--- title: Gateway --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Zero Trust](https://developers.cloudflare.com/api/python/resources/zero_trust) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Gateway ##### [Get Zero Trust account information](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/methods/list) zero\_trust.gateway.list(GatewayListParams\*\*kwargs) -> [GatewayListResponse]() GET/accounts/{account\_id}/gateway ##### [Create Zero Trust account](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/methods/create) zero\_trust.gateway.create(GatewayCreateParams\*\*kwargs) -> [GatewayCreateResponse]() POST/accounts/{account\_id}/gateway ##### ModelsExpand Collapse
class GatewayListResponse: … id: Optional\[str] Specify the Cloudflare account ID. maxLength32 Link to this property gateway\_tag: Optional\[str] Specify the gateway internal ID. maxLength32 Link to this property provider\_name: Optional\[str] Specify the provider name (usually Cloudflare). Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway%20%3E%20(model)%20gateway_list_response%20%3E%20(schema)>)
class GatewayCreateResponse: … id: Optional\[str] Specify the Cloudflare account ID. maxLength32 Link to this property gateway\_tag: Optional\[str] Specify the gateway internal ID. maxLength32 Link to this property provider\_name: Optional\[str] Specify the provider name (usually Cloudflare). Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway%20%3E%20(model)%20gateway_create_response%20%3E%20(schema)>) #### GatewayAudit SSH Settings ##### [Get Zero Trust SSH settings](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/audit_ssh_settings/methods/get) zero\_trust.gateway.audit\_ssh\_settings.get(AuditSSHSettingGetParams\*\*kwargs) -> [GatewaySettings]() GET/accounts/{account\_id}/gateway/audit\_ssh\_settings ##### [Update Zero Trust SSH settings](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/audit_ssh_settings/methods/update) zero\_trust.gateway.audit\_ssh\_settings.update(AuditSSHSettingUpdateParams\*\*kwargs) -> [GatewaySettings]() PUT/accounts/{account\_id}/gateway/audit\_ssh\_settings ##### [Rotate Zero Trust SSH account seed](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/audit_ssh_settings/methods/rotate_seed) zero\_trust.gateway.audit\_ssh\_settings.rotate\_seed(AuditSSHSettingRotateSeedParams\*\*kwargs) -> [GatewaySettings]() POST/accounts/{account\_id}/gateway/audit\_ssh\_settings/rotate\_seed ##### ModelsExpand Collapse
class GatewaySettings: … created\_at: Optional\[datetime] formatdate-time Link to this property public\_key: Optional\[str] Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging. Link to this property seed\_id: Optional\[str] Identify the seed ID. maxLength36 Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.audit_ssh_settings%20%3E%20(model)%20gateway_settings%20%3E%20(schema)>) #### GatewayCategories ##### [List categories](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/categories/methods/list) zero\_trust.gateway.categories.list(CategoryListParams\*\*kwargs) -> SyncSinglePage\[[Category]()] GET/accounts/{account\_id}/gateway/categories ##### ModelsExpand Collapse
class Category: … id: Optional\[int] Identify this category. Only one category per ID. Link to this property beta: Optional\[bool] Indicate whether the category is in beta and subject to change. Link to this property
class\_: Optional\[Literal\["free", "premium", "blocked", 2 more]] Specify which account types can create policies for this category. blocked Blocks unconditionally for all accounts. removalPending Allows removal from policies but disables addition. noBlock Prevents blocking. One of the following: "free" Link to this property "premium" Link to this property "blocked" Link to this property "removalPending" Link to this property "noBlock" Link to this property
Link to this property description: Optional\[str] Provide a short summary of domains in the category. Link to this property name: Optional\[str] Specify the category name. Link to this property
subcategories: Optional\[List\[Subcategory]] Provide all subcategories for this category. id: Optional\[int] Identify this category. Only one category per ID. Link to this property beta: Optional\[bool] Indicate whether the category is in beta and subject to change. Link to this property
class\_: Optional\[Literal\["free", "premium", "blocked", 2 more]] Specify which account types can create policies for this category. blocked Blocks unconditionally for all accounts. removalPending Allows removal from policies but disables addition. noBlock Prevents blocking. One of the following: "free" Link to this property "premium" Link to this property "blocked" Link to this property "removalPending" Link to this property "noBlock" Link to this property
Link to this property description: Optional\[str] Provide a short summary of domains in the category. Link to this property name: Optional\[str] Specify the category name. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.categories%20%3E%20(model)%20category%20%3E%20(schema)>) #### GatewayApp Types ##### [List application and application type mappings](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/app_types/methods/list) zero\_trust.gateway.app\_types.list(AppTypeListParams\*\*kwargs) -> SyncSinglePage\[[AppType]()] GET/accounts/{account\_id}/gateway/app\_types ##### ModelsExpand Collapse
AppType One of the following:
class ZeroTrustGatewayApplication: … id: Optional\[int] Identify this application. Only one application per ID. Link to this property application\_type\_id: Optional\[int] Identify the type of this application. Multiple applications can share the same type. Refers to the id of a returned application type. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property name: Optional\[str] Specify the name of the application or application type. Link to this property
Link to this property
class ZeroTrustGatewayApplicationType: … id: Optional\[int] Identify the type of this application. Multiple applications can share the same type. Refers to the id of a returned application type. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property description: Optional\[str] Provide a short summary of applications with this type. Link to this property name: Optional\[str] Specify the name of the application or application type. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.app_types%20%3E%20(model)%20app_type%20%3E%20(schema)>) #### GatewayConfigurations ##### [Get Zero Trust account configuration](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/configurations/methods/get) zero\_trust.gateway.configurations.get(ConfigurationGetParams\*\*kwargs) -> [ConfigurationGetResponse]() GET/accounts/{account\_id}/gateway/configuration ##### [Update Zero Trust account configuration](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/configurations/methods/update) zero\_trust.gateway.configurations.update(ConfigurationUpdateParams\*\*kwargs) -> [ConfigurationUpdateResponse]() PUT/accounts/{account\_id}/gateway/configuration ##### [Patch Zero Trust account configuration](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/configurations/methods/edit) zero\_trust.gateway.configurations.edit(ConfigurationEditParams\*\*kwargs) -> [ConfigurationEditResponse]() PATCH/accounts/{account\_id}/gateway/configuration ##### ModelsExpand Collapse
class ActivityLogSettings: … Specify activity log settings. enabled: Optional\[bool] Specify whether to log activity. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20activity_log_settings%20%3E%20(schema)>)
class AntiVirusSettings: … Specify anti-virus settings. enabled\_download\_phase: Optional\[bool] Specify whether to enable anti-virus scanning on downloads. Link to this property enabled\_upload\_phase: Optional\[bool] Specify whether to enable anti-virus scanning on uploads. Link to this property fail\_closed: Optional\[bool] Specify whether to block requests for unscannable files. Link to this property notification\_settings: Optional\[NotificationSettings] Configure the message the user’s device shows during an antivirus scan. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20anti_virus_settings%20%3E%20(schema)>)
class BlockPageSettings: … Specify block page layout settings. background\_color: Optional\[str] Specify the block page background color in #rrggbb format when the mode is customized\_block\_page. Link to this property enabled: Optional\[bool] Specify whether to enable the custom block page. Link to this property footer\_text: Optional\[str] Specify the block page footer text when the mode is customized\_block\_page. Link to this property header\_text: Optional\[str] Specify the block page header text when the mode is customized\_block\_page. Link to this property include\_context: Optional\[bool] Specify whether to append context to target\_uri as query parameters. This applies only when the mode is redirect\_uri. Link to this property logo\_path: Optional\[str] Specify the full URL to the logo file when the mode is customized\_block\_page. Link to this property mailto\_address: Optional\[str] Specify the admin email for users to contact when the mode is customized\_block\_page. Link to this property mailto\_subject: Optional\[str] Specify the subject line for emails created from the block page when the mode is customized\_block\_page. Link to this property
mode: Optional\[Literal\["", "customized\_block\_page", "redirect\_uri"]] Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI. One of the following: "" Link to this property "customized\_block\_page" Link to this property "redirect\_uri" Link to this property
Link to this property name: Optional\[str] Specify the block page title when the mode is customized\_block\_page. Link to this property read\_only: Optional\[bool] Indicate that this setting was shared via the Orgs API and read only for the current account. Link to this property source\_account: Optional\[str] Indicate the account tag of the account that shared this setting. Link to this property suppress\_footer: Optional\[bool] Specify whether to suppress detailed information at the bottom of the block page when the mode is customized\_block\_page. Link to this property target\_uri: Optional\[str] Specify the URI to redirect users to when the mode is redirect\_uri. formaturi Link to this property version: Optional\[int] Indicate the version number of the setting. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20block_page_settings%20%3E%20(schema)>)
class BodyScanningSettings: … Specify the DLP inspection mode.
inspection\_mode: Optional\[Literal\["deep", "shallow"]] Specify the inspection mode as either deep or shallow. One of the following: "deep" Link to this property "shallow" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20body_scanning_settings%20%3E%20(schema)>)
class BrowserIsolationSettings: … Specify Clientless Browser Isolation settings. non\_identity\_enabled: Optional\[bool] Specify whether to enable non-identity onramp support for Browser Isolation. Link to this property url\_browser\_isolation\_enabled: Optional\[bool] Specify whether to enable Clientless Browser Isolation. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20browser_isolation_settings%20%3E%20(schema)>)
class CustomCertificateSettings: … Specify custom certificate settings for BYO-PKI. This field is deprecated; use certificate instead. enabled: Optional\[bool] Specify whether to enable a custom certificate authority for signing Gateway traffic. Link to this property id: Optional\[str] Specify the UUID of the certificate (ID from MTLS certificate store). Link to this property binding\_status: Optional\[str] Indicate the internal certificate status. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20custom_certificate_settings%20%3E%20(schema)>)
class ExtendedEmailMatching: … Configures user email settings for firewall policies. When you enable this, the system standardizes email addresses in the identity portion of the rule to match extended email variants in firewall policies. When you disable this setting, the system matches email addresses exactly as you provide them. Enable this setting if your email uses . or + modifiers. enabled: Optional\[bool] Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies. Link to this property read\_only: Optional\[bool] Indicate that this setting was shared via the Orgs API and read only for the current account. Link to this property source\_account: Optional\[str] Indicate the account tag of the account that shared this setting. Link to this property version: Optional\[int] Indicate the version number of the setting. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20extended_email_matching%20%3E%20(schema)>)
class FipsSettings: … Specify FIPS settings. tls: Optional\[bool] Enforce cipher suites and TLS versions compliant with FIPS 140-2. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20fips_settings%20%3E%20(schema)>)
class GatewayConfigurationSettings: … Specify account settings. activity\_log: Optional\[ActivityLogSettings] Specify activity log settings. Link to this property antivirus: Optional\[AntiVirusSettings] Specify anti-virus settings. Link to this property block\_page: Optional\[BlockPageSettings] Specify block page layout settings. Link to this property body\_scanning: Optional\[BodyScanningSettings] Specify the DLP inspection mode. Link to this property browser\_isolation: Optional\[BrowserIsolationSettings] Specify Clientless Browser Isolation settings. Link to this property
certificate: Optional\[Certificate] Specify certificate settings for Gateway TLS interception. If unset, the Cloudflare Root CA handles interception. id: str Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called ‘active’). A nil UUID directs Cloudflare to use the Root CA. Link to this property
Link to this property Deprecatedcustom\_certificate: Optional\[CustomCertificateSettings] Specify custom certificate settings for BYO-PKI. This field is deprecated; use certificate instead. Link to this property extended\_email\_matching: Optional\[ExtendedEmailMatching] Configures user email settings for firewall policies. When you enable this, the system standardizes email addresses in the identity portion of the rule to match extended email variants in firewall policies. When you disable this setting, the system matches email addresses exactly as you provide them. Enable this setting if your email uses . or + modifiers. Link to this property fips: Optional\[FipsSettings] Specify FIPS settings. Link to this property
host\_selector: Optional\[HostSelector] Enable host selection in egress policies. enabled: Optional\[bool] Specify whether to enable filtering via hosts for egress policies. Link to this property
Link to this property
inspection: Optional\[Inspection] Define the proxy inspection mode.
mode: Optional\[Literal\["static", "dynamic"]] Define the proxy inspection mode. 1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443). 2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic. One of the following: "static" Link to this property "dynamic" Link to this property
Link to this property
Link to this property max\_ttl\_secs: Optional\[int] Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location max_ttl setting. maximum36000 minimum60 Link to this property protocol\_detection: Optional\[ProtocolDetection] Specify whether to detect protocols from the initial bytes of client traffic. Link to this property
sandbox: Optional\[Sandbox] Specify whether to enable the sandbox. enabled: Optional\[bool] Specify whether to enable the sandbox. Link to this property
fallback\_action: Optional\[Literal\["allow", "block"]] Specify the action to take when the system cannot scan the file. One of the following: "allow" Link to this property "block" Link to this property
Link to this property
Link to this property tls\_decrypt: Optional\[TLSSettings] Specify whether to inspect encrypted HTTP traffic. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20gateway_configuration_settings%20%3E%20(schema)>)
class NotificationSettings: … Configure the message the user’s device shows during an antivirus scan. enabled: Optional\[bool] Specify whether to enable notifications. Link to this property include\_context: Optional\[bool] Specify whether to include context information as query parameters. Link to this property msg: Optional\[str] Specify the message to show in the notification. Link to this property support\_url: Optional\[str] Specify a URL that directs users to more information. If unset, the notification opens a block page. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20notification_settings%20%3E%20(schema)>)
class ProtocolDetection: … Specify whether to detect protocols from the initial bytes of client traffic. enabled: Optional\[bool] Specify whether to detect protocols from the initial bytes of client traffic. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20protocol_detection%20%3E%20(schema)>)
class TLSSettings: … Specify whether to inspect encrypted HTTP traffic. enabled: Optional\[bool] Specify whether to inspect encrypted HTTP traffic. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20tls_settings%20%3E%20(schema)>)
class ConfigurationGetResponse: … Specify account settings. created\_at: Optional\[datetime] formatdate-time Link to this property settings: Optional\[GatewayConfigurationSettings] Specify account settings. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20configuration_get_response%20%3E%20(schema)>)
class ConfigurationUpdateResponse: … Specify account settings. created\_at: Optional\[datetime] formatdate-time Link to this property settings: Optional\[GatewayConfigurationSettings] Specify account settings. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20configuration_update_response%20%3E%20(schema)>)
class ConfigurationEditResponse: … Specify account settings. created\_at: Optional\[datetime] formatdate-time Link to this property settings: Optional\[GatewayConfigurationSettings] Specify account settings. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20configuration_edit_response%20%3E%20(schema)>) #### GatewayConfigurationsCustom Certificate ##### [Get Zero Trust certificate configuration](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/configurations/subresources/custom_certificate/methods/get) Deprecated zero\_trust.gateway.configurations.custom\_certificate.get(CustomCertificateGetParams\*\*kwargs) -> [CustomCertificateSettings]() GET/accounts/{account\_id}/gateway/configuration/custom\_certificate #### GatewayLists ##### [List Zero Trust lists](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/lists/methods/list) zero\_trust.gateway.lists.list(ListListParams\*\*kwargs) -> SyncSinglePage\[[GatewayList]()] GET/accounts/{account\_id}/gateway/lists ##### [Get Zero Trust list details](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/lists/methods/get) zero\_trust.gateway.lists.get(strlist\_id, ListGetParams\*\*kwargs) -> [GatewayList]() GET/accounts/{account\_id}/gateway/lists/{list\_id} ##### [Create Zero Trust list](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/lists/methods/create) zero\_trust.gateway.lists.create(ListCreateParams\*\*kwargs) -> [ListCreateResponse]() POST/accounts/{account\_id}/gateway/lists ##### [Update Zero Trust list](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/lists/methods/update) zero\_trust.gateway.lists.update(strlist\_id, ListUpdateParams\*\*kwargs) -> [GatewayList]() PUT/accounts/{account\_id}/gateway/lists/{list\_id} ##### [Patch Zero Trust list.](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/lists/methods/edit) zero\_trust.gateway.lists.edit(strlist\_id, ListEditParams\*\*kwargs) -> [GatewayList]() PATCH/accounts/{account\_id}/gateway/lists/{list\_id} ##### [Delete Zero Trust list](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/lists/methods/delete) zero\_trust.gateway.lists.delete(strlist\_id, ListDeleteParams\*\*kwargs) -> object DELETE/accounts/{account\_id}/gateway/lists/{list\_id} ##### ModelsExpand Collapse
class GatewayItem: … created\_at: Optional\[datetime] formatdate-time Link to this property description: Optional\[str] Provide the list item description (optional). minimum0 Link to this property value: Optional\[str] Specify the item value. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.lists%20%3E%20(model)%20gateway_item%20%3E%20(schema)>)
class GatewayList: … id: Optional\[str] Identify the API resource with a UUID. maxLength36 Link to this property count: Optional\[float] Indicate the number of items in the list. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property description: Optional\[str] Provide the list description. Link to this property
items: Optional\[List\[GatewayItem]] Provide the list items. created\_at: Optional\[datetime] formatdate-time Link to this property description: Optional\[str] Provide the list item description (optional). minimum0 Link to this property value: Optional\[str] Specify the item value. Link to this property
Link to this property name: Optional\[str] Specify the list name. Link to this property
type: Optional\[Literal\["SERIAL", "URL", "DOMAIN", 6 more]] Specify the list type. One of the following: "SERIAL" Link to this property "URL" Link to this property "DOMAIN" Link to this property "EMAIL" Link to this property "IP" Link to this property "CATEGORY" Link to this property "LOCATION" Link to this property "DEVICE" Link to this property "AAGUID" Link to this property
Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.lists%20%3E%20(model)%20gateway_list%20%3E%20(schema)>)
class ListCreateResponse: … id: Optional\[str] Identify the API resource with a UUID. maxLength36 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property description: Optional\[str] Provide the list description. Link to this property
items: Optional\[List\[GatewayItem]] Provide the list items. created\_at: Optional\[datetime] formatdate-time Link to this property description: Optional\[str] Provide the list item description (optional). minimum0 Link to this property value: Optional\[str] Specify the item value. Link to this property
Link to this property name: Optional\[str] Specify the list name. Link to this property
type: Optional\[Literal\["SERIAL", "URL", "DOMAIN", 6 more]] Specify the list type. One of the following: "SERIAL" Link to this property "URL" Link to this property "DOMAIN" Link to this property "EMAIL" Link to this property "IP" Link to this property "CATEGORY" Link to this property "LOCATION" Link to this property "DEVICE" Link to this property "AAGUID" Link to this property
Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.lists%20%3E%20(model)%20list_create_response%20%3E%20(schema)>) #### GatewayListsItems ##### [Get Zero Trust list items](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/lists/subresources/items/methods/list) zero\_trust.gateway.lists.items.list(strlist\_id, ItemListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[GatewayItem]()] GET/accounts/{account\_id}/gateway/lists/{list\_id}/items #### GatewayLocations ##### [List Zero Trust Gateway locations](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/locations/methods/list) zero\_trust.gateway.locations.list(LocationListParams\*\*kwargs) -> SyncSinglePage\[[Location]()] GET/accounts/{account\_id}/gateway/locations ##### [Get Zero Trust Gateway location details](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/locations/methods/get) zero\_trust.gateway.locations.get(strlocation\_id, LocationGetParams\*\*kwargs) -> [Location]() GET/accounts/{account\_id}/gateway/locations/{location\_id} ##### [Create a Zero Trust Gateway location](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/locations/methods/create) zero\_trust.gateway.locations.create(LocationCreateParams\*\*kwargs) -> [Location]() POST/accounts/{account\_id}/gateway/locations ##### [Update a Zero Trust Gateway location](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/locations/methods/update) zero\_trust.gateway.locations.update(strlocation\_id, LocationUpdateParams\*\*kwargs) -> [Location]() PUT/accounts/{account\_id}/gateway/locations/{location\_id} ##### [Delete a Zero Trust Gateway location](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/locations/methods/delete) zero\_trust.gateway.locations.delete(strlocation\_id, LocationDeleteParams\*\*kwargs) -> object DELETE/accounts/{account\_id}/gateway/locations/{location\_id} ##### ModelsExpand Collapse
class DOHEndpoint: … enabled: Optional\[bool] Indicate whether the DOH endpoint is enabled for this location. Link to this property
networks: Optional\[List\[IPNetwork]] Specify the list of allowed source IP network ranges for this endpoint. When the list is empty, the endpoint allows all source IPs. The list takes effect only if the endpoint is enabled for this location. network: str Specify the IP address or IP CIDR. Link to this property
Link to this property require\_token: Optional\[bool] Specify whether the DOH endpoint requires user identity authentication. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20doh_endpoint%20%3E%20(schema)>)
class DOTEndpoint: … enabled: Optional\[bool] Indicate whether the DOT endpoint is enabled for this location. Link to this property
networks: Optional\[List\[IPNetwork]] Specify the list of allowed source IP network ranges for this endpoint. When the list is empty, the endpoint allows all source IPs. The list takes effect only if the endpoint is enabled for this location. network: str Specify the IP address or IP CIDR. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20dot_endpoint%20%3E%20(schema)>)
class Endpoint: … Configure the destination endpoints for this location. doh: DOHEndpoint Link to this property dot: DOTEndpoint Link to this property ipv4: IPV4Endpoint Link to this property ipv6: IPV6Endpoint Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20endpoint%20%3E%20(schema)>)
class IPNetwork: … network: str Specify the IP address or IP CIDR. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20ip_network%20%3E%20(schema)>)
class IPV4Endpoint: … enabled: Optional\[bool] Indicate whether the IPv4 endpoint is enabled for this location. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20ipv4_endpoint%20%3E%20(schema)>)
class IPV6Endpoint: … enabled: Optional\[bool] Indicate whether the IPV6 endpoint is enabled for this location. Link to this property
networks: Optional\[List\[IPV6Network]] Specify the list of allowed source IPv6 network ranges for this endpoint. When the list is empty, the endpoint allows all source IPs. The list takes effect only if the endpoint is enabled for this location. network: str Specify the IPv6 address or IPv6 CIDR. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20ipv6_endpoint%20%3E%20(schema)>)
class IPV6Network: … network: str Specify the IPv6 address or IPv6 CIDR. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20ipv6_network%20%3E%20(schema)>)
class Location: … id: Optional\[str] Link to this property client\_default: Optional\[bool] Indicate whether this location is the default location. Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property dns\_destination\_ips\_id: Optional\[str] Indicate the identifier of the pair of IPv4 addresses assigned to this location. Link to this property dns\_destination\_ipv6\_block\_id: Optional\[str] Specify the UUID of the IPv6 block brought to the gateway so that this location’s IPv6 address is allocated from the Bring Your Own IPv6 (BYOIPv6) block rather than the standard Cloudflare IPv6 block. Link to this property doh\_subdomain: Optional\[str] Specify the DNS over HTTPS domain that receives DNS requests. Gateway automatically generates this value. Link to this property ecs\_support: Optional\[bool] Indicate whether the location must resolve EDNS queries. Link to this property endpoints: Optional\[Endpoint] Configure the destination endpoints for this location. Link to this property ip: Optional\[str] Defines the automatically generated IPv6 destination IP assigned to this location. Gateway counts all DNS requests sent to this IP as requests under this location. Link to this property ipv4\_destination: Optional\[str] Show the primary destination IPv4 address from the pair identified dns\_destination\_ips\_id. This field read-only. Link to this property ipv4\_destination\_backup: Optional\[str] Show the backup destination IPv4 address from the pair identified dns\_destination\_ips\_id. This field read-only. Link to this property
max\_ttl: Optional\[MaxTTL] Controls how DNS response TTLs are capped for this location relative to the account max_ttl_secs setting. Omitting max_ttl on update resets it to inherit.
mode: Literal\["inherit", "override", "disabled"] inherit uses the account max_ttl_secs. override uses this location’s ttl_secs. disabled leaves returned TTLs unchanged. One of the following: "inherit" Link to this property "override" Link to this property "disabled" Link to this property
Link to this property ttl\_secs: Optional\[int] Location-specific cap on DNS response TTLs, in seconds. Required when mode is override. Must be omitted when mode is inherit or disabled. maximum36000 minimum60 Link to this property
Link to this property name: Optional\[str] Specify the location name. Link to this property
networks: Optional\[List\[Network]] Specify the list of network ranges from which requests at this location originate. The list takes effect only if it is non-empty and the IPv4 endpoint is enabled for this location. network: str Specify the IPv4 address or IPv4 CIDR. Limit IPv4 CIDRs to a maximum of /24. Link to this property
Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20location%20%3E%20(schema)>) #### GatewayLogging ##### [Get logging settings for the Zero Trust account](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/logging/methods/get) zero\_trust.gateway.logging.get(LoggingGetParams\*\*kwargs) -> [LoggingSetting]() GET/accounts/{account\_id}/gateway/logging ##### [Update Zero Trust account logging settings](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/logging/methods/update) zero\_trust.gateway.logging.update(LoggingUpdateParams\*\*kwargs) -> [LoggingSetting]() PUT/accounts/{account\_id}/gateway/logging ##### ModelsExpand Collapse
class LoggingSetting: … redact\_pii: Optional\[bool] Indicate whether to redact personally identifiable information from activity logging (PII fields include source IP, user email, user ID, device ID, URL, referrer, and user agent). Link to this property
settings\_by\_rule\_type: Optional\[SettingsByRuleType] Configure logging settings for each rule type.
dns: Optional\[SettingsByRuleTypeDNS] Configure logging settings for DNS firewall. log\_all: Optional\[bool] Specify whether to log all requests to this service. Link to this property log\_blocks: Optional\[bool] Specify whether to log only blocking requests to this service. Link to this property
Link to this property
http: Optional\[SettingsByRuleTypeHTTP] Configure logging settings for HTTP/HTTPS firewall. log\_all: Optional\[bool] Specify whether to log all requests to this service. Link to this property log\_blocks: Optional\[bool] Specify whether to log only blocking requests to this service. Link to this property
Link to this property
l4: Optional\[SettingsByRuleTypeL4] Configure logging settings for Network firewall. log\_all: Optional\[bool] Specify whether to log all requests to this service. Link to this property log\_blocks: Optional\[bool] Specify whether to log only blocking requests to this service. Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.logging%20%3E%20(model)%20logging_setting%20%3E%20(schema)>) #### GatewayProxy Endpoints ##### [List proxy endpoints](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/list) zero\_trust.gateway.proxy\_endpoints.list(ProxyEndpointListParams\*\*kwargs) -> SyncSinglePage\[[ProxyEndpoint]()] GET/accounts/{account\_id}/gateway/proxy\_endpoints ##### [Get a proxy endpoint](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/get) zero\_trust.gateway.proxy\_endpoints.get(strproxy\_endpoint\_id, ProxyEndpointGetParams\*\*kwargs) -> [ProxyEndpoint]() GET/accounts/{account\_id}/gateway/proxy\_endpoints/{proxy\_endpoint\_id} ##### [Create a proxy endpoint](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/create) zero\_trust.gateway.proxy\_endpoints.create(ProxyEndpointCreateParams\*\*kwargs) -> [ProxyEndpoint]() POST/accounts/{account\_id}/gateway/proxy\_endpoints ##### [Update a proxy endpoint](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/edit) zero\_trust.gateway.proxy\_endpoints.edit(strproxy\_endpoint\_id, ProxyEndpointEditParams\*\*kwargs) -> [ProxyEndpoint]() PATCH/accounts/{account\_id}/gateway/proxy\_endpoints/{proxy\_endpoint\_id} ##### [Delete a proxy endpoint](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/delete) zero\_trust.gateway.proxy\_endpoints.delete(strproxy\_endpoint\_id, ProxyEndpointDeleteParams\*\*kwargs) -> object DELETE/accounts/{account\_id}/gateway/proxy\_endpoints/{proxy\_endpoint\_id} ##### ModelsExpand Collapse str Specify an IPv4 or IPv6 CIDR. Limit IPv6 to a maximum of /109 and IPv4 to a maximum of /25. [Link to this property](<#(resource)%20zero_trust.gateway.proxy_endpoints%20%3E%20(model)%20gateway_ips%20%3E%20(schema)>)
ProxyEndpoint One of the following:
class ZeroTrustGatewayProxyEndpointIP: … ips: List\[GatewayIPs] Specify the list of CIDRs to restrict ingress connections. Link to this property name: str Specify the name of the proxy endpoint. Link to this property id: Optional\[str] Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property kind: Optional\[Literal\["ip"]] The proxy endpoint kind Link to this property subdomain: Optional\[str] Specify the subdomain to use as the destination in the proxy client. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
Link to this property
class ZeroTrustGatewayProxyEndpointIdentity: … kind: Literal\["identity"] The proxy endpoint kind Link to this property name: str Specify the name of the proxy endpoint. Link to this property id: Optional\[str] Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property subdomain: Optional\[str] Specify the subdomain to use as the destination in the proxy client. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.proxy_endpoints%20%3E%20(model)%20proxy_endpoint%20%3E%20(schema)>) #### GatewayRules ##### [List Zero Trust Gateway rules](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/rules/methods/list) zero\_trust.gateway.rules.list(RuleListParams\*\*kwargs) -> SyncSinglePage\[[GatewayRule]()] GET/accounts/{account\_id}/gateway/rules ##### [Get Zero Trust Gateway rule details.](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/rules/methods/get) zero\_trust.gateway.rules.get(strrule\_id, RuleGetParams\*\*kwargs) -> [GatewayRule]() GET/accounts/{account\_id}/gateway/rules/{rule\_id} ##### [Create a Zero Trust Gateway rule](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/rules/methods/create) zero\_trust.gateway.rules.create(RuleCreateParams\*\*kwargs) -> [GatewayRule]() POST/accounts/{account\_id}/gateway/rules ##### [Update a Zero Trust Gateway rule](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/rules/methods/update) zero\_trust.gateway.rules.update(strrule\_id, RuleUpdateParams\*\*kwargs) -> [GatewayRule]() PUT/accounts/{account\_id}/gateway/rules/{rule\_id} ##### [Delete a Zero Trust Gateway rule](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/rules/methods/delete) zero\_trust.gateway.rules.delete(strrule\_id, RuleDeleteParams\*\*kwargs) -> object DELETE/accounts/{account\_id}/gateway/rules/{rule\_id} ##### [List Zero Trust Gateway rules inherited from the parent account](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/rules/methods/list_tenant) zero\_trust.gateway.rules.list\_tenant(RuleListTenantParams\*\*kwargs) -> SyncSinglePage\[[GatewayRule]()] GET/accounts/{account\_id}/gateway/rules/tenant ##### [Reset the expiration of a Zero Trust Gateway Rule](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/rules/methods/reset_expiration) zero\_trust.gateway.rules.reset\_expiration(strrule\_id, RuleResetExpirationParams\*\*kwargs) -> [GatewayRule]() POST/accounts/{account\_id}/gateway/rules/{rule\_id}/reset\_expiration ##### ModelsExpand Collapse
class DNSResolverSettingsV4: … ip: str Specify the IPv4 address of the upstream resolver. Link to this property port: Optional\[int] Specify a port number to use for the upstream resolver. Defaults to 53 if unspecified. Link to this property route\_through\_private\_network: Optional\[bool] Indicate whether to connect to this resolver over a private network. Must set when vnet\_id set. Link to this property vnet\_id: Optional\[str] Specify an optional virtual network for this resolver. Uses default virtual network id if omitted. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20dns_resolver_settings_v4%20%3E%20(schema)>)
class DNSResolverSettingsV6: … ip: str Specify the IPv6 address of the upstream resolver. Link to this property port: Optional\[int] Specify a port number to use for the upstream resolver. Defaults to 53 if unspecified. Link to this property route\_through\_private\_network: Optional\[bool] Indicate whether to connect to this resolver over a private network. Must set when vnet\_id set. Link to this property vnet\_id: Optional\[str] Specify an optional virtual network for this resolver. Uses default virtual network id if omitted. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20dns_resolver_settings_v6%20%3E%20(schema)>)
Literal\["http", "dns", "l4", 2 more] Specify the protocol or layer to use. One of the following: "http" Link to this property "dns" Link to this property "l4" Link to this property "egress" Link to this property "dns\_resolver" Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20gateway_filter%20%3E%20(schema)>)
class GatewayRule: …
action: Literal\["on", "off", "allow", 13 more] Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to true. One of the following: "on" Link to this property "off" Link to this property "allow" Link to this property "block" Link to this property "scan" Link to this property "noscan" Link to this property "safesearch" Link to this property "ytrestricted" Link to this property "isolate" Link to this property "noisolate" Link to this property "override" Link to this property "l4\_override" Link to this property "egress" Link to this property "resolve" Link to this property "quarantine" Link to this property "redirect" Link to this property
Link to this property enabled: bool Specify whether the rule is enabled. Link to this property
filters: List\[GatewayFilter] Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value. One of the following: "http" Link to this property "dns" Link to this property "l4" Link to this property "egress" Link to this property "dns\_resolver" Link to this property
Link to this property name: str Specify the rule name. Link to this property precedence: int Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to Order of enforcement to manage precedence via Terraform. Link to this property traffic: str Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response. Link to this property id: Optional\[str] Identify the API resource with a UUID. formatuuid maxLength36 Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property deleted\_at: Optional\[datetime] Indicate the date of deletion, if any. formatdate-time Link to this property description: Optional\[str] Specify the rule description. Link to this property device\_posture: Optional\[str] Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response. Link to this property
expiration: Optional\[Expiration] Defines the expiration time stamp and default duration of a DNS policy. Takes precedence over the policy’s schedule configuration, if any. This does not apply to HTTP or network policies. Settable only for dns rules. expires\_at: datetime Show the timestamp when the policy expires and stops applying. The value must follow RFC 3339 and include a UTC offset. The system accepts non-zero offsets but converts them to the equivalent UTC+00:00 value and returns timestamps with a trailing Z. Expiration policies ignore client timezones and expire globally at the specified expires\_at time. formatdate-time Link to this property duration: Optional\[int] Defines the default duration a policy active in minutes. Must set in order to use the reset_expiration endpoint on this rule. minimum5 Link to this property expired: Optional\[bool] Indicates whether the policy is expired. Link to this property
Link to this property identity: Optional\[str] Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response. Link to this property read\_only: Optional\[bool] Indicate that this rule is shared via the Orgs API and read only. Link to this property rule\_settings: Optional\[RuleSetting] Defines settings for this rule. Settings apply only to specific rule types and must use compatible selectors. If Terraform detects drift, confirm the setting supports your rule type and check whether the API modifies the value. Use API-returned values in your configuration to prevent drift. Link to this property schedule: Optional\[Schedule] Defines the schedule for activating DNS policies. Settable only for dns and dns_resolver rules. Link to this property sharable: Optional\[bool] Indicate that this rule is sharable via the Orgs API. Link to this property source\_account: Optional\[str] Provide the account tag of the account that created the rule. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property version: Optional\[int] Indicate the version number of the rule(read-only). Link to this property warning\_status: Optional\[str] Indicate a warning for a misconfigured rule, if any. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20gateway_rule%20%3E%20(schema)>)
class RuleSetting: … Defines settings for this rule. Settings apply only to specific rule types and must use compatible selectors. If Terraform detects drift, confirm the setting supports your rule type and check whether the API modifies the value. Use API-returned values in your configuration to prevent drift. add\_headers: Optional\[Dict\[str, List\[str]]] Add custom headers to allowed requests as key-value pairs. Use header names as keys that map to arrays of header values. Header values may contain @{selector.name} variable references that are interpolated at the edge. Use @@{ to escape a literal @{. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes and each header value may not exceed 4 KB. Settable only for http rules with the action set to allow. Link to this property allow\_child\_bypass: Optional\[bool] Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules. Link to this property
audit\_ssh: Optional\[AuditSSH] Define the settings for the Audit SSH action. Settable only for l4 rules with audit_ssh action. command\_logging: Optional\[bool] Enable SSH command logging. Link to this property
Link to this property
biso\_admin\_controls: Optional\[BISOAdminControls] Configure browser isolation behavior. Settable only for http rules with the action set to isolate.
copy: Optional\[Literal\["enabled", "disabled", "remote\_only"]] Configure copy behavior. If set to remote\_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == “v2”. One of the following: "enabled" Link to this property "disabled" Link to this property "remote\_only" Link to this property
Link to this property dcp: Optional\[bool] Set to false to enable copy-pasting. Only applies when version == "v1". Link to this property dd: Optional\[bool] Set to false to enable downloading. Only applies when version == "v1". Link to this property dk: Optional\[bool] Set to false to enable keyboard usage. Only applies when version == "v1". Link to this property
download: Optional\[Literal\["enabled", "disabled", "remote\_only"]] Configure download behavior. When set to remote\_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == “v2”. One of the following: "enabled" Link to this property "disabled" Link to this property "remote\_only" Link to this property
Link to this property dp: Optional\[bool] Set to false to enable printing. Only applies when version == "v1". Link to this property du: Optional\[bool] Set to false to enable uploading. Only applies when version == "v1". Link to this property
keyboard: Optional\[Literal\["enabled", "disabled"]] Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == “v2”. One of the following: "enabled" Link to this property "disabled" Link to this property
Link to this property
paste: Optional\[Literal\["enabled", "disabled", "remote\_only"]] Configure paste behavior. If set to remote\_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == “v2”. One of the following: "enabled" Link to this property "disabled" Link to this property "remote\_only" Link to this property
Link to this property
printing: Optional\[Literal\["enabled", "disabled"]] Configure print behavior. Default, Printing is enabled. Applies only when version == “v2”. One of the following: "enabled" Link to this property "disabled" Link to this property
Link to this property
upload: Optional\[Literal\["enabled", "disabled"]] Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == “v2”. One of the following: "enabled" Link to this property "disabled" Link to this property
Link to this property
version: Optional\[Literal\["v1", "v2"]] Indicate which version of the browser isolation controls should apply. One of the following: "v1" Link to this property "v2" Link to this property
Link to this property wm\_id: Optional\[str] Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser. formatuuid maxLength36 minLength1 Link to this property
Link to this property
block\_page: Optional\[BlockPage] Configure custom block page settings. If missing or null, use the account settings. Settable only for http rules with the action set to block. target\_uri: str Specify the URI to which the user is redirected. formaturi Link to this property include\_context: Optional\[bool] Specify whether to pass the context information as query parameters. Link to this property
Link to this property block\_page\_enabled: Optional\[bool] Enable the custom block page. Settable only for dns rules with action block. Link to this property block\_reason: Optional\[str] Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for dns, l4, and http rules when the action set to block. Link to this property bypass\_parent\_rule: Optional\[bool] Set to enable MSP accounts to bypass their parent’s rules. Only MSP child accounts can set this. Settable for all types of rules. Link to this property
check\_session: Optional\[CheckSession] Configure session check behavior. Settable only for l4 and http rules with the action set to allow. duration: Optional\[str] Sets the required session freshness threshold. The API returns a normalized version of this value. Link to this property enforce: Optional\[bool] Enable session enforcement. Link to this property
Link to this property delete\_headers: Optional\[List\[str]] Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for http rules with the action set to allow. Link to this property
dns\_resolvers: Optional\[DNSResolvers] Configure custom resolvers to route queries that match the resolver policy. Unused with ‘resolve\_dns\_through\_cloudflare’ or ‘resolve\_dns\_internally’ settings. DNS queries get routed to the address closest to their origin. Only valid when a rule’s action set to ‘resolve’. Settable only for dns_resolver rules.
ipv4: Optional\[List\[DNSResolverSettingsV4]] ip: str Specify the IPv4 address of the upstream resolver. Link to this property port: Optional\[int] Specify a port number to use for the upstream resolver. Defaults to 53 if unspecified. Link to this property route\_through\_private\_network: Optional\[bool] Indicate whether to connect to this resolver over a private network. Must set when vnet\_id set. Link to this property vnet\_id: Optional\[str] Specify an optional virtual network for this resolver. Uses default virtual network id if omitted. Link to this property
Link to this property
ipv6: Optional\[List\[DNSResolverSettingsV6]] ip: str Specify the IPv6 address of the upstream resolver. Link to this property port: Optional\[int] Specify a port number to use for the upstream resolver. Defaults to 53 if unspecified. Link to this property route\_through\_private\_network: Optional\[bool] Indicate whether to connect to this resolver over a private network. Must set when vnet\_id set. Link to this property vnet\_id: Optional\[str] Specify an optional virtual network for this resolver. Uses default virtual network id if omitted. Link to this property
Link to this property
Link to this property
egress: Optional\[Egress] Configure how Gateway Proxy traffic egresses. You can enable this setting for rules with Egress actions and filters, or omit it to indicate local egress via WARP IPs. Settable only for egress rules. ipv4: Optional\[str] Specify the IPv4 address to use for egress. Link to this property ipv4\_fallback: Optional\[str] Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set ‘0.0.0.0’ to indicate local egress via WARP IPs. Link to this property ipv6: Optional\[str] Specify the IPv6 range to use for egress. Link to this property
Link to this property
forensic\_copy: Optional\[ForensicCopy] Configure whether a copy of the HTTP request will be sent to storage when the rule matches. enabled: Optional\[bool] Enable sending the copy to storage. Link to this property
Link to this property ignore\_cname\_category\_matches: Optional\[bool] Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for dns and dns_resolver rules. Link to this property insecure\_disable\_dnssec\_validation: Optional\[bool] Specify whether to disable DNSSEC validation (for Allow actions) \[INSECURE]. Settable only for dns rules. Link to this property ip\_categories: Optional\[bool] Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for dns and dns_resolver rules. Link to this property ip\_indicator\_feeds: Optional\[bool] Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for dns and dns_resolver rules. Link to this property
l4override: Optional\[L4override] Send matching traffic to the supplied destination IP address and port. Settable only for l4 rules with the action set to l4_override. ip: Optional\[str] Defines the IPv4 or IPv6 address. Link to this property port: Optional\[int] Defines a port number to use for TCP/UDP overrides. Link to this property
Link to this property
notification\_settings: Optional\[NotificationSettings] Configure a notification to display on the user’s device when this rule matched. Settable for all types of rules with the action set to block. enabled: Optional\[bool] Enable notification. Link to this property include\_context: Optional\[bool] Indicates whether to pass the context information as query parameters. Link to this property msg: Optional\[str] Customize the message shown in the notification. Link to this property support\_url: Optional\[str] Defines an optional URL to direct users to additional information. If unset, the notification opens a block page. Link to this property
Link to this property override\_host: Optional\[str] Defines a hostname for override, for the matching DNS queries. Settable only for dns rules with the action set to override. Link to this property override\_ips: Optional\[List\[str]] Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for dns rules with the action set to override. Link to this property
payload\_log: Optional\[PayloadLog] Configure DLP payload logging. Settable only for http rules. enabled: Optional\[bool] Enable DLP payload logging for this rule. Link to this property
Link to this property
quarantine: Optional\[Quarantine] Configure settings that apply to quarantine rules. Settable only for http rules.
file\_types: Optional\[List\[Literal\["exe", "pdf", "doc", 10 more]]] Specify the types of files to sandbox. One of the following: "exe" Link to this property "pdf" Link to this property "doc" Link to this property "docm" Link to this property "docx" Link to this property "rtf" Link to this property "ppt" Link to this property "pptx" Link to this property "xls" Link to this property "xlsm" Link to this property "xlsx" Link to this property "zip" Link to this property "rar" Link to this property
Link to this property
Link to this property
redirect: Optional\[Redirect] Apply settings to redirect rules. Settable only for http rules with the action set to redirect. target\_uri: str Specify the URI to which the user is redirected. formaturi Link to this property include\_context: Optional\[bool] Specify whether to pass the context information as query parameters. Link to this property preserve\_path\_and\_query: Optional\[bool] Specify whether to append the path and query parameters from the original request to target\_uri. Link to this property
Link to this property
resolve\_dns\_internally: Optional\[ResolveDNSInternally] Configure to forward the query to the internal DNS service, passing the specified ‘view\_id’ as input. Not used when ‘dns\_resolvers’ is specified or ‘resolve\_dns\_through\_cloudflare’ is set. Only valid when a rule’s action set to ‘resolve’. Settable only for dns_resolver rules.
fallback: Optional\[Literal\["none", "public\_dns"]] Specify the fallback behavior to apply when the internal DNS response code differs from ‘NOERROR’ or when the response data contains only CNAME records for ‘A’ or ‘AAAA’ queries. One of the following: "none" Link to this property "public\_dns" Link to this property
Link to this property view\_id: Optional\[str] Specify the internal DNS view identifier to pass to the internal DNS service. Link to this property
Link to this property resolve\_dns\_through\_cloudflare: Optional\[bool] Enable to send queries that match the policy to Cloudflare’s default 1.1.1.1 DNS resolver. Cannot set when ‘dns\_resolvers’ specified or ‘resolve\_dns\_internally’ is set. Only valid when a rule’s action set to ‘resolve’. Settable only for dns_resolver rules. Link to this property set\_headers: Optional\[Dict\[str, List\[str]]] Replace existing headers on allowed requests with the specified key-value pairs. If a header does not exist, it is added. Header values may contain @{selector.name} variable references that are interpolated at the edge. Use @@{ to escape a literal @{. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes and each header value may not exceed 4 KB. Settable only for http rules with the action set to allow. Link to this property
untrusted\_cert: Optional\[UntrustedCERT] Configure behavior when an upstream certificate is invalid or an SSL error occurs. Settable only for http rules with the action set to allow.
action: Optional\[Literal\["pass\_through", "block", "error"]] Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526. One of the following: "pass\_through" Link to this property "block" Link to this property "error" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20rule_setting%20%3E%20(schema)>)
class Schedule: … Defines the schedule for activating DNS policies. Settable only for dns and dns_resolver rules. fri: Optional\[str] Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property mon: Optional\[str] Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property sat: Optional\[str] Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property sun: Optional\[str] Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property thu: Optional\[str] Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property time\_zone: Optional\[str] Specify the time zone for rule evaluation. When a valid time zone city name is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user’s IP address. Colo time zone is used when the user’s IP address does not resolve to a location. Link to this property tue: Optional\[str] Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property wed: Optional\[str] Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20schedule%20%3E%20(schema)>) #### GatewayCertificates ##### [List Zero Trust certificates](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/certificates/methods/list) zero\_trust.gateway.certificates.list(CertificateListParams\*\*kwargs) -> SyncSinglePage\[[CertificateListResponse]()] GET/accounts/{account\_id}/gateway/certificates ##### [Get Zero Trust certificate details](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/certificates/methods/get) zero\_trust.gateway.certificates.get(strcertificate\_id, CertificateGetParams\*\*kwargs) -> [CertificateGetResponse]() GET/accounts/{account\_id}/gateway/certificates/{certificate\_id} ##### [Create Zero Trust certificate](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/certificates/methods/create) zero\_trust.gateway.certificates.create(CertificateCreateParams\*\*kwargs) -> [CertificateCreateResponse]() POST/accounts/{account\_id}/gateway/certificates ##### [Delete Zero Trust certificate](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/certificates/methods/delete) zero\_trust.gateway.certificates.delete(strcertificate\_id, CertificateDeleteParams\*\*kwargs) -> [CertificateDeleteResponse]() DELETE/accounts/{account\_id}/gateway/certificates/{certificate\_id} ##### [Activate a Zero Trust certificate](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/certificates/methods/activate) zero\_trust.gateway.certificates.activate(strcertificate\_id, CertificateActivateParams\*\*kwargs) -> [CertificateActivateResponse]() POST/accounts/{account\_id}/gateway/certificates/{certificate\_id}/activate ##### [Deactivate a Zero Trust certificate](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/certificates/methods/deactivate) zero\_trust.gateway.certificates.deactivate(strcertificate\_id, CertificateDeactivateParams\*\*kwargs) -> [CertificateDeactivateResponse]() POST/accounts/{account\_id}/gateway/certificates/{certificate\_id}/deactivate ##### ModelsExpand Collapse
class CertificateListResponse: … id: Optional\[str] Identify the certificate with a UUID. maxLength36 Link to this property
binding\_status: Optional\[Literal\["pending\_deployment", "available", "pending\_deletion", "inactive"]] Indicate the read-only deployment status of the certificate on Cloudflare’s edge. Gateway TLS interception can use certificates in the ‘available’ (previously called ‘active’) state. One of the following: "pending\_deployment" Link to this property "available" Link to this property "pending\_deletion" Link to this property "inactive" Link to this property
Link to this property certificate: Optional\[str] Provide the CA certificate (read-only). Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property expires\_on: Optional\[datetime] formatdate-time Link to this property fingerprint: Optional\[str] Provide the SHA256 fingerprint of the certificate (read-only). Link to this property in\_use: Optional\[bool] Indicate whether Gateway TLS interception uses this certificate (read-only). You cannot set this value directly. To configure interception, use the Gateway configuration setting named certificate (read-only). Link to this property issuer\_org: Optional\[str] Indicate the organization that issued the certificate (read-only). Link to this property issuer\_raw: Optional\[str] Provide the entire issuer field of the certificate (read-only). Link to this property region: Optional\[str] Indicate the read-only region the certificate authority’s key material is pinned to. Omitted for certificates that were created without a region. Link to this property
type: Optional\[Literal\["custom", "gateway\_managed"]] Indicate the read-only certificate type, BYO-PKI (custom) or Gateway-managed. One of the following: "custom" Link to this property "gateway\_managed" Link to this property
Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property uploaded\_on: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.certificates%20%3E%20(model)%20certificate_list_response%20%3E%20(schema)>)
class CertificateGetResponse: … id: Optional\[str] Identify the certificate with a UUID. maxLength36 Link to this property
binding\_status: Optional\[Literal\["pending\_deployment", "available", "pending\_deletion", "inactive"]] Indicate the read-only deployment status of the certificate on Cloudflare’s edge. Gateway TLS interception can use certificates in the ‘available’ (previously called ‘active’) state. One of the following: "pending\_deployment" Link to this property "available" Link to this property "pending\_deletion" Link to this property "inactive" Link to this property
Link to this property certificate: Optional\[str] Provide the CA certificate (read-only). Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property expires\_on: Optional\[datetime] formatdate-time Link to this property fingerprint: Optional\[str] Provide the SHA256 fingerprint of the certificate (read-only). Link to this property in\_use: Optional\[bool] Indicate whether Gateway TLS interception uses this certificate (read-only). You cannot set this value directly. To configure interception, use the Gateway configuration setting named certificate (read-only). Link to this property issuer\_org: Optional\[str] Indicate the organization that issued the certificate (read-only). Link to this property issuer\_raw: Optional\[str] Provide the entire issuer field of the certificate (read-only). Link to this property region: Optional\[str] Indicate the read-only region the certificate authority’s key material is pinned to. Omitted for certificates that were created without a region. Link to this property
type: Optional\[Literal\["custom", "gateway\_managed"]] Indicate the read-only certificate type, BYO-PKI (custom) or Gateway-managed. One of the following: "custom" Link to this property "gateway\_managed" Link to this property
Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property uploaded\_on: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.certificates%20%3E%20(model)%20certificate_get_response%20%3E%20(schema)>)
class CertificateCreateResponse: … id: Optional\[str] Identify the certificate with a UUID. maxLength36 Link to this property
binding\_status: Optional\[Literal\["pending\_deployment", "available", "pending\_deletion", "inactive"]] Indicate the read-only deployment status of the certificate on Cloudflare’s edge. Gateway TLS interception can use certificates in the ‘available’ (previously called ‘active’) state. One of the following: "pending\_deployment" Link to this property "available" Link to this property "pending\_deletion" Link to this property "inactive" Link to this property
Link to this property certificate: Optional\[str] Provide the CA certificate (read-only). Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property expires\_on: Optional\[datetime] formatdate-time Link to this property fingerprint: Optional\[str] Provide the SHA256 fingerprint of the certificate (read-only). Link to this property in\_use: Optional\[bool] Indicate whether Gateway TLS interception uses this certificate (read-only). You cannot set this value directly. To configure interception, use the Gateway configuration setting named certificate (read-only). Link to this property issuer\_org: Optional\[str] Indicate the organization that issued the certificate (read-only). Link to this property issuer\_raw: Optional\[str] Provide the entire issuer field of the certificate (read-only). Link to this property region: Optional\[str] Indicate the read-only region the certificate authority’s key material is pinned to. Omitted for certificates that were created without a region. Link to this property
type: Optional\[Literal\["custom", "gateway\_managed"]] Indicate the read-only certificate type, BYO-PKI (custom) or Gateway-managed. One of the following: "custom" Link to this property "gateway\_managed" Link to this property
Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property uploaded\_on: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.certificates%20%3E%20(model)%20certificate_create_response%20%3E%20(schema)>)
class CertificateDeleteResponse: … id: Optional\[str] Identify the certificate with a UUID. maxLength36 Link to this property
binding\_status: Optional\[Literal\["pending\_deployment", "available", "pending\_deletion", "inactive"]] Indicate the read-only deployment status of the certificate on Cloudflare’s edge. Gateway TLS interception can use certificates in the ‘available’ (previously called ‘active’) state. One of the following: "pending\_deployment" Link to this property "available" Link to this property "pending\_deletion" Link to this property "inactive" Link to this property
Link to this property certificate: Optional\[str] Provide the CA certificate (read-only). Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property expires\_on: Optional\[datetime] formatdate-time Link to this property fingerprint: Optional\[str] Provide the SHA256 fingerprint of the certificate (read-only). Link to this property in\_use: Optional\[bool] Indicate whether Gateway TLS interception uses this certificate (read-only). You cannot set this value directly. To configure interception, use the Gateway configuration setting named certificate (read-only). Link to this property issuer\_org: Optional\[str] Indicate the organization that issued the certificate (read-only). Link to this property issuer\_raw: Optional\[str] Provide the entire issuer field of the certificate (read-only). Link to this property region: Optional\[str] Indicate the read-only region the certificate authority’s key material is pinned to. Omitted for certificates that were created without a region. Link to this property
type: Optional\[Literal\["custom", "gateway\_managed"]] Indicate the read-only certificate type, BYO-PKI (custom) or Gateway-managed. One of the following: "custom" Link to this property "gateway\_managed" Link to this property
Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property uploaded\_on: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.certificates%20%3E%20(model)%20certificate_delete_response%20%3E%20(schema)>)
class CertificateActivateResponse: … id: Optional\[str] Identify the certificate with a UUID. maxLength36 Link to this property
binding\_status: Optional\[Literal\["pending\_deployment", "available", "pending\_deletion", "inactive"]] Indicate the read-only deployment status of the certificate on Cloudflare’s edge. Gateway TLS interception can use certificates in the ‘available’ (previously called ‘active’) state. One of the following: "pending\_deployment" Link to this property "available" Link to this property "pending\_deletion" Link to this property "inactive" Link to this property
Link to this property certificate: Optional\[str] Provide the CA certificate (read-only). Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property expires\_on: Optional\[datetime] formatdate-time Link to this property fingerprint: Optional\[str] Provide the SHA256 fingerprint of the certificate (read-only). Link to this property in\_use: Optional\[bool] Indicate whether Gateway TLS interception uses this certificate (read-only). You cannot set this value directly. To configure interception, use the Gateway configuration setting named certificate (read-only). Link to this property issuer\_org: Optional\[str] Indicate the organization that issued the certificate (read-only). Link to this property issuer\_raw: Optional\[str] Provide the entire issuer field of the certificate (read-only). Link to this property region: Optional\[str] Indicate the read-only region the certificate authority’s key material is pinned to. Omitted for certificates that were created without a region. Link to this property
type: Optional\[Literal\["custom", "gateway\_managed"]] Indicate the read-only certificate type, BYO-PKI (custom) or Gateway-managed. One of the following: "custom" Link to this property "gateway\_managed" Link to this property
Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property uploaded\_on: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.certificates%20%3E%20(model)%20certificate_activate_response%20%3E%20(schema)>)
class CertificateDeactivateResponse: … id: Optional\[str] Identify the certificate with a UUID. maxLength36 Link to this property
binding\_status: Optional\[Literal\["pending\_deployment", "available", "pending\_deletion", "inactive"]] Indicate the read-only deployment status of the certificate on Cloudflare’s edge. Gateway TLS interception can use certificates in the ‘available’ (previously called ‘active’) state. One of the following: "pending\_deployment" Link to this property "available" Link to this property "pending\_deletion" Link to this property "inactive" Link to this property
Link to this property certificate: Optional\[str] Provide the CA certificate (read-only). Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property expires\_on: Optional\[datetime] formatdate-time Link to this property fingerprint: Optional\[str] Provide the SHA256 fingerprint of the certificate (read-only). Link to this property in\_use: Optional\[bool] Indicate whether Gateway TLS interception uses this certificate (read-only). You cannot set this value directly. To configure interception, use the Gateway configuration setting named certificate (read-only). Link to this property issuer\_org: Optional\[str] Indicate the organization that issued the certificate (read-only). Link to this property issuer\_raw: Optional\[str] Provide the entire issuer field of the certificate (read-only). Link to this property region: Optional\[str] Indicate the read-only region the certificate authority’s key material is pinned to. Omitted for certificates that were created without a region. Link to this property
type: Optional\[Literal\["custom", "gateway\_managed"]] Indicate the read-only certificate type, BYO-PKI (custom) or Gateway-managed. One of the following: "custom" Link to this property "gateway\_managed" Link to this property
Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property uploaded\_on: Optional\[datetime] formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.certificates%20%3E%20(model)%20certificate_deactivate_response%20%3E%20(schema)>) #### GatewayPacfiles ##### [List PAC files](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/list) zero\_trust.gateway.pacfiles.list(PacfileListParams\*\*kwargs) -> SyncV4PagePaginationArray\[[PacfileListResponse]()] GET/accounts/{account\_id}/gateway/pacfiles ##### [Get a PAC file](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/get) zero\_trust.gateway.pacfiles.get(strpacfile\_id, PacfileGetParams\*\*kwargs) -> [PacfileGetResponse]() GET/accounts/{account\_id}/gateway/pacfiles/{pacfile\_id} ##### [Create a PAC file](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/create) zero\_trust.gateway.pacfiles.create(PacfileCreateParams\*\*kwargs) -> [PacfileCreateResponse]() POST/accounts/{account\_id}/gateway/pacfiles ##### [Update a Zero Trust Gateway PAC file](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/update) zero\_trust.gateway.pacfiles.update(strpacfile\_id, PacfileUpdateParams\*\*kwargs) -> [PacfileUpdateResponse]() PUT/accounts/{account\_id}/gateway/pacfiles/{pacfile\_id} ##### [Delete a PAC file](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/delete) zero\_trust.gateway.pacfiles.delete(strpacfile\_id, PacfileDeleteParams\*\*kwargs) -> object DELETE/accounts/{account\_id}/gateway/pacfiles/{pacfile\_id} ##### ModelsExpand Collapse
class PacfileListResponse: … id: Optional\[str] Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property description: Optional\[str] Detailed description of the PAC file. Link to this property name: Optional\[str] Name of the PAC file. Link to this property slug: Optional\[str] URL-friendly version of the PAC file name. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property url: Optional\[str] Unique URL to download the PAC file. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.pacfiles%20%3E%20(model)%20pacfile_list_response%20%3E%20(schema)>)
class PacfileGetResponse: … id: Optional\[str] Link to this property contents: Optional\[str] Actual contents of the PAC file Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property description: Optional\[str] Detailed description of the PAC file. Link to this property name: Optional\[str] Name of the PAC file. Link to this property slug: Optional\[str] URL-friendly version of the PAC file name. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property url: Optional\[str] Unique URL to download the PAC file. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.pacfiles%20%3E%20(model)%20pacfile_get_response%20%3E%20(schema)>)
class PacfileCreateResponse: … id: Optional\[str] Link to this property contents: Optional\[str] Actual contents of the PAC file Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property description: Optional\[str] Detailed description of the PAC file. Link to this property name: Optional\[str] Name of the PAC file. Link to this property slug: Optional\[str] URL-friendly version of the PAC file name. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property url: Optional\[str] Unique URL to download the PAC file. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.pacfiles%20%3E%20(model)%20pacfile_create_response%20%3E%20(schema)>)
class PacfileUpdateResponse: … id: Optional\[str] Link to this property contents: Optional\[str] Actual contents of the PAC file Link to this property created\_at: Optional\[datetime] formatdate-time Link to this property description: Optional\[str] Detailed description of the PAC file. Link to this property name: Optional\[str] Name of the PAC file. Link to this property slug: Optional\[str] URL-friendly version of the PAC file name. Link to this property updated\_at: Optional\[datetime] formatdate-time Link to this property url: Optional\[str] Unique URL to download the PAC file. Link to this property
[Link to this property](<#(resource)%20zero_trust.gateway.pacfiles%20%3E%20(model)%20pacfile_update_response%20%3E%20(schema)>)