--- title: Access --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Zero Trust](https://developers.cloudflare.com/api/python/resources/zero_trust) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Access #### AccessAI Controls #### AccessAI ControlsMcp #### AccessAI ControlsMcpPortals ##### [List MCP Portals](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/list) zero\_trust.access.ai\_controls.mcp.portals.list(PortalListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[PortalListResponse]()] GET/accounts/{account\_id}/access/ai-controls/mcp/portals ##### [Create a new MCP Portal](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/create) zero\_trust.access.ai\_controls.mcp.portals.create(PortalCreateParams\*\*kwargs) -> [PortalCreateResponse]() POST/accounts/{account\_id}/access/ai-controls/mcp/portals ##### [Read details of an MCP Portal](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/read) zero\_trust.access.ai\_controls.mcp.portals.read(strid, PortalReadParams\*\*kwargs) -> [PortalReadResponse]() GET/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### [Update an MCP Portal](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/update) zero\_trust.access.ai\_controls.mcp.portals.update(strid, PortalUpdateParams\*\*kwargs) -> [PortalUpdateResponse]() PUT/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### [Delete an MCP Portal](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/delete) zero\_trust.access.ai\_controls.mcp.portals.delete(strid, PortalDeleteParams\*\*kwargs) -> [PortalDeleteResponse]() DELETE/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### ModelsExpand Collapse
class PortalListResponse: … id: str Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: str Hostname where the MCP portal is available. Link to this property name: str Display name for the MCP portal. maxLength350 Link to this property
servers: List\[Server] id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: Literal\["oauth", "bearer", "unauthenticated"] Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: str URL of the upstream MCP endpoint. formaturi Link to this property name: str Display name for the MCP server. maxLength350 Link to this property prompts: List\[Dict\[str, object]] Link to this property server\_id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: List\[Dict\[str, object]] Link to this property
auth\_config\_summary: Optional\[ServerAuthConfigSummary] Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: Optional\[Literal\["dcr", "manual"]] One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: Optional\[float] Link to this property
config: Optional\[ServerAuthConfigSummaryConfig] authorization\_endpoint: Optional\[str] Link to this property issuer: Optional\[str] Link to this property resource: Optional\[str] Link to this property revocation\_endpoint: Optional\[str] Link to this property token\_endpoint: Optional\[str] Link to this property
Link to this property has\_client\_secret: Optional\[bool] Link to this property
registration\_info: Optional\[ServerAuthConfigSummaryRegistrationInfo] client\_id: Optional\[str] Link to this property redirect\_uris: Optional\[List\[str]] Link to this property scope: Optional\[str] Link to this property token\_endpoint\_auth\_method: Optional\[str] Link to this property
Link to this property
Link to this property
authentication\_status: Optional\[Literal\["not\_required", "required", "connected", 2 more]] Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property default\_disabled: Optional\[bool] Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description: Optional\[str] Optional description of the MCP server. maxLength512 Link to this property error: Optional\[str] Link to this property
error\_details: Optional\[ServerErrorDetails] cause: Optional\[str] Underlying error message Link to this property is\_upstream: Optional\[bool] True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: Optional\[float] MCP protocol error code Link to this property retryable: Optional\[bool] Whether the error is transient and worth retrying Link to this property status\_code: Optional\[float] HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: Optional\[bool] When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: Optional\[datetime] formatdate-time Link to this property last\_synced: Optional\[datetime] formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property on\_behalf: Optional\[bool] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: Optional\[Literal\["waiting", "ready", "stale", "error"]] Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: Optional\[List\[ServerUpdatedPrompt]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
updated\_tools: Optional\[List\[ServerUpdatedTool]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode: Optional\[bool] Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode: Optional\[Literal\["off", "opt\_in", "default\_on", "enforced"]] Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property description: Optional\[str] Optional description of the MCP portal. maxLength512 Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_list_response%20%3E%20(schema)>)
class PortalCreateResponse: … id: str Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: str Hostname where the MCP portal is available. Link to this property name: str Display name for the MCP portal. maxLength350 Link to this property
servers: List\[Server] id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: Literal\["oauth", "bearer", "unauthenticated"] Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: str URL of the upstream MCP endpoint. formaturi Link to this property name: str Display name for the MCP server. maxLength350 Link to this property prompts: List\[Dict\[str, object]] Link to this property server\_id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: List\[Dict\[str, object]] Link to this property
auth\_config\_summary: Optional\[ServerAuthConfigSummary] Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: Optional\[Literal\["dcr", "manual"]] One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: Optional\[float] Link to this property
config: Optional\[ServerAuthConfigSummaryConfig] authorization\_endpoint: Optional\[str] Link to this property issuer: Optional\[str] Link to this property resource: Optional\[str] Link to this property revocation\_endpoint: Optional\[str] Link to this property token\_endpoint: Optional\[str] Link to this property
Link to this property has\_client\_secret: Optional\[bool] Link to this property
registration\_info: Optional\[ServerAuthConfigSummaryRegistrationInfo] client\_id: Optional\[str] Link to this property redirect\_uris: Optional\[List\[str]] Link to this property scope: Optional\[str] Link to this property token\_endpoint\_auth\_method: Optional\[str] Link to this property
Link to this property
Link to this property
authentication\_status: Optional\[Literal\["not\_required", "required", "connected", 2 more]] Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property default\_disabled: Optional\[bool] Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description: Optional\[str] Optional description of the MCP server. maxLength512 Link to this property error: Optional\[str] Link to this property
error\_details: Optional\[ServerErrorDetails] cause: Optional\[str] Underlying error message Link to this property is\_upstream: Optional\[bool] True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: Optional\[float] MCP protocol error code Link to this property retryable: Optional\[bool] Whether the error is transient and worth retrying Link to this property status\_code: Optional\[float] HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: Optional\[bool] When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: Optional\[datetime] formatdate-time Link to this property last\_synced: Optional\[datetime] formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property on\_behalf: Optional\[bool] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: Optional\[Literal\["waiting", "ready", "stale", "error"]] Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: Optional\[List\[ServerUpdatedPrompt]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
updated\_tools: Optional\[List\[ServerUpdatedTool]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode: Optional\[bool] Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode: Optional\[Literal\["off", "opt\_in", "default\_on", "enforced"]] Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property description: Optional\[str] Optional description of the MCP portal. maxLength512 Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_create_response%20%3E%20(schema)>)
class PortalReadResponse: … id: str Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: str Hostname where the MCP portal is available. Link to this property name: str Display name for the MCP portal. maxLength350 Link to this property
servers: List\[Server] id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: Literal\["oauth", "bearer", "unauthenticated"] Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: str URL of the upstream MCP endpoint. formaturi Link to this property name: str Display name for the MCP server. maxLength350 Link to this property prompts: List\[Dict\[str, object]] Link to this property server\_id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: List\[Dict\[str, object]] Link to this property
auth\_config\_summary: Optional\[ServerAuthConfigSummary] Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: Optional\[Literal\["dcr", "manual"]] One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: Optional\[float] Link to this property
config: Optional\[ServerAuthConfigSummaryConfig] authorization\_endpoint: Optional\[str] Link to this property issuer: Optional\[str] Link to this property resource: Optional\[str] Link to this property revocation\_endpoint: Optional\[str] Link to this property token\_endpoint: Optional\[str] Link to this property
Link to this property has\_client\_secret: Optional\[bool] Link to this property
registration\_info: Optional\[ServerAuthConfigSummaryRegistrationInfo] client\_id: Optional\[str] Link to this property redirect\_uris: Optional\[List\[str]] Link to this property scope: Optional\[str] Link to this property token\_endpoint\_auth\_method: Optional\[str] Link to this property
Link to this property
Link to this property
authentication\_status: Optional\[Literal\["not\_required", "required", "connected", 2 more]] Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property default\_disabled: Optional\[bool] Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description: Optional\[str] Optional description of the MCP server. maxLength512 Link to this property error: Optional\[str] Link to this property
error\_details: Optional\[ServerErrorDetails] cause: Optional\[str] Underlying error message Link to this property is\_upstream: Optional\[bool] True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: Optional\[float] MCP protocol error code Link to this property retryable: Optional\[bool] Whether the error is transient and worth retrying Link to this property status\_code: Optional\[float] HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: Optional\[bool] When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: Optional\[datetime] formatdate-time Link to this property last\_synced: Optional\[datetime] formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property on\_behalf: Optional\[bool] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: Optional\[Literal\["waiting", "ready", "stale", "error"]] Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: Optional\[List\[ServerUpdatedPrompt]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
updated\_tools: Optional\[List\[ServerUpdatedTool]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode: Optional\[bool] Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode: Optional\[Literal\["off", "opt\_in", "default\_on", "enforced"]] Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property description: Optional\[str] Optional description of the MCP portal. maxLength512 Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_read_response%20%3E%20(schema)>)
class PortalUpdateResponse: … id: str Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: str Hostname where the MCP portal is available. Link to this property name: str Display name for the MCP portal. maxLength350 Link to this property
servers: List\[Server] id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: Literal\["oauth", "bearer", "unauthenticated"] Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: str URL of the upstream MCP endpoint. formaturi Link to this property name: str Display name for the MCP server. maxLength350 Link to this property prompts: List\[Dict\[str, object]] Link to this property server\_id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: List\[Dict\[str, object]] Link to this property
auth\_config\_summary: Optional\[ServerAuthConfigSummary] Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: Optional\[Literal\["dcr", "manual"]] One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: Optional\[float] Link to this property
config: Optional\[ServerAuthConfigSummaryConfig] authorization\_endpoint: Optional\[str] Link to this property issuer: Optional\[str] Link to this property resource: Optional\[str] Link to this property revocation\_endpoint: Optional\[str] Link to this property token\_endpoint: Optional\[str] Link to this property
Link to this property has\_client\_secret: Optional\[bool] Link to this property
registration\_info: Optional\[ServerAuthConfigSummaryRegistrationInfo] client\_id: Optional\[str] Link to this property redirect\_uris: Optional\[List\[str]] Link to this property scope: Optional\[str] Link to this property token\_endpoint\_auth\_method: Optional\[str] Link to this property
Link to this property
Link to this property
authentication\_status: Optional\[Literal\["not\_required", "required", "connected", 2 more]] Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property default\_disabled: Optional\[bool] Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description: Optional\[str] Optional description of the MCP server. maxLength512 Link to this property error: Optional\[str] Link to this property
error\_details: Optional\[ServerErrorDetails] cause: Optional\[str] Underlying error message Link to this property is\_upstream: Optional\[bool] True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: Optional\[float] MCP protocol error code Link to this property retryable: Optional\[bool] Whether the error is transient and worth retrying Link to this property status\_code: Optional\[float] HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: Optional\[bool] When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: Optional\[datetime] formatdate-time Link to this property last\_synced: Optional\[datetime] formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property on\_behalf: Optional\[bool] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: Optional\[Literal\["waiting", "ready", "stale", "error"]] Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: Optional\[List\[ServerUpdatedPrompt]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
updated\_tools: Optional\[List\[ServerUpdatedTool]] name: str Link to this property enabled: Optional\[bool] Link to this property portal\_alias: Optional\[str] Link to this property portal\_description: Optional\[str] Link to this property server\_alias: Optional\[str] Link to this property server\_description: Optional\[str] Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode: Optional\[bool] Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode: Optional\[Literal\["off", "opt\_in", "default\_on", "enforced"]] Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property description: Optional\[str] Optional description of the MCP portal. maxLength512 Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_update_response%20%3E%20(schema)>)
class PortalDeleteResponse: … id: str Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: str Hostname where the MCP portal is available. Link to this property name: str Display name for the MCP portal. maxLength350 Link to this property Deprecatedallow\_code\_mode: Optional\[bool] Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode: Optional\[Literal\["off", "opt\_in", "default\_on", "enforced"]] Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property description: Optional\[str] Optional description of the MCP portal. maxLength512 Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_delete_response%20%3E%20(schema)>) #### AccessAI ControlsMcpServers ##### [List MCP Servers](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/list) zero\_trust.access.ai\_controls.mcp.servers.list(ServerListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[ServerListResponse]()] GET/accounts/{account\_id}/access/ai-controls/mcp/servers ##### [Create a new MCP Server](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/create) zero\_trust.access.ai\_controls.mcp.servers.create(ServerCreateParams\*\*kwargs) -> [ServerCreateResponse]() POST/accounts/{account\_id}/access/ai-controls/mcp/servers ##### [Read the details of an MCP Server](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/read) zero\_trust.access.ai\_controls.mcp.servers.read(strid, ServerReadParams\*\*kwargs) -> [ServerReadResponse]() GET/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Update an MCP Server](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/update) zero\_trust.access.ai\_controls.mcp.servers.update(strid, ServerUpdateParams\*\*kwargs) -> [ServerUpdateResponse]() PUT/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Delete an MCP Server](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/delete) zero\_trust.access.ai\_controls.mcp.servers.delete(strid, ServerDeleteParams\*\*kwargs) -> [ServerDeleteResponse]() DELETE/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Sync MCP Server Capabilities](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/sync) zero\_trust.access.ai\_controls.mcp.servers.sync(strid, ServerSyncParams\*\*kwargs) -> [ServerSyncResponse]() POST/accounts/{account\_id}/access/ai-controls/mcp/servers/{id}/sync ##### ModelsExpand Collapse
class ServerListResponse: … id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: Literal\["oauth", "bearer", "unauthenticated"] Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: str URL of the upstream MCP endpoint. formaturi Link to this property name: str Display name for the MCP server. maxLength350 Link to this property prompts: List\[Dict\[str, object]] Link to this property tools: List\[Dict\[str, object]] Link to this property
auth\_config\_summary: Optional\[AuthConfigSummary] Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: Optional\[Literal\["dcr", "manual"]] One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: Optional\[float] Link to this property
config: Optional\[AuthConfigSummaryConfig] authorization\_endpoint: Optional\[str] Link to this property issuer: Optional\[str] Link to this property resource: Optional\[str] Link to this property revocation\_endpoint: Optional\[str] Link to this property token\_endpoint: Optional\[str] Link to this property
Link to this property has\_client\_secret: Optional\[bool] Link to this property
registration\_info: Optional\[AuthConfigSummaryRegistrationInfo] client\_id: Optional\[str] Link to this property redirect\_uris: Optional\[List\[str]] Link to this property scope: Optional\[str] Link to this property token\_endpoint\_auth\_method: Optional\[str] Link to this property
Link to this property
Link to this property
authentication\_status: Optional\[Literal\["not\_required", "required", "connected", 2 more]] Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property description: Optional\[str] Optional description of the MCP server. maxLength512 Link to this property error: Optional\[str] Link to this property
error\_details: Optional\[ErrorDetails] cause: Optional\[str] Underlying error message Link to this property is\_upstream: Optional\[bool] True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: Optional\[float] MCP protocol error code Link to this property retryable: Optional\[bool] Whether the error is transient and worth retrying Link to this property status\_code: Optional\[float] HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: Optional\[bool] When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: Optional\[datetime] formatdate-time Link to this property last\_synced: Optional\[datetime] formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: Optional\[Literal\["waiting", "ready", "stale", "error"]] Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: Optional\[List\[UpdatedPrompt]] Server-wide prompt capability overrides. name: str Name of the tool or prompt capability to override. Link to this property alias: Optional\[str] Custom name exposed for the capability. maxLength40 Link to this property description: Optional\[str] Custom description exposed for the capability. Link to this property enabled: Optional\[bool] Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools: Optional\[List\[UpdatedTool]] Server-wide tool capability overrides. name: str Name of the tool or prompt capability to override. Link to this property alias: Optional\[str] Custom name exposed for the capability. maxLength40 Link to this property description: Optional\[str] Custom description exposed for the capability. Link to this property enabled: Optional\[bool] Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_list_response%20%3E%20(schema)>)
class ServerCreateResponse: … id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: Literal\["oauth", "bearer", "unauthenticated"] Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: str URL of the upstream MCP endpoint. formaturi Link to this property name: str Display name for the MCP server. maxLength350 Link to this property prompts: List\[Dict\[str, object]] Link to this property tools: List\[Dict\[str, object]] Link to this property
auth\_config\_summary: Optional\[AuthConfigSummary] Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: Optional\[Literal\["dcr", "manual"]] One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: Optional\[float] Link to this property
config: Optional\[AuthConfigSummaryConfig] authorization\_endpoint: Optional\[str] Link to this property issuer: Optional\[str] Link to this property resource: Optional\[str] Link to this property revocation\_endpoint: Optional\[str] Link to this property token\_endpoint: Optional\[str] Link to this property
Link to this property has\_client\_secret: Optional\[bool] Link to this property
registration\_info: Optional\[AuthConfigSummaryRegistrationInfo] client\_id: Optional\[str] Link to this property redirect\_uris: Optional\[List\[str]] Link to this property scope: Optional\[str] Link to this property token\_endpoint\_auth\_method: Optional\[str] Link to this property
Link to this property
Link to this property
authentication\_status: Optional\[Literal\["not\_required", "required", "connected", 2 more]] Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property description: Optional\[str] Optional description of the MCP server. maxLength512 Link to this property error: Optional\[str] Link to this property
error\_details: Optional\[ErrorDetails] cause: Optional\[str] Underlying error message Link to this property is\_upstream: Optional\[bool] True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: Optional\[float] MCP protocol error code Link to this property retryable: Optional\[bool] Whether the error is transient and worth retrying Link to this property status\_code: Optional\[float] HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: Optional\[bool] When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: Optional\[datetime] formatdate-time Link to this property last\_synced: Optional\[datetime] formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: Optional\[Literal\["waiting", "ready", "stale", "error"]] Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: Optional\[List\[UpdatedPrompt]] Server-wide prompt capability overrides. name: str Name of the tool or prompt capability to override. Link to this property alias: Optional\[str] Custom name exposed for the capability. maxLength40 Link to this property description: Optional\[str] Custom description exposed for the capability. Link to this property enabled: Optional\[bool] Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools: Optional\[List\[UpdatedTool]] Server-wide tool capability overrides. name: str Name of the tool or prompt capability to override. Link to this property alias: Optional\[str] Custom name exposed for the capability. maxLength40 Link to this property description: Optional\[str] Custom description exposed for the capability. Link to this property enabled: Optional\[bool] Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_create_response%20%3E%20(schema)>)
class ServerReadResponse: … id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: Literal\["oauth", "bearer", "unauthenticated"] Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: str URL of the upstream MCP endpoint. formaturi Link to this property name: str Display name for the MCP server. maxLength350 Link to this property prompts: List\[Dict\[str, object]] Link to this property tools: List\[Dict\[str, object]] Link to this property
auth\_config\_summary: Optional\[AuthConfigSummary] Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: Optional\[Literal\["dcr", "manual"]] One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: Optional\[float] Link to this property
config: Optional\[AuthConfigSummaryConfig] authorization\_endpoint: Optional\[str] Link to this property issuer: Optional\[str] Link to this property resource: Optional\[str] Link to this property revocation\_endpoint: Optional\[str] Link to this property token\_endpoint: Optional\[str] Link to this property
Link to this property has\_client\_secret: Optional\[bool] Link to this property
registration\_info: Optional\[AuthConfigSummaryRegistrationInfo] client\_id: Optional\[str] Link to this property redirect\_uris: Optional\[List\[str]] Link to this property scope: Optional\[str] Link to this property token\_endpoint\_auth\_method: Optional\[str] Link to this property
Link to this property
Link to this property
authentication\_status: Optional\[Literal\["not\_required", "required", "connected", 2 more]] Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property description: Optional\[str] Optional description of the MCP server. maxLength512 Link to this property error: Optional\[str] Link to this property
error\_details: Optional\[ErrorDetails] cause: Optional\[str] Underlying error message Link to this property is\_upstream: Optional\[bool] True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: Optional\[float] MCP protocol error code Link to this property retryable: Optional\[bool] Whether the error is transient and worth retrying Link to this property status\_code: Optional\[float] HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: Optional\[bool] When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: Optional\[datetime] formatdate-time Link to this property last\_synced: Optional\[datetime] formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: Optional\[Literal\["waiting", "ready", "stale", "error"]] Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: Optional\[List\[UpdatedPrompt]] Server-wide prompt capability overrides. name: str Name of the tool or prompt capability to override. Link to this property alias: Optional\[str] Custom name exposed for the capability. maxLength40 Link to this property description: Optional\[str] Custom description exposed for the capability. Link to this property enabled: Optional\[bool] Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools: Optional\[List\[UpdatedTool]] Server-wide tool capability overrides. name: str Name of the tool or prompt capability to override. Link to this property alias: Optional\[str] Custom name exposed for the capability. maxLength40 Link to this property description: Optional\[str] Custom description exposed for the capability. Link to this property enabled: Optional\[bool] Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_read_response%20%3E%20(schema)>)
class ServerUpdateResponse: … id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: Literal\["oauth", "bearer", "unauthenticated"] Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: str URL of the upstream MCP endpoint. formaturi Link to this property name: str Display name for the MCP server. maxLength350 Link to this property prompts: List\[Dict\[str, object]] Link to this property tools: List\[Dict\[str, object]] Link to this property
auth\_config\_summary: Optional\[AuthConfigSummary] Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: Optional\[Literal\["dcr", "manual"]] One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: Optional\[float] Link to this property
config: Optional\[AuthConfigSummaryConfig] authorization\_endpoint: Optional\[str] Link to this property issuer: Optional\[str] Link to this property resource: Optional\[str] Link to this property revocation\_endpoint: Optional\[str] Link to this property token\_endpoint: Optional\[str] Link to this property
Link to this property has\_client\_secret: Optional\[bool] Link to this property
registration\_info: Optional\[AuthConfigSummaryRegistrationInfo] client\_id: Optional\[str] Link to this property redirect\_uris: Optional\[List\[str]] Link to this property scope: Optional\[str] Link to this property token\_endpoint\_auth\_method: Optional\[str] Link to this property
Link to this property
Link to this property
authentication\_status: Optional\[Literal\["not\_required", "required", "connected", 2 more]] Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property description: Optional\[str] Optional description of the MCP server. maxLength512 Link to this property error: Optional\[str] Link to this property
error\_details: Optional\[ErrorDetails] cause: Optional\[str] Underlying error message Link to this property is\_upstream: Optional\[bool] True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: Optional\[float] MCP protocol error code Link to this property retryable: Optional\[bool] Whether the error is transient and worth retrying Link to this property status\_code: Optional\[float] HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: Optional\[bool] When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: Optional\[datetime] formatdate-time Link to this property last\_synced: Optional\[datetime] formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: Optional\[Literal\["waiting", "ready", "stale", "error"]] Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: Optional\[List\[UpdatedPrompt]] Server-wide prompt capability overrides. name: str Name of the tool or prompt capability to override. Link to this property alias: Optional\[str] Custom name exposed for the capability. maxLength40 Link to this property description: Optional\[str] Custom description exposed for the capability. Link to this property enabled: Optional\[bool] Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools: Optional\[List\[UpdatedTool]] Server-wide tool capability overrides. name: str Name of the tool or prompt capability to override. Link to this property alias: Optional\[str] Custom name exposed for the capability. maxLength40 Link to this property description: Optional\[str] Custom description exposed for the capability. Link to this property enabled: Optional\[bool] Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_update_response%20%3E%20(schema)>)
class ServerDeleteResponse: … id: str Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: Literal\["oauth", "bearer", "unauthenticated"] Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: str URL of the upstream MCP endpoint. formaturi Link to this property name: str Display name for the MCP server. maxLength350 Link to this property prompts: List\[Dict\[str, object]] Link to this property tools: List\[Dict\[str, object]] Link to this property
auth\_config\_summary: Optional\[AuthConfigSummary] Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: Optional\[Literal\["dcr", "manual"]] One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: Optional\[float] Link to this property
config: Optional\[AuthConfigSummaryConfig] authorization\_endpoint: Optional\[str] Link to this property issuer: Optional\[str] Link to this property resource: Optional\[str] Link to this property revocation\_endpoint: Optional\[str] Link to this property token\_endpoint: Optional\[str] Link to this property
Link to this property has\_client\_secret: Optional\[bool] Link to this property
registration\_info: Optional\[AuthConfigSummaryRegistrationInfo] client\_id: Optional\[str] Link to this property redirect\_uris: Optional\[List\[str]] Link to this property scope: Optional\[str] Link to this property token\_endpoint\_auth\_method: Optional\[str] Link to this property
Link to this property
Link to this property
authentication\_status: Optional\[Literal\["not\_required", "required", "connected", 2 more]] Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property created\_by: Optional\[str] Link to this property description: Optional\[str] Optional description of the MCP server. maxLength512 Link to this property error: Optional\[str] Link to this property
error\_details: Optional\[ErrorDetails] cause: Optional\[str] Underlying error message Link to this property is\_upstream: Optional\[bool] True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: Optional\[float] MCP protocol error code Link to this property retryable: Optional\[bool] Whether the error is transient and worth retrying Link to this property status\_code: Optional\[float] HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: Optional\[bool] When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: Optional\[datetime] formatdate-time Link to this property last\_synced: Optional\[datetime] formatdate-time Link to this property modified\_at: Optional\[datetime] formatdate-time Link to this property modified\_by: Optional\[str] Link to this property secure\_web\_gateway: Optional\[bool] Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: Optional\[Literal\["waiting", "ready", "stale", "error"]] Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: Optional\[List\[UpdatedPrompt]] Server-wide prompt capability overrides. name: str Name of the tool or prompt capability to override. Link to this property alias: Optional\[str] Custom name exposed for the capability. maxLength40 Link to this property description: Optional\[str] Custom description exposed for the capability. Link to this property enabled: Optional\[bool] Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools: Optional\[List\[UpdatedTool]] Server-wide tool capability overrides. name: str Name of the tool or prompt capability to override. Link to this property alias: Optional\[str] Custom name exposed for the capability. maxLength40 Link to this property description: Optional\[str] Custom description exposed for the capability. Link to this property enabled: Optional\[bool] Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_delete_response%20%3E%20(schema)>)
class ServerSyncResponse: … error: Optional\[str] Link to this property
error\_details: Optional\[ErrorDetails] cause: Optional\[str] Underlying error message Link to this property is\_upstream: Optional\[bool] True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: Optional\[float] MCP protocol error code Link to this property retryable: Optional\[bool] Whether the error is transient and worth retrying Link to this property status\_code: Optional\[float] HTTP status code from the server Link to this property
Link to this property
status: Optional\[Literal\["waiting", "ready", "stale", "error"]] One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_sync_response%20%3E%20(schema)>) #### AccessGateway CA ##### [List SSH Certificate Authorities (CA)](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/list) zero\_trust.access.gateway\_ca.list(GatewayCAListParams\*\*kwargs) -> SyncSinglePage\[[GatewayCAListResponse]()] GET/accounts/{account\_id}/access/gateway\_ca ##### [Add a new SSH Certificate Authority (CA)](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/create) zero\_trust.access.gateway\_ca.create(GatewayCACreateParams\*\*kwargs) -> [GatewayCACreateResponse]() POST/accounts/{account\_id}/access/gateway\_ca ##### [Delete an SSH Certificate Authority (CA)](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/delete) zero\_trust.access.gateway\_ca.delete(strcertificate\_id, GatewayCADeleteParams\*\*kwargs) -> [GatewayCADeleteResponse]() DELETE/accounts/{account\_id}/access/gateway\_ca/{certificate\_id} ##### ModelsExpand Collapse
class GatewayCAListResponse: … id: Optional\[str] The key ID of this certificate. Link to this property public\_key: Optional\[str] The public key of this certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.gateway_ca%20%3E%20(model)%20gateway_ca_list_response%20%3E%20(schema)>)
class GatewayCACreateResponse: … id: Optional\[str] The key ID of this certificate. Link to this property public\_key: Optional\[str] The public key of this certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.gateway_ca%20%3E%20(model)%20gateway_ca_create_response%20%3E%20(schema)>)
class GatewayCADeleteResponse: … id: Optional\[str] UUID. maxLength36 Link to this property
[Link to this property](<#(resource)%20zero_trust.access.gateway_ca%20%3E%20(model)%20gateway_ca_delete_response%20%3E%20(schema)>) #### AccessIdP Federation Grants ##### [List IdP federation grants](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/list) zero\_trust.access.idp\_federation\_grants.list(IdPFederationGrantListParams\*\*kwargs) -> [IdPFederationGrantListResponse]() GET/accounts/{account\_id}/access/idp\_federation\_grants ##### [Create an IdP federation grant](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/create) zero\_trust.access.idp\_federation\_grants.create(IdPFederationGrantCreateParams\*\*kwargs) -> [IdPFederationGrant]() POST/accounts/{account\_id}/access/idp\_federation\_grants ##### [Get an IdP federation grant](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/get) zero\_trust.access.idp\_federation\_grants.get(strgrant\_id, IdPFederationGrantGetParams\*\*kwargs) -> [IdPFederationGrant]() GET/accounts/{account\_id}/access/idp\_federation\_grants/{grant\_id} ##### [Delete an IdP federation grant](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/delete) zero\_trust.access.idp\_federation\_grants.delete(strgrant\_id, IdPFederationGrantDeleteParams\*\*kwargs) -> [IdPFederationGrantDeleteResponse]() DELETE/accounts/{account\_id}/access/idp\_federation\_grants/{grant\_id} ##### ModelsExpand Collapse
class IdPFederationGrant: … id: str UID of the IdP federation grant. maxLength32 Link to this property idp\_id: str UID of the identity provider being federated. formatuuid Link to this property
[Link to this property](<#(resource)%20zero_trust.access.idp_federation_grants%20%3E%20(model)%20idp_federation_grant%20%3E%20(schema)>)
List\[IdPFederationGrant] id: str UID of the IdP federation grant. maxLength32 Link to this property idp\_id: str UID of the identity provider being federated. formatuuid Link to this property
[Link to this property](<#(resource)%20zero_trust.access.idp_federation_grants%20%3E%20(model)%20idp_federation_grant_list_response%20%3E%20(schema)>)
class IdPFederationGrantDeleteResponse: … id: Optional\[str] UID of the deleted IdP federation grant. maxLength32 Link to this property
[Link to this property](<#(resource)%20zero_trust.access.idp_federation_grants%20%3E%20(model)%20idp_federation_grant_delete_response%20%3E%20(schema)>) #### AccessSAML Certificates ##### [List SAML certificate sets](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/list) zero\_trust.access.saml\_certificates.list(SAMLCertificateListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[SAMLCertificateListResponse]()] GET/accounts/{account\_id}/access/saml\_certificates ##### [Get SAML certificate set](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/get) zero\_trust.access.saml\_certificates.get(strsaml\_cert\_set\_id, SAMLCertificateGetParams\*\*kwargs) -> [SAMLCertificateGetResponse]() GET/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id} ##### [Rotate SAML certificate](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/rotate) zero\_trust.access.saml\_certificates.rotate(strsaml\_cert\_set\_id, SAMLCertificateRotateParams\*\*kwargs) -> [SAMLCertificateRotateResponse]() POST/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id}/rotate ##### [Download current certificate in PEM format](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/get_pem) zero\_trust.access.saml\_certificates.get\_pem(strsaml\_cert\_set\_id, SAMLCertificateGetPemParams\*\*kwargs) -> BinaryResponseContent GET/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id}/pem ##### ModelsExpand Collapse
class SAMLCertificateListResponse: … created\_at: datetime When the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set Link to this property updated\_at: datetime When the certificate set was last updated formatdate-time Link to this property
current\_certificate: Optional\[CurrentCertificate] The current active certificate is\_current: bool Indicates whether the certificate can be used for IdP configuration. Link to this property not\_after: datetime Certificate expiration date formatdate-time Link to this property public\_certificate: str The public certificate in PEM format Link to this property uid: str Unique identifier for the certificate Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate (maintained during rotation period). May be null when no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.saml_certificates%20%3E%20(model)%20saml_certificate_list_response%20%3E%20(schema)>)
class SAMLCertificateGetResponse: … created\_at: datetime When the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set Link to this property updated\_at: datetime When the certificate set was last updated formatdate-time Link to this property
current\_certificate: Optional\[CurrentCertificate] The current active certificate is\_current: bool Indicates whether the certificate can be used for IdP configuration. Link to this property not\_after: datetime Certificate expiration date formatdate-time Link to this property public\_certificate: str The public certificate in PEM format Link to this property uid: str Unique identifier for the certificate Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate (maintained during rotation period). May be null when no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.saml_certificates%20%3E%20(model)%20saml_certificate_get_response%20%3E%20(schema)>)
class SAMLCertificateRotateResponse: … created\_at: datetime When the certificate set was created formatdate-time Link to this property uid: str Unique identifier for the certificate set Link to this property updated\_at: datetime When the certificate set was last updated formatdate-time Link to this property
current\_certificate: Optional\[CurrentCertificate] The current active certificate is\_current: bool Indicates whether the certificate can be used for IdP configuration. Link to this property not\_after: datetime Certificate expiration date formatdate-time Link to this property public\_certificate: str The public certificate in PEM format Link to this property uid: str Unique identifier for the certificate Link to this property
Link to this property previous\_certificate: Optional\[object] The previous certificate (maintained during rotation period). May be null when no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.saml_certificates%20%3E%20(model)%20saml_certificate_rotate_response%20%3E%20(schema)>) #### AccessInfrastructure #### AccessInfrastructureTargets ##### [List all targets](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/list) zero\_trust.access.infrastructure.targets.list(TargetListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[TargetListResponse]()] GET/accounts/{account\_id}/infrastructure/targets ##### [Get target](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/get) zero\_trust.access.infrastructure.targets.get(strtarget\_id, TargetGetParams\*\*kwargs) -> [TargetGetResponse]() GET/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Create new target](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/create) zero\_trust.access.infrastructure.targets.create(TargetCreateParams\*\*kwargs) -> [TargetCreateResponse]() POST/accounts/{account\_id}/infrastructure/targets ##### [Update target](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/update) zero\_trust.access.infrastructure.targets.update(strtarget\_id, TargetUpdateParams\*\*kwargs) -> [TargetUpdateResponse]() PUT/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Delete target](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/delete) zero\_trust.access.infrastructure.targets.delete(strtarget\_id, TargetDeleteParams\*\*kwargs) DELETE/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Create new targets](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_update) zero\_trust.access.infrastructure.targets.bulk\_update(TargetBulkUpdateParams\*\*kwargs) -> SyncSinglePage\[[TargetBulkUpdateResponse]()] PUT/accounts/{account\_id}/infrastructure/targets/batch ##### [Delete targets (Deprecated)](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_delete) Deprecated zero\_trust.access.infrastructure.targets.bulk\_delete(TargetBulkDeleteParams\*\*kwargs) DELETE/accounts/{account\_id}/infrastructure/targets/batch ##### [Delete targets](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_delete_v2) zero\_trust.access.infrastructure.targets.bulk\_delete\_v2(TargetBulkDeleteV2Params\*\*kwargs) POST/accounts/{account\_id}/infrastructure/targets/batch\_delete ##### ModelsExpand Collapse
class TargetListResponse: … id: str Target identifier formatuuid maxLength36 Link to this property created\_at: datetime Date and time at which the target was created formatdate-time Link to this property hostname: str A non-unique field that refers to a target Link to this property
ip: IP The IPv4/IPv6 address that identifies where to reach a target
ipv4: Optional\[IPIPV4] The target’s IPv4 address ip\_addr: Optional\[str] IP address of the target Link to this property virtual\_network\_id: Optional\[str] (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6: Optional\[IPIPV6] The target’s IPv6 address ip\_addr: Optional\[str] IP address of the target Link to this property virtual\_network\_id: Optional\[str] (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: datetime Date and time at which the target was modified formatdate-time Link to this property tags: Optional\[Dict\[str, str]] Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_list_response%20%3E%20(schema)>)
class TargetGetResponse: … id: str Target identifier formatuuid maxLength36 Link to this property created\_at: datetime Date and time at which the target was created formatdate-time Link to this property hostname: str A non-unique field that refers to a target Link to this property
ip: IP The IPv4/IPv6 address that identifies where to reach a target
ipv4: Optional\[IPIPV4] The target’s IPv4 address ip\_addr: Optional\[str] IP address of the target Link to this property virtual\_network\_id: Optional\[str] (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6: Optional\[IPIPV6] The target’s IPv6 address ip\_addr: Optional\[str] IP address of the target Link to this property virtual\_network\_id: Optional\[str] (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: datetime Date and time at which the target was modified formatdate-time Link to this property tags: Optional\[Dict\[str, str]] Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_get_response%20%3E%20(schema)>)
class TargetCreateResponse: … id: str Target identifier formatuuid maxLength36 Link to this property created\_at: datetime Date and time at which the target was created formatdate-time Link to this property hostname: str A non-unique field that refers to a target Link to this property
ip: IP The IPv4/IPv6 address that identifies where to reach a target
ipv4: Optional\[IPIPV4] The target’s IPv4 address ip\_addr: Optional\[str] IP address of the target Link to this property virtual\_network\_id: Optional\[str] (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6: Optional\[IPIPV6] The target’s IPv6 address ip\_addr: Optional\[str] IP address of the target Link to this property virtual\_network\_id: Optional\[str] (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: datetime Date and time at which the target was modified formatdate-time Link to this property tags: Optional\[Dict\[str, str]] Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_create_response%20%3E%20(schema)>)
class TargetUpdateResponse: … id: str Target identifier formatuuid maxLength36 Link to this property created\_at: datetime Date and time at which the target was created formatdate-time Link to this property hostname: str A non-unique field that refers to a target Link to this property
ip: IP The IPv4/IPv6 address that identifies where to reach a target
ipv4: Optional\[IPIPV4] The target’s IPv4 address ip\_addr: Optional\[str] IP address of the target Link to this property virtual\_network\_id: Optional\[str] (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6: Optional\[IPIPV6] The target’s IPv6 address ip\_addr: Optional\[str] IP address of the target Link to this property virtual\_network\_id: Optional\[str] (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: datetime Date and time at which the target was modified formatdate-time Link to this property tags: Optional\[Dict\[str, str]] Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_update_response%20%3E%20(schema)>)
class TargetBulkUpdateResponse: … id: str Target identifier formatuuid maxLength36 Link to this property created\_at: datetime Date and time at which the target was created formatdate-time Link to this property hostname: str A non-unique field that refers to a target Link to this property
ip: IP The IPv4/IPv6 address that identifies where to reach a target
ipv4: Optional\[IPIPV4] The target’s IPv4 address ip\_addr: Optional\[str] IP address of the target Link to this property virtual\_network\_id: Optional\[str] (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6: Optional\[IPIPV6] The target’s IPv6 address ip\_addr: Optional\[str] IP address of the target Link to this property virtual\_network\_id: Optional\[str] (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: datetime Date and time at which the target was modified formatdate-time Link to this property tags: Optional\[Dict\[str, str]] Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_bulk_update_response%20%3E%20(schema)>) #### AccessApplications ##### [List Access applications](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/applications/methods/list) zero\_trust.access.applications.list(ApplicationListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[ApplicationListResponse]()] GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps ##### [Get an Access application](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/applications/methods/get) zero\_trust.access.applications.get([AppID]()app\_id, ApplicationGetParams\*\*kwargs) -> [ApplicationGetResponse]() GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Add an Access application](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/applications/methods/create) zero\_trust.access.applications.create(ApplicationCreateParams\*\*kwargs) -> [ApplicationCreateResponse]() POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps ##### [Update an Access application](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/applications/methods/update) zero\_trust.access.applications.update([AppID]()app\_id, ApplicationUpdateParams\*\*kwargs) -> [ApplicationUpdateResponse]() PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Delete an Access application](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/applications/methods/delete) zero\_trust.access.applications.delete([AppID]()app\_id, ApplicationDeleteParams\*\*kwargs) -> [ApplicationDeleteResponse]() DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Revoke application tokens](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/access/subresources/applications/methods/revoke_tokens) zero\_trust.access.applications.revoke\_tokens([AppID]()app\_id, ApplicationRevokeTokensParams\*\*kwargs) -> object POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/revoke\_tokens ##### ModelsExpand Collapse str [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_headers%20%3E%20(schema)>) str The identity providers selected for application. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_idps%20%3E%20(schema)>)
Literal\["GET", "POST", "HEAD", 6 more] One of the following: "GET" Link to this property "POST" Link to this property "HEAD" Link to this property "PUT" Link to this property "DELETE" Link to this property "CONNECT" Link to this property "OPTIONS" Link to this property "TRACE" Link to this property "PATCH" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_methods%20%3E%20(schema)>) str [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_origins%20%3E%20(schema)>) str Identifier. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20app_id%20%3E%20(schema)>)
Application One of the following:
class SelfHostedApplication: … domain: str The domain and path that Access will secure. Link to this property type: str The application type. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property allow\_iframe: Optional\[bool] Enables loading application content in an iFrame. Link to this property allowed\_idps: Optional\[List\[AllowedIdPs]] The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible: Optional\[bool] Displays the application in the App Launcher. Link to this property aud: Optional\[str] Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: Optional\[bool] When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property cors\_headers: Optional\[CORSHeaders] Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property custom\_deny\_message: Optional\[str] The custom error message shown to a user when they are denied access to the application. Link to this property custom\_deny\_url: Optional\[str] The custom URL a user is redirected to when they are denied access to the application. Link to this property eager\_redirect\_cookie\_setting: Optional\[bool] Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property enable\_binding\_cookie: Optional\[bool] Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property http\_only\_cookie\_attribute: Optional\[bool] Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property logo\_url: Optional\[str] The image URL for the logo shown in the App Launcher dashboard. Link to this property name: Optional\[str] The name of the application. Link to this property options\_preflight\_bypass: Optional\[bool] Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property same\_site\_cookie\_attribute: Optional\[str] Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
scim\_config: Optional\[SelfHostedApplicationSCIMConfig] Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: str The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: str The base URI for the application’s SCIM-compatible API. Link to this property
authentication: Optional\[SelfHostedApplicationSCIMConfigAuthentication] Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class SelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class SelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
List\[SelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2] Multiple authentication schemes One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class SelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class SelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: Optional\[bool] If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: Optional\[bool] Whether SCIM provisioning is turned on for this application. Link to this property
mappings: Optional\[List\[SCIMConfigMapping]] A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: str Which SCIM resource type this mapping applies to. Link to this property enabled: Optional\[bool] Whether or not this mapping is enabled. Link to this property filter: Optional\[str] A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: Optional\[Operations] Whether or not this mapping applies to creates, updates, or deletes. create: Optional\[bool] Whether or not this mapping applies to create (POST) operations. Link to this property delete: Optional\[bool] Whether or not this mapping applies to DELETE operations. Link to this property update: Optional\[bool] Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: Optional\[Literal\["strict", "passthrough"]] The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: Optional\[str] A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property service\_auth\_401\_redirect: Optional\[bool] Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property session\_duration: Optional\[str] The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property skip\_interstitial: Optional\[bool] Enables automatic authentication through cloudflared. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property use\_clientless\_isolation\_app\_launcher\_url: Optional\[bool] Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
class SaaSApplication: … id: Optional\[str] UUID. maxLength36 Link to this property allowed\_idps: Optional\[List\[AllowedIdPs]] The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible: Optional\[bool] Displays the application in the App Launcher. Link to this property aud: Optional\[str] Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: Optional\[bool] When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property logo\_url: Optional\[str] The image URL for the logo shown in the App Launcher dashboard. Link to this property name: Optional\[str] The name of the application. Link to this property
saas\_app: Optional\[SaaSApplicationSaaSApp] One of the following:
class SaaSApplicationSaaSAppAccessSAMLSaaSApp2: …
auth\_type: Optional\[Literal\["saml", "oidc"]] Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml” One of the following: "saml" Link to this property "oidc" Link to this property
Link to this property consumer\_service\_url: Optional\[str] The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property
custom\_attributes: Optional\[List\[SaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttribute]] friendly\_name: Optional\[str] The SAML FriendlyName of the attribute. Link to this property name: Optional\[str] The name of the attribute. Link to this property
name\_format: Optional\[Literal\["urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified", "urn:oasis:names:tc:SAML:2.0:attrname-format:basic", "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"]] A globally unique name for an identity or service provider. One of the following: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" Link to this property "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Link to this property "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Link to this property
Link to this property required: Optional\[bool] If the attribute is required when building a SAML assertion. Link to this property
source: Optional\[SaaSApplicationSaaSAppAccessSAMLSaaSApp2CustomAttributeSource] name: Optional\[str] The name of the IdP attribute. Link to this property name\_by\_idp: Optional\[Dict\[str, str]] A mapping from IdP ID to attribute name. Link to this property
Link to this property
Link to this property idp\_entity\_id: Optional\[str] The unique identifier for your SaaS application. Link to this property name\_id\_format: Optional\[SaaSAppNameIDFormat] The format of the name identifier sent to the SaaS application. Link to this property name\_id\_transform\_jsonata: Optional\[str] A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting. Link to this property public\_key: Optional\[str] The Access public certificate that will be used to verify your identity. Link to this property sp\_entity\_id: Optional\[str] A globally unique name for an identity or service provider. Link to this property sso\_endpoint: Optional\[str] The endpoint where your SaaS application will send login requests. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
Link to this property
class SaaSApplicationSaaSAppAccessOIDCSaaSApp2: … access\_token\_lifetime: Optional\[str] The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h. Link to this property allow\_pkce\_without\_client\_secret: Optional\[bool] If client secret should be required on the token endpoint when authorization\_code\_with\_pkce grant is used. Link to this property app\_launcher\_url: Optional\[str] The URL where this applications tile redirects users Link to this property
auth\_type: Optional\[Literal\["saml", "oidc"]] Identifier of the authentication protocol used for the saas app. Required for OIDC. One of the following: "saml" Link to this property "oidc" Link to this property
Link to this property client\_id: Optional\[str] The application client id Link to this property client\_secret: Optional\[str] The application client secret, only returned on POST request. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property
custom\_claims: Optional\[List\[SaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaim]] name: Optional\[str] The name of the claim. Link to this property required: Optional\[bool] If the claim is required when building an OIDC token. Link to this property
scope: Optional\[Literal\["groups", "profile", "email", "openid"]] The scope of the claim. One of the following: "groups" Link to this property "profile" Link to this property "email" Link to this property "openid" Link to this property
Link to this property
source: Optional\[SaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimSource] name: Optional\[str] The name of the IdP claim. Link to this property
name\_by\_idp: Optional\[List\[SaaSApplicationSaaSAppAccessOIDCSaaSApp2CustomClaimSourceNameByIdP]] A mapping from IdP ID to attribute name. idp\_id: Optional\[str] The UID of the IdP. Link to this property source\_name: Optional\[str] The name of the IdP provided attribute. Link to this property
Link to this property
Link to this property
Link to this property
grant\_types: Optional\[List\[Literal\["authorization\_code", "authorization\_code\_with\_pkce", "refresh\_tokens", 2 more]]] The OIDC flows supported by this application One of the following: "authorization\_code" Link to this property "authorization\_code\_with\_pkce" Link to this property "refresh\_tokens" Link to this property "hybrid" Link to this property "implicit" Link to this property
Link to this property group\_filter\_regex: Optional\[str] A regex to filter Cloudflare groups returned in ID token and userinfo endpoint. Link to this property
hybrid\_and\_implicit\_options: Optional\[SaaSApplicationSaaSAppAccessOIDCSaaSApp2HybridAndImplicitOptions] return\_access\_token\_from\_authorization\_endpoint: Optional\[bool] If an Access Token should be returned from the OIDC Authorization endpoint Link to this property return\_id\_token\_from\_authorization\_endpoint: Optional\[bool] If an ID Token should be returned from the OIDC Authorization endpoint Link to this property
Link to this property public\_key: Optional\[str] The Access public certificate that will be used to verify your identity. Link to this property redirect\_uris: Optional\[List\[str]] The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens Link to this property
refresh\_token\_options: Optional\[SaaSApplicationSaaSAppAccessOIDCSaaSApp2RefreshTokenOptions] lifetime: Optional\[str] How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m. Link to this property
Link to this property
scopes: Optional\[List\[Literal\["openid", "groups", "email", "profile"]]] Define the user information shared with access, “offline\_access” scope will be automatically enabled if refresh tokens are enabled One of the following: "openid" Link to this property "groups" Link to this property "email" Link to this property "profile" Link to this property
Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
Link to this property
Link to this property
scim\_config: Optional\[SaaSApplicationSCIMConfig] Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: str The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: str The base URI for the application’s SCIM-compatible API. Link to this property
authentication: Optional\[SaaSApplicationSCIMConfigAuthentication] Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class SaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class SaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
List\[SaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2] Multiple authentication schemes One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class SaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class SaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: Optional\[bool] If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: Optional\[bool] Whether SCIM provisioning is turned on for this application. Link to this property
mappings: Optional\[List\[SCIMConfigMapping]] A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: str Which SCIM resource type this mapping applies to. Link to this property enabled: Optional\[bool] Whether or not this mapping is enabled. Link to this property filter: Optional\[str] A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: Optional\[Operations] Whether or not this mapping applies to creates, updates, or deletes. create: Optional\[bool] Whether or not this mapping applies to create (POST) operations. Link to this property delete: Optional\[bool] Whether or not this mapping applies to DELETE operations. Link to this property update: Optional\[bool] Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: Optional\[Literal\["strict", "passthrough"]] The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: Optional\[str] A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property type: Optional\[str] The application type. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
Link to this property
class BrowserSSHApplication: … domain: str The domain and path that Access will secure. Link to this property type: str The application type. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property allow\_iframe: Optional\[bool] Enables loading application content in an iFrame. Link to this property allowed\_idps: Optional\[List\[AllowedIdPs]] The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible: Optional\[bool] Displays the application in the App Launcher. Link to this property aud: Optional\[str] Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: Optional\[bool] When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property cors\_headers: Optional\[CORSHeaders] Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property custom\_deny\_message: Optional\[str] The custom error message shown to a user when they are denied access to the application. Link to this property custom\_deny\_url: Optional\[str] The custom URL a user is redirected to when they are denied access to the application. Link to this property eager\_redirect\_cookie\_setting: Optional\[bool] Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property enable\_binding\_cookie: Optional\[bool] Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property http\_only\_cookie\_attribute: Optional\[bool] Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property logo\_url: Optional\[str] The image URL for the logo shown in the App Launcher dashboard. Link to this property name: Optional\[str] The name of the application. Link to this property options\_preflight\_bypass: Optional\[bool] Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property same\_site\_cookie\_attribute: Optional\[str] Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
scim\_config: Optional\[BrowserSSHApplicationSCIMConfig] Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: str The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: str The base URI for the application’s SCIM-compatible API. Link to this property
authentication: Optional\[BrowserSSHApplicationSCIMConfigAuthentication] Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class BrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class BrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
List\[BrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2] Multiple authentication schemes One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class BrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class BrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: Optional\[bool] If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: Optional\[bool] Whether SCIM provisioning is turned on for this application. Link to this property
mappings: Optional\[List\[SCIMConfigMapping]] A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: str Which SCIM resource type this mapping applies to. Link to this property enabled: Optional\[bool] Whether or not this mapping is enabled. Link to this property filter: Optional\[str] A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: Optional\[Operations] Whether or not this mapping applies to creates, updates, or deletes. create: Optional\[bool] Whether or not this mapping applies to create (POST) operations. Link to this property delete: Optional\[bool] Whether or not this mapping applies to DELETE operations. Link to this property update: Optional\[bool] Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: Optional\[Literal\["strict", "passthrough"]] The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: Optional\[str] A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property service\_auth\_401\_redirect: Optional\[bool] Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property session\_duration: Optional\[str] The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property skip\_interstitial: Optional\[bool] Enables automatic authentication through cloudflared. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property use\_clientless\_isolation\_app\_launcher\_url: Optional\[bool] Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
class BrowserVNCApplication: … domain: str The domain and path that Access will secure. Link to this property type: str The application type. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property allow\_iframe: Optional\[bool] Enables loading application content in an iFrame. Link to this property allowed\_idps: Optional\[List\[AllowedIdPs]] The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible: Optional\[bool] Displays the application in the App Launcher. Link to this property aud: Optional\[str] Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: Optional\[bool] When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property cors\_headers: Optional\[CORSHeaders] Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property custom\_deny\_message: Optional\[str] The custom error message shown to a user when they are denied access to the application. Link to this property custom\_deny\_url: Optional\[str] The custom URL a user is redirected to when they are denied access to the application. Link to this property eager\_redirect\_cookie\_setting: Optional\[bool] Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property enable\_binding\_cookie: Optional\[bool] Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property http\_only\_cookie\_attribute: Optional\[bool] Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property logo\_url: Optional\[str] The image URL for the logo shown in the App Launcher dashboard. Link to this property name: Optional\[str] The name of the application. Link to this property options\_preflight\_bypass: Optional\[bool] Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property same\_site\_cookie\_attribute: Optional\[str] Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
scim\_config: Optional\[BrowserVNCApplicationSCIMConfig] Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: str The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: str The base URI for the application’s SCIM-compatible API. Link to this property
authentication: Optional\[BrowserVNCApplicationSCIMConfigAuthentication] Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class BrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class BrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
List\[BrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2] Multiple authentication schemes One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class BrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class BrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: Optional\[bool] If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: Optional\[bool] Whether SCIM provisioning is turned on for this application. Link to this property
mappings: Optional\[List\[SCIMConfigMapping]] A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: str Which SCIM resource type this mapping applies to. Link to this property enabled: Optional\[bool] Whether or not this mapping is enabled. Link to this property filter: Optional\[str] A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: Optional\[Operations] Whether or not this mapping applies to creates, updates, or deletes. create: Optional\[bool] Whether or not this mapping applies to create (POST) operations. Link to this property delete: Optional\[bool] Whether or not this mapping applies to DELETE operations. Link to this property update: Optional\[bool] Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: Optional\[Literal\["strict", "passthrough"]] The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: Optional\[str] A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property service\_auth\_401\_redirect: Optional\[bool] Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property session\_duration: Optional\[str] The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property skip\_interstitial: Optional\[bool] Enables automatic authentication through cloudflared. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property use\_clientless\_isolation\_app\_launcher\_url: Optional\[bool] Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
class AppLauncherApplication: …
type: Literal\["self\_hosted", "saas", "ssh", 6 more] The application type. One of the following: "self\_hosted" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property
Link to this property id: Optional\[str] UUID. maxLength36 Link to this property allowed\_idps: Optional\[List\[AllowedIdPs]] The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property aud: Optional\[str] Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: Optional\[bool] When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property domain: Optional\[str] The domain and path that Access will secure. Link to this property name: Optional\[str] The name of the application. Link to this property
scim\_config: Optional\[AppLauncherApplicationSCIMConfig] Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: str The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: str The base URI for the application’s SCIM-compatible API. Link to this property
authentication: Optional\[AppLauncherApplicationSCIMConfigAuthentication] Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class AppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class AppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
List\[AppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2] Multiple authentication schemes One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class AppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class AppLauncherApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: Optional\[bool] If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: Optional\[bool] Whether SCIM provisioning is turned on for this application. Link to this property
mappings: Optional\[List\[SCIMConfigMapping]] A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: str Which SCIM resource type this mapping applies to. Link to this property enabled: Optional\[bool] Whether or not this mapping is enabled. Link to this property filter: Optional\[str] A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: Optional\[Operations] Whether or not this mapping applies to creates, updates, or deletes. create: Optional\[bool] Whether or not this mapping applies to create (POST) operations. Link to this property delete: Optional\[bool] Whether or not this mapping applies to DELETE operations. Link to this property update: Optional\[bool] Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: Optional\[Literal\["strict", "passthrough"]] The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: Optional\[str] A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property session\_duration: Optional\[str] The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
Link to this property
class DeviceEnrollmentPermissionsApplication: …
type: Literal\["self\_hosted", "saas", "ssh", 6 more] The application type. One of the following: "self\_hosted" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property
Link to this property id: Optional\[str] UUID. maxLength36 Link to this property allowed\_idps: Optional\[List\[AllowedIdPs]] The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property aud: Optional\[str] Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: Optional\[bool] When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property domain: Optional\[str] The domain and path that Access will secure. Link to this property name: Optional\[str] The name of the application. Link to this property
scim\_config: Optional\[DeviceEnrollmentPermissionsApplicationSCIMConfig] Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: str The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: str The base URI for the application’s SCIM-compatible API. Link to this property
authentication: Optional\[DeviceEnrollmentPermissionsApplicationSCIMConfigAuthentication] Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class DeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class DeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
List\[DeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2] Multiple authentication schemes One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class DeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class DeviceEnrollmentPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: Optional\[bool] If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: Optional\[bool] Whether SCIM provisioning is turned on for this application. Link to this property
mappings: Optional\[List\[SCIMConfigMapping]] A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: str Which SCIM resource type this mapping applies to. Link to this property enabled: Optional\[bool] Whether or not this mapping is enabled. Link to this property filter: Optional\[str] A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: Optional\[Operations] Whether or not this mapping applies to creates, updates, or deletes. create: Optional\[bool] Whether or not this mapping applies to create (POST) operations. Link to this property delete: Optional\[bool] Whether or not this mapping applies to DELETE operations. Link to this property update: Optional\[bool] Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: Optional\[Literal\["strict", "passthrough"]] The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: Optional\[str] A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property session\_duration: Optional\[str] The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
Link to this property
class BrowserIsolationPermissionsApplication: …
type: Literal\["self\_hosted", "saas", "ssh", 6 more] The application type. One of the following: "self\_hosted" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property
Link to this property id: Optional\[str] UUID. maxLength36 Link to this property allowed\_idps: Optional\[List\[AllowedIdPs]] The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property aud: Optional\[str] Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: Optional\[bool] When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property domain: Optional\[str] The domain and path that Access will secure. Link to this property name: Optional\[str] The name of the application. Link to this property
scim\_config: Optional\[BrowserIsolationPermissionsApplicationSCIMConfig] Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: str The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: str The base URI for the application’s SCIM-compatible API. Link to this property
authentication: Optional\[BrowserIsolationPermissionsApplicationSCIMConfigAuthentication] Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class BrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class BrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
List\[BrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2] Multiple authentication schemes One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class BrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class BrowserIsolationPermissionsApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: Optional\[bool] If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: Optional\[bool] Whether SCIM provisioning is turned on for this application. Link to this property
mappings: Optional\[List\[SCIMConfigMapping]] A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: str Which SCIM resource type this mapping applies to. Link to this property enabled: Optional\[bool] Whether or not this mapping is enabled. Link to this property filter: Optional\[str] A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: Optional\[Operations] Whether or not this mapping applies to creates, updates, or deletes. create: Optional\[bool] Whether or not this mapping applies to create (POST) operations. Link to this property delete: Optional\[bool] Whether or not this mapping applies to DELETE operations. Link to this property update: Optional\[bool] Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: Optional\[Literal\["strict", "passthrough"]] The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: Optional\[str] A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property session\_duration: Optional\[str] The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
Link to this property
class BookmarkApplication: … domain: str The URL or domain of the bookmark. Link to this property type: str The application type. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property app\_launcher\_visible: Optional\[bool] Link to this property aud: Optional\[str] Audience tag. maxLength64 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property logo\_url: Optional\[str] The image URL for the logo shown in the App Launcher dashboard. Link to this property name: Optional\[str] The name of the application. Link to this property
scim\_config: Optional\[BookmarkApplicationSCIMConfig] Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: str The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: str The base URI for the application’s SCIM-compatible API. Link to this property
authentication: Optional\[BookmarkApplicationSCIMConfigAuthentication] Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class BookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class BookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
List\[BookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2] Multiple authentication schemes One of the following:
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
class BookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationOAuthBearerToken2: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
class BookmarkApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication2AccessSCIMConfigAuthenticationAccessServiceToken: … Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: str Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: str Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: Literal\["access\_service\_token"] The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: Optional\[bool] If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: Optional\[bool] Whether SCIM provisioning is turned on for this application. Link to this property
mappings: Optional\[List\[SCIMConfigMapping]] A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: str Which SCIM resource type this mapping applies to. Link to this property enabled: Optional\[bool] Whether or not this mapping is enabled. Link to this property filter: Optional\[str] A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: Optional\[Operations] Whether or not this mapping applies to creates, updates, or deletes. create: Optional\[bool] Whether or not this mapping applies to create (POST) operations. Link to this property delete: Optional\[bool] Whether or not this mapping applies to DELETE operations. Link to this property update: Optional\[bool] Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: Optional\[Literal\["strict", "passthrough"]] The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: Optional\[str] A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application%20%3E%20(schema)>)
class ApplicationPolicy: … id: Optional\[str] The UUID of the policy maxLength36 Link to this property
approval\_groups: Optional\[List\[ApprovalGroup]] Administrators who can approve a temporary authentication request. approvals\_needed: float The number of approvals needed to obtain access. minimum0 Link to this property email\_addresses: Optional\[List\[str]] A list of emails that can approve the access request. Link to this property email\_list\_uuid: Optional\[str] The UUID of an re-usable email list. Link to this property
Link to this property approval\_required: Optional\[bool] Requires the user to request access from an administrator at the start of each session. Link to this property
connection\_rules: Optional\[ConnectionRules] The rules that define how users may connect to targets secured by your application.
rdp: Optional\[ConnectionRulesRDP] The RDP-specific rules that define clipboard behavior for RDP connections.
allowed\_clipboard\_local\_to\_remote\_formats: Optional\[List\[Literal\["text", "file"]]] Clipboard formats allowed when copying from local machine to remote RDP session. One of the following: "text" Link to this property "file" Link to this property
Link to this property
allowed\_clipboard\_remote\_to\_local\_formats: Optional\[List\[Literal\["text", "file"]]] Clipboard formats allowed when copying from remote RDP session to local machine. One of the following: "text" Link to this property "file" Link to this property
Link to this property
Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property decision: Optional\[Decision] The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Link to this property
exclude: Optional\[List\[AccessRule]] Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules. One of the following:
class GroupRule: … Matches an Access group.
group: Group id: str The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
class AnyValidServiceTokenRule: … Matches any valid Access Service Token any\_valid\_service\_token: AnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
class AccessAuthContextRule: … Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: AccessAuthContextRuleAuthContext id: str The ID of an Authentication context. Link to this property ac\_id: str The ACID of an Authentication context. Link to this property identity\_provider\_id: str The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
class AuthenticationMethodRule: … Enforce different MFA options
auth\_method: AuthMethod auth\_method: str The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
class AzureGroupRule: … Matches an Azure group. Requires an Azure identity provider.
azure\_ad: AzureAD id: str The ID of an Azure group. Link to this property identity\_provider\_id: str The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
class CertificateRule: … Matches any valid client certificate. certificate: Certificate Link to this property
Link to this property
class AccessCommonNameRule: … Matches a specific common name.
common\_name: AccessCommonNameRuleCommonName common\_name: str The common name to match. Link to this property
Link to this property
Link to this property
class CountryRule: … Matches a specific country
geo: Geo country\_code: str The country code that should be matched. Link to this property
Link to this property
Link to this property
class AccessDevicePostureRule: … Enforces a device posture rule has run successfully
device\_posture: DevicePosture integration\_uid: str The ID of a device posture integration. Link to this property account\_id: Optional\[str] The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
class DomainRule: … Match an entire email domain.
email\_domain: EmailDomain domain: str The email domain to match. Link to this property
Link to this property
Link to this property
class EmailListRule: … Matches an email address from a list.
email\_list: EmailList id: str The ID of a previously created email list. Link to this property
Link to this property
Link to this property
class EmailRule: … Matches a specific email.
email: Email email: str The email of the user. formatemail Link to this property
Link to this property
Link to this property
class EveryoneRule: … Matches everyone. everyone: Everyone An empty object which matches on all users. Link to this property
Link to this property
class ExternalEvaluationRule: … Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: ExternalEvaluation evaluate\_url: str The API endpoint containing your business logic. Link to this property keys\_url: str The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
class GitHubOrganizationRule: … Matches a Github organization. Requires a Github identity provider.
github\_organization: GitHubOrganization identity\_provider\_id: str The ID of your Github identity provider. Link to this property name: str The name of the organization. Link to this property team: Optional\[str] The name of the team Link to this property
Link to this property
Link to this property
class GSuiteGroupRule: … Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: GSuite email: str The email of the Google Workspace group. Link to this property identity\_provider\_id: str The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
class AccessLoginMethodRule: … Matches a specific identity provider id.
login\_method: AccessLoginMethodRuleLoginMethod id: str The ID of an identity provider. Link to this property
Link to this property
Link to this property
class IPListRule: … Matches an IP address from a list.
ip\_list: IPList id: str The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
class IPRule: … Matches an IP address block.
ip: IP ip: str An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
class OktaGroupRule: … Matches an Okta group. Requires an Okta identity provider.
okta: Okta identity\_provider\_id: str The ID of your Okta identity provider. Link to this property name: str The name of the Okta group. Link to this property
Link to this property
Link to this property
class SAMLGroupRule: … Matches a SAML group. Requires a SAML identity provider.
saml: SAML attribute\_name: str The name of the SAML attribute. Link to this property attribute\_value: str The SAML attribute value to look for. Link to this property identity\_provider\_id: str The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
class AccessOIDCClaimRule: … Matches an OIDC claim. Requires an OIDC identity provider.
oidc: AccessOIDCClaimRuleOIDC claim\_name: str The name of the OIDC claim. Link to this property claim\_value: str The OIDC claim value to look for. Link to this property identity\_provider\_id: str The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
class ServiceTokenRule: … Matches a specific Access Service Token
service\_token: ServiceToken token\_id: str The ID of a Service Token. Link to this property
Link to this property
Link to this property
class AccessLinkedAppTokenRule: … Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
linked\_app\_token: AccessLinkedAppTokenRuleLinkedAppToken app\_uid: str The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
class AccessUserRiskScoreRule: … Matches a user’s risk score.
user\_risk\_score: AccessUserRiskScoreRuleUserRiskScore
user\_risk\_score: List\[Literal\["low", "medium", "high", "unscored"]] A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "unscored" Link to this property
Link to this property
Link to this property
Link to this property
class AccessCloudflareAccountMemberRule: … Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
cloudflare\_account\_member: AccessCloudflareAccountMemberRuleCloudflareAccountMember account\_id: Optional\[str] Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property
include: Optional\[List\[AccessRule]] Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. One of the following:
class GroupRule: … Matches an Access group.
group: Group id: str The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
class AnyValidServiceTokenRule: … Matches any valid Access Service Token any\_valid\_service\_token: AnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
class AccessAuthContextRule: … Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: AccessAuthContextRuleAuthContext id: str The ID of an Authentication context. Link to this property ac\_id: str The ACID of an Authentication context. Link to this property identity\_provider\_id: str The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
class AuthenticationMethodRule: … Enforce different MFA options
auth\_method: AuthMethod auth\_method: str The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
class AzureGroupRule: … Matches an Azure group. Requires an Azure identity provider.
azure\_ad: AzureAD id: str The ID of an Azure group. Link to this property identity\_provider\_id: str The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
class CertificateRule: … Matches any valid client certificate. certificate: Certificate Link to this property
Link to this property
class AccessCommonNameRule: … Matches a specific common name.
common\_name: AccessCommonNameRuleCommonName common\_name: str The common name to match. Link to this property
Link to this property
Link to this property
class CountryRule: … Matches a specific country
geo: Geo country\_code: str The country code that should be matched. Link to this property
Link to this property
Link to this property
class AccessDevicePostureRule: … Enforces a device posture rule has run successfully
device\_posture: DevicePosture integration\_uid: str The ID of a device posture integration. Link to this property account\_id: Optional\[str] The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
class DomainRule: … Match an entire email domain.
email\_domain: EmailDomain domain: str The email domain to match. Link to this property
Link to this property
Link to this property
class EmailListRule: … Matches an email address from a list.
email\_list: EmailList id: str The ID of a previously created email list. Link to this property
Link to this property
Link to this property
class EmailRule: … Matches a specific email.
email: Email email: str The email of the user. formatemail Link to this property
Link to this property
Link to this property
class EveryoneRule: … Matches everyone. everyone: Everyone An empty object which matches on all users. Link to this property
Link to this property
class ExternalEvaluationRule: … Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: ExternalEvaluation evaluate\_url: str The API endpoint containing your business logic. Link to this property keys\_url: str The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
class GitHubOrganizationRule: … Matches a Github organization. Requires a Github identity provider.
github\_organization: GitHubOrganization identity\_provider\_id: str The ID of your Github identity provider. Link to this property name: str The name of the organization. Link to this property team: Optional\[str] The name of the team Link to this property
Link to this property
Link to this property
class GSuiteGroupRule: … Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: GSuite email: str The email of the Google Workspace group. Link to this property identity\_provider\_id: str The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
class AccessLoginMethodRule: … Matches a specific identity provider id.
login\_method: AccessLoginMethodRuleLoginMethod id: str The ID of an identity provider. Link to this property
Link to this property
Link to this property
class IPListRule: … Matches an IP address from a list.
ip\_list: IPList id: str The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
class IPRule: … Matches an IP address block.
ip: IP ip: str An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
class OktaGroupRule: … Matches an Okta group. Requires an Okta identity provider.
okta: Okta identity\_provider\_id: str The ID of your Okta identity provider. Link to this property name: str The name of the Okta group. Link to this property
Link to this property
Link to this property
class SAMLGroupRule: … Matches a SAML group. Requires a SAML identity provider.
saml: SAML attribute\_name: str The name of the SAML attribute. Link to this property attribute\_value: str The SAML attribute value to look for. Link to this property identity\_provider\_id: str The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
class AccessOIDCClaimRule: … Matches an OIDC claim. Requires an OIDC identity provider.
oidc: AccessOIDCClaimRuleOIDC claim\_name: str The name of the OIDC claim. Link to this property claim\_value: str The OIDC claim value to look for. Link to this property identity\_provider\_id: str The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
class ServiceTokenRule: … Matches a specific Access Service Token
service\_token: ServiceToken token\_id: str The ID of a Service Token. Link to this property
Link to this property
Link to this property
class AccessLinkedAppTokenRule: … Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
linked\_app\_token: AccessLinkedAppTokenRuleLinkedAppToken app\_uid: str The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
class AccessUserRiskScoreRule: … Matches a user’s risk score.
user\_risk\_score: AccessUserRiskScoreRuleUserRiskScore
user\_risk\_score: List\[Literal\["low", "medium", "high", "unscored"]] A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "unscored" Link to this property
Link to this property
Link to this property
Link to this property
class AccessCloudflareAccountMemberRule: … Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
cloudflare\_account\_member: AccessCloudflareAccountMemberRuleCloudflareAccountMember account\_id: Optional\[str] Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property isolation\_required: Optional\[bool] Require this application to be served in an isolated browser for users matching this policy. ‘Client Web Isolation’ must be on for the account in order to use this feature. Link to this property
mfa\_config: Optional\[MfaConfig] Configures multi-factor authentication (MFA) settings.
allowed\_authenticators: Optional\[List\[Literal\["totp", "biometrics", "security\_key"]]] Lists the MFA methods that users can authenticate with. One of the following: "totp" Link to this property "biometrics" Link to this property "security\_key" Link to this property
Link to this property mfa\_disabled: Optional\[bool] Indicates whether to disable MFA for this resource. This option is available at the application and policy level. Link to this property session\_duration: Optional\[str] Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property name: Optional\[str] The name of the Access policy. Link to this property purpose\_justification\_prompt: Optional\[str] A custom message that will appear on the purpose justification screen. Link to this property purpose\_justification\_required: Optional\[bool] Require users to enter a justification when they log in to the application. Link to this property
require: Optional\[List\[AccessRule]] Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules. One of the following:
class GroupRule: … Matches an Access group.
group: Group id: str The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
class AnyValidServiceTokenRule: … Matches any valid Access Service Token any\_valid\_service\_token: AnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
class AccessAuthContextRule: … Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: AccessAuthContextRuleAuthContext id: str The ID of an Authentication context. Link to this property ac\_id: str The ACID of an Authentication context. Link to this property identity\_provider\_id: str The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
class AuthenticationMethodRule: … Enforce different MFA options
auth\_method: AuthMethod auth\_method: str The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
class AzureGroupRule: … Matches an Azure group. Requires an Azure identity provider.
azure\_ad: AzureAD id: str The ID of an Azure group. Link to this property identity\_provider\_id: str The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
class CertificateRule: … Matches any valid client certificate. certificate: Certificate Link to this property
Link to this property
class AccessCommonNameRule: … Matches a specific common name.
common\_name: AccessCommonNameRuleCommonName common\_name: str The common name to match. Link to this property
Link to this property
Link to this property
class CountryRule: … Matches a specific country
geo: Geo country\_code: str The country code that should be matched. Link to this property
Link to this property
Link to this property
class AccessDevicePostureRule: … Enforces a device posture rule has run successfully
device\_posture: DevicePosture integration\_uid: str The ID of a device posture integration. Link to this property account\_id: Optional\[str] The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
class DomainRule: … Match an entire email domain.
email\_domain: EmailDomain domain: str The email domain to match. Link to this property
Link to this property
Link to this property
class EmailListRule: … Matches an email address from a list.
email\_list: EmailList id: str The ID of a previously created email list. Link to this property
Link to this property
Link to this property
class EmailRule: … Matches a specific email.
email: Email email: str The email of the user. formatemail Link to this property
Link to this property
Link to this property
class EveryoneRule: … Matches everyone. everyone: Everyone An empty object which matches on all users. Link to this property
Link to this property
class ExternalEvaluationRule: … Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: ExternalEvaluation evaluate\_url: str The API endpoint containing your business logic. Link to this property keys\_url: str The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
class GitHubOrganizationRule: … Matches a Github organization. Requires a Github identity provider.
github\_organization: GitHubOrganization identity\_provider\_id: str The ID of your Github identity provider. Link to this property name: str The name of the organization. Link to this property team: Optional\[str] The name of the team Link to this property
Link to this property
Link to this property
class GSuiteGroupRule: … Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: GSuite email: str The email of the Google Workspace group. Link to this property identity\_provider\_id: str The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
class AccessLoginMethodRule: … Matches a specific identity provider id.
login\_method: AccessLoginMethodRuleLoginMethod id: str The ID of an identity provider. Link to this property
Link to this property
Link to this property
class IPListRule: … Matches an IP address from a list.
ip\_list: IPList id: str The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
class IPRule: … Matches an IP address block.
ip: IP ip: str An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
class OktaGroupRule: … Matches an Okta group. Requires an Okta identity provider.
okta: Okta identity\_provider\_id: str The ID of your Okta identity provider. Link to this property name: str The name of the Okta group. Link to this property
Link to this property
Link to this property
class SAMLGroupRule: … Matches a SAML group. Requires a SAML identity provider.
saml: SAML attribute\_name: str The name of the SAML attribute. Link to this property attribute\_value: str The SAML attribute value to look for. Link to this property identity\_provider\_id: str The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
class AccessOIDCClaimRule: … Matches an OIDC claim. Requires an OIDC identity provider.
oidc: AccessOIDCClaimRuleOIDC claim\_name: str The name of the OIDC claim. Link to this property claim\_value: str The OIDC claim value to look for. Link to this property identity\_provider\_id: str The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
class ServiceTokenRule: … Matches a specific Access Service Token
service\_token: ServiceToken token\_id: str The ID of a Service Token. Link to this property
Link to this property
Link to this property
class AccessLinkedAppTokenRule: … Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
linked\_app\_token: AccessLinkedAppTokenRuleLinkedAppToken app\_uid: str The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
class AccessUserRiskScoreRule: … Matches a user’s risk score.
user\_risk\_score: AccessUserRiskScoreRuleUserRiskScore
user\_risk\_score: List\[Literal\["low", "medium", "high", "unscored"]] A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "unscored" Link to this property
Link to this property
Link to this property
Link to this property
class AccessCloudflareAccountMemberRule: … Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
cloudflare\_account\_member: AccessCloudflareAccountMemberRuleCloudflareAccountMember account\_id: Optional\[str] Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property session\_duration: Optional\[str] The amount of time that tokens issued for the application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application_policy%20%3E%20(schema)>)
Literal\["self\_hosted", "end\_user", "saas", 12 more] The application type. One of the following: "self\_hosted" Link to this property "end\_user" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property "infrastructure" Link to this property "rdp" Link to this property "mcp" Link to this property "mcp\_portal" Link to this property "proxy\_endpoint" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application_type%20%3E%20(schema)>)
class CORSHeaders: … allow\_all\_headers: Optional\[bool] Allows all HTTP request headers. Link to this property allow\_all\_methods: Optional\[bool] Allows all HTTP request methods. Link to this property allow\_all\_origins: Optional\[bool] Allows all origins. Link to this property allow\_credentials: Optional\[bool] When set to true, includes credentials (cookies, authorization headers, or TLS client certificates) with requests. Link to this property allowed\_headers: Optional\[List\[AllowedHeaders]] Allowed HTTP request headers. Link to this property
allowed\_methods: Optional\[List\[AllowedMethods]] Allowed HTTP request methods. One of the following: "GET" Link to this property "POST" Link to this property "HEAD" Link to this property "PUT" Link to this property "DELETE" Link to this property "CONNECT" Link to this property "OPTIONS" Link to this property "TRACE" Link to this property "PATCH" Link to this property
Link to this property allowed\_origins: Optional\[List\[AllowedOrigins]] Allowed origins. Link to this property max\_age: Optional\[float] The maximum number of seconds the results of a preflight request can be cached. maximum86400 minimum-1 Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20cors_headers%20%3E%20(schema)>)
Literal\["allow", "deny", "non\_identity", "bypass"] The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. One of the following: "allow" Link to this property "deny" Link to this property "non\_identity" Link to this property "bypass" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20decision%20%3E%20(schema)>)
class OIDCSaaSApp: … access\_token\_lifetime: Optional\[str] The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h. Link to this property allow\_pkce\_without\_client\_secret: Optional\[bool] If client secret should be required on the token endpoint when authorization\_code\_with\_pkce grant is used. Link to this property app\_launcher\_url: Optional\[str] The URL where this applications tile redirects users Link to this property
auth\_type: Optional\[Literal\["saml", "oidc"]] Identifier of the authentication protocol used for the saas app. Required for OIDC. One of the following: "saml" Link to this property "oidc" Link to this property
Link to this property client\_id: Optional\[str] The application client id Link to this property client\_secret: Optional\[str] The application client secret, only returned on POST request. Link to this property
custom\_claims: Optional\[List\[CustomClaim]] name: Optional\[str] The name of the claim. Link to this property required: Optional\[bool] If the claim is required when building an OIDC token. Link to this property
scope: Optional\[Literal\["groups", "profile", "email", "openid"]] The scope of the claim. One of the following: "groups" Link to this property "profile" Link to this property "email" Link to this property "openid" Link to this property
Link to this property
source: Optional\[CustomClaimSource] name: Optional\[str] The name of the IdP claim. Link to this property name\_by\_idp: Optional\[Dict\[str, str]] A mapping from IdP ID to claim name. Link to this property
Link to this property
Link to this property
grant\_types: Optional\[List\[Literal\["authorization\_code", "authorization\_code\_with\_pkce", "refresh\_tokens", 2 more]]] The OIDC flows supported by this application One of the following: "authorization\_code" Link to this property "authorization\_code\_with\_pkce" Link to this property "refresh\_tokens" Link to this property "hybrid" Link to this property "implicit" Link to this property
Link to this property group\_filter\_regex: Optional\[str] A regex to filter Cloudflare groups returned in ID token and userinfo endpoint Link to this property
hybrid\_and\_implicit\_options: Optional\[HybridAndImplicitOptions] return\_access\_token\_from\_authorization\_endpoint: Optional\[bool] If an Access Token should be returned from the OIDC Authorization endpoint Link to this property return\_id\_token\_from\_authorization\_endpoint: Optional\[bool] If an ID Token should be returned from the OIDC Authorization endpoint Link to this property
Link to this property public\_key: Optional\[str] The Access public certificate that will be used to verify your identity. Link to this property redirect\_uris: Optional\[List\[str]] The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens Link to this property
refresh\_token\_options: Optional\[RefreshTokenOptions] lifetime: Optional\[str] How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m. Link to this property
Link to this property
scopes: Optional\[List\[Literal\["openid", "groups", "email", "profile"]]] Define the user information shared with access, “offline\_access” scope will be automatically enabled if refresh tokens are enabled One of the following: "openid" Link to this property "groups" Link to this property "email" Link to this property "profile" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20oidc_saas_app%20%3E%20(schema)>)
Literal\["id", "email"] The format of the name identifier sent to the SaaS application. One of the following: "id" Link to this property "email" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20saas_app_name_id_format%20%3E%20(schema)>)
class SAMLSaaSApp: …
auth\_type: Optional\[Literal\["saml", "oidc"]] Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml” One of the following: "saml" Link to this property "oidc" Link to this property
Link to this property consumer\_service\_url: Optional\[str] The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion. Link to this property
custom\_attributes: Optional\[List\[CustomAttribute]] friendly\_name: Optional\[str] The SAML FriendlyName of the attribute. Link to this property name: Optional\[str] The name of the attribute. Link to this property
name\_format: Optional\[Literal\["urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified", "urn:oasis:names:tc:SAML:2.0:attrname-format:basic", "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"]] A globally unique name for an identity or service provider. One of the following: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" Link to this property "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Link to this property "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Link to this property
Link to this property required: Optional\[bool] If the attribute is required when building a SAML assertion. Link to this property
source: Optional\[CustomAttributeSource] name: Optional\[str] The name of the IdP attribute. Link to this property
name\_by\_idp: Optional\[List\[CustomAttributeSourceNameByIdP]] A mapping from IdP ID to attribute name. idp\_id: Optional\[str] The UID of the IdP. Link to this property source\_name: Optional\[str] The name of the IdP provided attribute. Link to this property
Link to this property
Link to this property
Link to this property default\_relay\_state: Optional\[str] The URL that the user will be redirected to after a successful login for IDP initiated logins. Link to this property idp\_entity\_id: Optional\[str] The unique identifier for your SaaS application. Link to this property name\_id\_format: Optional\[SaaSAppNameIDFormat] The format of the name identifier sent to the SaaS application. Link to this property name\_id\_transform\_jsonata: Optional\[str] A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting. Link to this property public\_key: Optional\[str] The Access public certificate that will be used to verify your identity. Link to this property saml\_attribute\_transform\_jsonata: Optional\[str] A \[JSONata] (https://jsonata.org/) expression that transforms an application’s user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml\_attributes or oidc\_fields of the identity provider used to authenticate. The output of this expression must be a JSON object. Link to this property sp\_entity\_id: Optional\[str] A globally unique name for an identity or service provider. Link to this property sso\_endpoint: Optional\[str] The endpoint where your SaaS application will send login requests. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20saml_saas_app%20%3E%20(schema)>)
class SCIMConfigAuthenticationHTTPBasic: … Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: str Password used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["httpbasic"] The authentication scheme to use when making SCIM requests to this application. Link to this property user: str User name used to authenticate with the remote SCIM service. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_http_basic%20%3E%20(schema)>)
class SCIMConfigAuthenticationOAuthBearerToken: … Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: str Token used to authenticate with the remote SCIM service. Link to this property scheme: Literal\["oauthbearertoken"] The authentication scheme to use when making SCIM requests to this application. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_oauth_bearer_token%20%3E%20(schema)>)
class SCIMConfigAuthenticationOauth2: … Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: str URL used to generate the auth code used during token generation. Link to this property client\_id: str Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: str Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: Literal\["oauth2"] The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: str URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: Optional\[List\[str]] The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_oauth2%20%3E%20(schema)>)
class SCIMConfigMapping: … Transformations and filters applied to resources before they are provisioned in the remote SCIM service. schema: str Which SCIM resource type this mapping applies to. Link to this property enabled: Optional\[bool] Whether or not this mapping is enabled. Link to this property filter: Optional\[str] A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: Optional\[Operations] Whether or not this mapping applies to creates, updates, or deletes. create: Optional\[bool] Whether or not this mapping applies to create (POST) operations. Link to this property delete: Optional\[bool] Whether or not this mapping applies to DELETE operations. Link to this property update: Optional\[bool] Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: Optional\[Literal\["strict", "passthrough"]] The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: Optional\[str] A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_mapping%20%3E%20(schema)>) str A domain that Access will secure. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20self_hosted_domains%20%3E%20(schema)>)
ApplicationListResponse One of the following:
class EndUserApplication: …
oauth\_configuration: EndUserApplicationOAuthConfiguration **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support RFC 8707 (Resource Indicators for OAuth 2.0). This feature is currently in beta.
dynamic\_client\_registration: Optional\[EndUserApplicationOAuthConfigurationDynamicClientRegistration] Settings for OAuth dynamic client registration. allow\_any\_on\_localhost: Optional\[bool] Allows any client with redirect URIs on localhost. Link to this property allow\_any\_on\_loopback: Optional\[bool] Allows any client with redirect URIs on 127.0.0.1. Link to this property allowed\_uris: Optional\[List\[str]] The URIs that are allowed as redirect URIs for dynamically registered clients. HTTP and HTTPS paths may end in /* to match all sub-paths. Custom-scheme URIs must be explicitly configured and match exactly. Link to this property enabled: Optional\[bool] Whether dynamic client registration is enabled. Link to this property
Link to this property enabled: Optional\[Literal\[true]] Managed OAuth is required for end user applications and cannot be disabled. Link to this property
grant: Optional\[EndUserApplicationOAuthConfigurationGrant] Settings for OAuth grant behavior. access\_token\_lifetime: Optional\[str] The lifetime of the access token. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h. Link to this property session\_duration: Optional\[str] The duration of the OAuth session. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h. Link to this property
Link to this property
Link to this property
type: Literal\["self\_hosted", "end\_user", "saas", 12 more] The application type. One of the following: "self\_hosted" Link to this property "end\_user" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property "infrastructure" Link to this property "rdp" Link to this property "mcp" Link to this property "mcp\_portal" Link to this property "proxy\_endpoint" Link to this property
Link to this property user\_populations: List\[str] The single user population associated with this application. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property allowed\_idps: Optional\[List\[AllowedIdPs]] The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property aud: Optional\[str] Audience tag. maxLength64 Link to this property
destinations: Optional\[List\[EndUserApplicationDestination]] Public hostname and Workers destinations secured by Access. One of the following:
class EndUserApplicationDestinationAccessEndUserPublicDestination: … uri: str The public hostname and optional path to secure. Link to this property
overrides: Optional\[List\[EndUserApplicationDestinationAccessEndUserPublicDestinationOverride]] Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: Literal\["public"] The behavior to apply to matching requests. Link to this property path\_pattern: str The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property type: Optional\[Literal\["public"]] Link to this property
Link to this property
class EndUserApplicationDestinationAccessEndUserWorkerDestination: … type: Literal\["worker"] Link to this property worker\_id: str The ID of the Cloudflare Worker to secure. Link to this property
overrides: Optional\[List\[EndUserApplicationDestinationAccessEndUserWorkerDestinationOverride]] Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: Literal\["public"] The behavior to apply to matching requests. Link to this property path\_pattern: str The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
class EndUserApplicationDestinationAccessEndUserPreviewWorkerDestination: … type: Literal\["preview\_worker"] Link to this property worker\_id: str The ID of the Cloudflare Worker whose previews to secure. Link to this property
overrides: Optional\[List\[EndUserApplicationDestinationAccessEndUserPreviewWorkerDestinationOverride]] Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: Literal\["public"] The behavior to apply to matching requests. Link to this property path\_pattern: str The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
class EndUserApplicationDestinationAccessEndUserAllWorkersDestination: … type: Literal\["all\_workers"] Link to this property
overrides: Optional\[List\[EndUserApplicationDestinationAccessEndUserAllWorkersDestinationOverride]] Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: Literal\["public"] The behavior to apply to matching requests. Link to this property path\_pattern: str The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
class EndUserApplicationDestinationAccessEndUserAllPreviewWorkersDestination: … type: Literal\["all\_preview\_workers"] Link to this property
overrides: Optional\[List\[EndUserApplicationDestinationAccessEndUserAllPreviewWorkersDestinationOverride]] Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: Literal\["public"] The behavior to apply to matching requests. Link to this property path\_pattern: str The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
Link to this property domain: Optional\[str] The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher. Link to this property name: Optional\[str] The name of the application. Link to this property Deprecatedself\_hosted\_domains: Optional\[List\[SelfHostedDomains]] List of public domains that Access will secure. This field is deprecated in favor of destinations and will be supported until **November 21, 2025.** If destinations are provided, then self_hosted_domains will be ignored. Link to this property
Link to this property
class SelfHostedApplication: … domain: str The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher. Link to this property type: ApplicationType The application type. Link to this property id: Optional\[str] UUID. maxLength36 Link to this property allow\_authenticate\_via\_warp: Optional\[bool] When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication. Link to this property allow\_iframe: Optional\[bool] Enables loading application content in an iFrame. Link to this property allowed\_idps: Optional\[List\[AllowedIdPs]] The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible: Optional\[bool] Displays the application in the App Launcher. Link to this property aud: Optional\[str] Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: Optional\[bool] When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property cors\_headers: Optional\[CORSHeaders] Link to this property custom\_deny\_message: Optional\[str] The custom error message shown to a user when they are denied access to the application. Link to this property custom\_deny\_url: Optional\[str] The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules. Link to this property custom\_non\_identity\_deny\_url: Optional\[str] The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules. Link to this property custom\_pages: Optional\[List\[str]] The custom pages that will be displayed when applicable for this application Link to this property
destinations: Optional\[List\[SelfHostedApplicationDestination]] List of destinations secured by Access. This supersedes self_hosted_domains to allow for more flexibility in defining different types of domains. If destinations are provided, then self_hosted_domains will be ignored. One of the following:
class SelfHostedApplicationDestinationPublicDestination: … A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard ’\*’ can be used in the definition.
overrides: Optional\[List\[SelfHostedApplicationDestinationPublicDestinationOverride]] Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: Literal\["public"] The behavior to apply to matching requests. Link to this property path\_pattern: str The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property type: Optional\[Literal\["public"]] Link to this property uri: Optional\[str] The URI of the destination. Public destinations’ URIs can include a domain and path with wildcards. Link to this property
Link to this property
class SelfHostedApplicationDestinationPrivateDestination: … cidr: Optional\[str] The CIDR range of the destination. Single IPs will be computed as /32. Link to this property hostname: Optional\[str] The hostname of the destination. Matches a valid SNI served by an HTTPS origin. Link to this property
l4\_protocol: Optional\[Literal\["tcp", "udp"]] The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match. One of the following: "tcp" Link to this property "udp" Link to this property
Link to this property port\_range: Optional\[str] The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match. Link to this property type: Optional\[Literal\["private"]] Link to this property vnet\_id: Optional\[str] The VNET ID to match the destination. When omitted, all VNETs will match. Link to this property
Link to this property
class SelfHostedApplicationDestinationViaMcpServerPortalDestination: … A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal. mcp\_server\_id: Optional\[str] The MCP server id configured in ai-controls. Link to this property type: Optional\[Literal\["via\_mcp\_server\_portal"]] Link to this property
Link to this property
class SelfHostedApplicationDestinationWorkerDestination: … A specific Cloudflare Worker that Access will secure. All requests routed to the specified Worker, including its preview deployments, will be protected. The preview_worker and public destination types takes precedence, so you can create separate applications to override the policies for the Worker’s previews or specific paths. type: Literal\["worker"] Link to this property worker\_id: str The ID of the Cloudflare Worker to protect with Access. Link to this property
overrides: Optional\[List\[SelfHostedApplicationDestinationWorkerDestinationOverride]] Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: Literal\["public"] The behavior to apply to matching requests. Link to this property path\_pattern: str The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
class SelfHostedApplicationDestinationPreviewWorkerDestination: … A specific Cloudflare Worker whose preview deployments Access will secure. Only requests routed to the preview deployments of the specified Worker will be protected. The public destination type takes precedence, so you can create separate applications to override the policies for specific paths. type: Literal\["preview\_worker"] Link to this property worker\_id: str The ID of the Cloudflare Worker whose preview deployments to protect with Access. Link to this property
overrides: Optional\[List\[SelfHostedApplicationDestinationPreviewWorkerDestinationOverride]] Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: Literal\["public"] The behavior to apply to matching requests. Link to this property path\_pattern: str The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
class SelfHostedApplicationDestinationAllWorkersDestination: … Protects all Cloudflare Workers on the account with Access, including their preview deployments. At most one destination of this type can exist per account. The worker, preview_worker, all_preview_workers, and public destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths. type: Literal\["all\_workers"] Link to this property
overrides: Optional\[List\[SelfHostedApplicationDestinationAllWorkersDestinationOverride]] Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: Literal\["public"] The behavior to apply to matching requests. Link to this property path\_pattern: str The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
class SelfHostedApplicationDestinationAllPreviewWorkersDestination: … Protects the preview deployments of all Cloudflare Workers on the account with Access. At most one destination of this type can exist per account. The worker, preview_worker, and public destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths. type: Literal\["all\_preview\_workers"] Link to this property
overrides: Optional\[List\[SelfHostedApplicationDestinationAllPreviewWorkersDestinationOverride]] Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: Literal\["public"] The behavior to apply to matching requests. Link to this property path\_pattern: str The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
Link to this property eager\_redirect\_cookie\_setting: Optional\[bool] Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property enable\_binding\_cookie: Optional\[bool] Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property http\_only\_cookie\_attribute: Optional\[bool] Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property logo\_url: Optional\[str] The image URL for the logo shown in the App Launcher dashboard. Link to this property
mfa\_config: Optional\[SelfHostedApplicationMfaConfig] Configures multi-factor authentication (MFA) settings.
allowed\_authenticators: Optional\[List\[Literal\["totp", "biometrics", "security\_key"]]] Lists the MFA methods that users can authenticate with. One of the following: "totp" Link to this property "biometrics" Link to this property "security\_key" Link to this property
Link to this property mfa\_disabled: Optional\[bool] Indicates whether to disable MFA for this resource. This option is available at the application and policy level. Link to this property session\_duration: Optional\[str] Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property name: Optional\[str] The name of the application. Link to this property
oauth\_configuration: Optional\[SelfHostedApplicationOAuthConfiguration] **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support RFC 8707 (Resource Indicators for OAuth 2.0). This feature is currently in beta.
dynamic\_client\_registration: Optional\[SelfHostedApplicationOAuthConfigurationDynamicClientRegistration] Settings for OAuth dynamic client registration. allow\_any\_on\_localhost: Optional\[bool] Allows any client with redirect URIs on localhost. Link to this property allow\_any\_on\_loopback: Optional\[bool] Allows any client with redirect URIs on 127.0.0.1. Link to this property allowed\_uris: Optional\[List\[str]] The URIs that are allowed as redirect URIs for dynamically registered clients. HTTP and HTTPS paths may end in /* to match all sub-paths. Custom-scheme URIs must be explicitly configured and match exactly. Link to this property enabled: Optional\[bool] Whether dynamic client registration is enabled. Link to this property
Link to this property enabled: Optional\[bool] Whether the OAuth configuration is enabled for this application. When set to false, Access will not handle OAuth for this application. Defaults to true if omitted. Link to this property
grant: Optional\[SelfHostedApplicationOAuthConfigurationGrant] Settings for OAuth grant behavior. access\_token\_lifetime: Optional\[str] The lifetime of the access token. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h. Link to this property session\_duration: Optional\[str] The duration of the OAuth session. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h. Link to this property
Link to this property
Link to this property options\_preflight\_bypass: Optional\[bool] Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property path\_cookie\_attribute: Optional\[bool] Enables cookie paths to scope an application’s JWT to the application path. If disabled, the JWT will scope to the hostname by default Link to this property
policies: Optional\[List\[SelfHostedApplicationPolicy]] id: Optional\[str] The UUID of the policy maxLength36 Link to this property account\_id: Optional\[str] Identifier. maxLength32 Link to this property
approval\_groups: Optional\[List\[ApprovalGroup]] Administrators who can approve a temporary authentication request. approvals\_needed: float The number of approvals needed to obtain access. minimum0 Link to this property email\_addresses: Optional\[List\[str]] A list of emails that can approve the access request. Link to this property email\_list\_uuid: Optional\[str] The UUID of an re-usable email list. Link to this property
Link to this property approval\_required: Optional\[bool] Requires the user to request access from an administrator at the start of each session. Link to this property
connection\_rules: Optional\[SelfHostedApplicationPolicyConnectionRules] The rules that define how users may connect to targets secured by your application.
rdp: Optional\[SelfHostedApplicationPolicyConnectionRulesRDP] The RDP-specific rules that define clipboard behavior for RDP connections.
allowed\_clipboard\_local\_to\_remote\_formats: Optional\[List\[Literal\["text", "file"]]] Clipboard formats allowed when copying from local machine to remote RDP session. One of the following: "text" Link to this property "file" Link to this property
Link to this property
allowed\_clipboard\_remote\_to\_local\_formats: Optional\[List\[Literal\["text", "file"]]] Clipboard formats allowed when copying from remote RDP session to local machine. One of the following: "text" Link to this property "file" Link to this property
Link to this property
Link to this property
Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property decision: Optional\[Decision] The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Link to this property
exclude: Optional\[List\[AccessRule]] Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules. One of the following:
class GroupRule: … Matches an Access group.
group: Group id: str The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
class AnyValidServiceTokenRule: … Matches any valid Access Service Token any\_valid\_service\_token: AnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
class AccessAuthContextRule: … Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: AccessAuthContextRuleAuthContext id: str The ID of an Authentication context. Link to this property ac\_id: str The ACID of an Authentication context. Link to this property identity\_provider\_id: str The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
class AuthenticationMethodRule: … Enforce different MFA options
auth\_method: AuthMethod auth\_method: str The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
class AzureGroupRule: … Matches an Azure group. Requires an Azure identity provider.
azure\_ad: AzureAD id: str The ID of an Azure group. Link to this property identity\_provider\_id: str The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
class CertificateRule: … Matches any valid client certificate. certificate: Certificate Link to this property
Link to this property
class AccessCommonNameRule: … Matches a specific common name.
common\_name: AccessCommonNameRuleCommonName common\_name: str The common name to match. Link to this property
Link to this property
Link to this property
class CountryRule: … Matches a specific country
geo: Geo country\_code: str The country code that should be matched. Link to this property
Link to this property
Link to this property
class AccessDevicePostureRule: … Enforces a device posture rule has run successfully
device\_posture: DevicePosture integration\_uid: str The ID of a device posture integration. Link to this property account\_id: Optional\[str] The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
class DomainRule: … Match an entire email domain.
email\_domain: EmailDomain domain: str The email domain to match. Link to this property
Link to this property
Link to this property
class EmailListRule: … Matches an email address from a list.
email\_list: EmailList id: str The ID of a previously created email list. Link to this property
Link to this property
Link to this property
class EmailRule: … Matches a specific email.
email: Email email: str The email of the user. formatemail Link to this property
Link to this property
Link to this property
class EveryoneRule: … Matches everyone. everyone: Everyone An empty object which matches on all users. Link to this property
Link to this property
class ExternalEvaluationRule: … Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: ExternalEvaluation evaluate\_url: str The API endpoint containing your business logic. Link to this property keys\_url: str The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
class GitHubOrganizationRule: … Matches a Github organization. Requires a Github identity provider.
github\_organization: GitHubOrganization identity\_provider\_id: str The ID of your Github identity provider. Link to this property name: str The name of the organization. Link to this property team: Optional\[str] The name of the team Link to this property
Link to this property
Link to this property
class GSuiteGroupRule: … Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: GSuite email: str The email of the Google Workspace group. Link to this property identity\_provider\_id: str The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
class AccessLoginMethodRule: … Matches a specific identity provider id.
login\_method: AccessLoginMethodRuleLoginMethod id: str The ID of an identity provider. Link to this property
Link to this property
Link to this property
class IPListRule: … Matches an IP address from a list.
ip\_list: IPList id: str The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
class IPRule: … Matches an IP address block.
ip: IP ip: str An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
class OktaGroupRule: … Matches an Okta group. Requires an Okta identity provider.
okta: Okta identity\_provider\_id: str The ID of your Okta identity provider. Link to this property name: str The name of the Okta group. Link to this property
Link to this property
Link to this property
class SAMLGroupRule: … Matches a SAML group. Requires a SAML identity provider.
saml: SAML attribute\_name: str The name of the SAML attribute. Link to this property attribute\_value: str The SAML attribute value to look for. Link to this property identity\_provider\_id: str The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
class AccessOIDCClaimRule: … Matches an OIDC claim. Requires an OIDC identity provider.
oidc: AccessOIDCClaimRuleOIDC claim\_name: str The name of the OIDC claim. Link to this property claim\_value: str The OIDC claim value to look for. Link to this property identity\_provider\_id: str The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
class ServiceTokenRule: … Matches a specific Access Service Token
service\_token: ServiceToken token\_id: str The ID of a Service Token. Link to this property
Link to this property
Link to this property
class AccessLinkedAppTokenRule: … Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
linked\_app\_token: AccessLinkedAppTokenRuleLinkedAppToken app\_uid: str The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
class AccessUserRiskScoreRule: … Matches a user’s risk score.
user\_risk\_score: AccessUserRiskScoreRuleUserRiskScore
user\_risk\_score: List\[Literal\["low", "medium", "high", "unscored"]] A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "unscored" Link to this property
Link to this property
Link to this property
Link to this property
class AccessCloudflareAccountMemberRule: … Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
cloudflare\_account\_member: AccessCloudflareAccountMemberRuleCloudflareAccountMember account\_id: Optional\[str] Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property
include: Optional\[List\[AccessRule]] Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. One of the following:
class GroupRule: … Matches an Access group.
group: Group id: str The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
class AnyValidServiceTokenRule: … Matches any valid Access Service Token any\_valid\_service\_token: AnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
class AccessAuthContextRule: … Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: AccessAuthContextRuleAuthContext id: str The ID of an Authentication context. Link to this property ac\_id: str The ACID of an Authentication context. Link to this property identity\_provider\_id: str The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
class AuthenticationMethodRule: … Enforce different MFA options
auth\_method: AuthMethod auth\_method: str The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
class AzureGroupRule: … Matches an Azure group. Requires an Azure identity provider.
azure\_ad: AzureAD id: str The ID of an Azure group. Link to this property identity\_provider\_id: str The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
class CertificateRule: … Matches any valid client certificate. certificate: Certificate Link to this property
Link to this property
class AccessCommonNameRule: … Matches a specific common name.
common\_name: AccessCommonNameRuleCommonName common\_name: str The common name to match. Link to this property
Link to this property
Link to this property
class CountryRule: … Matches a specific country
geo: Geo country\_code: str The country code that should be matched. Link to this property
Link to this property
Link to this property
class AccessDevicePostureRule: … Enforces a device posture rule has run successfully
device\_posture: DevicePosture integration\_uid: str The ID of a device posture integration. Link to this property account\_id: Optional\[str] The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
class DomainRule: … Match an entire email domain.
email\_domain: EmailDomain domain: str The email domain to match. Link to this property
Link to this property
Link to this property
class EmailListRule: … Matches an email address from a list.
email\_list: EmailList id: str The ID of a previously created email list. Link to this property
Link to this property
Link to this property
class EmailRule: … Matches a specific email.
email: Email email: str The email of the user. formatemail Link to this property
Link to this property
Link to this property
class EveryoneRule: … Matches everyone. everyone: Everyone An empty object which matches on all users. Link to this property
Link to this property
class ExternalEvaluationRule: … Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: ExternalEvaluation evaluate\_url: str The API endpoint containing your business logic. Link to this property keys\_url: str The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
class GitHubOrganizationRule: … Matches a Github organization. Requires a Github identity provider.
github\_organization: GitHubOrganization identity\_provider\_id: str The ID of your Github identity provider. Link to this property name: str The name of the organization. Link to this property team: Optional\[str] The name of the team Link to this property
Link to this property
Link to this property
class GSuiteGroupRule: … Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: GSuite email: str The email of the Google Workspace group. Link to this property identity\_provider\_id: str The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
class AccessLoginMethodRule: … Matches a specific identity provider id.
login\_method: AccessLoginMethodRuleLoginMethod id: str The ID of an identity provider. Link to this property
Link to this property
Link to this property
class IPListRule: … Matches an IP address from a list.
ip\_list: IPList id: str The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
class IPRule: … Matches an IP address block.
ip: IP ip: str An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
class OktaGroupRule: … Matches an Okta group. Requires an Okta identity provider.
okta: Okta identity\_provider\_id: str The ID of your Okta identity provider. Link to this property name: str The name of the Okta group. Link to this property
Link to this property
Link to this property
class SAMLGroupRule: … Matches a SAML group. Requires a SAML identity provider.
saml: SAML attribute\_name: str The name of the SAML attribute. Link to this property attribute\_value: str The SAML attribute value to look for. Link to this property identity\_provider\_id: str The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
class AccessOIDCClaimRule: … Matches an OIDC claim. Requires an OIDC identity provider.
oidc: AccessOIDCClaimRuleOIDC claim\_name: str The name of the OIDC claim. Link to this property claim\_value: str The OIDC claim value to look for. Link to this property identity\_provider\_id: str The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
class ServiceTokenRule: … Matches a specific Access Service Token
service\_token: ServiceToken token\_id: str The ID of a Service Token. Link to this property
Link to this property
Link to this property
class AccessLinkedAppTokenRule: … Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
linked\_app\_token: AccessLinkedAppTokenRuleLinkedAppToken app\_uid: str The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
class AccessUserRiskScoreRule: … Matches a user’s risk score.
user\_risk\_score: AccessUserRiskScoreRuleUserRiskScore
user\_risk\_score: List\[Literal\["low", "medium", "high", "unscored"]] A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "unscored" Link to this property
Link to this property
Link to this property
Link to this property
class AccessCloudflareAccountMemberRule: … Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
cloudflare\_account\_member: AccessCloudflareAccountMemberRuleCloudflareAccountMember account\_id: Optional\[str] Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property isolation\_required: Optional\[bool] Require this application to be served in an isolated browser for users matching this policy. ‘Client Web Isolation’ must be on for the account in order to use this feature. Link to this property
mfa\_config: Optional\[SelfHostedApplicationPolicyMfaConfig] Configures multi-factor authentication (MFA) settings.
allowed\_authenticators: Optional\[List\[Literal\["totp", "biometrics", "security\_key"]]] Lists the MFA methods that users can authenticate with. One of the following: "totp" Link to this property "biometrics" Link to this property "security\_key" Link to this property
Link to this property mfa\_disabled: Optional\[bool] Indicates whether to disable MFA for this resource. This option is available at the application and policy level. Link to this property session\_duration: Optional\[str] Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property name: Optional\[str] The name of the Access policy. Link to this property precedence: Optional\[int] The order of execution for this policy. Must be unique for each policy within an app. Link to this property purpose\_justification\_prompt: Optional\[str] A custom message that will appear on the purpose justification screen. Link to this property purpose\_justification\_required: Optional\[bool] Require users to enter a justification when they log in to the application. Link to this property
require: Optional\[List\[AccessRule]] Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules. One of the following:
class GroupRule: … Matches an Access group.
group: Group id: str The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
class AnyValidServiceTokenRule: … Matches any valid Access Service Token any\_valid\_service\_token: AnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
class AccessAuthContextRule: … Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: AccessAuthContextRuleAuthContext id: str The ID of an Authentication context. Link to this property ac\_id: str The ACID of an Authentication context. Link to this property identity\_provider\_id: str The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
class AuthenticationMethodRule: … Enforce different MFA options
auth\_method: AuthMethod auth\_method: str The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
class AzureGroupRule: … Matches an Azure group. Requires an Azure identity provider.
azure\_ad: AzureAD id: str The ID of an Azure group. Link to this property identity\_provider\_id: str The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
class CertificateRule: … Matches any valid client certificate. certificate: Certificate Link to this property
Link to this property
class AccessCommonNameRule: … Matches a specific common name.
common\_name: AccessCommonNameRuleCommonName common\_name: str The common name to match. Link to this property
Link to this property
Link to this property
class CountryRule: … Matches a specific country
geo: Geo country\_code: str The country code that should be matched. Link to this property
Link to this property
Link to this property
class AccessDevicePostureRule: … Enforces a device posture rule has run successfully
device\_posture: DevicePosture integration\_uid: str The ID of a device posture integration. Link to this property account\_id: Optional\[str] The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
class DomainRule: … Match an entire email domain.
email\_domain: EmailDomain domain: str The email domain to match. Link to this property
Link to this property
Link to this property
class EmailListRule: … Matches an email address from a list.
email\_list: EmailList id: str The ID of a previously created email list. Link to this property
Link to this property
Link to this property
class EmailRule: … Matches a specific email.
email: Email email: str The email of the user. formatemail Link to this property
Link to this property
Link to this property
class EveryoneRule: … Matches everyone. everyone: Everyone An empty object which matches on all users. Link to this property
Link to this property
class ExternalEvaluationRule: … Create Allow or Block policies which evaluate the user based on custom criteria.