallbackOptional Specify the fallback behavior to apply when the internal DNS response code differs from ‘NOERROR’ or when the response data contains only CNAME records for ‘A’ or ‘AAAA’ queries. One of the following: const RuleSettingResolveDNSInternallyFallbackNone RuleSettingResolveDNSInternallyFallback = "none" Link to this property const RuleSettingResolveDNSInternallyFallbackPublicDNS RuleSettingResolveDNSInternallyFallback = "public\_dns" Link to this property
Link to this property ViewID stringOptional Specify the internal DNS view identifier to pass to the internal DNS service. Link to this property
Link to this property ResolveDNSThroughCloudflare boolOptional Enable to send queries that match the policy to Cloudflare’s default 1.1.1.1 DNS resolver. Cannot set when ‘dns\_resolvers’ specified or ‘resolve\_dns\_internally’ is set. Only valid when a rule’s action set to ‘resolve’. Settable only for dns_resolver rules. Link to this property SetHeaders map\[string, \[]string]Optional Replace existing headers on allowed requests with the specified key-value pairs. If a header does not exist, it is added. Header values may contain @{selector.name} variable references that are interpolated at the edge. Use @@{ to escape a literal @{. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes and each header value may not exceed 4 KB. Settable only for http rules with the action set to allow. Link to this property
UntrustedCERT RuleSettingUntrustedCERTOptional Configure behavior when an upstream certificate is invalid or an SSL error occurs. Settable only for http rules with the action set to allow.
Action RuleSettingUntrustedCERTActionOptional Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526. One of the following: const RuleSettingUntrustedCERTActionPassThrough RuleSettingUntrustedCERTAction = "pass\_through" Link to this property const RuleSettingUntrustedCERTActionBlock RuleSettingUntrustedCERTAction = "block" Link to this property const RuleSettingUntrustedCERTActionError RuleSettingUntrustedCERTAction = "error" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20rule_setting%20%3E%20(schema)>)
type Schedule struct{…} Defines the schedule for activating DNS policies. Settable only for dns and dns_resolver rules. Fri stringOptional Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property Mon stringOptional Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property Sat stringOptional Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property Sun stringOptional Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property Thu stringOptional Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property TimeZone stringOptional Specify the time zone for rule evaluation. When a valid time zone city name is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user’s IP address. Colo time zone is used when the user’s IP address does not resolve to a location. Link to this property Tue stringOptional Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property Wed stringOptional Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20schedule%20%3E%20(schema)>) #### GatewayCertificates ##### [List Zero Trust certificates](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/certificates/methods/list) client.ZeroTrust.Gateway.Certificates.List(ctx, query) (\*SinglePage\[[GatewayCertificateListResponse]()], error) GET/accounts/{account\_id}/gateway/certificates ##### [Get Zero Trust certificate details](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/certificates/methods/get) client.ZeroTrust.Gateway.Certificates.Get(ctx, certificateID, query) (\*[GatewayCertificateGetResponse](), error) GET/accounts/{account\_id}/gateway/certificates/{certificate\_id} ##### [Create Zero Trust certificate](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/certificates/methods/create) client.ZeroTrust.Gateway.Certificates.New(ctx, params) (\*[GatewayCertificateNewResponse](), error) POST/accounts/{account\_id}/gateway/certificates ##### [Delete Zero Trust certificate](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/certificates/methods/delete) client.ZeroTrust.Gateway.Certificates.Delete(ctx, certificateID, body) (\*[GatewayCertificateDeleteResponse](), error) DELETE/accounts/{account\_id}/gateway/certificates/{certificate\_id} ##### [Activate a Zero Trust certificate](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/certificates/methods/activate) client.ZeroTrust.Gateway.Certificates.Activate(ctx, certificateID, body) (\*[GatewayCertificateActivateResponse](), error) POST/accounts/{account\_id}/gateway/certificates/{certificate\_id}/activate ##### [Deactivate a Zero Trust certificate](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/certificates/methods/deactivate) client.ZeroTrust.Gateway.Certificates.Deactivate(ctx, certificateID, body) (\*[GatewayCertificateDeactivateResponse](), error) POST/accounts/{account\_id}/gateway/certificates/{certificate\_id}/deactivate #### GatewayPacfiles ##### [List PAC files](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/list) client.ZeroTrust.Gateway.Pacfiles.List(ctx, params) (\*V4PagePaginationArray\[[GatewayPacfileListResponse]()], error) GET/accounts/{account\_id}/gateway/pacfiles ##### [Get a PAC file](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/get) client.ZeroTrust.Gateway.Pacfiles.Get(ctx, pacfileID, query) (\*[GatewayPacfileGetResponse](), error) GET/accounts/{account\_id}/gateway/pacfiles/{pacfile\_id} ##### [Create a PAC file](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/create) client.ZeroTrust.Gateway.Pacfiles.New(ctx, params) (\*[GatewayPacfileNewResponse](), error) POST/accounts/{account\_id}/gateway/pacfiles ##### [Update a Zero Trust Gateway PAC file](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/update) client.ZeroTrust.Gateway.Pacfiles.Update(ctx, pacfileID, params) (\*[GatewayPacfileUpdateResponse](), error) PUT/accounts/{account\_id}/gateway/pacfiles/{pacfile\_id} ##### [Delete a PAC file](https://developers.cloudflare.com/api/go/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/delete) client.ZeroTrust.Gateway.Pacfiles.Delete(ctx, pacfileID, body) (\*[GatewayPacfileDeleteResponse](), error) DELETE/accounts/{account\_id}/gateway/pacfiles/{pacfile\_id}