--- title: Zero Trust --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Zero Trust #### Zero TrustDevices ##### [List devices (deprecated)](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/methods/list) Deprecated zero\_trust.devices.list(DeviceListParams\*\*kwargs) -> SyncSinglePage\[[Device]()] GET/accounts/{account\_id}/devices ##### [Get device (deprecated)](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/methods/get) Deprecated zero\_trust.devices.get(strdevice\_id, DeviceGetParams\*\*kwargs) -> [DeviceGetResponse]() GET/accounts/{account\_id}/devices/{device\_id} ##### ModelsExpand Collapse
class Device: … id: Optional\[str] Registration ID. Equal to Device ID except for accounts which enabled multi-user mode. maxLength36 Link to this property created: Optional\[datetime] When the device was created. formatdate-time Link to this property deleted: Optional\[bool] True if the device was deleted. Link to this property
device\_type: Optional\[Literal\["windows", "mac", "linux", 3 more]] One of the following: "windows" Link to this property "mac" Link to this property "linux" Link to this property "android" Link to this property "ios" Link to this property "chromeos" Link to this property
Link to this property ip: Optional\[str] IPv4 or IPv6 address. Link to this property key: Optional\[str] The device’s public key. Link to this property last\_seen: Optional\[datetime] When the device last connected to Cloudflare services. formatdate-time Link to this property mac\_address: Optional\[str] The device mac address. Link to this property manufacturer: Optional\[str] The device manufacturer name. Link to this property model: Optional\[str] The device model name. Link to this property name: Optional\[str] The device name. Link to this property os\_distro\_name: Optional\[str] The Linux distro name. Link to this property os\_distro\_revision: Optional\[str] The Linux distro revision. Link to this property os\_version: Optional\[str] The operating system version. Link to this property os\_version\_extra: Optional\[str] Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. Link to this property revoked\_at: Optional\[datetime] When the device was revoked. formatdate-time Link to this property serial\_number: Optional\[str] The device serial number. Link to this property updated: Optional\[datetime] When the device was updated. formatdate-time Link to this property
user: Optional\[User] id: Optional\[str] UUID. maxLength36 Link to this property email: Optional\[str] The contact email address of the user. maxLength90 Link to this property name: Optional\[str] The enrolled device user’s name. Link to this property
Link to this property version: Optional\[str] The WARP client version. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices%20%3E%20(model)%20device%20%3E%20(schema)>)
class DeviceGetResponse: … id: Optional\[str] Registration ID. Equal to Device ID except for accounts which enabled multi-user mode. maxLength36 Link to this property
account: Optional\[Account] Deprecatedid: Optional\[str] Link to this property Deprecatedaccount\_type: Optional\[str] Link to this property name: Optional\[str] The name of the enrolled account. Link to this property
Link to this property created: Optional\[datetime] When the device was created. formatdate-time Link to this property deleted: Optional\[bool] True if the device was deleted. Link to this property device\_type: Optional\[str] Link to this property Deprecatedgateway\_device\_id: Optional\[str] Link to this property ip: Optional\[str] IPv4 or IPv6 address. Link to this property key: Optional\[str] The device’s public key. Link to this property key\_type: Optional\[str] Type of the key. Link to this property last\_seen: Optional\[datetime] When the device last connected to Cloudflare services. formatdate-time Link to this property mac\_address: Optional\[str] The device mac address. Link to this property model: Optional\[str] The device model name. Link to this property name: Optional\[str] The device name. Link to this property os\_version: Optional\[str] The operating system version. Link to this property serial\_number: Optional\[str] The device serial number. Link to this property tunnel\_type: Optional\[str] Type of the tunnel connection used. Link to this property updated: Optional\[datetime] When the device was updated. formatdate-time Link to this property
user: Optional\[User] id: Optional\[str] UUID. maxLength36 Link to this property email: Optional\[str] The contact email address of the user. maxLength90 Link to this property name: Optional\[str] The enrolled device user’s name. Link to this property
Link to this property version: Optional\[str] The WARP client version. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices%20%3E%20(model)%20device_get_response%20%3E%20(schema)>) #### Zero TrustDevicesDevices ##### [List devices](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/devices/methods/list) zero\_trust.devices.devices.list(DeviceListParams\*\*kwargs) -> SyncCursorPagination\[[DeviceListResponse]()] GET/accounts/{account\_id}/devices/physical-devices ##### [Get device](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/devices/methods/get) zero\_trust.devices.devices.get(strdevice\_id, DeviceGetParams\*\*kwargs) -> [DeviceGetResponse]() GET/accounts/{account\_id}/devices/physical-devices/{device\_id} ##### [Delete device](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/devices/methods/delete) zero\_trust.devices.devices.delete(strdevice\_id, DeviceDeleteParams\*\*kwargs) -> object DELETE/accounts/{account\_id}/devices/physical-devices/{device\_id} ##### [Revoke device registrations](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/devices/methods/revoke) Deprecated zero\_trust.devices.devices.revoke(strdevice\_id, DeviceRevokeParams\*\*kwargs) -> object POST/accounts/{account\_id}/devices/physical-devices/{device\_id}/revoke ##### ModelsExpand Collapse
class DeviceListResponse: … A WARP Device. id: str The unique ID of the device. Link to this property active\_registrations: int The number of active registrations for the device. Active registrations are those which haven’t been revoked or deleted. Link to this property created\_at: str The RFC3339 timestamp when the device was created. Link to this property last\_seen\_at: Optional\[str] The RFC3339 timestamp when the device was last seen. Link to this property name: str The name of the device. Link to this property tags: Dict\[str, str] Tags assigned to the device. An empty object if the device has no tags. Link to this property updated\_at: str The RFC3339 timestamp when the device was last updated. Link to this property client\_version: Optional\[str] Version of the WARP client. Link to this property deleted\_at: Optional\[str] The RFC3339 timestamp when the device was deleted. Link to this property device\_type: Optional\[str] The device operating system. Link to this property hardware\_id: Optional\[str] A string that uniquely identifies the hardware or virtual machine (VM). Link to this property
last\_seen\_registration: Optional\[LastSeenRegistration] The last seen registration for the device.
policy: Optional\[LastSeenRegistrationPolicy] A summary of the device profile evaluated for the registration. id: str The ID of the device settings profile. Link to this property default: bool Whether the device settings profile is the default profile for the account. Link to this property deleted: bool Whether the device settings profile was deleted. Link to this property name: str The name of the device settings profile. Link to this property updated\_at: str The RFC3339 timestamp of when the device settings profile last changed for the registration. Link to this property
Link to this property
Link to this property
last\_seen\_user: Optional\[LastSeenUser] The last user to use the WARP device. id: Optional\[str] UUID. maxLength36 Link to this property email: Optional\[str] The contact email address of the user. maxLength90 Link to this property name: Optional\[str] The enrolled device user’s name. Link to this property
Link to this property mac\_address: Optional\[str] The device MAC address. Link to this property manufacturer: Optional\[str] The device manufacturer. Link to this property model: Optional\[str] The model name of the device. Link to this property os\_version: Optional\[str] The device operating system version number. Link to this property os\_version\_extra: Optional\[str] Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. Link to this property Deprecatedpublic\_ip: Optional\[str] **Deprecated**: IP information is provided by DEX - see https://developers.cloudflare.com/api/resources/zero\_trust/subresources/dex/subresources/fleet\_status/subresources/devices/methods/list/ Link to this property serial\_number: Optional\[str] The device serial number. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.devices%20%3E%20(model)%20device_list_response%20%3E%20(schema)>)
class DeviceGetResponse: … A WARP Device. id: str The unique ID of the device. Link to this property active\_registrations: int The number of active registrations for the device. Active registrations are those which haven’t been revoked or deleted. Link to this property created\_at: str The RFC3339 timestamp when the device was created. Link to this property last\_seen\_at: Optional\[str] The RFC3339 timestamp when the device was last seen. Link to this property name: str The name of the device. Link to this property tags: Dict\[str, str] Tags assigned to the device. An empty object if the device has no tags. Link to this property updated\_at: str The RFC3339 timestamp when the device was last updated. Link to this property client\_version: Optional\[str] Version of the WARP client. Link to this property deleted\_at: Optional\[str] The RFC3339 timestamp when the device was deleted. Link to this property device\_type: Optional\[str] The device operating system. Link to this property hardware\_id: Optional\[str] A string that uniquely identifies the hardware or virtual machine (VM). Link to this property
last\_seen\_registration: Optional\[LastSeenRegistration] The last seen registration for the device.
policy: Optional\[LastSeenRegistrationPolicy] A summary of the device profile evaluated for the registration. id: str The ID of the device settings profile. Link to this property default: bool Whether the device settings profile is the default profile for the account. Link to this property deleted: bool Whether the device settings profile was deleted. Link to this property name: str The name of the device settings profile. Link to this property updated\_at: str The RFC3339 timestamp of when the device settings profile last changed for the registration. Link to this property
Link to this property
Link to this property
last\_seen\_user: Optional\[LastSeenUser] The last user to use the WARP device. id: Optional\[str] UUID. maxLength36 Link to this property email: Optional\[str] The contact email address of the user. maxLength90 Link to this property name: Optional\[str] The enrolled device user’s name. Link to this property
Link to this property mac\_address: Optional\[str] The device MAC address. Link to this property manufacturer: Optional\[str] The device manufacturer. Link to this property model: Optional\[str] The model name of the device. Link to this property os\_version: Optional\[str] The device operating system version number. Link to this property os\_version\_extra: Optional\[str] Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. Link to this property Deprecatedpublic\_ip: Optional\[str] **Deprecated**: IP information is provided by DEX - see https://developers.cloudflare.com/api/resources/zero\_trust/subresources/dex/subresources/fleet\_status/subresources/devices/methods/list/ Link to this property serial\_number: Optional\[str] The device serial number. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.devices%20%3E%20(model)%20device_get_response%20%3E%20(schema)>) #### Zero TrustDevicesResilience #### Zero TrustDevicesResilienceGlobal WARP Override ##### [Get Global Disconnect](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/resilience/subresources/global_warp_override/methods/get) zero\_trust.devices.resilience.global\_warp\_override.get(GlobalWARPOverrideGetParams\*\*kwargs) -> [GlobalWARPOverrideGetResponse]() GET/accounts/{account\_id}/devices/resilience/disconnect ##### [Set Global Disconnect](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/resilience/subresources/global_warp_override/methods/create) zero\_trust.devices.resilience.global\_warp\_override.create(GlobalWARPOverrideCreateParams\*\*kwargs) -> [GlobalWARPOverrideCreateResponse]() POST/accounts/{account\_id}/devices/resilience/disconnect ##### ModelsExpand Collapse
class GlobalWARPOverrideGetResponse: … disconnect: Optional\[bool] Disconnects all devices on the account using Global WARP override. Link to this property timestamp: Optional\[datetime] When the Global WARP override state was updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.resilience.global_warp_override%20%3E%20(model)%20global_warp_override_get_response%20%3E%20(schema)>)
class GlobalWARPOverrideCreateResponse: … disconnect: Optional\[bool] Disconnects all devices on the account using Global WARP override. Link to this property timestamp: Optional\[datetime] When the Global WARP override state was updated. formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.resilience.global_warp_override%20%3E%20(model)%20global_warp_override_create_response%20%3E%20(schema)>) #### Zero TrustDevicesRegistrations ##### [List registrations](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/registrations/methods/list) zero\_trust.devices.registrations.list(RegistrationListParams\*\*kwargs) -> SyncCursorPagination\[[RegistrationListResponse]()] GET/accounts/{account\_id}/devices/registrations ##### [Get registration](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/registrations/methods/get) zero\_trust.devices.registrations.get(strregistration\_id, RegistrationGetParams\*\*kwargs) -> [RegistrationGetResponse]() GET/accounts/{account\_id}/devices/registrations/{registration\_id} ##### [Delete registration](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/registrations/methods/delete) zero\_trust.devices.registrations.delete(strregistration\_id, RegistrationDeleteParams\*\*kwargs) -> object DELETE/accounts/{account\_id}/devices/registrations/{registration\_id} ##### [Delete registrations](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/registrations/methods/bulk_delete) zero\_trust.devices.registrations.bulk\_delete(RegistrationBulkDeleteParams\*\*kwargs) -> object DELETE/accounts/{account\_id}/devices/registrations ##### [Revoke registrations](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/registrations/methods/revoke) Deprecated zero\_trust.devices.registrations.revoke(RegistrationRevokeParams\*\*kwargs) -> object POST/accounts/{account\_id}/devices/registrations/revoke ##### [Unrevoke registrations](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/registrations/methods/unrevoke) Deprecated zero\_trust.devices.registrations.unrevoke(RegistrationUnrevokeParams\*\*kwargs) -> object POST/accounts/{account\_id}/devices/registrations/unrevoke ##### ModelsExpand Collapse
class RegistrationListResponse: … A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device. id: str The ID of the registration. Link to this property created\_at: str The RFC3339 timestamp when the registration was created. Link to this property
device: Device Device details embedded inside of a registration. id: str The ID of the device. Link to this property name: str The name of the device. Link to this property client\_version: Optional\[str] Version of the WARP client. Link to this property
Link to this property key: str The public key used to connect to the Cloudflare network. Link to this property last\_seen\_at: str The RFC3339 timestamp when the registration was last seen. Link to this property
registration\_type: Literal\["warp", "browser\_extension"] The registration client type, derived from device\_type. One of the following: "warp" Link to this property "browser\_extension" Link to this property
Link to this property updated\_at: str The RFC3339 timestamp when the registration was last updated. Link to this property deleted\_at: Optional\[str] The RFC3339 timestamp when the registration was deleted. Link to this property key\_type: Optional\[str] The type of encryption key used by the WARP client for the active key. Currently ‘curve25519’ for WireGuard and ‘secp256r1’ for MASQUE. Link to this property
policy: Optional\[Policy] The device settings profile assigned to this registration. id: str The ID of the device settings profile. Link to this property default: bool Whether the device settings profile is the default profile for the account. Link to this property deleted: bool Whether the device settings profile was deleted. Link to this property name: str The name of the device settings profile. Link to this property updated\_at: str The RFC3339 timestamp of when the device settings profile last changed for the registration. Link to this property
Link to this property revoked\_at: Optional\[str] The RFC3339 timestamp when the registration was revoked. Link to this property tunnel\_type: Optional\[str] Type of the tunnel - wireguard or masque. Link to this property
user: Optional\[User] id: Optional\[str] UUID. maxLength36 Link to this property email: Optional\[str] The contact email address of the user. maxLength90 Link to this property name: Optional\[str] The enrolled device user’s name. Link to this property
Link to this property virtual\_ipv4: Optional\[str] The virtual IPv4 address assigned to the network interface of the tunnel for this registration. Link to this property virtual\_ipv6: Optional\[str] The virtual IPv6 address assigned to the network interface of the tunnel for this registration. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.registrations%20%3E%20(model)%20registration_list_response%20%3E%20(schema)>)
class RegistrationGetResponse: … A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device. id: str The ID of the registration. Link to this property created\_at: str The RFC3339 timestamp when the registration was created. Link to this property
device: Device Device details embedded inside of a registration. id: str The ID of the device. Link to this property name: str The name of the device. Link to this property client\_version: Optional\[str] Version of the WARP client. Link to this property
Link to this property key: str The public key used to connect to the Cloudflare network. Link to this property last\_seen\_at: str The RFC3339 timestamp when the registration was last seen. Link to this property
registration\_type: Literal\["warp", "browser\_extension"] The registration client type, derived from device\_type. One of the following: "warp" Link to this property "browser\_extension" Link to this property
Link to this property updated\_at: str The RFC3339 timestamp when the registration was last updated. Link to this property deleted\_at: Optional\[str] The RFC3339 timestamp when the registration was deleted. Link to this property key\_type: Optional\[str] The type of encryption key used by the WARP client for the active key. Currently ‘curve25519’ for WireGuard and ‘secp256r1’ for MASQUE. Link to this property
policy: Optional\[Policy] The device settings profile assigned to this registration. id: str The ID of the device settings profile. Link to this property default: bool Whether the device settings profile is the default profile for the account. Link to this property deleted: bool Whether the device settings profile was deleted. Link to this property name: str The name of the device settings profile. Link to this property updated\_at: str The RFC3339 timestamp of when the device settings profile last changed for the registration. Link to this property
Link to this property revoked\_at: Optional\[str] The RFC3339 timestamp when the registration was revoked. Link to this property tunnel\_type: Optional\[str] Type of the tunnel - wireguard or masque. Link to this property
user: Optional\[User] id: Optional\[str] UUID. maxLength36 Link to this property email: Optional\[str] The contact email address of the user. maxLength90 Link to this property name: Optional\[str] The enrolled device user’s name. Link to this property
Link to this property virtual\_ipv4: Optional\[str] The virtual IPv4 address assigned to the network interface of the tunnel for this registration. Link to this property virtual\_ipv6: Optional\[str] The virtual IPv6 address assigned to the network interface of the tunnel for this registration. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.registrations%20%3E%20(model)%20registration_get_response%20%3E%20(schema)>) #### Zero TrustDevicesDEX Tests ##### [List Device DEX tests](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/list) zero\_trust.devices.dex\_tests.list(DEXTestListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[SchemaHTTP]()] GET/accounts/{account\_id}/dex/devices/dex\_tests ##### [Get Device DEX test](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/get) zero\_trust.devices.dex\_tests.get(strdex\_test\_id, DEXTestGetParams\*\*kwargs) -> [SchemaHTTP]() GET/accounts/{account\_id}/dex/devices/dex\_tests/{dex\_test\_id} ##### [Create Device DEX test](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/create) zero\_trust.devices.dex\_tests.create(DEXTestCreateParams\*\*kwargs) -> [SchemaHTTP]() POST/accounts/{account\_id}/dex/devices/dex\_tests ##### [Update Device DEX test](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/update) zero\_trust.devices.dex\_tests.update(strdex\_test\_id, DEXTestUpdateParams\*\*kwargs) -> [SchemaHTTP]() PUT/accounts/{account\_id}/dex/devices/dex\_tests/{dex\_test\_id} ##### [Delete Device DEX test](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/delete) zero\_trust.devices.dex\_tests.delete(strdex\_test\_id, DEXTestDeleteParams\*\*kwargs) -> [DEXTestDeleteResponse]() DELETE/accounts/{account\_id}/dex/devices/dex\_tests/{dex\_test\_id} ##### ModelsExpand Collapse
class SchemaData: … The configuration object which contains the details for the WARP client to conduct the test. host: str The desired endpoint to test. Link to this property
kind: Literal\["http", "traceroute"] The type of test. One of the following: "http" Link to this property "traceroute" Link to this property
Link to this property method: Optional\[Literal\["GET"]] The HTTP request method type. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.dex_tests%20%3E%20(model)%20schema_data%20%3E%20(schema)>)
class SchemaHTTP: … data: SchemaData The configuration object which contains the details for the WARP client to conduct the test. Link to this property enabled: bool Determines whether or not the test is active. Link to this property interval: str How often the test will run. Link to this property name: str The name of the DEX test. Must be unique. Link to this property created: Optional\[datetime] Date the test was created, in RFC 3339 format. formatdate-time Link to this property description: Optional\[str] Additional details about the test. Link to this property
target\_policies: Optional\[List\[TargetPolicy]] DEX rules targeted by this test id: str The id of the DEX rule. maxLength36 Link to this property default: Optional\[bool] Whether the DEX rule is the account default. Link to this property name: Optional\[str] The name of the DEX rule. Link to this property
Link to this property targeted: Optional\[bool] Link to this property test\_id: Optional\[str] The unique identifier for the test. maxLength32 Link to this property updated: Optional\[datetime] Date the test was last updated, in RFC 3339 format. formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.dex_tests%20%3E%20(model)%20schema_http%20%3E%20(schema)>)
class DEXTestDeleteResponse: …
dex\_tests: Optional\[List\[SchemaHTTP]] data: SchemaData The configuration object which contains the details for the WARP client to conduct the test. Link to this property enabled: bool Determines whether or not the test is active. Link to this property interval: str How often the test will run. Link to this property name: str The name of the DEX test. Must be unique. Link to this property created: Optional\[datetime] Date the test was created, in RFC 3339 format. formatdate-time Link to this property description: Optional\[str] Additional details about the test. Link to this property
target\_policies: Optional\[List\[TargetPolicy]] DEX rules targeted by this test id: str The id of the DEX rule. maxLength36 Link to this property default: Optional\[bool] Whether the DEX rule is the account default. Link to this property name: Optional\[str] The name of the DEX rule. Link to this property
Link to this property targeted: Optional\[bool] Link to this property test\_id: Optional\[str] The unique identifier for the test. maxLength32 Link to this property updated: Optional\[datetime] Date the test was last updated, in RFC 3339 format. formatdate-time Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.dex_tests%20%3E%20(model)%20dex_test_delete_response%20%3E%20(schema)>) #### Zero TrustDevicesIP Profiles ##### [List IP profiles](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/list) zero\_trust.devices.ip\_profiles.list(IPProfileListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[IPProfile]()] GET/accounts/{account\_id}/devices/ip-profiles ##### [Get IP profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/get) zero\_trust.devices.ip\_profiles.get(strprofile\_id, IPProfileGetParams\*\*kwargs) -> [IPProfile]() GET/accounts/{account\_id}/devices/ip-profiles/{profile\_id} ##### [Create IP profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/create) zero\_trust.devices.ip\_profiles.create(IPProfileCreateParams\*\*kwargs) -> [IPProfile]() POST/accounts/{account\_id}/devices/ip-profiles ##### [Update IP profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/update) zero\_trust.devices.ip\_profiles.update(strprofile\_id, IPProfileUpdateParams\*\*kwargs) -> [IPProfile]() PATCH/accounts/{account\_id}/devices/ip-profiles/{profile\_id} ##### [Delete IP profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/delete) zero\_trust.devices.ip\_profiles.delete(strprofile\_id, IPProfileDeleteParams\*\*kwargs) -> [IPProfileDeleteResponse]() DELETE/accounts/{account\_id}/devices/ip-profiles/{profile\_id} ##### ModelsExpand Collapse
class IPProfile: … id: str The ID of the Device IP profile. Link to this property created\_at: str The RFC3339Nano timestamp when the Device IP profile was created. Link to this property description: Optional\[str] An optional description of the Device IP profile. Link to this property enabled: bool Whether the Device IP profile is enabled. Link to this property match: str The wirefilter expression to match registrations. Available values: “identity.name”, “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.saml\_attributes”. maxLength10000 Link to this property name: str A user-friendly name for the Device IP profile. Link to this property precedence: int The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field. Link to this property subnet\_id: str The ID of the Subnet. Link to this property updated\_at: str The RFC3339Nano timestamp when the Device IP profile was last updated. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.ip_profiles%20%3E%20(model)%20ip_profile%20%3E%20(schema)>)
class IPProfileDeleteResponse: … id: Optional\[str] ID of the deleted Device IP profile. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.ip_profiles%20%3E%20(model)%20ip_profile_delete_response%20%3E%20(schema)>) #### Zero TrustDevicesDeployment Groups ##### [List deployment groups](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/list) zero\_trust.devices.deployment\_groups.list(DeploymentGroupListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[DeploymentGroup]()] GET/accounts/{account\_id}/devices/deployment-groups ##### [Get deployment group](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/get) zero\_trust.devices.deployment\_groups.get(strgroup\_id, DeploymentGroupGetParams\*\*kwargs) -> [DeploymentGroup]() GET/accounts/{account\_id}/devices/deployment-groups/{group\_id} ##### [Create deployment group](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/create) zero\_trust.devices.deployment\_groups.create(DeploymentGroupCreateParams\*\*kwargs) -> [DeploymentGroup]() POST/accounts/{account\_id}/devices/deployment-groups ##### [Update deployment group](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/edit) zero\_trust.devices.deployment\_groups.edit(strgroup\_id, DeploymentGroupEditParams\*\*kwargs) -> [DeploymentGroup]() PATCH/accounts/{account\_id}/devices/deployment-groups/{group\_id} ##### [Delete deployment group](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/delete) zero\_trust.devices.deployment\_groups.delete(strgroup\_id, DeploymentGroupDeleteParams\*\*kwargs) -> [DeploymentGroupDeleteResponse]() DELETE/accounts/{account\_id}/devices/deployment-groups/{group\_id} ##### ModelsExpand Collapse
class DeploymentGroup: … id: str The ID of the deployment group. Link to this property created\_at: str The RFC3339Nano timestamp when the deployment group was created. Link to this property name: str A user-friendly name for the deployment group. maxLength255 minLength1 Link to this property updated\_at: str The RFC3339Nano timestamp when the deployment group was last updated. Link to this property
version\_config: List\[VersionConfig] Contains version configurations for different target environments. target\_environment: Optional\[str] The target environment for the client version (e.g., windows, macos). Link to this property version: str The specific client version to deploy. Link to this property
Link to this property policy\_ids: Optional\[List\[str]] Contains a list of policy IDs assigned to this deployment group. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.deployment_groups%20%3E%20(model)%20deployment_group%20%3E%20(schema)>)
class DeploymentGroupDeleteResponse: … id: Optional\[str] The ID of a deleted deployment group. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.deployment_groups%20%3E%20(model)%20deployment_group_delete_response%20%3E%20(schema)>) #### Zero TrustDevicesNetworks ##### [List your device managed networks](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/networks/methods/list) zero\_trust.devices.networks.list(NetworkListParams\*\*kwargs) -> SyncSinglePage\[[DeviceNetwork]()] GET/accounts/{account\_id}/devices/networks ##### [Get device managed network details](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/networks/methods/get) zero\_trust.devices.networks.get(strnetwork\_id, NetworkGetParams\*\*kwargs) -> [DeviceNetwork]() GET/accounts/{account\_id}/devices/networks/{network\_id} ##### [Create a device managed network](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/networks/methods/create) zero\_trust.devices.networks.create(NetworkCreateParams\*\*kwargs) -> [DeviceNetwork]() POST/accounts/{account\_id}/devices/networks ##### [Update a device managed network](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/networks/methods/update) zero\_trust.devices.networks.update(strnetwork\_id, NetworkUpdateParams\*\*kwargs) -> [DeviceNetwork]() PUT/accounts/{account\_id}/devices/networks/{network\_id} ##### [Delete a device managed network](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/networks/methods/delete) zero\_trust.devices.networks.delete(strnetwork\_id, NetworkDeleteParams\*\*kwargs) -> SyncSinglePage\[[DeviceNetwork]()] DELETE/accounts/{account\_id}/devices/networks/{network\_id} ##### ModelsExpand Collapse
class DeviceNetwork: …
config: Optional\[Config] The configuration object containing information for the WARP client to detect the managed network. tls\_sockaddr: str A network address of the form “host:port” that the WARP client will use to detect the presence of a TLS host. Link to this property sha256: Optional\[str] The SHA-256 hash of the TLS certificate presented by the host found at tls\_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate. Link to this property
Link to this property name: Optional\[str] The name of the device managed network. This name must be unique. Link to this property network\_id: Optional\[str] API UUID. maxLength36 Link to this property type: Optional\[Literal\["tls"]] The type of device managed network. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.networks%20%3E%20(model)%20device_network%20%3E%20(schema)>) #### Zero TrustDevicesFleet Status ##### [Get the latest status of a device.](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/fleet_status/methods/get) zero\_trust.devices.fleet\_status.get(strdevice\_id, FleetStatusGetParams\*\*kwargs) -> [FleetStatusGetResponse]() GET/accounts/{account\_id}/dex/devices/{device\_id}/fleet-status/live ##### ModelsExpand Collapse
class FleetStatusGetResponse: … colo: str Cloudflare colo airport code. Link to this property device\_id: str Device identifier (UUID v4) Link to this property mode: str The mode under which the WARP client is run. Link to this property platform: str Operating system. Link to this property status: str Network status. Link to this property timestamp: str Link to this property version: str WARP client version. Link to this property always\_on: Optional\[bool] Link to this property battery\_charging: Optional\[bool] Link to this property battery\_cycles: Optional\[int] formatint64 Link to this property battery\_pct: Optional\[float] formatfloat Link to this property connection\_type: Optional\[str] Link to this property cpu\_pct: Optional\[float] formatfloat Link to this property
cpu\_pct\_by\_app: Optional\[List\[CPUPctByApp]] cpu\_pct: Optional\[float] CPU usage percentage, on a scale of 0 to 100. formatfloat maximum100 minimum0 Link to this property name: Optional\[str] Application name. Link to this property
Link to this property
device\_ipv4: Optional\[DeviceIPV4] address: Optional\[str] Link to this property asn: Optional\[int] Link to this property aso: Optional\[str] Link to this property
location: Optional\[DeviceIPV4Location] city: Optional\[str] Link to this property country\_iso: Optional\[str] Link to this property state\_iso: Optional\[str] Link to this property zip: Optional\[str] Link to this property
Link to this property name: Optional\[str] Link to this property netmask: Optional\[str] Link to this property version: Optional\[int] IP version (1 for IPv4, 2 for IPv6, 0 if unknown). Link to this property
Link to this property
device\_ipv6: Optional\[DeviceIPV6] address: Optional\[str] Link to this property asn: Optional\[int] Link to this property aso: Optional\[str] Link to this property
location: Optional\[DeviceIPV6Location] city: Optional\[str] Link to this property country\_iso: Optional\[str] Link to this property state\_iso: Optional\[str] Link to this property zip: Optional\[str] Link to this property
Link to this property name: Optional\[str] Link to this property netmask: Optional\[str] Link to this property version: Optional\[int] IP version (1 for IPv4, 2 for IPv6, 0 if unknown). Link to this property
Link to this property device\_name: Optional\[str] Device identifier (human readable). Link to this property Deprecateddevice\_registration: Optional\[str] Use registrationId instead. Deprecated: use registrationId. Device registration identifier (UUID). Link to this property disk\_read\_bps: Optional\[int] formatint64 Link to this property disk\_usage\_pct: Optional\[float] formatfloat Link to this property disk\_write\_bps: Optional\[int] formatint64 Link to this property doh\_subdomain: Optional\[str] Link to this property estimated\_loss\_pct: Optional\[float] formatfloat Link to this property firewall\_enabled: Optional\[bool] Link to this property
gateway\_ipv4: Optional\[GatewayIPV4] address: Optional\[str] Link to this property asn: Optional\[int] Link to this property aso: Optional\[str] Link to this property
location: Optional\[GatewayIPV4Location] city: Optional\[str] Link to this property country\_iso: Optional\[str] Link to this property state\_iso: Optional\[str] Link to this property zip: Optional\[str] Link to this property
Link to this property name: Optional\[str] Link to this property netmask: Optional\[str] Link to this property version: Optional\[int] IP version (1 for IPv4, 2 for IPv6, 0 if unknown). Link to this property
Link to this property
gateway\_ipv6: Optional\[GatewayIPV6] address: Optional\[str] Link to this property asn: Optional\[int] Link to this property aso: Optional\[str] Link to this property
location: Optional\[GatewayIPV6Location] city: Optional\[str] Link to this property country\_iso: Optional\[str] Link to this property state\_iso: Optional\[str] Link to this property zip: Optional\[str] Link to this property
Link to this property name: Optional\[str] Link to this property netmask: Optional\[str] Link to this property version: Optional\[int] IP version (1 for IPv4, 2 for IPv6, 0 if unknown). Link to this property
Link to this property handshake\_latency\_ms: Optional\[float] formatint64 Link to this property
isp\_ipv4: Optional\[ISPIPV4] address: Optional\[str] Link to this property asn: Optional\[int] Link to this property aso: Optional\[str] Link to this property
location: Optional\[ISPIPV4Location] city: Optional\[str] Link to this property country\_iso: Optional\[str] Link to this property state\_iso: Optional\[str] Link to this property zip: Optional\[str] Link to this property
Link to this property name: Optional\[str] Link to this property netmask: Optional\[str] Link to this property version: Optional\[int] IP version (1 for IPv4, 2 for IPv6, 0 if unknown). Link to this property
Link to this property
isp\_ipv6: Optional\[ISPIPV6] address: Optional\[str] Link to this property asn: Optional\[int] Link to this property aso: Optional\[str] Link to this property
location: Optional\[ISPIPV6Location] city: Optional\[str] Link to this property country\_iso: Optional\[str] Link to this property state\_iso: Optional\[str] Link to this property zip: Optional\[str] Link to this property
Link to this property name: Optional\[str] Link to this property netmask: Optional\[str] Link to this property version: Optional\[int] IP version (1 for IPv4, 2 for IPv6, 0 if unknown). Link to this property
Link to this property metal: Optional\[str] Link to this property network\_rcvd\_bps: Optional\[int] formatint64 Link to this property network\_sent\_bps: Optional\[int] formatint64 Link to this property network\_ssid: Optional\[str] Link to this property person\_email: Optional\[str] User contact email address Link to this property ram\_available\_kb: Optional\[int] formatint64 Link to this property ram\_used\_pct: Optional\[float] formatfloat Link to this property
ram\_used\_pct\_by\_app: Optional\[List\[RamUsedPctByApp]] name: Optional\[str] Application name. Link to this property ram\_used\_pct: Optional\[float] RAM usage percentage, on a scale of 0 to 100. formatfloat maximum100 minimum0 Link to this property
Link to this property registration\_id: Optional\[str] Device registration identifier (UUID v4). On multi-user devices, this uniquely identifies a user’s registration on the device. Link to this property
rtt: Optional\[RTT] Round-trip time statistics for the WARP tunnel.
min\_rtt\_us: Optional\[RTTMinRTTUs] Minimum round-trip time in microseconds. downstream: Optional\[int] Link to this property upstream: Optional\[int] Link to this property
Link to this property
rtt\_us: Optional\[RTTRTTUs] Round-trip time in microseconds. downstream: Optional\[int] Link to this property upstream: Optional\[int] Link to this property
Link to this property
rtt\_var\_us: Optional\[RTTRTTVarUs] Round-trip time variance in microseconds. downstream: Optional\[int] Link to this property upstream: Optional\[int] Link to this property
Link to this property
Link to this property switch\_locked: Optional\[bool] Link to this property
tunnel\_stats: Optional\[TunnelStats] WARP tunnel packet and byte counters.
bytes\_lost: Optional\[TunnelStatsBytesLost] Number of bytes lost, split by direction. downstream: Optional\[int] Link to this property upstream: Optional\[int] Link to this property
Link to this property
bytes\_received: Optional\[TunnelStatsBytesReceived] Number of bytes received, split by direction. downstream: Optional\[int] Link to this property upstream: Optional\[int] Link to this property
Link to this property
bytes\_retransmitted: Optional\[TunnelStatsBytesRetransmitted] Number of bytes retransmitted, split by direction. downstream: Optional\[int] Link to this property upstream: Optional\[int] Link to this property
Link to this property
bytes\_sent: Optional\[TunnelStatsBytesSent] Number of bytes sent, split by direction. downstream: Optional\[int] Link to this property upstream: Optional\[int] Link to this property
Link to this property
packets\_lost: Optional\[TunnelStatsPacketsLost] Number of packets lost, split by direction. downstream: Optional\[int] Link to this property upstream: Optional\[int] Link to this property
Link to this property
packets\_received: Optional\[TunnelStatsPacketsReceived] Number of packets received, split by direction. downstream: Optional\[int] Link to this property upstream: Optional\[int] Link to this property
Link to this property
packets\_retransmitted: Optional\[TunnelStatsPacketsRetransmitted] Number of packets retransmitted, split by direction. downstream: Optional\[int] Link to this property upstream: Optional\[int] Link to this property
Link to this property
packets\_sent: Optional\[TunnelStatsPacketsSent] Number of packets sent, split by direction. downstream: Optional\[int] Link to this property upstream: Optional\[int] Link to this property
Link to this property stats\_window\_ms: Optional\[int] The measurement window duration in milliseconds. Link to this property
Link to this property tunnel\_type: Optional\[str] Link to this property wifi\_strength\_dbm: Optional\[int] formatint64 Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.fleet_status%20%3E%20(model)%20fleet_status_get_response%20%3E%20(schema)>) #### Zero TrustDevicesPolicies ##### ModelsExpand Collapse
class DevicePolicyCertificates: … enabled: bool The current status of the device policy certificate provisioning feature for WARP clients. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20device_policy_certificates%20%3E%20(schema)>)
class FallbackDomain: … suffix: str The domain suffix to match when resolving locally. Link to this property description: Optional\[str] A description of the fallback domain, displayed in the client UI. maxLength100 Link to this property dns\_server: Optional\[List\[str]] A list of IP addresses to handle domain resolution. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20fallback_domain%20%3E%20(schema)>)
class SettingsPolicy: … allow\_mode\_switch: Optional\[bool] Whether to allow the user to switch WARP between modes. Link to this property allow\_updates: Optional\[bool] Whether to receive update notifications when a new version of the client is available. Link to this property allowed\_to\_leave: Optional\[bool] Whether to allow devices to leave the organization. Link to this property auto\_connect: Optional\[float] The amount of time in seconds to reconnect after having been disabled. Link to this property
browser\_extension\_config: Optional\[BrowserExtensionConfig] Browser extension proxy settings. Required when profile\_type is browser\_extension and invalid for WARP profiles.
proxy\_control: Literal\["unlocked", "locked"] Whether the user may disable the browser extension proxy. One of the following: "unlocked" Link to this property "locked" Link to this property
Link to this property proxy\_enabled: bool Whether the browser extension proxy is active. Link to this property
Link to this property captive\_portal: Optional\[float] Turn on the captive portal after the specified amount of time. Link to this property default: Optional\[bool] Whether the policy is the account default. WARP group profiles cannot set this field. Link to this property description: Optional\[str] A description of the policy. maxLength500 Link to this property disable\_auto\_fallback: Optional\[bool] If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true. Link to this property
dns\_search\_suffixes: Optional\[List\[DNSSearchSuffix]] List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear. suffix: str The DNS search suffix to append when resolving short hostnames. Link to this property description: Optional\[str] A description of the DNS search suffix. Link to this property
Link to this property enabled: Optional\[bool] Whether the policy will be applied to matching devices. Link to this property
exclude: Optional\[List\[SplitTunnelExclude]] List of routes excluded in the WARP client’s tunnel. One of the following:
class TeamsDevicesExcludeSplitTunnelWithAddress: … address: str The address in CIDR format to exclude from the tunnel. If address is present, host must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
class TeamsDevicesExcludeSplitTunnelWithHost: … host: str The domain name to exclude from the tunnel. If host is present, address must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
Link to this property exclude\_office\_ips: Optional\[bool] Whether to add Microsoft IPs to Split Tunnel exclusions. Link to this property
fallback\_domains: Optional\[List\[FallbackDomain]] suffix: str The domain suffix to match when resolving locally. Link to this property description: Optional\[str] A description of the fallback domain, displayed in the client UI. maxLength100 Link to this property dns\_server: Optional\[List\[str]] A list of IP addresses to handle domain resolution. Link to this property
Link to this property gateway\_unique\_id: Optional\[str] Link to this property
global\_acceleration: Optional\[GlobalAcceleration] Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/. api\_endpoints: List\[str] IP:port entries for the API endpoints. Link to this property enabled: bool Global acceleration settings are used only when “enabled”. Link to this property masque\_endpoints: List\[str] IP:port entries for the MASQUE tunnel endpoints. Either wireguard\_endpoints or masque\_endpoints must be provided. Link to this property wireguard\_endpoints: List\[str] IP:port entries for the WireGuard tunnel endpoints. Either wireguard\_endpoints or masque\_endpoints must be provided. Link to this property autoswitch: Optional\[bool] Automatically switch Global Acceleration regions based on device location. Defaults to false when not provided. Link to this property
Link to this property
include: Optional\[List\[SplitTunnelInclude]] List of routes included in the WARP client’s tunnel. One of the following:
class TeamsDevicesIncludeSplitTunnelWithAddress: … address: str The address in CIDR format to include in the tunnel. If address is present, host must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
class TeamsDevicesIncludeSplitTunnelWithHost: … host: str The domain name to include in the tunnel. If host is present, address must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
Link to this property lan\_allow\_minutes: Optional\[float] The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset. Link to this property lan\_allow\_subnet\_size: Optional\[float] The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset. Link to this property match: Optional\[str] The wirefilter expression to match devices. Available values: “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.service\_token\_uuid”, “identity.saml\_attributes”, “network”, “os.name”, “os.version”. maxLength500 Link to this property name: Optional\[str] The name of the device settings profile. maxLength100 Link to this property policy\_id: Optional\[str] maxLength36 Link to this property precedence: Optional\[float] The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field. Link to this property
profile\_type: Optional\[Literal\["warp", "browser\_extension"]] The client type to which the device settings profile applies. This field is set when the profile is created and cannot be changed. One of the following: "warp" Link to this property "browser\_extension" Link to this property
Link to this property register\_interface\_ip\_with\_dns: Optional\[bool] Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server. Link to this property sccm\_vpn\_boundary\_support: Optional\[bool] Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only). Link to this property
service\_mode\_v2: Optional\[ServiceModeV2] mode: Optional\[str] The mode to run the WARP client under. Link to this property port: Optional\[float] The port number when used with proxy mode. Link to this property
Link to this property support\_url: Optional\[str] The URL to launch when the Send Feedback button is clicked. Link to this property switch\_locked: Optional\[bool] Whether to allow the user to turn off the WARP switch and disconnect the client. Link to this property
Deprecatedtarget\_tests: Optional\[List\[TargetTest]] id: Optional\[str] The id of the DEX test targeting this policy. Link to this property name: Optional\[str] The name of the DEX test targeting this policy. Link to this property
Link to this property tunnel\_protocol: Optional\[str] Determines which tunnel protocol to use. Link to this property uninstall\_protection: Optional\[bool] Determines whether uninstalling the WARP client requires an override code. (Windows only). Link to this property
virtual\_networks: Optional\[VirtualNetworks] Virtual network access settings for the device. allowed: List\[str] List of virtual network IDs the device is allowed to access. When virtual\_networks is set, at least one entry is required. Link to this property default: str The default virtual network ID. Must be included in the allowed list. formatuuid Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20settings_policy%20%3E%20(schema)>)
SplitTunnelExclude One of the following:
class TeamsDevicesExcludeSplitTunnelWithAddress: … address: str The address in CIDR format to exclude from the tunnel. If address is present, host must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
class TeamsDevicesExcludeSplitTunnelWithHost: … host: str The domain name to exclude from the tunnel. If host is present, address must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20split_tunnel_exclude%20%3E%20(schema)>)
SplitTunnelInclude One of the following:
class TeamsDevicesIncludeSplitTunnelWithAddress: … address: str The address in CIDR format to include in the tunnel. If address is present, host must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
class TeamsDevicesIncludeSplitTunnelWithHost: … host: str The domain name to include in the tunnel. If host is present, address must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20split_tunnel_include%20%3E%20(schema)>) #### Zero TrustDevicesPoliciesDefault ##### [Get the default device settings profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/methods/get) zero\_trust.devices.policies.default.get(DefaultGetParams\*\*kwargs) -> [DefaultGetResponse]() GET/accounts/{account\_id}/devices/policy ##### [Update the default device settings profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/methods/edit) zero\_trust.devices.policies.default.edit(DefaultEditParams\*\*kwargs) -> [DefaultEditResponse]() PATCH/accounts/{account\_id}/devices/policy ##### ModelsExpand Collapse
class DefaultGetResponse: … allow\_mode\_switch: Optional\[bool] Whether to allow the user to switch WARP between modes. Link to this property allow\_updates: Optional\[bool] Whether to receive update notifications when a new version of the client is available. Link to this property allowed\_to\_leave: Optional\[bool] Whether to allow devices to leave the organization. Link to this property auto\_connect: Optional\[float] The amount of time in seconds to reconnect after having been disabled. Link to this property captive\_portal: Optional\[float] Turn on the captive portal after the specified amount of time. Link to this property default: Optional\[bool] Whether the policy will be applied to matching devices. Link to this property disable\_auto\_fallback: Optional\[bool] If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true. Link to this property
dns\_search\_suffixes: Optional\[List\[DNSSearchSuffix]] List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear. suffix: str The DNS search suffix to append when resolving short hostnames. Link to this property description: Optional\[str] A description of the DNS search suffix. Link to this property
Link to this property enabled: Optional\[bool] Whether the policy will be applied to matching devices. Link to this property
exclude: Optional\[List\[SplitTunnelExclude]] List of routes excluded in the WARP client’s tunnel. One of the following:
class TeamsDevicesExcludeSplitTunnelWithAddress: … address: str The address in CIDR format to exclude from the tunnel. If address is present, host must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
class TeamsDevicesExcludeSplitTunnelWithHost: … host: str The domain name to exclude from the tunnel. If host is present, address must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
Link to this property exclude\_office\_ips: Optional\[bool] Whether to add Microsoft IPs to Split Tunnel exclusions. Link to this property
fallback\_domains: Optional\[List\[FallbackDomain]] suffix: str The domain suffix to match when resolving locally. Link to this property description: Optional\[str] A description of the fallback domain, displayed in the client UI. maxLength100 Link to this property dns\_server: Optional\[List\[str]] A list of IP addresses to handle domain resolution. Link to this property
Link to this property gateway\_unique\_id: Optional\[str] Link to this property
global\_acceleration: Optional\[GlobalAcceleration] Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/. api\_endpoints: List\[str] IP:port entries for the API endpoints. Link to this property enabled: bool Global acceleration settings are used only when “enabled”. Link to this property masque\_endpoints: List\[str] IP:port entries for the MASQUE tunnel endpoints. Either wireguard\_endpoints or masque\_endpoints must be provided. Link to this property wireguard\_endpoints: List\[str] IP:port entries for the WireGuard tunnel endpoints. Either wireguard\_endpoints or masque\_endpoints must be provided. Link to this property autoswitch: Optional\[bool] Automatically switch Global Acceleration regions based on device location. Defaults to false when not provided. Link to this property
Link to this property
include: Optional\[List\[SplitTunnelInclude]] List of routes included in the WARP client’s tunnel. One of the following:
class TeamsDevicesIncludeSplitTunnelWithAddress: … address: str The address in CIDR format to include in the tunnel. If address is present, host must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
class TeamsDevicesIncludeSplitTunnelWithHost: … host: str The domain name to include in the tunnel. If host is present, address must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
Link to this property policy\_id: Optional\[str] maxLength36 Link to this property
profile\_type: Optional\[Literal\["warp", "browser\_extension"]] The client type to which the device settings profile applies. This field is set when the profile is created and cannot be changed. One of the following: "warp" Link to this property "browser\_extension" Link to this property
Link to this property register\_interface\_ip\_with\_dns: Optional\[bool] Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server. Link to this property sccm\_vpn\_boundary\_support: Optional\[bool] Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only). Link to this property
service\_mode\_v2: Optional\[ServiceModeV2] mode: Optional\[str] The mode to run the WARP client under. Link to this property port: Optional\[float] The port number when used with proxy mode. Link to this property
Link to this property support\_url: Optional\[str] The URL to launch when the Send Feedback button is clicked. Link to this property switch\_locked: Optional\[bool] Whether to allow the user to turn off the WARP switch and disconnect the client. Link to this property tunnel\_protocol: Optional\[str] Determines which tunnel protocol to use. Link to this property uninstall\_protection: Optional\[bool] Determines whether uninstalling the WARP client requires an override code. (Windows only). Link to this property
virtual\_networks: Optional\[VirtualNetworks] Virtual network access settings for the device. allowed: List\[str] List of virtual network IDs the device is allowed to access. When virtual\_networks is set, at least one entry is required. Link to this property default: str The default virtual network ID. Must be included in the allowed list. formatuuid Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies.default%20%3E%20(model)%20default_get_response%20%3E%20(schema)>)
class DefaultEditResponse: … allow\_mode\_switch: Optional\[bool] Whether to allow the user to switch WARP between modes. Link to this property allow\_updates: Optional\[bool] Whether to receive update notifications when a new version of the client is available. Link to this property allowed\_to\_leave: Optional\[bool] Whether to allow devices to leave the organization. Link to this property auto\_connect: Optional\[float] The amount of time in seconds to reconnect after having been disabled. Link to this property captive\_portal: Optional\[float] Turn on the captive portal after the specified amount of time. Link to this property default: Optional\[bool] Whether the policy will be applied to matching devices. Link to this property disable\_auto\_fallback: Optional\[bool] If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true. Link to this property
dns\_search\_suffixes: Optional\[List\[DNSSearchSuffix]] List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear. suffix: str The DNS search suffix to append when resolving short hostnames. Link to this property description: Optional\[str] A description of the DNS search suffix. Link to this property
Link to this property enabled: Optional\[bool] Whether the policy will be applied to matching devices. Link to this property
exclude: Optional\[List\[SplitTunnelExclude]] List of routes excluded in the WARP client’s tunnel. One of the following:
class TeamsDevicesExcludeSplitTunnelWithAddress: … address: str The address in CIDR format to exclude from the tunnel. If address is present, host must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
class TeamsDevicesExcludeSplitTunnelWithHost: … host: str The domain name to exclude from the tunnel. If host is present, address must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
Link to this property exclude\_office\_ips: Optional\[bool] Whether to add Microsoft IPs to Split Tunnel exclusions. Link to this property
fallback\_domains: Optional\[List\[FallbackDomain]] suffix: str The domain suffix to match when resolving locally. Link to this property description: Optional\[str] A description of the fallback domain, displayed in the client UI. maxLength100 Link to this property dns\_server: Optional\[List\[str]] A list of IP addresses to handle domain resolution. Link to this property
Link to this property gateway\_unique\_id: Optional\[str] Link to this property
global\_acceleration: Optional\[GlobalAcceleration] Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/. api\_endpoints: List\[str] IP:port entries for the API endpoints. Link to this property enabled: bool Global acceleration settings are used only when “enabled”. Link to this property masque\_endpoints: List\[str] IP:port entries for the MASQUE tunnel endpoints. Either wireguard\_endpoints or masque\_endpoints must be provided. Link to this property wireguard\_endpoints: List\[str] IP:port entries for the WireGuard tunnel endpoints. Either wireguard\_endpoints or masque\_endpoints must be provided. Link to this property autoswitch: Optional\[bool] Automatically switch Global Acceleration regions based on device location. Defaults to false when not provided. Link to this property
Link to this property
include: Optional\[List\[SplitTunnelInclude]] List of routes included in the WARP client’s tunnel. One of the following:
class TeamsDevicesIncludeSplitTunnelWithAddress: … address: str The address in CIDR format to include in the tunnel. If address is present, host must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
class TeamsDevicesIncludeSplitTunnelWithHost: … host: str The domain name to include in the tunnel. If host is present, address must not be present. Link to this property description: Optional\[str] A description of the Split Tunnel item, displayed in the client UI. maxLength100 Link to this property
Link to this property
Link to this property policy\_id: Optional\[str] maxLength36 Link to this property
profile\_type: Optional\[Literal\["warp", "browser\_extension"]] The client type to which the device settings profile applies. This field is set when the profile is created and cannot be changed. One of the following: "warp" Link to this property "browser\_extension" Link to this property
Link to this property register\_interface\_ip\_with\_dns: Optional\[bool] Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server. Link to this property sccm\_vpn\_boundary\_support: Optional\[bool] Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only). Link to this property
service\_mode\_v2: Optional\[ServiceModeV2] mode: Optional\[str] The mode to run the WARP client under. Link to this property port: Optional\[float] The port number when used with proxy mode. Link to this property
Link to this property support\_url: Optional\[str] The URL to launch when the Send Feedback button is clicked. Link to this property switch\_locked: Optional\[bool] Whether to allow the user to turn off the WARP switch and disconnect the client. Link to this property tunnel\_protocol: Optional\[str] Determines which tunnel protocol to use. Link to this property uninstall\_protection: Optional\[bool] Determines whether uninstalling the WARP client requires an override code. (Windows only). Link to this property
virtual\_networks: Optional\[VirtualNetworks] Virtual network access settings for the device. allowed: List\[str] List of virtual network IDs the device is allowed to access. When virtual\_networks is set, at least one entry is required. Link to this property default: str The default virtual network ID. Must be included in the allowed list. formatuuid Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies.default%20%3E%20(model)%20default_edit_response%20%3E%20(schema)>) #### Zero TrustDevicesPoliciesDefaultExcludes ##### [Get the Split Tunnel exclude list](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/excludes/methods/get) zero\_trust.devices.policies.default.excludes.get(ExcludeGetParams\*\*kwargs) -> SyncSinglePage\[[SplitTunnelExclude]()] GET/accounts/{account\_id}/devices/policy/exclude ##### [Set the Split Tunnel exclude list](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/excludes/methods/update) zero\_trust.devices.policies.default.excludes.update(ExcludeUpdateParams\*\*kwargs) -> SyncSinglePage\[[SplitTunnelExclude]()] PUT/accounts/{account\_id}/devices/policy/exclude #### Zero TrustDevicesPoliciesDefaultIncludes ##### [Get the Split Tunnel include list](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/includes/methods/get) zero\_trust.devices.policies.default.includes.get(IncludeGetParams\*\*kwargs) -> SyncSinglePage\[[SplitTunnelInclude]()] GET/accounts/{account\_id}/devices/policy/include ##### [Set the Split Tunnel include list](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/includes/methods/update) zero\_trust.devices.policies.default.includes.update(IncludeUpdateParams\*\*kwargs) -> SyncSinglePage\[[SplitTunnelInclude]()] PUT/accounts/{account\_id}/devices/policy/include #### Zero TrustDevicesPoliciesDefaultFallback Domains ##### [Get your Local Domain Fallback list](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/fallback_domains/methods/get) zero\_trust.devices.policies.default.fallback\_domains.get(FallbackDomainGetParams\*\*kwargs) -> SyncSinglePage\[[FallbackDomain]()] GET/accounts/{account\_id}/devices/policy/fallback\_domains ##### [Set your Local Domain Fallback list](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/fallback_domains/methods/update) zero\_trust.devices.policies.default.fallback\_domains.update(FallbackDomainUpdateParams\*\*kwargs) -> SyncSinglePage\[[FallbackDomain]()] PUT/accounts/{account\_id}/devices/policy/fallback\_domains #### Zero TrustDevicesPoliciesDefaultCertificates ##### [Get device certificate provisioning status](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/certificates/methods/get) zero\_trust.devices.policies.default.certificates.get(CertificateGetParams\*\*kwargs) -> [DevicePolicyCertificates]() GET/zones/{zone\_id}/devices/policy/certificates ##### [Update device certificate provisioning status](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/certificates/methods/edit) zero\_trust.devices.policies.default.certificates.edit(CertificateEditParams\*\*kwargs) -> [DevicePolicyCertificates]() PATCH/zones/{zone\_id}/devices/policy/certificates #### Zero TrustDevicesPoliciesCustom ##### [List device settings profiles](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/list) zero\_trust.devices.policies.custom.list(CustomListParams\*\*kwargs) -> SyncSinglePage\[[SettingsPolicy]()] GET/accounts/{account\_id}/devices/policies ##### [Get device settings profile by ID](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/get) zero\_trust.devices.policies.custom.get(strpolicy\_id, CustomGetParams\*\*kwargs) -> [SettingsPolicy]() GET/accounts/{account\_id}/devices/policy/{policy\_id} ##### [Create a device settings profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/create) zero\_trust.devices.policies.custom.create(CustomCreateParams\*\*kwargs) -> [SettingsPolicy]() POST/accounts/{account\_id}/devices/policy ##### [Update a device settings profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/edit) zero\_trust.devices.policies.custom.edit(strpolicy\_id, CustomEditParams\*\*kwargs) -> [SettingsPolicy]() PATCH/accounts/{account\_id}/devices/policy/{policy\_id} ##### [Delete a device settings profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/delete) zero\_trust.devices.policies.custom.delete(strpolicy\_id, CustomDeleteParams\*\*kwargs) -> SyncSinglePage\[[SettingsPolicy]()] DELETE/accounts/{account\_id}/devices/policy/{policy\_id} #### Zero TrustDevicesPoliciesCustomExcludes ##### [Get the Split Tunnel exclude list for a device settings profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/excludes/methods/get) zero\_trust.devices.policies.custom.excludes.get(strpolicy\_id, ExcludeGetParams\*\*kwargs) -> SyncSinglePage\[[SplitTunnelExclude]()] GET/accounts/{account\_id}/devices/policy/{policy\_id}/exclude ##### [Set the Split Tunnel exclude list for a device settings profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/excludes/methods/update) zero\_trust.devices.policies.custom.excludes.update(strpolicy\_id, ExcludeUpdateParams\*\*kwargs) -> SyncSinglePage\[[SplitTunnelExclude]()] PUT/accounts/{account\_id}/devices/policy/{policy\_id}/exclude #### Zero TrustDevicesPoliciesCustomIncludes ##### [Get the Split Tunnel include list for a device settings profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/includes/methods/get) zero\_trust.devices.policies.custom.includes.get(strpolicy\_id, IncludeGetParams\*\*kwargs) -> SyncSinglePage\[[SplitTunnelInclude]()] GET/accounts/{account\_id}/devices/policy/{policy\_id}/include ##### [Set the Split Tunnel include list for a device settings profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/includes/methods/update) zero\_trust.devices.policies.custom.includes.update(strpolicy\_id, IncludeUpdateParams\*\*kwargs) -> SyncSinglePage\[[SplitTunnelInclude]()] PUT/accounts/{account\_id}/devices/policy/{policy\_id}/include #### Zero TrustDevicesPoliciesCustomFallback Domains ##### [Get the Local Domain Fallback list for a device settings profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/fallback_domains/methods/get) zero\_trust.devices.policies.custom.fallback\_domains.get(strpolicy\_id, FallbackDomainGetParams\*\*kwargs) -> SyncSinglePage\[[FallbackDomain]()] GET/accounts/{account\_id}/devices/policy/{policy\_id}/fallback\_domains ##### [Set the Local Domain Fallback list for a device settings profile](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/fallback_domains/methods/update) zero\_trust.devices.policies.custom.fallback\_domains.update(strpolicy\_id, FallbackDomainUpdateParams\*\*kwargs) -> SyncSinglePage\[[FallbackDomain]()] PUT/accounts/{account\_id}/devices/policy/{policy\_id}/fallback\_domains #### Zero TrustDevicesPosture ##### [List posture rules](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/posture/methods/list) zero\_trust.devices.posture.list(PostureListParams\*\*kwargs) -> SyncSinglePage\[[DevicePostureRule]()] GET/accounts/{account\_id}/devices/posture ##### [Get posture rule](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/posture/methods/get) zero\_trust.devices.posture.get(strrule\_id, PostureGetParams\*\*kwargs) -> [DevicePostureRule]() GET/accounts/{account\_id}/devices/posture/{rule\_id} ##### [Create posture rule](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/posture/methods/create) zero\_trust.devices.posture.create(PostureCreateParams\*\*kwargs) -> [DevicePostureRule]() POST/accounts/{account\_id}/devices/posture ##### [Update posture rule](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/posture/methods/update) zero\_trust.devices.posture.update(strrule\_id, PostureUpdateParams\*\*kwargs) -> [DevicePostureRule]() PUT/accounts/{account\_id}/devices/posture/{rule\_id} ##### [Delete posture rule](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/posture/methods/delete) zero\_trust.devices.posture.delete(strrule\_id, PostureDeleteParams\*\*kwargs) -> [PostureDeleteResponse]() DELETE/accounts/{account\_id}/devices/posture/{rule\_id} ##### ModelsExpand Collapse str [Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20carbonblack_input%20%3E%20(schema)>)
class ClientCertificateInput: … certificate\_id: str UUID of Cloudflare managed certificate. maxLength36 Link to this property cn: str Common Name that is protected by the certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20client_certificate_input%20%3E%20(schema)>)
class CrowdstrikeInput: … connection\_id: str Posture Integration ID. Link to this property last\_seen: Optional\[str] For more details on last seen, please refer to the Crowdstrike documentation. Link to this property
operator: Optional\[Literal\["<", "<=", ">", 2 more]] Operator. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property os: Optional\[str] Os Version. Link to this property overall: Optional\[str] Overall. Link to this property sensor\_config: Optional\[str] SensorConfig. Link to this property
state: Optional\[Literal\["online", "offline", "unknown"]] For more details on state, please refer to the Crowdstrike documentation. One of the following: "online" Link to this property "offline" Link to this property "unknown" Link to this property
Link to this property version: Optional\[str] Version. Link to this property
version\_operator: Optional\[Literal\["<", "<=", ">", 2 more]] Version Operator. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20crowdstrike_input%20%3E%20(schema)>)
DeviceInput The value to be checked against. One of the following:
class FileInput: …
operating\_system: Literal\["windows", "linux", "mac"] Operating system. One of the following: "windows" Link to this property "linux" Link to this property "mac" Link to this property
Link to this property path: str File path. Link to this property exists: Optional\[bool] Whether or not file exists. Link to this property sha256: Optional\[str] SHA-256. Link to this property thumbprint: Optional\[str] Signing certificate thumbprint. Link to this property
Link to this property
class UniqueClientIDInput: … id: str List ID. Link to this property
operating\_system: Literal\["android", "ios", "chromeos"] Operating System. One of the following: "android" Link to this property "ios" Link to this property "chromeos" Link to this property
Link to this property
Link to this property
class DomainJoinedInput: … operating\_system: Literal\["windows"] Operating System. Link to this property domain: Optional\[str] Domain. Link to this property
Link to this property
class OSVersionInput: … operating\_system: Literal\["windows"] Operating System. Link to this property
operator: Literal\["<", "<=", ">", 2 more] Operator. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property version: str Version of OS. Link to this property os\_distro\_name: Optional\[str] Operating System Distribution Name (linux only). Link to this property os\_distro\_revision: Optional\[str] Version of OS Distribution (linux only). Link to this property os\_version\_extra: Optional\[str] Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. Link to this property
Link to this property
class FirewallInput: … enabled: bool Enabled. Link to this property
operating\_system: Literal\["windows", "mac"] Operating System. One of the following: "windows" Link to this property "mac" Link to this property
Link to this property
Link to this property
class SentineloneInput: …
operating\_system: Literal\["windows", "linux", "mac"] Operating system. One of the following: "windows" Link to this property "linux" Link to this property "mac" Link to this property
Link to this property path: str File path. Link to this property sha256: Optional\[str] SHA-256. Link to this property thumbprint: Optional\[str] Signing certificate thumbprint. Link to this property
Link to this property
class TeamsDevicesCarbonblackInputRequest: …
operating\_system: Literal\["windows", "linux", "mac"] Operating system. One of the following: "windows" Link to this property "linux" Link to this property "mac" Link to this property
Link to this property path: str File path. Link to this property sha256: Optional\[str] SHA-256. Link to this property thumbprint: Optional\[str] Signing certificate thumbprint. Link to this property
Link to this property
class TeamsDevicesAccessSerialNumberListInputRequest: … id: str UUID of Access List. maxLength36 Link to this property
Link to this property
class DiskEncryptionInput: … check\_disks: Optional\[List\[CarbonblackInput]] List of volume names to be checked for encryption. Link to this property require\_all: Optional\[bool] Whether to check all disks for encryption. Link to this property
Link to this property
class TeamsDevicesApplicationInputRequest: …
operating\_system: Literal\["windows", "linux", "mac"] Operating system. One of the following: "windows" Link to this property "linux" Link to this property "mac" Link to this property
Link to this property path: str Path for the application. Link to this property sha256: Optional\[str] SHA-256. Link to this property thumbprint: Optional\[str] Signing certificate thumbprint. Link to this property
Link to this property
class ClientCertificateInput: … certificate\_id: str UUID of Cloudflare managed certificate. maxLength36 Link to this property cn: str Common Name that is protected by the certificate. Link to this property
Link to this property
class TeamsDevicesClientCertificateV2InputRequest: … certificate\_id: str UUID of Cloudflare managed certificate. maxLength36 Link to this property check\_private\_key: bool Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key. Link to this property
operating\_system: Literal\["windows", "linux", "mac"] Operating system. One of the following: "windows" Link to this property "linux" Link to this property "mac" Link to this property
Link to this property cn: Optional\[str] Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial\_number} and ${hostname} are valid variables. Link to this property
extended\_key\_usage: Optional\[List\[Literal\["clientAuth", "emailProtection"]]] List of values indicating purposes for which the certificate public key can be used. One of the following: "clientAuth" Link to this property "emailProtection" Link to this property
Link to this property
locations: Optional\[TeamsDevicesClientCertificateV2InputRequestLocations] paths: Optional\[List\[str]] List of paths to check for client certificate on linux. Link to this property
trust\_stores: Optional\[List\[Literal\["system", "user"]]] List of trust stores to check for client certificate. One of the following: "system" Link to this property "user" Link to this property
Link to this property
Link to this property subject\_alternative\_names: Optional\[List\[str]] List of certificate Subject Alternative Names. Link to this property
Link to this property
class TeamsDevicesAntivirusInputRequest: … update\_window\_days: Optional\[float] Number of days that the antivirus should be updated within. Link to this property
Link to this property
class WorkspaceOneInput: …
compliance\_status: Literal\["compliant", "noncompliant", "unknown"] Compliance Status. One of the following: "compliant" Link to this property "noncompliant" Link to this property "unknown" Link to this property
Link to this property connection\_id: str Posture Integration ID. Link to this property
Link to this property
class CrowdstrikeInput: … connection\_id: str Posture Integration ID. Link to this property last\_seen: Optional\[str] For more details on last seen, please refer to the Crowdstrike documentation. Link to this property
operator: Optional\[Literal\["<", "<=", ">", 2 more]] Operator. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property os: Optional\[str] Os Version. Link to this property overall: Optional\[str] Overall. Link to this property sensor\_config: Optional\[str] SensorConfig. Link to this property
state: Optional\[Literal\["online", "offline", "unknown"]] For more details on state, please refer to the Crowdstrike documentation. One of the following: "online" Link to this property "offline" Link to this property "unknown" Link to this property
Link to this property version: Optional\[str] Version. Link to this property
version\_operator: Optional\[Literal\["<", "<=", ">", 2 more]] Version Operator. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property
Link to this property
class IntuneInput: …
compliance\_status: Literal\["compliant", "noncompliant", "unknown", 3 more] Compliance Status. One of the following: "compliant" Link to this property "noncompliant" Link to this property "unknown" Link to this property "notapplicable" Link to this property "ingraceperiod" Link to this property "error" Link to this property
Link to this property connection\_id: str Posture Integration ID. Link to this property
Link to this property
class KolideInput: … connection\_id: str Posture Integration ID. Link to this property
auth\_state: Optional\[List\[Literal\["Good", "Notified", "Will Block", "Blocked"]]] The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states. One of the following: "Good" Link to this property "Notified" Link to this property "Will Block" Link to this property "Blocked" Link to this property
Link to this property
count\_operator: Optional\[Literal\["<", "<=", ">", 2 more]] Count Operator. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property issue\_count: Optional\[str] The Number of Issues. Link to this property
Link to this property
class TaniumInput: … connection\_id: str Posture Integration ID. Link to this property eid\_last\_seen: Optional\[str] For more details on eid last seen, refer to the Tanium documentation. Link to this property
operator: Optional\[Literal\["<", "<=", ">", 2 more]] Operator to evaluate risk\_level or eid\_last\_seen. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property
risk\_level: Optional\[Literal\["low", "medium", "high", "critical"]] For more details on risk level, refer to the Tanium documentation. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "critical" Link to this property
Link to this property
score\_operator: Optional\[Literal\["<", "<=", ">", 2 more]] Score Operator. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property total\_score: Optional\[float] For more details on total score, refer to the Tanium documentation. Link to this property
Link to this property
class SentineloneS2sInput: … connection\_id: str Posture Integration ID. Link to this property active\_threats: Optional\[float] The Number of active threats. Link to this property infected: Optional\[bool] Whether device is infected. Link to this property is\_active: Optional\[bool] Whether device is active. Link to this property
network\_status: Optional\[Literal\["connected", "disconnected", "disconnecting", "connecting"]] Network status of device. One of the following: "connected" Link to this property "disconnected" Link to this property "disconnecting" Link to this property "connecting" Link to this property
Link to this property
operational\_state: Optional\[Literal\["na", "partially\_disabled", "auto\_fully\_disabled", 4 more]] Agent operational state. One of the following: "na" Link to this property "partially\_disabled" Link to this property "auto\_fully\_disabled" Link to this property "fully\_disabled" Link to this property "auto\_partially\_disabled" Link to this property "disabled\_error" Link to this property "db\_corruption" Link to this property
Link to this property
operator: Optional\[Literal\["<", "<=", ">", 2 more]] Operator. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property
Link to this property
class TeamsDevicesCustomS2sInputRequest: … connection\_id: str Posture Integration ID. Link to this property
operator: Literal\["<", "<=", ">", 2 more] Operator. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property score: float A value between 0-100 assigned to devices set by the 3rd party posture provider. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20device_input%20%3E%20(schema)>)
class DeviceMatch: …
platform: Optional\[Literal\["windows", "mac", "linux", 3 more]] One of the following: "windows" Link to this property "mac" Link to this property "linux" Link to this property "android" Link to this property "ios" Link to this property "chromeos" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20device_match%20%3E%20(schema)>)
class DevicePostureRule: … id: Optional\[str] API UUID. maxLength36 Link to this property description: Optional\[str] The description of the device posture rule. Link to this property enabled: Optional\[bool] Whether the rule is enabled. This is a computed, read-only value. It is false for deprecated Kolide posture rules that still use the issue\_count input, and true otherwise. Link to this property expiration: Optional\[str] Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client. Link to this property input: Optional\[DeviceInput] The value to be checked against. Link to this property
match: Optional\[List\[DeviceMatch]] The conditions that the client must match to run the rule.
platform: Optional\[Literal\["windows", "mac", "linux", 3 more]] One of the following: "windows" Link to this property "mac" Link to this property "linux" Link to this property "android" Link to this property "ios" Link to this property "chromeos" Link to this property
Link to this property
Link to this property name: Optional\[str] The name of the device posture rule. Link to this property schedule: Optional\[str] Polling frequency for the WARP client posture check. Default: 5m (poll every five minutes). Minimum: 1m. Link to this property
type: Optional\[Literal\["file", "application", "tanium", 20 more]] The type of device posture rule. One of the following: "file" Link to this property "application" Link to this property "tanium" Link to this property "gateway" Link to this property "warp" Link to this property "disk\_encryption" Link to this property "serial\_number" Link to this property "sentinelone" Link to this property "carbonblack" Link to this property "firewall" Link to this property "os\_version" Link to this property "domain\_joined" Link to this property "client\_certificate" Link to this property "client\_certificate\_v2" Link to this property "antivirus" Link to this property "unique\_client\_id" Link to this property "kolide" Link to this property "tanium\_s2s" Link to this property "crowdstrike\_s2s" Link to this property "intune" Link to this property "workspace\_one" Link to this property "sentinelone\_s2s" Link to this property "custom\_s2s" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20device_posture_rule%20%3E%20(schema)>)
class DiskEncryptionInput: … check\_disks: Optional\[List\[CarbonblackInput]] List of volume names to be checked for encryption. Link to this property require\_all: Optional\[bool] Whether to check all disks for encryption. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20disk_encryption_input%20%3E%20(schema)>)
class DomainJoinedInput: … operating\_system: Literal\["windows"] Operating System. Link to this property domain: Optional\[str] Domain. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20domain_joined_input%20%3E%20(schema)>)
class FileInput: …
operating\_system: Literal\["windows", "linux", "mac"] Operating system. One of the following: "windows" Link to this property "linux" Link to this property "mac" Link to this property
Link to this property path: str File path. Link to this property exists: Optional\[bool] Whether or not file exists. Link to this property sha256: Optional\[str] SHA-256. Link to this property thumbprint: Optional\[str] Signing certificate thumbprint. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20file_input%20%3E%20(schema)>)
class FirewallInput: … enabled: bool Enabled. Link to this property
operating\_system: Literal\["windows", "mac"] Operating System. One of the following: "windows" Link to this property "mac" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20firewall_input%20%3E%20(schema)>)
class IntuneInput: …
compliance\_status: Literal\["compliant", "noncompliant", "unknown", 3 more] Compliance Status. One of the following: "compliant" Link to this property "noncompliant" Link to this property "unknown" Link to this property "notapplicable" Link to this property "ingraceperiod" Link to this property "error" Link to this property
Link to this property connection\_id: str Posture Integration ID. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20intune_input%20%3E%20(schema)>)
class KolideInput: … connection\_id: str Posture Integration ID. Link to this property
auth\_state: Optional\[List\[Literal\["Good", "Notified", "Will Block", "Blocked"]]] The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states. One of the following: "Good" Link to this property "Notified" Link to this property "Will Block" Link to this property "Blocked" Link to this property
Link to this property
count\_operator: Optional\[Literal\["<", "<=", ">", 2 more]] Count Operator. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property issue\_count: Optional\[str] The Number of Issues. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20kolide_input%20%3E%20(schema)>)
class OSVersionInput: … operating\_system: Literal\["windows"] Operating System. Link to this property
operator: Literal\["<", "<=", ">", 2 more] Operator. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property version: str Version of OS. Link to this property os\_distro\_name: Optional\[str] Operating System Distribution Name (linux only). Link to this property os\_distro\_revision: Optional\[str] Version of OS Distribution (linux only). Link to this property os\_version\_extra: Optional\[str] Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20os_version_input%20%3E%20(schema)>)
class SentineloneInput: …
operating\_system: Literal\["windows", "linux", "mac"] Operating system. One of the following: "windows" Link to this property "linux" Link to this property "mac" Link to this property
Link to this property path: str File path. Link to this property sha256: Optional\[str] SHA-256. Link to this property thumbprint: Optional\[str] Signing certificate thumbprint. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20sentinelone_input%20%3E%20(schema)>)
class SentineloneS2sInput: … connection\_id: str Posture Integration ID. Link to this property active\_threats: Optional\[float] The Number of active threats. Link to this property infected: Optional\[bool] Whether device is infected. Link to this property is\_active: Optional\[bool] Whether device is active. Link to this property
network\_status: Optional\[Literal\["connected", "disconnected", "disconnecting", "connecting"]] Network status of device. One of the following: "connected" Link to this property "disconnected" Link to this property "disconnecting" Link to this property "connecting" Link to this property
Link to this property
operational\_state: Optional\[Literal\["na", "partially\_disabled", "auto\_fully\_disabled", 4 more]] Agent operational state. One of the following: "na" Link to this property "partially\_disabled" Link to this property "auto\_fully\_disabled" Link to this property "fully\_disabled" Link to this property "auto\_partially\_disabled" Link to this property "disabled\_error" Link to this property "db\_corruption" Link to this property
Link to this property
operator: Optional\[Literal\["<", "<=", ">", 2 more]] Operator. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20sentinelone_s2s_input%20%3E%20(schema)>)
class TaniumInput: … connection\_id: str Posture Integration ID. Link to this property eid\_last\_seen: Optional\[str] For more details on eid last seen, refer to the Tanium documentation. Link to this property
operator: Optional\[Literal\["<", "<=", ">", 2 more]] Operator to evaluate risk\_level or eid\_last\_seen. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property
risk\_level: Optional\[Literal\["low", "medium", "high", "critical"]] For more details on risk level, refer to the Tanium documentation. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "critical" Link to this property
Link to this property
score\_operator: Optional\[Literal\["<", "<=", ">", 2 more]] Score Operator. One of the following: "<" Link to this property "<=" Link to this property ">" Link to this property ">=" Link to this property "==" Link to this property
Link to this property total\_score: Optional\[float] For more details on total score, refer to the Tanium documentation. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20tanium_input%20%3E%20(schema)>)
class UniqueClientIDInput: … id: str List ID. Link to this property
operating\_system: Literal\["android", "ios", "chromeos"] Operating System. One of the following: "android" Link to this property "ios" Link to this property "chromeos" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20unique_client_id_input%20%3E%20(schema)>)
class WorkspaceOneInput: …
compliance\_status: Literal\["compliant", "noncompliant", "unknown"] Compliance Status. One of the following: "compliant" Link to this property "noncompliant" Link to this property "unknown" Link to this property
Link to this property connection\_id: str Posture Integration ID. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20workspace_one_input%20%3E%20(schema)>)
class PostureDeleteResponse: … id: Optional\[str] API UUID. maxLength36 Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20posture_delete_response%20%3E%20(schema)>) #### Zero TrustDevicesPostureIntegrations ##### [List posture integrations](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/list) zero\_trust.devices.posture.integrations.list(IntegrationListParams\*\*kwargs) -> SyncSinglePage\[[Integration]()] GET/accounts/{account\_id}/devices/posture/integration ##### [Get posture integration](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/get) zero\_trust.devices.posture.integrations.get(strintegration\_id, IntegrationGetParams\*\*kwargs) -> [Integration]() GET/accounts/{account\_id}/devices/posture/integration/{integration\_id} ##### [Create posture integration](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/create) zero\_trust.devices.posture.integrations.create(IntegrationCreateParams\*\*kwargs) -> [Integration]() POST/accounts/{account\_id}/devices/posture/integration ##### [Update posture integration](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/edit) zero\_trust.devices.posture.integrations.edit(strintegration\_id, IntegrationEditParams\*\*kwargs) -> [Integration]() PATCH/accounts/{account\_id}/devices/posture/integration/{integration\_id} ##### [Delete posture integration](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/delete) zero\_trust.devices.posture.integrations.delete(strintegration\_id, IntegrationDeleteParams\*\*kwargs) -> [IntegrationDeleteResponse]() DELETE/accounts/{account\_id}/devices/posture/integration/{integration\_id} ##### ModelsExpand Collapse
class Integration: … id: Optional\[str] API UUID. maxLength36 Link to this property
config: Optional\[Config] The configuration object containing third-party integration information. api\_url: str The Workspace One API URL provided in the Workspace One Admin Dashboard. Link to this property auth\_url: str The Workspace One Authorization URL depending on your region. Link to this property client\_id: str The Workspace One client ID provided in the Workspace One Admin Dashboard. Link to this property
Link to this property interval: Optional\[str] The interval between each posture check with the third-party API. Use m for minutes (e.g. 5m) and h for hours (e.g. 12h). Link to this property name: Optional\[str] The name of the device posture integration. Link to this property
type: Optional\[Literal\["workspace\_one", "crowdstrike\_s2s", "uptycs", 5 more]] The type of device posture integration. One of the following: "workspace\_one" Link to this property "crowdstrike\_s2s" Link to this property "uptycs" Link to this property "intune" Link to this property "kolide" Link to this property "tanium\_s2s" Link to this property "sentinelone\_s2s" Link to this property "custom\_s2s" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture.integrations%20%3E%20(model)%20integration%20%3E%20(schema)>)
Union\[str, object, null] One of the following: str Link to this property object Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture.integrations%20%3E%20(model)%20integration_delete_response%20%3E%20(schema)>) #### Zero TrustDevicesRevoke ##### [Revoke devices (deprecated)](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/revoke/methods/create) Deprecated zero\_trust.devices.revoke.create(RevokeCreateParams\*\*kwargs) -> [RevokeCreateResponse]() POST/accounts/{account\_id}/devices/revoke ##### ModelsExpand Collapse
Union\[str, object, null] One of the following: str Link to this property object Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.revoke%20%3E%20(model)%20revoke_create_response%20%3E%20(schema)>) #### Zero TrustDevicesSettings ##### [Get device settings](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/settings/methods/get) zero\_trust.devices.settings.get(SettingGetParams\*\*kwargs) -> [DeviceSettings]() GET/accounts/{account\_id}/devices/settings ##### [Update device settings (deprecated)](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/settings/methods/update) Deprecated zero\_trust.devices.settings.update(SettingUpdateParams\*\*kwargs) -> [DeviceSettings]() PUT/accounts/{account\_id}/devices/settings ##### [Update device settings](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/settings/methods/edit) zero\_trust.devices.settings.edit(SettingEditParams\*\*kwargs) -> [DeviceSettings]() PATCH/accounts/{account\_id}/devices/settings ##### [Reset device settings](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/settings/methods/delete) zero\_trust.devices.settings.delete(SettingDeleteParams\*\*kwargs) -> [DeviceSettings]() DELETE/accounts/{account\_id}/devices/settings ##### ModelsExpand Collapse
class DeviceSettings: … disable\_for\_time: Optional\[float] Sets the time limit, in seconds, that a user can use an override code to bypass WARP. Link to this property external\_emergency\_signal\_enabled: Optional\[bool] Controls whether the external emergency disconnect feature is enabled. Link to this property external\_emergency\_signal\_fingerprint: Optional\[str] The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external\_emergency\_signal\_url. If provided, the WARP client will use this value to verify the server’s identity. The device will ignore any response if the server’s certificate fingerprint does not exactly match this value. Link to this property external\_emergency\_signal\_interval: Optional\[str] The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., “5m”, “2m30s”, “1h”). Minimum 30 seconds. Link to this property external\_emergency\_signal\_url: Optional\[str] The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host. Link to this property gateway\_proxy\_enabled: Optional\[bool] Enable gateway proxy filtering on TCP. Link to this property gateway\_udp\_proxy\_enabled: Optional\[bool] Enable gateway proxy filtering on UDP. Link to this property root\_certificate\_installation\_enabled: Optional\[bool] Enable installation of cloudflare managed root certificate. Link to this property use\_zt\_virtual\_ip: Optional\[bool] Enable using CGNAT virtual IPv4. Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.settings%20%3E%20(model)%20device_settings%20%3E%20(schema)>) #### Zero TrustDevicesUnrevoke ##### [Unrevoke devices (deprecated)](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/unrevoke/methods/create) Deprecated zero\_trust.devices.unrevoke.create(UnrevokeCreateParams\*\*kwargs) -> [UnrevokeCreateResponse]() POST/accounts/{account\_id}/devices/unrevoke ##### ModelsExpand Collapse
Union\[str, object, null] One of the following: str Link to this property object Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.unrevoke%20%3E%20(model)%20unrevoke_create_response%20%3E%20(schema)>) #### Zero TrustDevicesOverride Codes ##### [Get override codes (deprecated)](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/override_codes/methods/list) Deprecated zero\_trust.devices.override\_codes.list(strdevice\_id, OverrideCodeListParams\*\*kwargs) -> [OverrideCodeListResponse]() GET/accounts/{account\_id}/devices/{device\_id}/override\_codes ##### [Get override codes](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/devices/subresources/override_codes/methods/get) zero\_trust.devices.override\_codes.get(strregistration\_id, OverrideCodeGetParams\*\*kwargs) -> [OverrideCodeGetResponse]() GET/accounts/{account\_id}/devices/registrations/{registration\_id}/override\_codes ##### ModelsExpand Collapse
class OverrideCodeListResponse: …
disable\_for\_time: Optional\[DisableForTime] \_1: Optional\[str] Override code that is valid for 1 hour. Link to this property \_12: Optional\[str] Override code that is valid for 12 hour2. Link to this property \_24: Optional\[str] Override code that is valid for 24 hour.2. Link to this property \_3: Optional\[str] Override code that is valid for 3 hours. Link to this property \_6: Optional\[str] Override code that is valid for 6 hours. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.override_codes%20%3E%20(model)%20override_code_list_response%20%3E%20(schema)>)
class OverrideCodeGetResponse: … disable\_for\_time: Optional\[Dict\[str, str]] Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.override_codes%20%3E%20(model)%20override_code_get_response%20%3E%20(schema)>) #### Zero TrustIdentity Providers ##### [List Access identity providers](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/methods/list) zero\_trust.identity\_providers.list(IdentityProviderListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[IdentityProviderListResponse]()] GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers ##### [Get an Access identity provider](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/methods/get) zero\_trust.identity\_providers.get(stridentity\_provider\_id, IdentityProviderGetParams\*\*kwargs) -> [IdentityProvider]() GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers/{identity\_provider\_id} ##### [Add an Access identity provider](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/methods/create) zero\_trust.identity\_providers.create(IdentityProviderCreateParams\*\*kwargs) -> [IdentityProvider]() POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers ##### [Update an Access identity provider](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/methods/update) zero\_trust.identity\_providers.update(stridentity\_provider\_id, IdentityProviderUpdateParams\*\*kwargs) -> [IdentityProvider]() PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers/{identity\_provider\_id} ##### [Delete an Access identity provider](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/methods/delete) zero\_trust.identity\_providers.delete(stridentity\_provider\_id, IdentityProviderDeleteParams\*\*kwargs) -> [IdentityProviderDeleteResponse]() DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers/{identity\_provider\_id} ##### ModelsExpand Collapse
class AzureAD: …
config: Config The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property conditional\_access\_enabled: Optional\[bool] Should Cloudflare try to load authentication contexts from your account Link to this property directory\_id: Optional\[str] Your Azure directory uuid Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
prompt: Optional\[Literal\["login", "select\_account", "none"]] Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction\_required error. prompt=select\_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. One of the following: "login" Link to this property "select\_account" Link to this property "none" Link to this property
Link to this property support\_groups: Optional\[bool] Should Cloudflare try to load groups from your account Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[SAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[SAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20azure_ad%20%3E%20(schema)>)
class GenericOAuthConfig: … client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20generic_oauth_config%20%3E%20(schema)>)
IdentityProvider One of the following:
class AzureAD: …
config: Config The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property conditional\_access\_enabled: Optional\[bool] Should Cloudflare try to load authentication contexts from your account Link to this property directory\_id: Optional\[str] Your Azure directory uuid Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
prompt: Optional\[Literal\["login", "select\_account", "none"]] Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction\_required error. prompt=select\_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. One of the following: "login" Link to this property "select\_account" Link to this property "none" Link to this property
Link to this property support\_groups: Optional\[bool] Should Cloudflare try to load groups from your account Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[SAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[SAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessCentrify: …
config: AccessCentrifyConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. centrify\_account: Optional\[str] Your centrify account url Link to this property centrify\_app\_id: Optional\[str] Your centrify app id Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessCentrifySAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessCentrifySAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessFacebook: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessFacebookSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessFacebookSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessGitHub: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessGitHubSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessGitHubSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessGoogle: …
config: AccessGoogleConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessGoogleSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessGoogleSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessGoogleApps: …
config: AccessGoogleAppsConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. apps\_domain: Optional\[str] Your companies TLD Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
prompt: Optional\[Literal\["none", "consent", "select\_account"]] Configures the prompt behavior for Google authentication. One of the following: "none" Link to this property "consent" Link to this property "select\_account" Link to this property
Link to this property use\_login\_hint: Optional\[bool] Whether to use a previously authenticated Access email as a Google login hint when exactly one email matches the Workspace domain. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessGoogleAppsSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessGoogleAppsSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessLinkedin: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessLinkedinSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessLinkedinSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOIDC: …
config: AccessOIDCConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. auth\_url: Optional\[str] The authorization\_endpoint URL of your IdP Link to this property certs\_url: Optional\[str] The jwks\_uri endpoint of your IdP to allow the IdP keys to sign the tokens Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property pkce\_enabled: Optional\[bool] Enable Proof Key for Code Exchange (PKCE) Link to this property scopes: Optional\[List\[str]] OAuth scopes Link to this property token\_url: Optional\[str] The token\_endpoint URL of your IdP Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOIDCSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOIDCSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOkta: …
config: AccessOktaConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. authorization\_server\_id: Optional\[str] Your okta authorization server id Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property okta\_account: Optional\[str] Your okta account url Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOktaSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOktaSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOnelogin: …
config: AccessOneloginConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property onelogin\_account: Optional\[str] Your OneLogin account url Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOneloginSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOneloginSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessPingone: …
config: AccessPingoneConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property ping\_env\_id: Optional\[str] Your PingOne environment identifier Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessPingoneSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessPingoneSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessSAML: …
config: AccessSAMLConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. attributes: Optional\[List\[str]] A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules. Link to this property email\_attribute\_name: Optional\[str] The attribute name for email in the SAML response. Link to this property enable\_encryption: Optional\[bool] Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set. To enable encryption: 1. Create a certificate set via POST to /identity_providers/{id}/saml_certificate 2. Set this field to true and include saml_certificate_set_id in the PUT request 3. Configure the public certificate in your external Identity Provider Note: Requires saml_certificate_set_id to be set when true. Link to this property force\_authn: Optional\[bool] Asks the IdP to reauthenticate the user for each SAML authentication request. Link to this property
header\_attributes: Optional\[List\[AccessSAMLConfigHeaderAttribute]] Add a list of attribute names that will be returned in the response header from the Access callback. attribute\_name: Optional\[str] attribute name from the IDP Link to this property header\_name: Optional\[str] header that will be added on the request to the origin Link to this property
Link to this property idp\_public\_certs: Optional\[List\[str]] X509 certificate to verify the signature in the SAML authentication response Link to this property issuer\_url: Optional\[str] IdP Entity ID or Issuer URL Link to this property max\_sso\_url\_length: Optional\[int] The maximum URL length the IdP accepts for the SSO redirect URL. When the constructed SSO URL would exceed this length, the RelayState is stored server-side and a short nonce is passed to the IdP instead. Set this if your IdP enforces a URL length limit. maximum100000 minimum512 Link to this property sign\_request: Optional\[bool] Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints. Link to this property sso\_target\_url: Optional\[str] URL to send the SAML authentication requests to Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessSAMLSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessSAMLSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessYandex: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessYandexSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessYandexSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOnetimepin: …
config: AccessOnetimepinConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. redirect\_url: Optional\[str] Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOnetimepinSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOnetimepinSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessCloudflare: …
config: AccessCloudflareConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. redirect\_url: Optional\[str] Link to this property restrict\_to\_account\_members: Optional\[bool] When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessCloudflareSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessCloudflareSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessPasskeys: …
config: AccessPasskeysConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. login\_page\_auto\_prompt: Optional\[bool] When enabled, the Access login page automatically prompts the user to authenticate with a passkey. Link to this property redirect\_url: Optional\[str] Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessPasskeysSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessPasskeysSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider%20%3E%20(schema)>)
class IdentityProviderSCIMConfig: … The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. enabled: Optional\[bool] A flag to enable or disable SCIM for the identity provider. Link to this property
identity\_update\_behavior: Optional\[Literal\["automatic", "reauth", "no\_action"]] Indicates how a SCIM event updates a user identity used for policy evaluation. Use “automatic” to automatically update a user’s identity and augment it with fields from the SCIM user resource. Use “reauth” to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With “reauth” identities will not contain fields from the SCIM user resource. With “no\_action” identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate. One of the following: "automatic" Link to this property "reauth" Link to this property "no\_action" Link to this property
Link to this property scim\_base\_url: Optional\[str] The base URL of Cloudflare’s SCIM V2.0 API endpoint. Link to this property seat\_deprovision: Optional\[bool] A flag to remove a user’s seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user\_deprovision is also enabled. Link to this property secret: Optional\[str] A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity\_providers/:idpID/refresh\_scim\_secret. Link to this property user\_deprovision: Optional\[bool] A flag to enable revoking a user’s session in Access and Gateway when they have been deprovisioned in the Identity Provider. Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider_scim_config%20%3E%20(schema)>)
Literal\["onetimepin", "azureAD", "saml", 13 more] The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. One of the following: "onetimepin" Link to this property "azureAD" Link to this property "saml" Link to this property "centrify" Link to this property "facebook" Link to this property "github" Link to this property "google-apps" Link to this property "google" Link to this property "linkedin" Link to this property "oidc" Link to this property "okta" Link to this property "onelogin" Link to this property "pingone" Link to this property "yandex" Link to this property "cloudflare" Link to this property "passkeys" Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider_type%20%3E%20(schema)>)
IdentityProviderListResponse One of the following:
class AzureAD: …
config: Config The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property conditional\_access\_enabled: Optional\[bool] Should Cloudflare try to load authentication contexts from your account Link to this property directory\_id: Optional\[str] Your Azure directory uuid Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
prompt: Optional\[Literal\["login", "select\_account", "none"]] Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction\_required error. prompt=select\_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether. One of the following: "login" Link to this property "select\_account" Link to this property "none" Link to this property
Link to this property support\_groups: Optional\[bool] Should Cloudflare try to load groups from your account Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[SAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[SAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessCentrify: …
config: AccessCentrifyConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. centrify\_account: Optional\[str] Your centrify account url Link to this property centrify\_app\_id: Optional\[str] Your centrify app id Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessCentrifySAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessCentrifySAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessFacebook: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessFacebookSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessFacebookSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessGitHub: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessGitHubSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessGitHubSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessGoogle: …
config: AccessGoogleConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessGoogleSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessGoogleSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessGoogleApps: …
config: AccessGoogleAppsConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. apps\_domain: Optional\[str] Your companies TLD Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property
prompt: Optional\[Literal\["none", "consent", "select\_account"]] Configures the prompt behavior for Google authentication. One of the following: "none" Link to this property "consent" Link to this property "select\_account" Link to this property
Link to this property use\_login\_hint: Optional\[bool] Whether to use a previously authenticated Access email as a Google login hint when exactly one email matches the Workspace domain. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessGoogleAppsSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessGoogleAppsSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessLinkedin: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessLinkedinSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessLinkedinSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOIDC: …
config: AccessOIDCConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. auth\_url: Optional\[str] The authorization\_endpoint URL of your IdP Link to this property certs\_url: Optional\[str] The jwks\_uri endpoint of your IdP to allow the IdP keys to sign the tokens Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property pkce\_enabled: Optional\[bool] Enable Proof Key for Code Exchange (PKCE) Link to this property scopes: Optional\[List\[str]] OAuth scopes Link to this property token\_url: Optional\[str] The token\_endpoint URL of your IdP Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOIDCSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOIDCSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOkta: …
config: AccessOktaConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. authorization\_server\_id: Optional\[str] Your okta authorization server id Link to this property claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property okta\_account: Optional\[str] Your okta account url Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOktaSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOktaSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOnelogin: …
config: AccessOneloginConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property onelogin\_account: Optional\[str] Your OneLogin account url Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOneloginSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOneloginSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessPingone: …
config: AccessPingoneConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. claims: Optional\[List\[str]] Custom claims Link to this property client\_id: Optional\[str] Your OAuth Client ID Link to this property client\_secret: Optional\[str] Your OAuth Client Secret Link to this property email\_claim\_name: Optional\[str] The claim name for email in the id\_token response. Link to this property ping\_env\_id: Optional\[str] Your PingOne environment identifier Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessPingoneSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessPingoneSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessSAML: …
config: AccessSAMLConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. attributes: Optional\[List\[str]] A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules. Link to this property email\_attribute\_name: Optional\[str] The attribute name for email in the SAML response. Link to this property enable\_encryption: Optional\[bool] Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set. To enable encryption: 1. Create a certificate set via POST to /identity_providers/{id}/saml_certificate 2. Set this field to true and include saml_certificate_set_id in the PUT request 3. Configure the public certificate in your external Identity Provider Note: Requires saml_certificate_set_id to be set when true. Link to this property force\_authn: Optional\[bool] Asks the IdP to reauthenticate the user for each SAML authentication request. Link to this property
header\_attributes: Optional\[List\[AccessSAMLConfigHeaderAttribute]] Add a list of attribute names that will be returned in the response header from the Access callback. attribute\_name: Optional\[str] attribute name from the IDP Link to this property header\_name: Optional\[str] header that will be added on the request to the origin Link to this property
Link to this property idp\_public\_certs: Optional\[List\[str]] X509 certificate to verify the signature in the SAML authentication response Link to this property issuer\_url: Optional\[str] IdP Entity ID or Issuer URL Link to this property max\_sso\_url\_length: Optional\[int] The maximum URL length the IdP accepts for the SSO redirect URL. When the constructed SSO URL would exceed this length, the RelayState is stored server-side and a short nonce is passed to the IdP instead. Set this if your IdP enforces a URL length limit. maximum100000 minimum512 Link to this property sign\_request: Optional\[bool] Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints. Link to this property sso\_target\_url: Optional\[str] URL to send the SAML authentication requests to Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessSAMLSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessSAMLSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessYandex: … config: GenericOAuthConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessYandexSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessYandexSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessOnetimepin: …
config: AccessOnetimepinConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. redirect\_url: Optional\[str] Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessOnetimepinSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessOnetimepinSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessCloudflare: …
config: AccessCloudflareConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. redirect\_url: Optional\[str] Link to this property restrict\_to\_account\_members: Optional\[bool] When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies. Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessCloudflareSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessCloudflareSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
class AccessPasskeys: …
config: AccessPasskeysConfig The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation. login\_page\_auto\_prompt: Optional\[bool] When enabled, the Access login page automatically prompts the user to authenticate with a passkey. Link to this property redirect\_url: Optional\[str] Link to this property
Link to this property name: str The name of the identity provider, shown to users on the login page. Link to this property type: IdentityProviderType The type of identity provider. To determine the value for a specific provider, refer to our developer documentation. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property read\_only: Optional\[bool] Indicates that the identity provider is immutable and cannot be updated or deleted via the API. Link to this property
saml\_certificate\_set: Optional\[AccessPasskeysSAMLCertificateSet] The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[AccessPasskeysSAMLCertificateSetCurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
Link to this property saml\_certificate\_set\_id: Optional\[str] The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate. formatuuid Link to this property scim\_config: Optional\[IdentityProviderSCIMConfig] The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider_list_response%20%3E%20(schema)>)
class IdentityProviderDeleteResponse: … id: Optional\[str] UUID. maxLength36 Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider_delete_response%20%3E%20(schema)>) #### Zero TrustIdentity ProvidersSCIM #### Zero TrustIdentity ProvidersSCIMGroups ##### [List SCIM Group resources](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/subresources/scim/subresources/groups/methods/list) zero\_trust.identity\_providers.scim.groups.list(stridentity\_provider\_id, GroupListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[ZeroTrustGroup]()] GET/accounts/{account\_id}/access/identity\_providers/{identity\_provider\_id}/scim/groups #### Zero TrustIdentity ProvidersSCIMUsers ##### [List SCIM User resources](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/subresources/scim/subresources/users/methods/list) zero\_trust.identity\_providers.scim.users.list(stridentity\_provider\_id, UserListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[AccessUser]()] GET/accounts/{account\_id}/access/identity\_providers/{identity\_provider\_id}/scim/users #### Zero TrustIdentity ProvidersSAML Certificate ##### [Create SAML encryption certificate for Identity Provider](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/identity_providers/subresources/saml_certificate/methods/create) zero\_trust.identity\_providers.saml\_certificate.create(stridentity\_provider\_id, SAMLCertificateCreateParams\*\*kwargs) -> [SAMLCertificateCreateResponse]() POST/accounts/{account\_id}/access/identity\_providers/{identity\_provider\_id}/saml\_certificate ##### ModelsExpand Collapse
class SAMLCertificateCreateResponse: … A SAML encryption certificate set containing current and optionally previous certificates for encryption key rotation. created\_at: datetime Timestamp when the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set formatuuid Link to this property updated\_at: datetime Timestamp when the certificate set was last updated (e.g., during rotation) formatdate-time Link to this property
current\_certificate: Optional\[CurrentCertificate] The currently active certificate used for encrypting SAML assertions is\_current: bool Indicates whether this is the currently active certificate Link to this property not\_after: datetime Certificate expiration date. Certificates are automatically rotated 30 days before expiration. formatdate-time Link to this property public\_certificate: str PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption. Link to this property uid: str Unique identifier for the certificate formatuuid Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers.saml_certificate%20%3E%20(model)%20saml_certificate_create_response%20%3E%20(schema)>) #### Zero TrustOrganizations ##### [Get your Zero Trust organization](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/organizations/methods/list) zero\_trust.organizations.list(OrganizationListParams\*\*kwargs) -> [OrganizationListResponse]() GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations ##### [Create your Zero Trust organization](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/organizations/methods/create) zero\_trust.organizations.create(OrganizationCreateParams\*\*kwargs) -> [Organization]() POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations ##### [Update your Zero Trust organization](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/organizations/methods/update) zero\_trust.organizations.update(OrganizationUpdateParams\*\*kwargs) -> [Organization]() PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations ##### [Revoke all Access tokens for a user](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/organizations/methods/revoke_users) zero\_trust.organizations.revoke\_users(OrganizationRevokeUsersParams\*\*kwargs) -> [OrganizationRevokeUsersResponse]() POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations/revoke\_user ##### ModelsExpand Collapse
class LoginDesign: … background\_color: Optional\[str] The background color on your login page. Link to this property footer\_text: Optional\[str] The text at the bottom of your login page. Link to this property header\_text: Optional\[str] The text at the top of your login page. Link to this property logo\_path: Optional\[str] The URL of the logo on your login page. Link to this property text\_color: Optional\[str] The text color on your login page. Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20login_design%20%3E%20(schema)>)
class Organization: … allow\_authenticate\_via\_warp: Optional\[bool] When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value. Link to this property auth\_domain: Optional\[str] The unique subdomain assigned to your Zero Trust organization. If omitted on creation, a unique subdomain is auto-generated in the format adjective-noun-hex4 (e.g. frosty-moon-7a3b.cloudflareaccess.com). Link to this property auto\_redirect\_to\_identity: Optional\[bool] When set to true, users skip the identity provider selection step during login. Link to this property
custom\_pages: Optional\[CustomPages] forbidden: Optional\[str] The uid of the custom page to use when a user is denied access after failing a non-identity rule. Link to this property identity\_denied: Optional\[str] The uid of the custom page to use when a user is denied access. Link to this property
Link to this property deny\_unmatched\_requests: Optional\[bool] Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array. Link to this property deny\_unmatched\_requests\_exempted\_zone\_names: Optional\[List\[str]] Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request. Link to this property is\_ui\_read\_only: Optional\[bool] Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled. Link to this property login\_design: Optional\[LoginDesign] Link to this property
mfa\_config: Optional\[MfaConfig] Configures multi-factor authentication (MFA) settings for an organization.
allowed\_authenticators: Optional\[List\[Literal\["totp", "biometrics", "security\_key", 2 more]]] Lists the MFA methods that users can authenticate with. The piv_key and ssh_fido2_key values are supported only for infrastructure applications. One of the following: "totp" Link to this property "biometrics" Link to this property "security\_key" Link to this property "piv\_key" Link to this property "ssh\_fido2\_key" Link to this property
Link to this property amr\_matching\_session\_duration: Optional\[str] Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains “mfa”. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Link to this property required\_aaguids: Optional\[str] Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs. formatuuid Link to this property session\_duration: Optional\[str] Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property
mfa\_piv\_key\_requirements: Optional\[MfaPivKeyRequirements] Configures PIV key requirements for MFA using hardware security keys.
pin\_policy: Optional\[Literal\["never", "once", "always"]] Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use). One of the following: "never" Link to this property "once" Link to this property "always" Link to this property
Link to this property require\_fips\_device: Optional\[bool] Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device. Link to this property
ssh\_key\_size: Optional\[List\[Literal\[256, 384, 521, 3 more]]] Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter. One of the following: 256 Link to this property 384 Link to this property 521 Link to this property 2048 Link to this property 3072 Link to this property 4096 Link to this property
Link to this property
ssh\_key\_type: Optional\[List\[Literal\["ecdsa", "ed25519", "rsa"]]] Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa. One of the following: "ecdsa" Link to this property "ed25519" Link to this property "rsa" Link to this property
Link to this property
touch\_policy: Optional\[Literal\["never", "always", "cached"]] Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds). One of the following: "never" Link to this property "always" Link to this property "cached" Link to this property
Link to this property
Link to this property mfa\_required\_for\_all\_apps: Optional\[bool] Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: ‘allowed\_authenticators’ cannot contain only the infrastructure SSH authenticators (‘piv\_key’ and ‘ssh\_fido2\_key’) if the organization has any non-infrastructure applications. Link to this property name: Optional\[str] The name of your Zero Trust organization. When omitted on creation, defaults to the provided auth\_domain; when both are omitted, defaults to the auto-generated subdomain slug (e.g. frosty-moon-7a3b). Link to this property
service\_token\_inactivity: Optional\[ServiceTokenInactivity] Configures automatic enforcement for inactive service tokens. A service token is inactive if no policy references it, and it has not successfully authenticated with an Access application during the selected inactivity period. This setting applies to every service token in your Zero Trust account.
action: Literal\["disable", "delete"] The action applied to an inactive service token. One of the following: "disable" Link to this property "delete" Link to this property
Link to this property enabled: bool Whether automatic enforcement for inactive service tokens is enabled. Link to this property inactivity\_threshold\_days: int The number of days a service token must be inactive before the configured action is applied. maximum365 minimum30 Link to this property
Link to this property session\_duration: Optional\[str] The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property strict\_service\_token\_auth: Optional\[bool] Enables new behaviors for requests made with Access service tokens. Unauthorized requests emit audit logs, and return a 401 or 403 status code in the response instead of redirecting to the login page. Successful requests no longer receive a CF\_Authorization cookie in the response. Zero Trust organizations created on or after October 5, 2026 will have this setting enabled by default, and cannot disable it. Link to this property ui\_read\_only\_toggle\_reason: Optional\[str] A description of the reason why the UI read only field is being toggled. Link to this property user\_seat\_expiration\_inactive\_time: Optional\[str] The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property warp\_auth\_non\_browser\_401: Optional\[bool] When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page. Link to this property warp\_auth\_session\_duration: Optional\[str] The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h. Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20organization%20%3E%20(schema)>)
class OrganizationListResponse: … allow\_authenticate\_via\_warp: Optional\[bool] When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value. Link to this property auth\_domain: Optional\[str] The unique subdomain assigned to your Zero Trust organization. If omitted on creation, a unique subdomain is auto-generated in the format adjective-noun-hex4 (e.g. frosty-moon-7a3b.cloudflareaccess.com). Link to this property auto\_redirect\_to\_identity: Optional\[bool] When set to true, users skip the identity provider selection step during login. Link to this property
custom\_pages: Optional\[CustomPages] forbidden: Optional\[str] The uid of the custom page to use when a user is denied access after failing a non-identity rule. Link to this property identity\_denied: Optional\[str] The uid of the custom page to use when a user is denied access. Link to this property
Link to this property deny\_unmatched\_requests: Optional\[bool] Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array. Link to this property deny\_unmatched\_requests\_exempted\_zone\_names: Optional\[List\[str]] Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request. Link to this property is\_ui\_read\_only: Optional\[bool] Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled. Link to this property login\_design: Optional\[LoginDesign] Link to this property
mfa\_config: Optional\[MfaConfig] Configures multi-factor authentication (MFA) settings for an organization.
allowed\_authenticators: Optional\[List\[Literal\["totp", "biometrics", "security\_key", 2 more]]] Lists the MFA methods that users can authenticate with. The piv_key and ssh_fido2_key values are supported only for infrastructure applications. One of the following: "totp" Link to this property "biometrics" Link to this property "security\_key" Link to this property "piv\_key" Link to this property "ssh\_fido2\_key" Link to this property
Link to this property amr\_matching\_session\_duration: Optional\[str] Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains “mfa”. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Link to this property required\_aaguids: Optional\[str] Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs. formatuuid Link to this property session\_duration: Optional\[str] Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property
mfa\_piv\_key\_requirements: Optional\[MfaPivKeyRequirements] Configures PIV key requirements for MFA using hardware security keys.
pin\_policy: Optional\[Literal\["never", "once", "always"]] Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use). One of the following: "never" Link to this property "once" Link to this property "always" Link to this property
Link to this property require\_fips\_device: Optional\[bool] Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device. Link to this property
ssh\_key\_size: Optional\[List\[Literal\[256, 384, 521, 3 more]]] Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter. One of the following: 256 Link to this property 384 Link to this property 521 Link to this property 2048 Link to this property 3072 Link to this property 4096 Link to this property
Link to this property
ssh\_key\_type: Optional\[List\[Literal\["ecdsa", "ed25519", "rsa"]]] Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa. One of the following: "ecdsa" Link to this property "ed25519" Link to this property "rsa" Link to this property
Link to this property
touch\_policy: Optional\[Literal\["never", "always", "cached"]] Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds). One of the following: "never" Link to this property "always" Link to this property "cached" Link to this property
Link to this property
Link to this property mfa\_required\_for\_all\_apps: Optional\[bool] Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: ‘allowed\_authenticators’ cannot contain only the infrastructure SSH authenticators (‘piv\_key’ and ‘ssh\_fido2\_key’) if the organization has any non-infrastructure applications. Link to this property name: Optional\[str] The name of your Zero Trust organization. When omitted on creation, defaults to the provided auth\_domain; when both are omitted, defaults to the auto-generated subdomain slug (e.g. frosty-moon-7a3b). Link to this property
service\_token\_inactivity: Optional\[ServiceTokenInactivity] Configures automatic enforcement for inactive service tokens. A service token is inactive if no policy references it, and it has not successfully authenticated with an Access application during the selected inactivity period. This setting applies to every service token in your Zero Trust account.
action: Literal\["disable", "delete"] The action applied to an inactive service token. One of the following: "disable" Link to this property "delete" Link to this property
Link to this property enabled: bool Whether automatic enforcement for inactive service tokens is enabled. Link to this property inactivity\_threshold\_days: int The number of days a service token must be inactive before the configured action is applied. maximum365 minimum30 Link to this property
Link to this property session\_duration: Optional\[str] The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property strict\_service\_token\_auth: Optional\[bool] Enables new behaviors for requests made with Access service tokens. Unauthorized requests emit audit logs, and return a 401 or 403 status code in the response instead of redirecting to the login page. Successful requests no longer receive a CF\_Authorization cookie in the response. Zero Trust organizations created on or after October 5, 2026 will have this setting enabled by default, and cannot disable it. Link to this property trusted\_accounts: Optional\[List\[str]] The account tags of organizations trusted by this organization for policy and device posture sharing. Link to this property ui\_read\_only\_toggle\_reason: Optional\[str] A description of the reason why the UI read only field is being toggled. Link to this property user\_seat\_expiration\_inactive\_time: Optional\[str] The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property warp\_auth\_non\_browser\_401: Optional\[bool] When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page. Link to this property warp\_auth\_session\_duration: Optional\[str] The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h. Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20organization_list_response%20%3E%20(schema)>)
Literal\[true, false] One of the following: true Link to this property false Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20organization_revoke_users_response%20%3E%20(schema)>) #### Zero TrustOrganizationsDOH ##### [Get your Zero Trust organization DoH settings](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/organizations/subresources/doh/methods/get) zero\_trust.organizations.doh.get(DOHGetParams\*\*kwargs) -> [DOHGetResponse]() GET/accounts/{account\_id}/access/organizations/doh ##### [Update your Zero Trust organization DoH settings](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/organizations/subresources/doh/methods/update) zero\_trust.organizations.doh.update(DOHUpdateParams\*\*kwargs) -> [DOHUpdateResponse]() PUT/accounts/{account\_id}/access/organizations/doh ##### ModelsExpand Collapse
class DOHGetResponse: … id: Optional\[str] The ID of the service token. maxLength36 Link to this property client\_id: Optional\[str] The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header. Link to this property doh\_jwt\_duration: Optional\[str] The duration the DoH JWT is valid for. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Note that the maximum duration for this setting is the same as the key rotation period on the account. Link to this property duration: Optional\[str] The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h). Link to this property enabled: Optional\[bool] Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous client_secret stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create. Link to this property expires\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] The name of the service token. Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations.doh%20%3E%20(model)%20doh_get_response%20%3E%20(schema)>)
class DOHUpdateResponse: … id: Optional\[str] The ID of the service token. maxLength36 Link to this property client\_id: Optional\[str] The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header. Link to this property doh\_jwt\_duration: Optional\[str] The duration the DoH JWT is valid for. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h Link to this property duration: Optional\[str] The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h). Link to this property enabled: Optional\[bool] Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous client_secret stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create. Link to this property expires\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] The name of the service token. Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations.doh%20%3E%20(model)%20doh_update_response%20%3E%20(schema)>) #### Zero TrustSeats ##### [Update a user seat](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/seats/methods/edit) zero\_trust.seats.edit(SeatEditParams\*\*kwargs) -> SyncSinglePage\[[Seat]()] PATCH/accounts/{account\_id}/access/seats ##### ModelsExpand Collapse
class Seat: … access\_seat: Optional\[bool] True if the seat is part of Access. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property gateway\_seat: Optional\[bool] True if the seat is part of Gateway. Link to this property seat\_uid: Optional\[str] The unique API identifier for the Zero Trust seat. maxLength36 Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.seats%20%3E%20(model)%20seat%20%3E%20(schema)>) #### Zero TrustAccess #### Zero TrustAccessAI Controls #### Zero TrustAccessAI ControlsMcp #### Zero TrustAccessAI ControlsMcpPortals ##### [List MCP Portals](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/list) zero\_trust.access.ai\_controls.mcp.portals.list(PortalListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[PortalListResponse]()] GET/accounts/{account\_id}/access/ai-controls/mcp/portals ##### [Create a new MCP Portal](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/create) zero\_trust.access.ai\_controls.mcp.portals.create(PortalCreateParams\*\*kwargs) -> [PortalCreateResponse]() POST/accounts/{account\_id}/access/ai-controls/mcp/portals ##### [Read details of an MCP Portal](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/read) zero\_trust.access.ai\_controls.mcp.portals.read(strid, PortalReadParams\*\*kwargs) -> [PortalReadResponse]() GET/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### [Update an MCP Portal](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/update) zero\_trust.access.ai\_controls.mcp.portals.update(strid, PortalUpdateParams\*\*kwargs) -> [PortalUpdateResponse]() PUT/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### [Delete an MCP Portal](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/delete) zero\_trust.access.ai\_controls.mcp.portals.delete(strid, PortalDeleteParams\*\*kwargs) -> [PortalDeleteResponse]() DELETE/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### ModelsExpand Collapse
class PortalListResponse: … id: str Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: str Hostname where the MCP portal is available. Link to this property name: str Display name for the MCP portal. maxLength350 Link to this property
servers: List\[Server] id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: Literal\["oauth", "bearer", "unauthenticated"] Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: str URL of the upstream MCP endpoint. formaturi Link to this property name: str Display name for the MCP server. maxLength350 Link to this property prompts: List\[Dict\[str, object]] Link to this property server\_id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: List\[Dict\[str, object]] Link to this property
auth\_config\_summary: Optional\[ServerAuthConfigSummary] Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: Optional\[Literal\["dcr", "manual"]] One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: Optional\[float] Link to this property
config: Optional\[ServerAuthConfigSummaryConfig] authorization\_endpoint: Optional\[str] Link to this property issuer: Optional\[str] Link to this property resource: Optional\[str] Link to this property revocation\_endpoint: Optional\[str] Link to this property token\_endpoint: Optional\[str] Link to this property
Link to this property has\_client\_secret: Optional\[bool] Link to this property
registration\_info: Optional\[ServerAuthConfigSummaryRegistrationInfo] client\_id: Optional\[str] Link to this property redirect\_uris: Optional\[List\[str]] Link to this property scope: Optional\[str] Link to this property token\_endpoint\_auth\_method: Optional\[str] Link to this property
Link to this property
Link to this property
authentication\_status: Optional\[Literal\["not\_required", "required", "connected", 2 more]] Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property default\_disabled: Optional\[bool] Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description: Optional\[str] Optional description of the MCP server. maxLength512 Link to this property error: Optional\[str] Link to this property
error\_details: Optional\[ServerErrorDetails] cause: Optional\[str] Underlying error message Link to this property is\_upstream: Optional\[bool] True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: Optional\[float] MCP protocol error code Link to this property retryable: Optional\[bool] Whether the error is transient and worth retrying Link to this property status\_code: Optional\[float] HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: Optional\[bool] When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: Optional\[datetime] formatdate-time Link to this property last\_synced: Optional\[datetime] formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property on\_behalf: Optional\[bool] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: Optional\[Literal\["waiting", "ready", "stale", "error"]] Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: Optional\[List\[ServerUpdatedPrompt]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
updated\_tools: Optional\[List\[ServerUpdatedTool]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode: Optional\[bool] Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode: Optional\[Literal\["off", "opt\_in", "default\_on", "enforced"]] Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property description: Optional\[str] Optional description of the MCP portal. maxLength512 Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_list_response%20%3E%20(schema)>)
class PortalCreateResponse: … id: str Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: str Hostname where the MCP portal is available. Link to this property name: str Display name for the MCP portal. maxLength350 Link to this property
servers: List\[Server] id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: Literal\["oauth", "bearer", "unauthenticated"] Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: str URL of the upstream MCP endpoint. formaturi Link to this property name: str Display name for the MCP server. maxLength350 Link to this property prompts: List\[Dict\[str, object]] Link to this property server\_id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: List\[Dict\[str, object]] Link to this property
auth\_config\_summary: Optional\[ServerAuthConfigSummary] Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: Optional\[Literal\["dcr", "manual"]] One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: Optional\[float] Link to this property
config: Optional\[ServerAuthConfigSummaryConfig] authorization\_endpoint: Optional\[str] Link to this property issuer: Optional\[str] Link to this property resource: Optional\[str] Link to this property revocation\_endpoint: Optional\[str] Link to this property token\_endpoint: Optional\[str] Link to this property
Link to this property has\_client\_secret: Optional\[bool] Link to this property
registration\_info: Optional\[ServerAuthConfigSummaryRegistrationInfo] client\_id: Optional\[str] Link to this property redirect\_uris: Optional\[List\[str]] Link to this property scope: Optional\[str] Link to this property token\_endpoint\_auth\_method: Optional\[str] Link to this property
Link to this property
Link to this property
authentication\_status: Optional\[Literal\["not\_required", "required", "connected", 2 more]] Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property default\_disabled: Optional\[bool] Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description: Optional\[str] Optional description of the MCP server. maxLength512 Link to this property error: Optional\[str] Link to this property
error\_details: Optional\[ServerErrorDetails] cause: Optional\[str] Underlying error message Link to this property is\_upstream: Optional\[bool] True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: Optional\[float] MCP protocol error code Link to this property retryable: Optional\[bool] Whether the error is transient and worth retrying Link to this property status\_code: Optional\[float] HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: Optional\[bool] When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: Optional\[datetime] formatdate-time Link to this property last\_synced: Optional\[datetime] formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property on\_behalf: Optional\[bool] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: Optional\[Literal\["waiting", "ready", "stale", "error"]] Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: Optional\[List\[ServerUpdatedPrompt]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
updated\_tools: Optional\[List\[ServerUpdatedTool]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode: Optional\[bool] Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode: Optional\[Literal\["off", "opt\_in", "default\_on", "enforced"]] Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property description: Optional\[str] Optional description of the MCP portal. maxLength512 Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_create_response%20%3E%20(schema)>)
class PortalReadResponse: … id: str Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: str Hostname where the MCP portal is available. Link to this property name: str Display name for the MCP portal. maxLength350 Link to this property
servers: List\[Server] id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: Literal\["oauth", "bearer", "unauthenticated"] Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: str URL of the upstream MCP endpoint. formaturi Link to this property name: str Display name for the MCP server. maxLength350 Link to this property prompts: List\[Dict\[str, object]] Link to this property server\_id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: List\[Dict\[str, object]] Link to this property
auth\_config\_summary: Optional\[ServerAuthConfigSummary] Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: Optional\[Literal\["dcr", "manual"]] One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: Optional\[float] Link to this property
config: Optional\[ServerAuthConfigSummaryConfig] authorization\_endpoint: Optional\[str] Link to this property issuer: Optional\[str] Link to this property resource: Optional\[str] Link to this property revocation\_endpoint: Optional\[str] Link to this property token\_endpoint: Optional\[str] Link to this property
Link to this property has\_client\_secret: Optional\[bool] Link to this property
registration\_info: Optional\[ServerAuthConfigSummaryRegistrationInfo] client\_id: Optional\[str] Link to this property redirect\_uris: Optional\[List\[str]] Link to this property scope: Optional\[str] Link to this property token\_endpoint\_auth\_method: Optional\[str] Link to this property
Link to this property
Link to this property
authentication\_status: Optional\[Literal\["not\_required", "required", "connected", 2 more]] Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property default\_disabled: Optional\[bool] Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description: Optional\[str] Optional description of the MCP server. maxLength512 Link to this property error: Optional\[str] Link to this property
error\_details: Optional\[ServerErrorDetails] cause: Optional\[str] Underlying error message Link to this property is\_upstream: Optional\[bool] True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: Optional\[float] MCP protocol error code Link to this property retryable: Optional\[bool] Whether the error is transient and worth retrying Link to this property status\_code: Optional\[float] HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: Optional\[bool] When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: Optional\[datetime] formatdate-time Link to this property last\_synced: Optional\[datetime] formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property on\_behalf: Optional\[bool] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: Optional\[Literal\["waiting", "ready", "stale", "error"]] Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: Optional\[List\[ServerUpdatedPrompt]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
updated\_tools: Optional\[List\[ServerUpdatedTool]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode: Optional\[bool] Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode: Optional\[Literal\["off", "opt\_in", "default\_on", "enforced"]] Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property description: Optional\[str] Optional description of the MCP portal. maxLength512 Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_read_response%20%3E%20(schema)>)
class PortalUpdateResponse: … id: str Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: str Hostname where the MCP portal is available. Link to this property name: str Display name for the MCP portal. maxLength350 Link to this property
servers: List\[Server] id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: Literal\["oauth", "bearer", "unauthenticated"] Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: str URL of the upstream MCP endpoint. formaturi Link to this property name: str Display name for the MCP server. maxLength350 Link to this property prompts: List\[Dict\[str, object]] Link to this property server\_id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: List\[Dict\[str, object]] Link to this property
auth\_config\_summary: Optional\[ServerAuthConfigSummary] Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: Optional\[Literal\["dcr", "manual"]] One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: Optional\[float] Link to this property
config: Optional\[ServerAuthConfigSummaryConfig] authorization\_endpoint: Optional\[str] Link to this property issuer: Optional\[str] Link to this property resource: Optional\[str] Link to this property revocation\_endpoint: Optional\[str] Link to this property token\_endpoint: Optional\[str] Link to this property
Link to this property has\_client\_secret: Optional\[bool] Link to this property
registration\_info: Optional\[ServerAuthConfigSummaryRegistrationInfo] client\_id: Optional\[str] Link to this property redirect\_uris: Optional\[List\[str]] Link to this property scope: Optional\[str] Link to this property token\_endpoint\_auth\_method: Optional\[str] Link to this property
Link to this property
Link to this property
authentication\_status: Optional\[Literal\["not\_required", "required", "connected", 2 more]] Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property default\_disabled: Optional\[bool] Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description: Optional\[str] Optional description of the MCP server. maxLength512 Link to this property error: Optional\[str] Link to this property
error\_details: Optional\[ServerErrorDetails] cause: Optional\[str] Underlying error message Link to this property is\_upstream: Optional\[bool] True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: Optional\[float] MCP protocol error code Link to this property retryable: Optional\[bool] Whether the error is transient and worth retrying Link to this property status\_code: Optional\[float] HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: Optional\[bool] When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: Optional\[datetime] formatdate-time Link to this property last\_synced: Optional\[datetime] formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property on\_behalf: Optional\[bool] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: Optional\[Literal\["waiting", "ready", "stale", "error"]] Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: Optional\[List\[ServerUpdatedPrompt]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
updated\_tools: Optional\[List\[ServerUpdatedTool]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode: Optional\[bool] Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode: Optional\[Literal\["off", "opt\_in", "default\_on", "enforced"]] Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced"