---
title: Zero Trust
---
[Skip to content](#_top)
[API Reference](https://developers.cloudflare.com/api)
Copy Markdown
Open in **Claude**Open in **ChatGPT**Open in **Cursor**
---
**Copy Markdown****View as Markdown**
# Zero Trust
#### Zero TrustDevices
##### [List devices (deprecated)](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/methods/list)
Deprecated
GET/accounts/{account\_id}/devices
##### [Get device (deprecated)](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/methods/get)
Deprecated
GET/accounts/{account\_id}/devices/{device\_id}
##### ModelsExpand Collapse
Device object {id, created, deleted, 17 more }
id: optional string
Registration ID. Equal to Device ID except for accounts which enabled multi-user mode.
maxLength36
Link to this property
created: optional string
When the device was created.
formatdate-time
Link to this property
deleted: optional boolean
True if the device was deleted.
Link to this property
device\_type: optional "windows"or "mac"or "linux"or 3 more
One of the following:
"windows"
Link to this property
"mac"
Link to this property
"linux"
Link to this property
"android"
Link to this property
"ios"
Link to this property
"chromeos"
Link to this property
Link to this property
ip: optional string
IPv4 or IPv6 address.
Link to this property
key: optional string
The device’s public key.
Link to this property
last\_seen: optional string
When the device last connected to Cloudflare services.
formatdate-time
Link to this property
mac\_address: optional string
The device mac address.
Link to this property
manufacturer: optional string
The device manufacturer name.
Link to this property
model: optional string
The device model name.
Link to this property
name: optional string
The device name.
Link to this property
os\_distro\_name: optional string
The Linux distro name.
Link to this property
os\_distro\_revision: optional string
The Linux distro revision.
Link to this property
os\_version: optional string
The operating system version.
Link to this property
os\_version\_extra: optional string
Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
Link to this property
revoked\_at: optional string
When the device was revoked.
formatdate-time
Link to this property
serial\_number: optional string
The device serial number.
Link to this property
updated: optional string
When the device was updated.
formatdate-time
Link to this property
user: optional object {id, email, name }
id: optional string
UUID.
maxLength36
Link to this property
email: optional string
The contact email address of the user.
maxLength90
Link to this property
name: optional string
The enrolled device user’s name.
Link to this property
Link to this property
version: optional string
The WARP client version.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices%20%3E%20(model)%20device%20%3E%20(schema)>)
DeviceGetResponse object {id, account, created, 16 more }
id: optional string
Registration ID. Equal to Device ID except for accounts which enabled multi-user mode.
maxLength36
Link to this property
account: optional object {id, account\_type, name }
Deprecatedid: optional string
Link to this property
Deprecatedaccount\_type: optional string
Link to this property
name: optional string
The name of the enrolled account.
Link to this property
Link to this property
created: optional string
When the device was created.
formatdate-time
Link to this property
deleted: optional boolean
True if the device was deleted.
Link to this property
device\_type: optional string
Link to this property
Deprecatedgateway\_device\_id: optional string
Link to this property
ip: optional string
IPv4 or IPv6 address.
Link to this property
key: optional string
The device’s public key.
Link to this property
key\_type: optional string
Type of the key.
Link to this property
last\_seen: optional string
When the device last connected to Cloudflare services.
formatdate-time
Link to this property
mac\_address: optional string
The device mac address.
Link to this property
model: optional string
The device model name.
Link to this property
name: optional string
The device name.
Link to this property
os\_version: optional string
The operating system version.
Link to this property
serial\_number: optional string
The device serial number.
Link to this property
tunnel\_type: optional string
Type of the tunnel connection used.
Link to this property
updated: optional string
When the device was updated.
formatdate-time
Link to this property
user: optional object {id, email, name }
id: optional string
UUID.
maxLength36
Link to this property
email: optional string
The contact email address of the user.
maxLength90
Link to this property
name: optional string
The enrolled device user’s name.
Link to this property
Link to this property
version: optional string
The WARP client version.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices%20%3E%20(model)%20device_get_response%20%3E%20(schema)>)
#### Zero TrustDevicesDevices
##### [List devices](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/devices/methods/list)
GET/accounts/{account\_id}/devices/physical-devices
##### [Get device](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/devices/methods/get)
GET/accounts/{account\_id}/devices/physical-devices/{device\_id}
##### [Delete device](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/devices/methods/delete)
DELETE/accounts/{account\_id}/devices/physical-devices/{device\_id}
##### [Revoke device registrations](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/devices/methods/revoke)
Deprecated
POST/accounts/{account\_id}/devices/physical-devices/{device\_id}/revoke
##### ModelsExpand Collapse
DeviceListResponse object {id, active\_registrations, created\_at, 17 more }
A WARP Device.
id: string
The unique ID of the device.
Link to this property
active\_registrations: number
The number of active registrations for the device. Active registrations are those which haven’t been revoked or deleted.
Link to this property
created\_at: string
The RFC3339 timestamp when the device was created.
Link to this property
last\_seen\_at: string
The RFC3339 timestamp when the device was last seen.
Link to this property
name: string
The name of the device.
Link to this property
tags: map\[string]
Tags assigned to the device. An empty object if the device has no tags.
Link to this property
updated\_at: string
The RFC3339 timestamp when the device was last updated.
Link to this property
client\_version: optional string
Version of the WARP client.
Link to this property
deleted\_at: optional string
The RFC3339 timestamp when the device was deleted.
Link to this property
device\_type: optional string
The device operating system.
Link to this property
hardware\_id: optional string
A string that uniquely identifies the hardware or virtual machine (VM).
Link to this property
last\_seen\_registration: optional object {policy }
The last seen registration for the device.
policy: optional object {id, default, deleted, 2 more }
A summary of the device profile evaluated for the registration.
id: string
The ID of the device settings profile.
Link to this property
default: boolean
Whether the device settings profile is the default profile for the account.
Link to this property
deleted: boolean
Whether the device settings profile was deleted.
Link to this property
name: string
The name of the device settings profile.
Link to this property
updated\_at: string
The RFC3339 timestamp of when the device settings profile last changed for the registration.
Link to this property
Link to this property
Link to this property
last\_seen\_user: optional object {id, email, name }
The last user to use the WARP device.
id: optional string
UUID.
maxLength36
Link to this property
email: optional string
The contact email address of the user.
maxLength90
Link to this property
name: optional string
The enrolled device user’s name.
Link to this property
Link to this property
mac\_address: optional string
The device MAC address.
Link to this property
manufacturer: optional string
The device manufacturer.
Link to this property
model: optional string
The model name of the device.
Link to this property
os\_version: optional string
The device operating system version number.
Link to this property
os\_version\_extra: optional string
Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
Link to this property
Deprecatedpublic\_ip: optional string
**Deprecated**: IP information is provided by DEX - see https://developers.cloudflare.com/api/resources/zero\_trust/subresources/dex/subresources/fleet\_status/subresources/devices/methods/list/
Link to this property
serial\_number: optional string
The device serial number.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.devices%20%3E%20(model)%20device_list_response%20%3E%20(schema)>)
DeviceGetResponse object {id, active\_registrations, created\_at, 17 more }
A WARP Device.
id: string
The unique ID of the device.
Link to this property
active\_registrations: number
The number of active registrations for the device. Active registrations are those which haven’t been revoked or deleted.
Link to this property
created\_at: string
The RFC3339 timestamp when the device was created.
Link to this property
last\_seen\_at: string
The RFC3339 timestamp when the device was last seen.
Link to this property
name: string
The name of the device.
Link to this property
tags: map\[string]
Tags assigned to the device. An empty object if the device has no tags.
Link to this property
updated\_at: string
The RFC3339 timestamp when the device was last updated.
Link to this property
client\_version: optional string
Version of the WARP client.
Link to this property
deleted\_at: optional string
The RFC3339 timestamp when the device was deleted.
Link to this property
device\_type: optional string
The device operating system.
Link to this property
hardware\_id: optional string
A string that uniquely identifies the hardware or virtual machine (VM).
Link to this property
last\_seen\_registration: optional object {policy }
The last seen registration for the device.
policy: optional object {id, default, deleted, 2 more }
A summary of the device profile evaluated for the registration.
id: string
The ID of the device settings profile.
Link to this property
default: boolean
Whether the device settings profile is the default profile for the account.
Link to this property
deleted: boolean
Whether the device settings profile was deleted.
Link to this property
name: string
The name of the device settings profile.
Link to this property
updated\_at: string
The RFC3339 timestamp of when the device settings profile last changed for the registration.
Link to this property
Link to this property
Link to this property
last\_seen\_user: optional object {id, email, name }
The last user to use the WARP device.
id: optional string
UUID.
maxLength36
Link to this property
email: optional string
The contact email address of the user.
maxLength90
Link to this property
name: optional string
The enrolled device user’s name.
Link to this property
Link to this property
mac\_address: optional string
The device MAC address.
Link to this property
manufacturer: optional string
The device manufacturer.
Link to this property
model: optional string
The model name of the device.
Link to this property
os\_version: optional string
The device operating system version number.
Link to this property
os\_version\_extra: optional string
Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
Link to this property
Deprecatedpublic\_ip: optional string
**Deprecated**: IP information is provided by DEX - see https://developers.cloudflare.com/api/resources/zero\_trust/subresources/dex/subresources/fleet\_status/subresources/devices/methods/list/
Link to this property
serial\_number: optional string
The device serial number.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.devices%20%3E%20(model)%20device_get_response%20%3E%20(schema)>)
DeviceDeleteResponse = unknown
[Link to this property](<#(resource)%20zero_trust.devices.devices%20%3E%20(model)%20device_delete_response%20%3E%20(schema)>)
DeviceRevokeResponse = unknown
[Link to this property](<#(resource)%20zero_trust.devices.devices%20%3E%20(model)%20device_revoke_response%20%3E%20(schema)>)
#### Zero TrustDevicesResilience
#### Zero TrustDevicesResilienceGlobal WARP Override
##### [Get Global Disconnect](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/resilience/subresources/global_warp_override/methods/get)
GET/accounts/{account\_id}/devices/resilience/disconnect
##### [Set Global Disconnect](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/resilience/subresources/global_warp_override/methods/create)
POST/accounts/{account\_id}/devices/resilience/disconnect
##### ModelsExpand Collapse
GlobalWARPOverrideGetResponse object {disconnect, timestamp }
disconnect: optional boolean
Disconnects all devices on the account using Global WARP override.
Link to this property
timestamp: optional string
When the Global WARP override state was updated.
formatdate-time
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.resilience.global_warp_override%20%3E%20(model)%20global_warp_override_get_response%20%3E%20(schema)>)
GlobalWARPOverrideCreateResponse object {disconnect, timestamp }
disconnect: optional boolean
Disconnects all devices on the account using Global WARP override.
Link to this property
timestamp: optional string
When the Global WARP override state was updated.
formatdate-time
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.resilience.global_warp_override%20%3E%20(model)%20global_warp_override_create_response%20%3E%20(schema)>)
#### Zero TrustDevicesRegistrations
##### [List registrations](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/registrations/methods/list)
GET/accounts/{account\_id}/devices/registrations
##### [Get registration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/registrations/methods/get)
GET/accounts/{account\_id}/devices/registrations/{registration\_id}
##### [Delete registration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/registrations/methods/delete)
DELETE/accounts/{account\_id}/devices/registrations/{registration\_id}
##### [Delete registrations](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/registrations/methods/bulk_delete)
DELETE/accounts/{account\_id}/devices/registrations
##### [Revoke registrations](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/registrations/methods/revoke)
Deprecated
POST/accounts/{account\_id}/devices/registrations/revoke
##### [Unrevoke registrations](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/registrations/methods/unrevoke)
Deprecated
POST/accounts/{account\_id}/devices/registrations/unrevoke
##### ModelsExpand Collapse
RegistrationListResponse object {id, created\_at, device, 12 more }
A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device.
id: string
The ID of the registration.
Link to this property
created\_at: string
The RFC3339 timestamp when the registration was created.
Link to this property
device: object {id, name, client\_version }
Device details embedded inside of a registration.
id: string
The ID of the device.
Link to this property
name: string
The name of the device.
Link to this property
client\_version: optional string
Version of the WARP client.
Link to this property
Link to this property
key: string
The public key used to connect to the Cloudflare network.
Link to this property
last\_seen\_at: string
The RFC3339 timestamp when the registration was last seen.
Link to this property
registration\_type: "warp"or "browser\_extension"
The registration client type, derived from device\_type.
One of the following:
"warp"
Link to this property
"browser\_extension"
Link to this property
Link to this property
updated\_at: string
The RFC3339 timestamp when the registration was last updated.
Link to this property
deleted\_at: optional string
The RFC3339 timestamp when the registration was deleted.
Link to this property
key\_type: optional string
The type of encryption key used by the WARP client for the active key. Currently ‘curve25519’ for WireGuard and ‘secp256r1’ for MASQUE.
Link to this property
policy: optional object {id, default, deleted, 2 more }
The device settings profile assigned to this registration.
id: string
The ID of the device settings profile.
Link to this property
default: boolean
Whether the device settings profile is the default profile for the account.
Link to this property
deleted: boolean
Whether the device settings profile was deleted.
Link to this property
name: string
The name of the device settings profile.
Link to this property
updated\_at: string
The RFC3339 timestamp of when the device settings profile last changed for the registration.
Link to this property
Link to this property
revoked\_at: optional string
The RFC3339 timestamp when the registration was revoked.
Link to this property
tunnel\_type: optional string
Type of the tunnel - wireguard or masque.
Link to this property
user: optional object {id, email, name }
id: optional string
UUID.
maxLength36
Link to this property
email: optional string
The contact email address of the user.
maxLength90
Link to this property
name: optional string
The enrolled device user’s name.
Link to this property
Link to this property
virtual\_ipv4: optional string
The virtual IPv4 address assigned to the network interface of the tunnel for this registration.
Link to this property
virtual\_ipv6: optional string
The virtual IPv6 address assigned to the network interface of the tunnel for this registration.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.registrations%20%3E%20(model)%20registration_list_response%20%3E%20(schema)>)
RegistrationGetResponse object {id, created\_at, device, 12 more }
A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device.
id: string
The ID of the registration.
Link to this property
created\_at: string
The RFC3339 timestamp when the registration was created.
Link to this property
device: object {id, name, client\_version }
Device details embedded inside of a registration.
id: string
The ID of the device.
Link to this property
name: string
The name of the device.
Link to this property
client\_version: optional string
Version of the WARP client.
Link to this property
Link to this property
key: string
The public key used to connect to the Cloudflare network.
Link to this property
last\_seen\_at: string
The RFC3339 timestamp when the registration was last seen.
Link to this property
registration\_type: "warp"or "browser\_extension"
The registration client type, derived from device\_type.
One of the following:
"warp"
Link to this property
"browser\_extension"
Link to this property
Link to this property
updated\_at: string
The RFC3339 timestamp when the registration was last updated.
Link to this property
deleted\_at: optional string
The RFC3339 timestamp when the registration was deleted.
Link to this property
key\_type: optional string
The type of encryption key used by the WARP client for the active key. Currently ‘curve25519’ for WireGuard and ‘secp256r1’ for MASQUE.
Link to this property
policy: optional object {id, default, deleted, 2 more }
The device settings profile assigned to this registration.
id: string
The ID of the device settings profile.
Link to this property
default: boolean
Whether the device settings profile is the default profile for the account.
Link to this property
deleted: boolean
Whether the device settings profile was deleted.
Link to this property
name: string
The name of the device settings profile.
Link to this property
updated\_at: string
The RFC3339 timestamp of when the device settings profile last changed for the registration.
Link to this property
Link to this property
revoked\_at: optional string
The RFC3339 timestamp when the registration was revoked.
Link to this property
tunnel\_type: optional string
Type of the tunnel - wireguard or masque.
Link to this property
user: optional object {id, email, name }
id: optional string
UUID.
maxLength36
Link to this property
email: optional string
The contact email address of the user.
maxLength90
Link to this property
name: optional string
The enrolled device user’s name.
Link to this property
Link to this property
virtual\_ipv4: optional string
The virtual IPv4 address assigned to the network interface of the tunnel for this registration.
Link to this property
virtual\_ipv6: optional string
The virtual IPv6 address assigned to the network interface of the tunnel for this registration.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.registrations%20%3E%20(model)%20registration_get_response%20%3E%20(schema)>)
RegistrationDeleteResponse = unknown
[Link to this property](<#(resource)%20zero_trust.devices.registrations%20%3E%20(model)%20registration_delete_response%20%3E%20(schema)>)
RegistrationBulkDeleteResponse = unknown
[Link to this property](<#(resource)%20zero_trust.devices.registrations%20%3E%20(model)%20registration_bulk_delete_response%20%3E%20(schema)>)
RegistrationRevokeResponse = unknown
[Link to this property](<#(resource)%20zero_trust.devices.registrations%20%3E%20(model)%20registration_revoke_response%20%3E%20(schema)>)
RegistrationUnrevokeResponse = unknown
[Link to this property](<#(resource)%20zero_trust.devices.registrations%20%3E%20(model)%20registration_unrevoke_response%20%3E%20(schema)>)
#### Zero TrustDevicesDEX Tests
##### [List Device DEX tests](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/list)
GET/accounts/{account\_id}/dex/devices/dex\_tests
##### [Get Device DEX test](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/get)
GET/accounts/{account\_id}/dex/devices/dex\_tests/{dex\_test\_id}
##### [Create Device DEX test](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/create)
POST/accounts/{account\_id}/dex/devices/dex\_tests
##### [Update Device DEX test](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/update)
PUT/accounts/{account\_id}/dex/devices/dex\_tests/{dex\_test\_id}
##### [Delete Device DEX test](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/dex_tests/methods/delete)
DELETE/accounts/{account\_id}/dex/devices/dex\_tests/{dex\_test\_id}
##### ModelsExpand Collapse
SchemaData object {host, kind, method }
The configuration object which contains the details for the WARP client to conduct the test.
host: string
The desired endpoint to test.
Link to this property
kind: "http"or "traceroute"
The type of test.
One of the following:
"http"
Link to this property
"traceroute"
Link to this property
Link to this property
method: optional "GET"
The HTTP request method type.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.dex_tests%20%3E%20(model)%20schema_data%20%3E%20(schema)>)
SchemaHTTP object {data, enabled, interval, 7 more }
data: SchemaData { host, kind, method }
The configuration object which contains the details for the WARP client to conduct the test.
Link to this property
enabled: boolean
Determines whether or not the test is active.
Link to this property
interval: string
How often the test will run.
Link to this property
name: string
The name of the DEX test. Must be unique.
Link to this property
created: optional string
Date the test was created, in RFC 3339 format.
formatdate-time
Link to this property
description: optional string
Additional details about the test.
Link to this property
target\_policies: optional array of object {id, default, name }
DEX rules targeted by this test
id: string
The id of the DEX rule.
maxLength36
Link to this property
default: optional boolean
Whether the DEX rule is the account default.
Link to this property
name: optional string
The name of the DEX rule.
Link to this property
Link to this property
targeted: optional boolean
Link to this property
test\_id: optional string
The unique identifier for the test.
maxLength32
Link to this property
updated: optional string
Date the test was last updated, in RFC 3339 format.
formatdate-time
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.dex_tests%20%3E%20(model)%20schema_http%20%3E%20(schema)>)
DEXTestDeleteResponse object {dex\_tests }
dex\_tests: optional array of SchemaHTTP { data, enabled, interval, 7 more }
data: SchemaData { host, kind, method }
The configuration object which contains the details for the WARP client to conduct the test.
Link to this property
enabled: boolean
Determines whether or not the test is active.
Link to this property
interval: string
How often the test will run.
Link to this property
name: string
The name of the DEX test. Must be unique.
Link to this property
created: optional string
Date the test was created, in RFC 3339 format.
formatdate-time
Link to this property
description: optional string
Additional details about the test.
Link to this property
target\_policies: optional array of object {id, default, name }
DEX rules targeted by this test
id: string
The id of the DEX rule.
maxLength36
Link to this property
default: optional boolean
Whether the DEX rule is the account default.
Link to this property
name: optional string
The name of the DEX rule.
Link to this property
Link to this property
targeted: optional boolean
Link to this property
test\_id: optional string
The unique identifier for the test.
maxLength32
Link to this property
updated: optional string
Date the test was last updated, in RFC 3339 format.
formatdate-time
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.dex_tests%20%3E%20(model)%20dex_test_delete_response%20%3E%20(schema)>)
#### Zero TrustDevicesIP Profiles
##### [List IP profiles](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/list)
GET/accounts/{account\_id}/devices/ip-profiles
##### [Get IP profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/get)
GET/accounts/{account\_id}/devices/ip-profiles/{profile\_id}
##### [Create IP profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/create)
POST/accounts/{account\_id}/devices/ip-profiles
##### [Update IP profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/update)
PATCH/accounts/{account\_id}/devices/ip-profiles/{profile\_id}
##### [Delete IP profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/ip_profiles/methods/delete)
DELETE/accounts/{account\_id}/devices/ip-profiles/{profile\_id}
##### ModelsExpand Collapse
IPProfile object {id, created\_at, description, 6 more }
id: string
The ID of the Device IP profile.
Link to this property
created\_at: string
The RFC3339Nano timestamp when the Device IP profile was created.
Link to this property
description: string
An optional description of the Device IP profile.
Link to this property
enabled: boolean
Whether the Device IP profile is enabled.
Link to this property
match: string
The wirefilter expression to match registrations. Available values: “identity.name”, “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.saml\_attributes”.
maxLength10000
Link to this property
name: string
A user-friendly name for the Device IP profile.
Link to this property
precedence: number
The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.
Link to this property
subnet\_id: string
The ID of the Subnet.
Link to this property
updated\_at: string
The RFC3339Nano timestamp when the Device IP profile was last updated.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.ip_profiles%20%3E%20(model)%20ip_profile%20%3E%20(schema)>)
IPProfileDeleteResponse object {id }
id: optional string
ID of the deleted Device IP profile.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.ip_profiles%20%3E%20(model)%20ip_profile_delete_response%20%3E%20(schema)>)
#### Zero TrustDevicesDeployment Groups
##### [List deployment groups](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/list)
GET/accounts/{account\_id}/devices/deployment-groups
##### [Get deployment group](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/get)
GET/accounts/{account\_id}/devices/deployment-groups/{group\_id}
##### [Create deployment group](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/create)
POST/accounts/{account\_id}/devices/deployment-groups
##### [Update deployment group](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/edit)
PATCH/accounts/{account\_id}/devices/deployment-groups/{group\_id}
##### [Delete deployment group](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/deployment_groups/methods/delete)
DELETE/accounts/{account\_id}/devices/deployment-groups/{group\_id}
##### ModelsExpand Collapse
DeploymentGroup object {id, created\_at, name, 3 more }
id: string
The ID of the deployment group.
Link to this property
created\_at: string
The RFC3339Nano timestamp when the deployment group was created.
Link to this property
name: string
A user-friendly name for the deployment group.
maxLength255
minLength1
Link to this property
updated\_at: string
The RFC3339Nano timestamp when the deployment group was last updated.
Link to this property
version\_config: array of object {target\_environment, version }
Contains version configurations for different target environments.
target\_environment: string
The target environment for the client version (e.g., windows, macos).
Link to this property
version: string
The specific client version to deploy.
Link to this property
Link to this property
policy\_ids: optional array of string
Contains a list of policy IDs assigned to this deployment group.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.deployment_groups%20%3E%20(model)%20deployment_group%20%3E%20(schema)>)
DeploymentGroupDeleteResponse object {id }
id: optional string
The ID of a deleted deployment group.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.deployment_groups%20%3E%20(model)%20deployment_group_delete_response%20%3E%20(schema)>)
#### Zero TrustDevicesNetworks
##### [List your device managed networks](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/networks/methods/list)
GET/accounts/{account\_id}/devices/networks
##### [Get device managed network details](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/networks/methods/get)
GET/accounts/{account\_id}/devices/networks/{network\_id}
##### [Create a device managed network](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/networks/methods/create)
POST/accounts/{account\_id}/devices/networks
##### [Update a device managed network](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/networks/methods/update)
PUT/accounts/{account\_id}/devices/networks/{network\_id}
##### [Delete a device managed network](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/networks/methods/delete)
DELETE/accounts/{account\_id}/devices/networks/{network\_id}
##### ModelsExpand Collapse
DeviceNetwork object {config, name, network\_id, type }
config: optional object {tls\_sockaddr, sha256 }
The configuration object containing information for the WARP client to detect the managed network.
tls\_sockaddr: string
A network address of the form “host:port” that the WARP client will use to detect the presence of a TLS host.
Link to this property
sha256: optional string
The SHA-256 hash of the TLS certificate presented by the host found at tls\_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.
Link to this property
Link to this property
name: optional string
The name of the device managed network. This name must be unique.
Link to this property
network\_id: optional string
API UUID.
maxLength36
Link to this property
type: optional "tls"
The type of device managed network.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.networks%20%3E%20(model)%20device_network%20%3E%20(schema)>)
#### Zero TrustDevicesFleet Status
##### [Get the latest status of a device.](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/fleet_status/methods/get)
GET/accounts/{account\_id}/dex/devices/{device\_id}/fleet-status/live
##### ModelsExpand Collapse
FleetStatusGetResponse object {colo, deviceId, mode, 40 more }
colo: string
Cloudflare colo airport code.
Link to this property
deviceId: string
Device identifier (UUID v4)
Link to this property
mode: string
The mode under which the WARP client is run.
Link to this property
platform: string
Operating system.
Link to this property
status: string
Network status.
Link to this property
timestamp: string
Link to this property
version: string
WARP client version.
Link to this property
alwaysOn: optional boolean
Link to this property
batteryCharging: optional boolean
Link to this property
batteryCycles: optional number
formatint64
Link to this property
batteryPct: optional number
formatfloat
Link to this property
connectionType: optional string
Link to this property
cpuPct: optional number
formatfloat
Link to this property
cpuPctByApp: optional array of object {cpu\_pct, name }
cpu\_pct: optional number
CPU usage percentage, on a scale of 0 to 100.
formatfloat
maximum100
minimum0
Link to this property
name: optional string
Application name.
Link to this property
Link to this property
deviceIpv4: optional object {address, asn, aso, 4 more }
address: optional string
Link to this property
asn: optional number
Link to this property
aso: optional string
Link to this property
location: optional object {city, country\_iso, state\_iso, zip }
city: optional string
Link to this property
country\_iso: optional string
Link to this property
state\_iso: optional string
Link to this property
zip: optional string
Link to this property
Link to this property
name: optional string
Link to this property
netmask: optional string
Link to this property
version: optional number
IP version (1 for IPv4, 2 for IPv6, 0 if unknown).
Link to this property
Link to this property
deviceIpv6: optional object {address, asn, aso, 4 more }
address: optional string
Link to this property
asn: optional number
Link to this property
aso: optional string
Link to this property
location: optional object {city, country\_iso, state\_iso, zip }
city: optional string
Link to this property
country\_iso: optional string
Link to this property
state\_iso: optional string
Link to this property
zip: optional string
Link to this property
Link to this property
name: optional string
Link to this property
netmask: optional string
Link to this property
version: optional number
IP version (1 for IPv4, 2 for IPv6, 0 if unknown).
Link to this property
Link to this property
deviceName: optional string
Device identifier (human readable).
Link to this property
DeprecateddeviceRegistration: optional string
Use registrationId instead.
Deprecated: use registrationId. Device registration identifier (UUID).
Link to this property
diskReadBps: optional number
formatint64
Link to this property
diskUsagePct: optional number
formatfloat
Link to this property
diskWriteBps: optional number
formatint64
Link to this property
dohSubdomain: optional string
Link to this property
estimatedLossPct: optional number
formatfloat
Link to this property
firewallEnabled: optional boolean
Link to this property
gatewayIpv4: optional object {address, asn, aso, 4 more }
address: optional string
Link to this property
asn: optional number
Link to this property
aso: optional string
Link to this property
location: optional object {city, country\_iso, state\_iso, zip }
city: optional string
Link to this property
country\_iso: optional string
Link to this property
state\_iso: optional string
Link to this property
zip: optional string
Link to this property
Link to this property
name: optional string
Link to this property
netmask: optional string
Link to this property
version: optional number
IP version (1 for IPv4, 2 for IPv6, 0 if unknown).
Link to this property
Link to this property
gatewayIpv6: optional object {address, asn, aso, 4 more }
address: optional string
Link to this property
asn: optional number
Link to this property
aso: optional string
Link to this property
location: optional object {city, country\_iso, state\_iso, zip }
city: optional string
Link to this property
country\_iso: optional string
Link to this property
state\_iso: optional string
Link to this property
zip: optional string
Link to this property
Link to this property
name: optional string
Link to this property
netmask: optional string
Link to this property
version: optional number
IP version (1 for IPv4, 2 for IPv6, 0 if unknown).
Link to this property
Link to this property
handshakeLatencyMs: optional number
formatint64
Link to this property
ispIpv4: optional object {address, asn, aso, 4 more }
address: optional string
Link to this property
asn: optional number
Link to this property
aso: optional string
Link to this property
location: optional object {city, country\_iso, state\_iso, zip }
city: optional string
Link to this property
country\_iso: optional string
Link to this property
state\_iso: optional string
Link to this property
zip: optional string
Link to this property
Link to this property
name: optional string
Link to this property
netmask: optional string
Link to this property
version: optional number
IP version (1 for IPv4, 2 for IPv6, 0 if unknown).
Link to this property
Link to this property
ispIpv6: optional object {address, asn, aso, 4 more }
address: optional string
Link to this property
asn: optional number
Link to this property
aso: optional string
Link to this property
location: optional object {city, country\_iso, state\_iso, zip }
city: optional string
Link to this property
country\_iso: optional string
Link to this property
state\_iso: optional string
Link to this property
zip: optional string
Link to this property
Link to this property
name: optional string
Link to this property
netmask: optional string
Link to this property
version: optional number
IP version (1 for IPv4, 2 for IPv6, 0 if unknown).
Link to this property
Link to this property
metal: optional string
Link to this property
networkRcvdBps: optional number
formatint64
Link to this property
networkSentBps: optional number
formatint64
Link to this property
networkSsid: optional string
Link to this property
personEmail: optional string
User contact email address
Link to this property
ramAvailableKb: optional number
formatint64
Link to this property
ramUsedPct: optional number
formatfloat
Link to this property
ramUsedPctByApp: optional array of object {name, ram\_used\_pct }
name: optional string
Application name.
Link to this property
ram\_used\_pct: optional number
RAM usage percentage, on a scale of 0 to 100.
formatfloat
maximum100
minimum0
Link to this property
Link to this property
registrationId: optional string
Device registration identifier (UUID v4). On multi-user devices, this uniquely identifies a user’s registration on the device.
Link to this property
rtt: optional object {minRttUs, rttUs, rttVarUs }
Round-trip time statistics for the WARP tunnel.
minRttUs: optional object {downstream, upstream }
Minimum round-trip time in microseconds.
downstream: optional number
Link to this property
upstream: optional number
Link to this property
Link to this property
rttUs: optional object {downstream, upstream }
Round-trip time in microseconds.
downstream: optional number
Link to this property
upstream: optional number
Link to this property
Link to this property
rttVarUs: optional object {downstream, upstream }
Round-trip time variance in microseconds.
downstream: optional number
Link to this property
upstream: optional number
Link to this property
Link to this property
Link to this property
switchLocked: optional boolean
Link to this property
tunnelStats: optional object {bytesLost, bytesReceived, bytesRetransmitted, 6 more }
WARP tunnel packet and byte counters.
bytesLost: optional object {downstream, upstream }
Number of bytes lost, split by direction.
downstream: optional number
Link to this property
upstream: optional number
Link to this property
Link to this property
bytesReceived: optional object {downstream, upstream }
Number of bytes received, split by direction.
downstream: optional number
Link to this property
upstream: optional number
Link to this property
Link to this property
bytesRetransmitted: optional object {downstream, upstream }
Number of bytes retransmitted, split by direction.
downstream: optional number
Link to this property
upstream: optional number
Link to this property
Link to this property
bytesSent: optional object {downstream, upstream }
Number of bytes sent, split by direction.
downstream: optional number
Link to this property
upstream: optional number
Link to this property
Link to this property
packetsLost: optional object {downstream, upstream }
Number of packets lost, split by direction.
downstream: optional number
Link to this property
upstream: optional number
Link to this property
Link to this property
packetsReceived: optional object {downstream, upstream }
Number of packets received, split by direction.
downstream: optional number
Link to this property
upstream: optional number
Link to this property
Link to this property
packetsRetransmitted: optional object {downstream, upstream }
Number of packets retransmitted, split by direction.
downstream: optional number
Link to this property
upstream: optional number
Link to this property
Link to this property
packetsSent: optional object {downstream, upstream }
Number of packets sent, split by direction.
downstream: optional number
Link to this property
upstream: optional number
Link to this property
Link to this property
statsWindowMs: optional number
The measurement window duration in milliseconds.
Link to this property
Link to this property
tunnelType: optional string
Link to this property
wifiStrengthDbm: optional number
formatint64
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.fleet_status%20%3E%20(model)%20fleet_status_get_response%20%3E%20(schema)>)
#### Zero TrustDevicesPolicies
##### ModelsExpand Collapse
DevicePolicyCertificates object {enabled }
enabled: boolean
The current status of the device policy certificate provisioning feature for WARP clients.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20device_policy_certificates%20%3E%20(schema)>)
FallbackDomain object {suffix, description, dns\_server }
suffix: string
The domain suffix to match when resolving locally.
Link to this property
description: optional string
A description of the fallback domain, displayed in the client UI.
maxLength100
Link to this property
dns\_server: optional array of string
A list of IP addresses to handle domain resolution.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20fallback_domain%20%3E%20(schema)>)
SettingsPolicy object {allow\_mode\_switch, allow\_updates, allowed\_to\_leave, 30 more }
allow\_mode\_switch: optional boolean
Whether to allow the user to switch WARP between modes.
Link to this property
allow\_updates: optional boolean
Whether to receive update notifications when a new version of the client is available.
Link to this property
allowed\_to\_leave: optional boolean
Whether to allow devices to leave the organization.
Link to this property
auto\_connect: optional number
The amount of time in seconds to reconnect after having been disabled.
Link to this property
browser\_extension\_config: optional object {proxy\_control, proxy\_enabled }
Browser extension proxy settings. Required when profile\_type is browser\_extension and invalid for WARP profiles.
proxy\_control: "unlocked"or "locked"
Whether the user may disable the browser extension proxy.
One of the following:
"unlocked"
Link to this property
"locked"
Link to this property
Link to this property
proxy\_enabled: boolean
Whether the browser extension proxy is active.
Link to this property
Link to this property
captive\_portal: optional number
Turn on the captive portal after the specified amount of time.
Link to this property
default: optional boolean
Whether the policy is the account default. WARP group profiles cannot set this field.
Link to this property
description: optional string
A description of the policy.
maxLength500
Link to this property
disable\_auto\_fallback: optional boolean
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
Link to this property
dns\_search\_suffixes: optional array of object {suffix, description }
List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
suffix: string
The DNS search suffix to append when resolving short hostnames.
Link to this property
description: optional string
A description of the DNS search suffix.
Link to this property
Link to this property
enabled: optional boolean
Whether the policy will be applied to matching devices.
Link to this property
exclude: optional array of SplitTunnelExclude
List of routes excluded in the WARP client’s tunnel.
One of the following:
TeamsDevicesExcludeSplitTunnelWithAddress object {address, description }
address: string
The address in CIDR format to exclude from the tunnel. If address is present, host must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
TeamsDevicesExcludeSplitTunnelWithHost object {host, description }
host: string
The domain name to exclude from the tunnel. If host is present, address must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
Link to this property
exclude\_office\_ips: optional boolean
Whether to add Microsoft IPs to Split Tunnel exclusions.
Link to this property
fallback\_domains: optional array of FallbackDomain { suffix, description, dns\_server }
suffix: string
The domain suffix to match when resolving locally.
Link to this property
description: optional string
A description of the fallback domain, displayed in the client UI.
maxLength100
Link to this property
dns\_server: optional array of string
A list of IP addresses to handle domain resolution.
Link to this property
Link to this property
gateway\_unique\_id: optional string
Link to this property
global\_acceleration: optional object {api\_endpoints, enabled, masque\_endpoints, 2 more }
Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
api\_endpoints: array of string
IP:port entries for the API endpoints.
Link to this property
enabled: boolean
Global acceleration settings are used only when “enabled”.
Link to this property
masque\_endpoints: array of string
IP:port entries for the MASQUE tunnel endpoints. Either wireguard\_endpoints or masque\_endpoints must be provided.
Link to this property
wireguard\_endpoints: array of string
IP:port entries for the WireGuard tunnel endpoints. Either wireguard\_endpoints or masque\_endpoints must be provided.
Link to this property
autoswitch: optional boolean
Automatically switch Global Acceleration regions based on device location. Defaults to false when not provided.
Link to this property
Link to this property
include: optional array of SplitTunnelInclude
List of routes included in the WARP client’s tunnel.
One of the following:
TeamsDevicesIncludeSplitTunnelWithAddress object {address, description }
address: string
The address in CIDR format to include in the tunnel. If address is present, host must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
TeamsDevicesIncludeSplitTunnelWithHost object {host, description }
host: string
The domain name to include in the tunnel. If host is present, address must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
Link to this property
lan\_allow\_minutes: optional number
The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.
Link to this property
lan\_allow\_subnet\_size: optional number
The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.
Link to this property
match: optional string
The wirefilter expression to match devices. Available values: “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.service\_token\_uuid”, “identity.saml\_attributes”, “network”, “os.name”, “os.version”.
maxLength500
Link to this property
name: optional string
The name of the device settings profile.
maxLength100
Link to this property
policy\_id: optional string
maxLength36
Link to this property
precedence: optional number
The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.
Link to this property
profile\_type: optional "warp"or "browser\_extension"
The client type to which the device settings profile applies. This field is set when the profile is created and cannot be changed.
One of the following:
"warp"
Link to this property
"browser\_extension"
Link to this property
Link to this property
register\_interface\_ip\_with\_dns: optional boolean
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Link to this property
sccm\_vpn\_boundary\_support: optional boolean
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
Link to this property
service\_mode\_v2: optional object {mode, port }
mode: optional string
The mode to run the WARP client under.
Link to this property
port: optional number
The port number when used with proxy mode.
Link to this property
Link to this property
support\_url: optional string
The URL to launch when the Send Feedback button is clicked.
Link to this property
switch\_locked: optional boolean
Whether to allow the user to turn off the WARP switch and disconnect the client.
Link to this property
Deprecatedtarget\_tests: optional array of object {id, name }
id: optional string
The id of the DEX test targeting this policy.
Link to this property
name: optional string
The name of the DEX test targeting this policy.
Link to this property
Link to this property
tunnel\_protocol: optional string
Determines which tunnel protocol to use.
Link to this property
uninstall\_protection: optional boolean
Determines whether uninstalling the WARP client requires an override code. (Windows only).
Link to this property
virtual\_networks: optional object {allowed, default }
Virtual network access settings for the device.
allowed: array of string
List of virtual network IDs the device is allowed to access. When virtual\_networks is set, at least one entry is required.
Link to this property
default: string
The default virtual network ID. Must be included in the allowed list.
formatuuid
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20settings_policy%20%3E%20(schema)>)
SplitTunnelExclude = object {address, description } or object {host, description }
One of the following:
TeamsDevicesExcludeSplitTunnelWithAddress object {address, description }
address: string
The address in CIDR format to exclude from the tunnel. If address is present, host must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
TeamsDevicesExcludeSplitTunnelWithHost object {host, description }
host: string
The domain name to exclude from the tunnel. If host is present, address must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20split_tunnel_exclude%20%3E%20(schema)>)
SplitTunnelInclude = object {address, description } or object {host, description }
One of the following:
TeamsDevicesIncludeSplitTunnelWithAddress object {address, description }
address: string
The address in CIDR format to include in the tunnel. If address is present, host must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
TeamsDevicesIncludeSplitTunnelWithHost object {host, description }
host: string
The domain name to include in the tunnel. If host is present, address must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies%20%3E%20(model)%20split_tunnel_include%20%3E%20(schema)>)
#### Zero TrustDevicesPoliciesDefault
##### [Get the default device settings profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/methods/get)
GET/accounts/{account\_id}/devices/policy
##### [Update the default device settings profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/methods/edit)
PATCH/accounts/{account\_id}/devices/policy
##### ModelsExpand Collapse
DefaultGetResponse object {allow\_mode\_switch, allow\_updates, allowed\_to\_leave, 22 more }
allow\_mode\_switch: optional boolean
Whether to allow the user to switch WARP between modes.
Link to this property
allow\_updates: optional boolean
Whether to receive update notifications when a new version of the client is available.
Link to this property
allowed\_to\_leave: optional boolean
Whether to allow devices to leave the organization.
Link to this property
auto\_connect: optional number
The amount of time in seconds to reconnect after having been disabled.
Link to this property
captive\_portal: optional number
Turn on the captive portal after the specified amount of time.
Link to this property
default: optional boolean
Whether the policy will be applied to matching devices.
Link to this property
disable\_auto\_fallback: optional boolean
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
Link to this property
dns\_search\_suffixes: optional array of object {suffix, description }
List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
suffix: string
The DNS search suffix to append when resolving short hostnames.
Link to this property
description: optional string
A description of the DNS search suffix.
Link to this property
Link to this property
enabled: optional boolean
Whether the policy will be applied to matching devices.
Link to this property
exclude: optional array of SplitTunnelExclude
List of routes excluded in the WARP client’s tunnel.
One of the following:
TeamsDevicesExcludeSplitTunnelWithAddress object {address, description }
address: string
The address in CIDR format to exclude from the tunnel. If address is present, host must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
TeamsDevicesExcludeSplitTunnelWithHost object {host, description }
host: string
The domain name to exclude from the tunnel. If host is present, address must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
Link to this property
exclude\_office\_ips: optional boolean
Whether to add Microsoft IPs to Split Tunnel exclusions.
Link to this property
fallback\_domains: optional array of FallbackDomain { suffix, description, dns\_server }
suffix: string
The domain suffix to match when resolving locally.
Link to this property
description: optional string
A description of the fallback domain, displayed in the client UI.
maxLength100
Link to this property
dns\_server: optional array of string
A list of IP addresses to handle domain resolution.
Link to this property
Link to this property
gateway\_unique\_id: optional string
Link to this property
global\_acceleration: optional object {api\_endpoints, enabled, masque\_endpoints, 2 more }
Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
api\_endpoints: array of string
IP:port entries for the API endpoints.
Link to this property
enabled: boolean
Global acceleration settings are used only when “enabled”.
Link to this property
masque\_endpoints: array of string
IP:port entries for the MASQUE tunnel endpoints. Either wireguard\_endpoints or masque\_endpoints must be provided.
Link to this property
wireguard\_endpoints: array of string
IP:port entries for the WireGuard tunnel endpoints. Either wireguard\_endpoints or masque\_endpoints must be provided.
Link to this property
autoswitch: optional boolean
Automatically switch Global Acceleration regions based on device location. Defaults to false when not provided.
Link to this property
Link to this property
include: optional array of SplitTunnelInclude
List of routes included in the WARP client’s tunnel.
One of the following:
TeamsDevicesIncludeSplitTunnelWithAddress object {address, description }
address: string
The address in CIDR format to include in the tunnel. If address is present, host must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
TeamsDevicesIncludeSplitTunnelWithHost object {host, description }
host: string
The domain name to include in the tunnel. If host is present, address must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
Link to this property
policy\_id: optional string
maxLength36
Link to this property
profile\_type: optional "warp"or "browser\_extension"
The client type to which the device settings profile applies. This field is set when the profile is created and cannot be changed.
One of the following:
"warp"
Link to this property
"browser\_extension"
Link to this property
Link to this property
register\_interface\_ip\_with\_dns: optional boolean
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Link to this property
sccm\_vpn\_boundary\_support: optional boolean
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
Link to this property
service\_mode\_v2: optional object {mode, port }
mode: optional string
The mode to run the WARP client under.
Link to this property
port: optional number
The port number when used with proxy mode.
Link to this property
Link to this property
support\_url: optional string
The URL to launch when the Send Feedback button is clicked.
Link to this property
switch\_locked: optional boolean
Whether to allow the user to turn off the WARP switch and disconnect the client.
Link to this property
tunnel\_protocol: optional string
Determines which tunnel protocol to use.
Link to this property
uninstall\_protection: optional boolean
Determines whether uninstalling the WARP client requires an override code. (Windows only).
Link to this property
virtual\_networks: optional object {allowed, default }
Virtual network access settings for the device.
allowed: array of string
List of virtual network IDs the device is allowed to access. When virtual\_networks is set, at least one entry is required.
Link to this property
default: string
The default virtual network ID. Must be included in the allowed list.
formatuuid
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies.default%20%3E%20(model)%20default_get_response%20%3E%20(schema)>)
DefaultEditResponse object {allow\_mode\_switch, allow\_updates, allowed\_to\_leave, 22 more }
allow\_mode\_switch: optional boolean
Whether to allow the user to switch WARP between modes.
Link to this property
allow\_updates: optional boolean
Whether to receive update notifications when a new version of the client is available.
Link to this property
allowed\_to\_leave: optional boolean
Whether to allow devices to leave the organization.
Link to this property
auto\_connect: optional number
The amount of time in seconds to reconnect after having been disabled.
Link to this property
captive\_portal: optional number
Turn on the captive portal after the specified amount of time.
Link to this property
default: optional boolean
Whether the policy will be applied to matching devices.
Link to this property
disable\_auto\_fallback: optional boolean
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
Link to this property
dns\_search\_suffixes: optional array of object {suffix, description }
List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
suffix: string
The DNS search suffix to append when resolving short hostnames.
Link to this property
description: optional string
A description of the DNS search suffix.
Link to this property
Link to this property
enabled: optional boolean
Whether the policy will be applied to matching devices.
Link to this property
exclude: optional array of SplitTunnelExclude
List of routes excluded in the WARP client’s tunnel.
One of the following:
TeamsDevicesExcludeSplitTunnelWithAddress object {address, description }
address: string
The address in CIDR format to exclude from the tunnel. If address is present, host must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
TeamsDevicesExcludeSplitTunnelWithHost object {host, description }
host: string
The domain name to exclude from the tunnel. If host is present, address must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
Link to this property
exclude\_office\_ips: optional boolean
Whether to add Microsoft IPs to Split Tunnel exclusions.
Link to this property
fallback\_domains: optional array of FallbackDomain { suffix, description, dns\_server }
suffix: string
The domain suffix to match when resolving locally.
Link to this property
description: optional string
A description of the fallback domain, displayed in the client UI.
maxLength100
Link to this property
dns\_server: optional array of string
A list of IP addresses to handle domain resolution.
Link to this property
Link to this property
gateway\_unique\_id: optional string
Link to this property
global\_acceleration: optional object {api\_endpoints, enabled, masque\_endpoints, 2 more }
Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
api\_endpoints: array of string
IP:port entries for the API endpoints.
Link to this property
enabled: boolean
Global acceleration settings are used only when “enabled”.
Link to this property
masque\_endpoints: array of string
IP:port entries for the MASQUE tunnel endpoints. Either wireguard\_endpoints or masque\_endpoints must be provided.
Link to this property
wireguard\_endpoints: array of string
IP:port entries for the WireGuard tunnel endpoints. Either wireguard\_endpoints or masque\_endpoints must be provided.
Link to this property
autoswitch: optional boolean
Automatically switch Global Acceleration regions based on device location. Defaults to false when not provided.
Link to this property
Link to this property
include: optional array of SplitTunnelInclude
List of routes included in the WARP client’s tunnel.
One of the following:
TeamsDevicesIncludeSplitTunnelWithAddress object {address, description }
address: string
The address in CIDR format to include in the tunnel. If address is present, host must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
TeamsDevicesIncludeSplitTunnelWithHost object {host, description }
host: string
The domain name to include in the tunnel. If host is present, address must not be present.
Link to this property
description: optional string
A description of the Split Tunnel item, displayed in the client UI.
maxLength100
Link to this property
Link to this property
Link to this property
policy\_id: optional string
maxLength36
Link to this property
profile\_type: optional "warp"or "browser\_extension"
The client type to which the device settings profile applies. This field is set when the profile is created and cannot be changed.
One of the following:
"warp"
Link to this property
"browser\_extension"
Link to this property
Link to this property
register\_interface\_ip\_with\_dns: optional boolean
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Link to this property
sccm\_vpn\_boundary\_support: optional boolean
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
Link to this property
service\_mode\_v2: optional object {mode, port }
mode: optional string
The mode to run the WARP client under.
Link to this property
port: optional number
The port number when used with proxy mode.
Link to this property
Link to this property
support\_url: optional string
The URL to launch when the Send Feedback button is clicked.
Link to this property
switch\_locked: optional boolean
Whether to allow the user to turn off the WARP switch and disconnect the client.
Link to this property
tunnel\_protocol: optional string
Determines which tunnel protocol to use.
Link to this property
uninstall\_protection: optional boolean
Determines whether uninstalling the WARP client requires an override code. (Windows only).
Link to this property
virtual\_networks: optional object {allowed, default }
Virtual network access settings for the device.
allowed: array of string
List of virtual network IDs the device is allowed to access. When virtual\_networks is set, at least one entry is required.
Link to this property
default: string
The default virtual network ID. Must be included in the allowed list.
formatuuid
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.policies.default%20%3E%20(model)%20default_edit_response%20%3E%20(schema)>)
#### Zero TrustDevicesPoliciesDefaultExcludes
##### [Get the Split Tunnel exclude list](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/excludes/methods/get)
GET/accounts/{account\_id}/devices/policy/exclude
##### [Set the Split Tunnel exclude list](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/excludes/methods/update)
PUT/accounts/{account\_id}/devices/policy/exclude
#### Zero TrustDevicesPoliciesDefaultIncludes
##### [Get the Split Tunnel include list](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/includes/methods/get)
GET/accounts/{account\_id}/devices/policy/include
##### [Set the Split Tunnel include list](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/includes/methods/update)
PUT/accounts/{account\_id}/devices/policy/include
#### Zero TrustDevicesPoliciesDefaultFallback Domains
##### [Get your Local Domain Fallback list](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/fallback_domains/methods/get)
GET/accounts/{account\_id}/devices/policy/fallback\_domains
##### [Set your Local Domain Fallback list](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/fallback_domains/methods/update)
PUT/accounts/{account\_id}/devices/policy/fallback\_domains
#### Zero TrustDevicesPoliciesDefaultCertificates
##### [Get device certificate provisioning status](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/certificates/methods/get)
GET/zones/{zone\_id}/devices/policy/certificates
##### [Update device certificate provisioning status](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/default/subresources/certificates/methods/edit)
PATCH/zones/{zone\_id}/devices/policy/certificates
#### Zero TrustDevicesPoliciesCustom
##### [List device settings profiles](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/list)
GET/accounts/{account\_id}/devices/policies
##### [Get device settings profile by ID](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/get)
GET/accounts/{account\_id}/devices/policy/{policy\_id}
##### [Create a device settings profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/create)
POST/accounts/{account\_id}/devices/policy
##### [Update a device settings profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/edit)
PATCH/accounts/{account\_id}/devices/policy/{policy\_id}
##### [Delete a device settings profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/methods/delete)
DELETE/accounts/{account\_id}/devices/policy/{policy\_id}
#### Zero TrustDevicesPoliciesCustomExcludes
##### [Get the Split Tunnel exclude list for a device settings profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/excludes/methods/get)
GET/accounts/{account\_id}/devices/policy/{policy\_id}/exclude
##### [Set the Split Tunnel exclude list for a device settings profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/excludes/methods/update)
PUT/accounts/{account\_id}/devices/policy/{policy\_id}/exclude
#### Zero TrustDevicesPoliciesCustomIncludes
##### [Get the Split Tunnel include list for a device settings profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/includes/methods/get)
GET/accounts/{account\_id}/devices/policy/{policy\_id}/include
##### [Set the Split Tunnel include list for a device settings profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/includes/methods/update)
PUT/accounts/{account\_id}/devices/policy/{policy\_id}/include
#### Zero TrustDevicesPoliciesCustomFallback Domains
##### [Get the Local Domain Fallback list for a device settings profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/fallback_domains/methods/get)
GET/accounts/{account\_id}/devices/policy/{policy\_id}/fallback\_domains
##### [Set the Local Domain Fallback list for a device settings profile](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/policies/subresources/custom/subresources/fallback_domains/methods/update)
PUT/accounts/{account\_id}/devices/policy/{policy\_id}/fallback\_domains
#### Zero TrustDevicesPosture
##### [List posture rules](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/posture/methods/list)
GET/accounts/{account\_id}/devices/posture
##### [Get posture rule](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/posture/methods/get)
GET/accounts/{account\_id}/devices/posture/{rule\_id}
##### [Create posture rule](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/posture/methods/create)
POST/accounts/{account\_id}/devices/posture
##### [Update posture rule](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/posture/methods/update)
PUT/accounts/{account\_id}/devices/posture/{rule\_id}
##### [Delete posture rule](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/posture/methods/delete)
DELETE/accounts/{account\_id}/devices/posture/{rule\_id}
##### ModelsExpand Collapse
CarbonblackInput = string
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20carbonblack_input%20%3E%20(schema)>)
ClientCertificateInput object {certificate\_id, cn }
certificate\_id: string
UUID of Cloudflare managed certificate.
maxLength36
Link to this property
cn: string
Common Name that is protected by the certificate.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20client_certificate_input%20%3E%20(schema)>)
CrowdstrikeInput object {connection\_id, last\_seen, operator, 6 more }
connection\_id: string
Posture Integration ID.
Link to this property
last\_seen: optional string
For more details on last seen, please refer to the Crowdstrike documentation.
Link to this property
operator: optional "<"or "<="or ">"or 2 more
Operator.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
os: optional string
Os Version.
Link to this property
overall: optional string
Overall.
Link to this property
sensor\_config: optional string
SensorConfig.
Link to this property
state: optional "online"or "offline"or "unknown"
For more details on state, please refer to the Crowdstrike documentation.
One of the following:
"online"
Link to this property
"offline"
Link to this property
"unknown"
Link to this property
Link to this property
version: optional string
Version.
Link to this property
versionOperator: optional "<"or "<="or ">"or 2 more
Version Operator.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20crowdstrike_input%20%3E%20(schema)>)
DeviceInput = FileInput { operating\_system, path, exists, 2 more } or UniqueClientIDInput { id, operating\_system } or DomainJoinedInput { operating\_system, domain } or 17 more
The value to be checked against.
One of the following:
FileInput object {operating\_system, path, exists, 2 more }
operating\_system: "windows"or "linux"or "mac"
Operating system.
One of the following:
"windows"
Link to this property
"linux"
Link to this property
"mac"
Link to this property
Link to this property
path: string
File path.
Link to this property
exists: optional boolean
Whether or not file exists.
Link to this property
sha256: optional string
SHA-256.
Link to this property
thumbprint: optional string
Signing certificate thumbprint.
Link to this property
Link to this property
UniqueClientIDInput object {id, operating\_system }
id: string
List ID.
Link to this property
operating\_system: "android"or "ios"or "chromeos"
Operating System.
One of the following:
"android"
Link to this property
"ios"
Link to this property
"chromeos"
Link to this property
Link to this property
Link to this property
DomainJoinedInput object {operating\_system, domain }
operating\_system: "windows"
Operating System.
Link to this property
domain: optional string
Domain.
Link to this property
Link to this property
OSVersionInput object {operating\_system, operator, version, 3 more }
operating\_system: "windows"
Operating System.
Link to this property
operator: "<"or "<="or ">"or 2 more
Operator.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
version: string
Version of OS.
Link to this property
os\_distro\_name: optional string
Operating System Distribution Name (linux only).
Link to this property
os\_distro\_revision: optional string
Version of OS Distribution (linux only).
Link to this property
os\_version\_extra: optional string
Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
Link to this property
Link to this property
FirewallInput object {enabled, operating\_system }
enabled: boolean
Enabled.
Link to this property
operating\_system: "windows"or "mac"
Operating System.
One of the following:
"windows"
Link to this property
"mac"
Link to this property
Link to this property
Link to this property
SentineloneInput object {operating\_system, path, sha256, thumbprint }
operating\_system: "windows"or "linux"or "mac"
Operating system.
One of the following:
"windows"
Link to this property
"linux"
Link to this property
"mac"
Link to this property
Link to this property
path: string
File path.
Link to this property
sha256: optional string
SHA-256.
Link to this property
thumbprint: optional string
Signing certificate thumbprint.
Link to this property
Link to this property
TeamsDevicesCarbonblackInputRequest object {operating\_system, path, sha256, thumbprint }
operating\_system: "windows"or "linux"or "mac"
Operating system.
One of the following:
"windows"
Link to this property
"linux"
Link to this property
"mac"
Link to this property
Link to this property
path: string
File path.
Link to this property
sha256: optional string
SHA-256.
Link to this property
thumbprint: optional string
Signing certificate thumbprint.
Link to this property
Link to this property
TeamsDevicesAccessSerialNumberListInputRequest object {id }
id: string
UUID of Access List.
maxLength36
Link to this property
Link to this property
DiskEncryptionInput object {checkDisks, requireAll }
checkDisks: optional array of CarbonblackInput
List of volume names to be checked for encryption.
Link to this property
requireAll: optional boolean
Whether to check all disks for encryption.
Link to this property
Link to this property
TeamsDevicesApplicationInputRequest object {operating\_system, path, sha256, thumbprint }
operating\_system: "windows"or "linux"or "mac"
Operating system.
One of the following:
"windows"
Link to this property
"linux"
Link to this property
"mac"
Link to this property
Link to this property
path: string
Path for the application.
Link to this property
sha256: optional string
SHA-256.
Link to this property
thumbprint: optional string
Signing certificate thumbprint.
Link to this property
Link to this property
ClientCertificateInput object {certificate\_id, cn }
certificate\_id: string
UUID of Cloudflare managed certificate.
maxLength36
Link to this property
cn: string
Common Name that is protected by the certificate.
Link to this property
Link to this property
TeamsDevicesClientCertificateV2InputRequest object {certificate\_id, check\_private\_key, operating\_system, 4 more }
certificate\_id: string
UUID of Cloudflare managed certificate.
maxLength36
Link to this property
check\_private\_key: boolean
Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.
Link to this property
operating\_system: "windows"or "linux"or "mac"
Operating system.
One of the following:
"windows"
Link to this property
"linux"
Link to this property
"mac"
Link to this property
Link to this property
cn: optional string
Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial\_number} and ${hostname} are valid variables.
Link to this property
extended\_key\_usage: optional array of "clientAuth"or "emailProtection"
List of values indicating purposes for which the certificate public key can be used.
One of the following:
"clientAuth"
Link to this property
"emailProtection"
Link to this property
Link to this property
locations: optional object {paths, trust\_stores }
paths: optional array of string
List of paths to check for client certificate on linux.
Link to this property
trust\_stores: optional array of "system"or "user"
List of trust stores to check for client certificate.
One of the following:
"system"
Link to this property
"user"
Link to this property
Link to this property
Link to this property
subject\_alternative\_names: optional array of string
List of certificate Subject Alternative Names.
Link to this property
Link to this property
TeamsDevicesAntivirusInputRequest object {update\_window\_days }
update\_window\_days: optional number
Number of days that the antivirus should be updated within.
Link to this property
Link to this property
WorkspaceOneInput object {compliance\_status, connection\_id }
compliance\_status: "compliant"or "noncompliant"or "unknown"
Compliance Status.
One of the following:
"compliant"
Link to this property
"noncompliant"
Link to this property
"unknown"
Link to this property
Link to this property
connection\_id: string
Posture Integration ID.
Link to this property
Link to this property
CrowdstrikeInput object {connection\_id, last\_seen, operator, 6 more }
connection\_id: string
Posture Integration ID.
Link to this property
last\_seen: optional string
For more details on last seen, please refer to the Crowdstrike documentation.
Link to this property
operator: optional "<"or "<="or ">"or 2 more
Operator.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
os: optional string
Os Version.
Link to this property
overall: optional string
Overall.
Link to this property
sensor\_config: optional string
SensorConfig.
Link to this property
state: optional "online"or "offline"or "unknown"
For more details on state, please refer to the Crowdstrike documentation.
One of the following:
"online"
Link to this property
"offline"
Link to this property
"unknown"
Link to this property
Link to this property
version: optional string
Version.
Link to this property
versionOperator: optional "<"or "<="or ">"or 2 more
Version Operator.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
Link to this property
IntuneInput object {compliance\_status, connection\_id }
compliance\_status: "compliant"or "noncompliant"or "unknown"or 3 more
Compliance Status.
One of the following:
"compliant"
Link to this property
"noncompliant"
Link to this property
"unknown"
Link to this property
"notapplicable"
Link to this property
"ingraceperiod"
Link to this property
"error"
Link to this property
Link to this property
connection\_id: string
Posture Integration ID.
Link to this property
Link to this property
KolideInput object {connection\_id, auth\_state, countOperator, issue\_count }
connection\_id: string
Posture Integration ID.
Link to this property
auth\_state: optional array of "Good"or "Notified"or "Will Block"or "Blocked"
The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.
One of the following:
"Good"
Link to this property
"Notified"
Link to this property
"Will Block"
Link to this property
"Blocked"
Link to this property
Link to this property
countOperator: optional "<"or "<="or ">"or 2 more
Count Operator.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
issue\_count: optional string
The Number of Issues.
Link to this property
Link to this property
TaniumInput object {connection\_id, eid\_last\_seen, operator, 3 more }
connection\_id: string
Posture Integration ID.
Link to this property
eid\_last\_seen: optional string
For more details on eid last seen, refer to the Tanium documentation.
Link to this property
operator: optional "<"or "<="or ">"or 2 more
Operator to evaluate risk\_level or eid\_last\_seen.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
risk\_level: optional "low"or "medium"or "high"or "critical"
For more details on risk level, refer to the Tanium documentation.
One of the following:
"low"
Link to this property
"medium"
Link to this property
"high"
Link to this property
"critical"
Link to this property
Link to this property
scoreOperator: optional "<"or "<="or ">"or 2 more
Score Operator.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
total\_score: optional number
For more details on total score, refer to the Tanium documentation.
Link to this property
Link to this property
SentineloneS2sInput object {connection\_id, active\_threats, infected, 4 more }
connection\_id: string
Posture Integration ID.
Link to this property
active\_threats: optional number
The Number of active threats.
Link to this property
infected: optional boolean
Whether device is infected.
Link to this property
is\_active: optional boolean
Whether device is active.
Link to this property
network\_status: optional "connected"or "disconnected"or "disconnecting"or "connecting"
Network status of device.
One of the following:
"connected"
Link to this property
"disconnected"
Link to this property
"disconnecting"
Link to this property
"connecting"
Link to this property
Link to this property
operational\_state: optional "na"or "partially\_disabled"or "auto\_fully\_disabled"or 4 more
Agent operational state.
One of the following:
"na"
Link to this property
"partially\_disabled"
Link to this property
"auto\_fully\_disabled"
Link to this property
"fully\_disabled"
Link to this property
"auto\_partially\_disabled"
Link to this property
"disabled\_error"
Link to this property
"db\_corruption"
Link to this property
Link to this property
operator: optional "<"or "<="or ">"or 2 more
Operator.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
Link to this property
TeamsDevicesCustomS2sInputRequest object {connection\_id, operator, score }
connection\_id: string
Posture Integration ID.
Link to this property
operator: "<"or "<="or ">"or 2 more
Operator.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
score: number
A value between 0-100 assigned to devices set by the 3rd party posture provider.
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20device_input%20%3E%20(schema)>)
DeviceMatch object {platform }
platform: optional "windows"or "mac"or "linux"or 3 more
One of the following:
"windows"
Link to this property
"mac"
Link to this property
"linux"
Link to this property
"android"
Link to this property
"ios"
Link to this property
"chromeos"
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20device_match%20%3E%20(schema)>)
DevicePostureRule object {id, description, enabled, 6 more }
id: optional string
API UUID.
maxLength36
Link to this property
description: optional string
The description of the device posture rule.
Link to this property
enabled: optional boolean
Whether the rule is enabled. This is a computed, read-only value. It is false for deprecated Kolide posture rules that still use the issue\_count input, and true otherwise.
Link to this property
expiration: optional string
Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.
Link to this property
input: optional DeviceInput
The value to be checked against.
Link to this property
match: optional array of DeviceMatch { platform }
The conditions that the client must match to run the rule.
platform: optional "windows"or "mac"or "linux"or 3 more
One of the following:
"windows"
Link to this property
"mac"
Link to this property
"linux"
Link to this property
"android"
Link to this property
"ios"
Link to this property
"chromeos"
Link to this property
Link to this property
Link to this property
name: optional string
The name of the device posture rule.
Link to this property
schedule: optional string
Polling frequency for the WARP client posture check. Default: 5m (poll every five minutes). Minimum: 1m.
Link to this property
type: optional "file"or "application"or "tanium"or 20 more
The type of device posture rule.
One of the following:
"file"
Link to this property
"application"
Link to this property
"tanium"
Link to this property
"gateway"
Link to this property
"warp"
Link to this property
"disk\_encryption"
Link to this property
"serial\_number"
Link to this property
"sentinelone"
Link to this property
"carbonblack"
Link to this property
"firewall"
Link to this property
"os\_version"
Link to this property
"domain\_joined"
Link to this property
"client\_certificate"
Link to this property
"client\_certificate\_v2"
Link to this property
"antivirus"
Link to this property
"unique\_client\_id"
Link to this property
"kolide"
Link to this property
"tanium\_s2s"
Link to this property
"crowdstrike\_s2s"
Link to this property
"intune"
Link to this property
"workspace\_one"
Link to this property
"sentinelone\_s2s"
Link to this property
"custom\_s2s"
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20device_posture_rule%20%3E%20(schema)>)
DiskEncryptionInput object {checkDisks, requireAll }
checkDisks: optional array of CarbonblackInput
List of volume names to be checked for encryption.
Link to this property
requireAll: optional boolean
Whether to check all disks for encryption.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20disk_encryption_input%20%3E%20(schema)>)
DomainJoinedInput object {operating\_system, domain }
operating\_system: "windows"
Operating System.
Link to this property
domain: optional string
Domain.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20domain_joined_input%20%3E%20(schema)>)
FileInput object {operating\_system, path, exists, 2 more }
operating\_system: "windows"or "linux"or "mac"
Operating system.
One of the following:
"windows"
Link to this property
"linux"
Link to this property
"mac"
Link to this property
Link to this property
path: string
File path.
Link to this property
exists: optional boolean
Whether or not file exists.
Link to this property
sha256: optional string
SHA-256.
Link to this property
thumbprint: optional string
Signing certificate thumbprint.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20file_input%20%3E%20(schema)>)
FirewallInput object {enabled, operating\_system }
enabled: boolean
Enabled.
Link to this property
operating\_system: "windows"or "mac"
Operating System.
One of the following:
"windows"
Link to this property
"mac"
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20firewall_input%20%3E%20(schema)>)
IntuneInput object {compliance\_status, connection\_id }
compliance\_status: "compliant"or "noncompliant"or "unknown"or 3 more
Compliance Status.
One of the following:
"compliant"
Link to this property
"noncompliant"
Link to this property
"unknown"
Link to this property
"notapplicable"
Link to this property
"ingraceperiod"
Link to this property
"error"
Link to this property
Link to this property
connection\_id: string
Posture Integration ID.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20intune_input%20%3E%20(schema)>)
KolideInput object {connection\_id, auth\_state, countOperator, issue\_count }
connection\_id: string
Posture Integration ID.
Link to this property
auth\_state: optional array of "Good"or "Notified"or "Will Block"or "Blocked"
The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.
One of the following:
"Good"
Link to this property
"Notified"
Link to this property
"Will Block"
Link to this property
"Blocked"
Link to this property
Link to this property
countOperator: optional "<"or "<="or ">"or 2 more
Count Operator.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
issue\_count: optional string
The Number of Issues.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20kolide_input%20%3E%20(schema)>)
OSVersionInput object {operating\_system, operator, version, 3 more }
operating\_system: "windows"
Operating System.
Link to this property
operator: "<"or "<="or ">"or 2 more
Operator.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
version: string
Version of OS.
Link to this property
os\_distro\_name: optional string
Operating System Distribution Name (linux only).
Link to this property
os\_distro\_revision: optional string
Version of OS Distribution (linux only).
Link to this property
os\_version\_extra: optional string
Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20os_version_input%20%3E%20(schema)>)
SentineloneInput object {operating\_system, path, sha256, thumbprint }
operating\_system: "windows"or "linux"or "mac"
Operating system.
One of the following:
"windows"
Link to this property
"linux"
Link to this property
"mac"
Link to this property
Link to this property
path: string
File path.
Link to this property
sha256: optional string
SHA-256.
Link to this property
thumbprint: optional string
Signing certificate thumbprint.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20sentinelone_input%20%3E%20(schema)>)
SentineloneS2sInput object {connection\_id, active\_threats, infected, 4 more }
connection\_id: string
Posture Integration ID.
Link to this property
active\_threats: optional number
The Number of active threats.
Link to this property
infected: optional boolean
Whether device is infected.
Link to this property
is\_active: optional boolean
Whether device is active.
Link to this property
network\_status: optional "connected"or "disconnected"or "disconnecting"or "connecting"
Network status of device.
One of the following:
"connected"
Link to this property
"disconnected"
Link to this property
"disconnecting"
Link to this property
"connecting"
Link to this property
Link to this property
operational\_state: optional "na"or "partially\_disabled"or "auto\_fully\_disabled"or 4 more
Agent operational state.
One of the following:
"na"
Link to this property
"partially\_disabled"
Link to this property
"auto\_fully\_disabled"
Link to this property
"fully\_disabled"
Link to this property
"auto\_partially\_disabled"
Link to this property
"disabled\_error"
Link to this property
"db\_corruption"
Link to this property
Link to this property
operator: optional "<"or "<="or ">"or 2 more
Operator.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20sentinelone_s2s_input%20%3E%20(schema)>)
TaniumInput object {connection\_id, eid\_last\_seen, operator, 3 more }
connection\_id: string
Posture Integration ID.
Link to this property
eid\_last\_seen: optional string
For more details on eid last seen, refer to the Tanium documentation.
Link to this property
operator: optional "<"or "<="or ">"or 2 more
Operator to evaluate risk\_level or eid\_last\_seen.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
risk\_level: optional "low"or "medium"or "high"or "critical"
For more details on risk level, refer to the Tanium documentation.
One of the following:
"low"
Link to this property
"medium"
Link to this property
"high"
Link to this property
"critical"
Link to this property
Link to this property
scoreOperator: optional "<"or "<="or ">"or 2 more
Score Operator.
One of the following:
"<"
Link to this property
"<="
Link to this property
">"
Link to this property
">="
Link to this property
"=="
Link to this property
Link to this property
total\_score: optional number
For more details on total score, refer to the Tanium documentation.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20tanium_input%20%3E%20(schema)>)
UniqueClientIDInput object {id, operating\_system }
id: string
List ID.
Link to this property
operating\_system: "android"or "ios"or "chromeos"
Operating System.
One of the following:
"android"
Link to this property
"ios"
Link to this property
"chromeos"
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20unique_client_id_input%20%3E%20(schema)>)
WorkspaceOneInput object {compliance\_status, connection\_id }
compliance\_status: "compliant"or "noncompliant"or "unknown"
Compliance Status.
One of the following:
"compliant"
Link to this property
"noncompliant"
Link to this property
"unknown"
Link to this property
Link to this property
connection\_id: string
Posture Integration ID.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20workspace_one_input%20%3E%20(schema)>)
PostureDeleteResponse object {id }
id: optional string
API UUID.
maxLength36
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture%20%3E%20(model)%20posture_delete_response%20%3E%20(schema)>)
#### Zero TrustDevicesPostureIntegrations
##### [List posture integrations](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/list)
GET/accounts/{account\_id}/devices/posture/integration
##### [Get posture integration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/get)
GET/accounts/{account\_id}/devices/posture/integration/{integration\_id}
##### [Create posture integration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/create)
POST/accounts/{account\_id}/devices/posture/integration
##### [Update posture integration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/edit)
PATCH/accounts/{account\_id}/devices/posture/integration/{integration\_id}
##### [Delete posture integration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/posture/subresources/integrations/methods/delete)
DELETE/accounts/{account\_id}/devices/posture/integration/{integration\_id}
##### ModelsExpand Collapse
Integration object {id, config, interval, 2 more }
id: optional string
API UUID.
maxLength36
Link to this property
config: optional object {api\_url, auth\_url, client\_id }
The configuration object containing third-party integration information.
api\_url: string
The Workspace One API URL provided in the Workspace One Admin Dashboard.
Link to this property
auth\_url: string
The Workspace One Authorization URL depending on your region.
Link to this property
client\_id: string
The Workspace One client ID provided in the Workspace One Admin Dashboard.
Link to this property
Link to this property
interval: optional string
The interval between each posture check with the third-party API. Use m for minutes (e.g. 5m) and h for hours (e.g. 12h).
Link to this property
name: optional string
The name of the device posture integration.
Link to this property
type: optional "workspace\_one"or "crowdstrike\_s2s"or "uptycs"or 5 more
The type of device posture integration.
One of the following:
"workspace\_one"
Link to this property
"crowdstrike\_s2s"
Link to this property
"uptycs"
Link to this property
"intune"
Link to this property
"kolide"
Link to this property
"tanium\_s2s"
Link to this property
"sentinelone\_s2s"
Link to this property
"custom\_s2s"
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture.integrations%20%3E%20(model)%20integration%20%3E%20(schema)>)
IntegrationDeleteResponse = unknownor string
One of the following:
unknown
Link to this property
string
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.posture.integrations%20%3E%20(model)%20integration_delete_response%20%3E%20(schema)>)
#### Zero TrustDevicesRevoke
##### [Revoke devices (deprecated)](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/revoke/methods/create)
Deprecated
POST/accounts/{account\_id}/devices/revoke
##### ModelsExpand Collapse
RevokeCreateResponse = unknownor string
One of the following:
unknown
Link to this property
string
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.revoke%20%3E%20(model)%20revoke_create_response%20%3E%20(schema)>)
#### Zero TrustDevicesSettings
##### [Get device settings](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/settings/methods/get)
GET/accounts/{account\_id}/devices/settings
##### [Update device settings (deprecated)](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/settings/methods/update)
Deprecated
PUT/accounts/{account\_id}/devices/settings
##### [Update device settings](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/settings/methods/edit)
PATCH/accounts/{account\_id}/devices/settings
##### [Reset device settings](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/settings/methods/delete)
DELETE/accounts/{account\_id}/devices/settings
##### ModelsExpand Collapse
DeviceSettings object {disable\_for\_time, external\_emergency\_signal\_enabled, external\_emergency\_signal\_fingerprint, 6 more }
disable\_for\_time: optional number
Sets the time limit, in seconds, that a user can use an override code to bypass WARP.
Link to this property
external\_emergency\_signal\_enabled: optional boolean
Controls whether the external emergency disconnect feature is enabled.
Link to this property
external\_emergency\_signal\_fingerprint: optional string
The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external\_emergency\_signal\_url. If provided, the WARP client will use this value to verify the server’s identity. The device will ignore any response if the server’s certificate fingerprint does not exactly match this value.
Link to this property
external\_emergency\_signal\_interval: optional string
The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., “5m”, “2m30s”, “1h”). Minimum 30 seconds.
Link to this property
external\_emergency\_signal\_url: optional string
The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.
Link to this property
gateway\_proxy\_enabled: optional boolean
Enable gateway proxy filtering on TCP.
Link to this property
gateway\_udp\_proxy\_enabled: optional boolean
Enable gateway proxy filtering on UDP.
Link to this property
root\_certificate\_installation\_enabled: optional boolean
Enable installation of cloudflare managed root certificate.
Link to this property
use\_zt\_virtual\_ip: optional boolean
Enable using CGNAT virtual IPv4.
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.settings%20%3E%20(model)%20device_settings%20%3E%20(schema)>)
#### Zero TrustDevicesUnrevoke
##### [Unrevoke devices (deprecated)](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/unrevoke/methods/create)
Deprecated
POST/accounts/{account\_id}/devices/unrevoke
##### ModelsExpand Collapse
UnrevokeCreateResponse = unknownor string
One of the following:
unknown
Link to this property
string
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.unrevoke%20%3E%20(model)%20unrevoke_create_response%20%3E%20(schema)>)
#### Zero TrustDevicesOverride Codes
##### [Get override codes (deprecated)](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/override_codes/methods/list)
Deprecated
GET/accounts/{account\_id}/devices/{device\_id}/override\_codes
##### [Get override codes](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/override_codes/methods/get)
GET/accounts/{account\_id}/devices/registrations/{registration\_id}/override\_codes
##### ModelsExpand Collapse
OverrideCodeListResponse object {disable\_for\_time }
disable\_for\_time: optional object {"1", "12", "24", 2 more }
"1": optional string
Override code that is valid for 1 hour.
Link to this property
"12": optional string
Override code that is valid for 12 hour2.
Link to this property
"24": optional string
Override code that is valid for 24 hour.2.
Link to this property
"3": optional string
Override code that is valid for 3 hours.
Link to this property
"6": optional string
Override code that is valid for 6 hours.
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.override_codes%20%3E%20(model)%20override_code_list_response%20%3E%20(schema)>)
OverrideCodeGetResponse object {disable\_for\_time }
disable\_for\_time: optional map\[string]
Link to this property
[Link to this property](<#(resource)%20zero_trust.devices.override_codes%20%3E%20(model)%20override_code_get_response%20%3E%20(schema)>)
#### Zero TrustIdentity Providers
##### [List Access identity providers](https://developers.cloudflare.com/api/resources/zero_trust/subresources/identity_providers/methods/list)
GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers
##### [Get an Access identity provider](https://developers.cloudflare.com/api/resources/zero_trust/subresources/identity_providers/methods/get)
GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers/{identity\_provider\_id}
##### [Add an Access identity provider](https://developers.cloudflare.com/api/resources/zero_trust/subresources/identity_providers/methods/create)
POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers
##### [Update an Access identity provider](https://developers.cloudflare.com/api/resources/zero_trust/subresources/identity_providers/methods/update)
PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers/{identity\_provider\_id}
##### [Delete an Access identity provider](https://developers.cloudflare.com/api/resources/zero_trust/subresources/identity_providers/methods/delete)
DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/identity\_providers/{identity\_provider\_id}
##### ModelsExpand Collapse
AzureAD object {config, name, type, 5 more }
config: object {claims, client\_id, client\_secret, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
conditional\_access\_enabled: optional boolean
Should Cloudflare try to load authentication contexts from your account
Link to this property
directory\_id: optional string
Your Azure directory uuid
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
prompt: optional "login"or "select\_account"or "none"
Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction\_required error. prompt=select\_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
One of the following:
"login"
Link to this property
"select\_account"
Link to this property
"none"
Link to this property
Link to this property
support\_groups: optional boolean
Should Cloudflare try to load groups from your account
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20azure_ad%20%3E%20(schema)>)
GenericOAuthConfig object {client\_id, client\_secret }
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20generic_oauth_config%20%3E%20(schema)>)
IdentityProvider = AzureAD { config, name, type, 5 more } or object {config, name, type, 5 more } or object {config, name, type, 5 more } or 13 more
One of the following:
AzureAD object {config, name, type, 5 more }
config: object {claims, client\_id, client\_secret, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
conditional\_access\_enabled: optional boolean
Should Cloudflare try to load authentication contexts from your account
Link to this property
directory\_id: optional string
Your Azure directory uuid
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
prompt: optional "login"or "select\_account"or "none"
Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction\_required error. prompt=select\_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
One of the following:
"login"
Link to this property
"select\_account"
Link to this property
"none"
Link to this property
Link to this property
support\_groups: optional boolean
Should Cloudflare try to load groups from your account
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessCentrify object {config, name, type, 5 more }
config: object {centrify\_account, centrify\_app\_id, claims, 3 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
centrify\_account: optional string
Your centrify account url
Link to this property
centrify\_app\_id: optional string
Your centrify app id
Link to this property
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessFacebook object {config, name, type, 5 more }
config: GenericOAuthConfig { client\_id, client\_secret }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessGitHub object {config, name, type, 5 more }
config: GenericOAuthConfig { client\_id, client\_secret }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessGoogle object {config, name, type, 5 more }
config: object {claims, client\_id, client\_secret, email\_claim\_name }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessGoogleApps object {config, name, type, 5 more }
config: object {apps\_domain, claims, client\_id, 4 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
apps\_domain: optional string
Your companies TLD
Link to this property
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
prompt: optional "none"or "consent"or "select\_account"
Configures the prompt behavior for Google authentication.
One of the following:
"none"
Link to this property
"consent"
Link to this property
"select\_account"
Link to this property
Link to this property
use\_login\_hint: optional boolean
Whether to use a previously authenticated Access email as a Google login hint when exactly one email matches the Workspace domain.
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessLinkedin object {config, name, type, 5 more }
config: GenericOAuthConfig { client\_id, client\_secret }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessOIDC object {config, name, type, 5 more }
config: object {auth\_url, certs\_url, claims, 6 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
auth\_url: optional string
The authorization\_endpoint URL of your IdP
Link to this property
certs\_url: optional string
The jwks\_uri endpoint of your IdP to allow the IdP keys to sign the tokens
Link to this property
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
pkce\_enabled: optional boolean
Enable Proof Key for Code Exchange (PKCE)
Link to this property
scopes: optional array of string
OAuth scopes
Link to this property
token\_url: optional string
The token\_endpoint URL of your IdP
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessOkta object {config, name, type, 5 more }
config: object {authorization\_server\_id, claims, client\_id, 3 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
authorization\_server\_id: optional string
Your okta authorization server id
Link to this property
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
okta\_account: optional string
Your okta account url
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessOnelogin object {config, name, type, 5 more }
config: object {claims, client\_id, client\_secret, 2 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
onelogin\_account: optional string
Your OneLogin account url
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessPingone object {config, name, type, 5 more }
config: object {claims, client\_id, client\_secret, 2 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
ping\_env\_id: optional string
Your PingOne environment identifier
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessSAML object {config, name, type, 5 more }
config: object {attributes, email\_attribute\_name, enable\_encryption, 7 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
attributes: optional array of string
A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
Link to this property
email\_attribute\_name: optional string
The attribute name for email in the SAML response.
Link to this property
enable\_encryption: optional boolean
Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.
To enable encryption:
1. Create a certificate set via POST to /identity_providers/{id}/saml_certificate
2. Set this field to true and include saml_certificate_set_id in the PUT request
3. Configure the public certificate in your external Identity Provider
Note: Requires saml_certificate_set_id to be set when true.
Link to this property
force\_authn: optional boolean
Asks the IdP to reauthenticate the user for each SAML authentication request.
Link to this property
header\_attributes: optional array of object {attribute\_name, header\_name }
Add a list of attribute names that will be returned in the response header from the Access callback.
attribute\_name: optional string
attribute name from the IDP
Link to this property
header\_name: optional string
header that will be added on the request to the origin
Link to this property
Link to this property
idp\_public\_certs: optional array of string
X509 certificate to verify the signature in the SAML authentication response
Link to this property
issuer\_url: optional string
IdP Entity ID or Issuer URL
Link to this property
max\_sso\_url\_length: optional number
The maximum URL length the IdP accepts for the SSO redirect URL. When the constructed SSO URL would exceed this length, the RelayState is stored server-side and a short nonce is passed to the IdP instead. Set this if your IdP enforces a URL length limit.
maximum100000
minimum512
Link to this property
sign\_request: optional boolean
Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
Link to this property
sso\_target\_url: optional string
URL to send the SAML authentication requests to
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessYandex object {config, name, type, 5 more }
config: GenericOAuthConfig { client\_id, client\_secret }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessOnetimepin object {config, name, type, 5 more }
config: object {redirect\_url }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
redirect\_url: optional string
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessCloudflare object {config, name, type, 5 more }
config: object {redirect\_url, restrict\_to\_account\_members }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
redirect\_url: optional string
Link to this property
restrict\_to\_account\_members: optional boolean
When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessPasskeys object {config, name, type, 5 more }
config: object {login\_page\_auto\_prompt, redirect\_url }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
login\_page\_auto\_prompt: optional boolean
When enabled, the Access login page automatically prompts the user to authenticate with a passkey.
Link to this property
redirect\_url: optional string
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider%20%3E%20(schema)>)
IdentityProviderSCIMConfig object {enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
enabled: optional boolean
A flag to enable or disable SCIM for the identity provider.
Link to this property
identity\_update\_behavior: optional "automatic"or "reauth"or "no\_action"
Indicates how a SCIM event updates a user identity used for policy evaluation. Use “automatic” to automatically update a user’s identity and augment it with fields from the SCIM user resource. Use “reauth” to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With “reauth” identities will not contain fields from the SCIM user resource. With “no\_action” identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.
One of the following:
"automatic"
Link to this property
"reauth"
Link to this property
"no\_action"
Link to this property
Link to this property
scim\_base\_url: optional string
The base URL of Cloudflare’s SCIM V2.0 API endpoint.
Link to this property
seat\_deprovision: optional boolean
A flag to remove a user’s seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user\_deprovision is also enabled.
Link to this property
secret: optional string
A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity\_providers/:idpID/refresh\_scim\_secret.
Link to this property
user\_deprovision: optional boolean
A flag to enable revoking a user’s session in Access and Gateway when they have been deprovisioned in the Identity Provider.
Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider_scim_config%20%3E%20(schema)>)
IdentityProviderType = "onetimepin"or "azureAD"or "saml"or 13 more
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
One of the following:
"onetimepin"
Link to this property
"azureAD"
Link to this property
"saml"
Link to this property
"centrify"
Link to this property
"facebook"
Link to this property
"github"
Link to this property
"google-apps"
Link to this property
"google"
Link to this property
"linkedin"
Link to this property
"oidc"
Link to this property
"okta"
Link to this property
"onelogin"
Link to this property
"pingone"
Link to this property
"yandex"
Link to this property
"cloudflare"
Link to this property
"passkeys"
Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider_type%20%3E%20(schema)>)
IdentityProviderListResponse = AzureAD { config, name, type, 5 more } or object {config, name, type, 5 more } or object {config, name, type, 5 more } or 13 more
One of the following:
AzureAD object {config, name, type, 5 more }
config: object {claims, client\_id, client\_secret, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
conditional\_access\_enabled: optional boolean
Should Cloudflare try to load authentication contexts from your account
Link to this property
directory\_id: optional string
Your Azure directory uuid
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
prompt: optional "login"or "select\_account"or "none"
Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction\_required error. prompt=select\_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
One of the following:
"login"
Link to this property
"select\_account"
Link to this property
"none"
Link to this property
Link to this property
support\_groups: optional boolean
Should Cloudflare try to load groups from your account
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessCentrify object {config, name, type, 5 more }
config: object {centrify\_account, centrify\_app\_id, claims, 3 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
centrify\_account: optional string
Your centrify account url
Link to this property
centrify\_app\_id: optional string
Your centrify app id
Link to this property
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessFacebook object {config, name, type, 5 more }
config: GenericOAuthConfig { client\_id, client\_secret }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessGitHub object {config, name, type, 5 more }
config: GenericOAuthConfig { client\_id, client\_secret }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessGoogle object {config, name, type, 5 more }
config: object {claims, client\_id, client\_secret, email\_claim\_name }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessGoogleApps object {config, name, type, 5 more }
config: object {apps\_domain, claims, client\_id, 4 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
apps\_domain: optional string
Your companies TLD
Link to this property
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
prompt: optional "none"or "consent"or "select\_account"
Configures the prompt behavior for Google authentication.
One of the following:
"none"
Link to this property
"consent"
Link to this property
"select\_account"
Link to this property
Link to this property
use\_login\_hint: optional boolean
Whether to use a previously authenticated Access email as a Google login hint when exactly one email matches the Workspace domain.
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessLinkedin object {config, name, type, 5 more }
config: GenericOAuthConfig { client\_id, client\_secret }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessOIDC object {config, name, type, 5 more }
config: object {auth\_url, certs\_url, claims, 6 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
auth\_url: optional string
The authorization\_endpoint URL of your IdP
Link to this property
certs\_url: optional string
The jwks\_uri endpoint of your IdP to allow the IdP keys to sign the tokens
Link to this property
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
pkce\_enabled: optional boolean
Enable Proof Key for Code Exchange (PKCE)
Link to this property
scopes: optional array of string
OAuth scopes
Link to this property
token\_url: optional string
The token\_endpoint URL of your IdP
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessOkta object {config, name, type, 5 more }
config: object {authorization\_server\_id, claims, client\_id, 3 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
authorization\_server\_id: optional string
Your okta authorization server id
Link to this property
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
okta\_account: optional string
Your okta account url
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessOnelogin object {config, name, type, 5 more }
config: object {claims, client\_id, client\_secret, 2 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
onelogin\_account: optional string
Your OneLogin account url
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessPingone object {config, name, type, 5 more }
config: object {claims, client\_id, client\_secret, 2 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
claims: optional array of string
Custom claims
Link to this property
client\_id: optional string
Your OAuth Client ID
Link to this property
client\_secret: optional string
Your OAuth Client Secret
Link to this property
email\_claim\_name: optional string
The claim name for email in the id\_token response.
Link to this property
ping\_env\_id: optional string
Your PingOne environment identifier
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessSAML object {config, name, type, 5 more }
config: object {attributes, email\_attribute\_name, enable\_encryption, 7 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
attributes: optional array of string
A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
Link to this property
email\_attribute\_name: optional string
The attribute name for email in the SAML response.
Link to this property
enable\_encryption: optional boolean
Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.
To enable encryption:
1. Create a certificate set via POST to /identity_providers/{id}/saml_certificate
2. Set this field to true and include saml_certificate_set_id in the PUT request
3. Configure the public certificate in your external Identity Provider
Note: Requires saml_certificate_set_id to be set when true.
Link to this property
force\_authn: optional boolean
Asks the IdP to reauthenticate the user for each SAML authentication request.
Link to this property
header\_attributes: optional array of object {attribute\_name, header\_name }
Add a list of attribute names that will be returned in the response header from the Access callback.
attribute\_name: optional string
attribute name from the IDP
Link to this property
header\_name: optional string
header that will be added on the request to the origin
Link to this property
Link to this property
idp\_public\_certs: optional array of string
X509 certificate to verify the signature in the SAML authentication response
Link to this property
issuer\_url: optional string
IdP Entity ID or Issuer URL
Link to this property
max\_sso\_url\_length: optional number
The maximum URL length the IdP accepts for the SSO redirect URL. When the constructed SSO URL would exceed this length, the RelayState is stored server-side and a short nonce is passed to the IdP instead. Set this if your IdP enforces a URL length limit.
maximum100000
minimum512
Link to this property
sign\_request: optional boolean
Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
Link to this property
sso\_target\_url: optional string
URL to send the SAML authentication requests to
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessYandex object {config, name, type, 5 more }
config: GenericOAuthConfig { client\_id, client\_secret }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessOnetimepin object {config, name, type, 5 more }
config: object {redirect\_url }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
redirect\_url: optional string
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessCloudflare object {config, name, type, 5 more }
config: object {redirect\_url, restrict\_to\_account\_members }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
redirect\_url: optional string
Link to this property
restrict\_to\_account\_members: optional boolean
When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
AccessPasskeys object {config, name, type, 5 more }
config: object {login\_page\_auto\_prompt, redirect\_url }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
login\_page\_auto\_prompt: optional boolean
When enabled, the Access login page automatically prompts the user to authenticate with a passkey.
Link to this property
redirect\_url: optional string
Link to this property
Link to this property
name: string
The name of the identity provider, shown to users on the login page.
Link to this property
type: IdentityProviderType
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Link to this property
id: optional string
UUID.
maxLength36
Link to this property
read\_only: optional boolean
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
Link to this property
saml\_certificate\_set: optional object {created\_at, uid, updated\_at, 2 more }
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
Link to this property
saml\_certificate\_set\_id: optional string
The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
formatuuid
Link to this property
scim\_config: optional IdentityProviderSCIMConfig { enabled, identity\_update\_behavior, scim\_base\_url, 3 more }
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider_list_response%20%3E%20(schema)>)
IdentityProviderDeleteResponse object {id }
id: optional string
UUID.
maxLength36
Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers%20%3E%20(model)%20identity_provider_delete_response%20%3E%20(schema)>)
#### Zero TrustIdentity ProvidersSCIM
#### Zero TrustIdentity ProvidersSCIMGroups
##### [List SCIM Group resources](https://developers.cloudflare.com/api/resources/zero_trust/subresources/identity_providers/subresources/scim/subresources/groups/methods/list)
GET/accounts/{account\_id}/access/identity\_providers/{identity\_provider\_id}/scim/groups
#### Zero TrustIdentity ProvidersSCIMUsers
##### [List SCIM User resources](https://developers.cloudflare.com/api/resources/zero_trust/subresources/identity_providers/subresources/scim/subresources/users/methods/list)
GET/accounts/{account\_id}/access/identity\_providers/{identity\_provider\_id}/scim/users
#### Zero TrustIdentity ProvidersSAML Certificate
##### [Create SAML encryption certificate for Identity Provider](https://developers.cloudflare.com/api/resources/zero_trust/subresources/identity_providers/subresources/saml_certificate/methods/create)
POST/accounts/{account\_id}/access/identity\_providers/{identity\_provider\_id}/saml\_certificate
##### ModelsExpand Collapse
SAMLCertificateCreateResponse object {created\_at, uid, updated\_at, 2 more }
A SAML encryption certificate set containing current and optionally previous certificates for encryption key rotation.
created\_at: string
Timestamp when the certificate set was created
formatdate-time
Link to this property
uid: string
Unique identifier for the certificate set
formatuuid
Link to this property
updated\_at: string
Timestamp when the certificate set was last updated (e.g., during rotation)
formatdate-time
Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid }
The currently active certificate used for encrypting SAML assertions
is\_current: boolean
Indicates whether this is the currently active certificate
Link to this property
not\_after: string
Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
formatdate-time
Link to this property
public\_certificate: string
PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
Link to this property
uid: string
Unique identifier for the certificate
formatuuid
Link to this property
Link to this property
previous\_certificate: optional unknown
The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
Link to this property
[Link to this property](<#(resource)%20zero_trust.identity_providers.saml_certificate%20%3E%20(model)%20saml_certificate_create_response%20%3E%20(schema)>)
#### Zero TrustOrganizations
##### [Get your Zero Trust organization](https://developers.cloudflare.com/api/resources/zero_trust/subresources/organizations/methods/list)
GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations
##### [Create your Zero Trust organization](https://developers.cloudflare.com/api/resources/zero_trust/subresources/organizations/methods/create)
POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations
##### [Update your Zero Trust organization](https://developers.cloudflare.com/api/resources/zero_trust/subresources/organizations/methods/update)
PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations
##### [Revoke all Access tokens for a user](https://developers.cloudflare.com/api/resources/zero_trust/subresources/organizations/methods/revoke_users)
POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/organizations/revoke\_user
##### ModelsExpand Collapse
LoginDesign object {background\_color, footer\_text, header\_text, 2 more }
background\_color: optional string
The background color on your login page.
Link to this property
footer\_text: optional string
The text at the bottom of your login page.
Link to this property
header\_text: optional string
The text at the top of your login page.
Link to this property
logo\_path: optional string
The URL of the logo on your login page.
Link to this property
text\_color: optional string
The text color on your login page.
Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20login_design%20%3E%20(schema)>)
Organization object {allow\_authenticate\_via\_warp, auth\_domain, auto\_redirect\_to\_identity, 16 more }
allow\_authenticate\_via\_warp: optional boolean
When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
Link to this property
auth\_domain: optional string
The unique subdomain assigned to your Zero Trust organization. If omitted on creation, a unique subdomain is auto-generated in the format adjective-noun-hex4 (e.g. frosty-moon-7a3b.cloudflareaccess.com).
Link to this property
auto\_redirect\_to\_identity: optional boolean
When set to true, users skip the identity provider selection step during login.
Link to this property
custom\_pages: optional object {forbidden, identity\_denied }
forbidden: optional string
The uid of the custom page to use when a user is denied access after failing a non-identity rule.
Link to this property
identity\_denied: optional string
The uid of the custom page to use when a user is denied access.
Link to this property
Link to this property
deny\_unmatched\_requests: optional boolean
Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array.
Link to this property
deny\_unmatched\_requests\_exempted\_zone\_names: optional array of string
Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
Link to this property
is\_ui\_read\_only: optional boolean
Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
Link to this property
login\_design: optional LoginDesign { background\_color, footer\_text, header\_text, 2 more }
Link to this property
mfa\_config: optional object {allowed\_authenticators, amr\_matching\_session\_duration, required\_aaguids, session\_duration }
Configures multi-factor authentication (MFA) settings for an organization.
allowed\_authenticators: optional array of "totp"or "biometrics"or "security\_key"or 2 more
Lists the MFA methods that users can authenticate with. The piv_key and ssh_fido2_key values are supported only for infrastructure applications.
One of the following:
"totp"
Link to this property
"biometrics"
Link to this property
"security\_key"
Link to this property
"piv\_key"
Link to this property
"ssh\_fido2\_key"
Link to this property
Link to this property
amr\_matching\_session\_duration: optional string
Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains “mfa”. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).
Link to this property
required\_aaguids: optional string
Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.
formatuuid
Link to this property
session\_duration: optional string
Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
Link to this property
Link to this property
mfa\_piv\_key\_requirements: optional object {pin\_policy, require\_fips\_device, ssh\_key\_size, 2 more }
Configures PIV key requirements for MFA using hardware security keys.
pin\_policy: optional "never"or "once"or "always"
Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use).
One of the following:
"never"
Link to this property
"once"
Link to this property
"always"
Link to this property
Link to this property
require\_fips\_device: optional boolean
Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.
Link to this property
ssh\_key\_size: optional array of 256or 384or 521or 3 more
Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.
One of the following:
256
Link to this property
384
Link to this property
521
Link to this property
2048
Link to this property
3072
Link to this property
4096
Link to this property
Link to this property
ssh\_key\_type: optional array of "ecdsa"or "ed25519"or "rsa"
Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa.
One of the following:
"ecdsa"
Link to this property
"ed25519"
Link to this property
"rsa"
Link to this property
Link to this property
touch\_policy: optional "never"or "always"or "cached"
Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds).
One of the following:
"never"
Link to this property
"always"
Link to this property
"cached"
Link to this property
Link to this property
Link to this property
mfa\_required\_for\_all\_apps: optional boolean
Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: ‘allowed\_authenticators’ cannot contain only the infrastructure SSH authenticators (‘piv\_key’ and ‘ssh\_fido2\_key’) if the organization has any non-infrastructure applications.
Link to this property
name: optional string
The name of your Zero Trust organization. When omitted on creation, defaults to the provided auth\_domain; when both are omitted, defaults to the auto-generated subdomain slug (e.g. frosty-moon-7a3b).
Link to this property
service\_token\_inactivity: optional object {action, enabled, inactivity\_threshold\_days }
Configures automatic enforcement for inactive service tokens. A service token is inactive if no policy references it, and it has not successfully authenticated with an Access application during the selected inactivity period. This setting applies to every service token in your Zero Trust account.
action: "disable"or "delete"
The action applied to an inactive service token.
One of the following:
"disable"
Link to this property
"delete"
Link to this property
Link to this property
enabled: boolean
Whether automatic enforcement for inactive service tokens is enabled.
Link to this property
inactivity\_threshold\_days: number
The number of days a service token must be inactive before the configured action is applied.
maximum365
minimum30
Link to this property
Link to this property
session\_duration: optional string
The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
Link to this property
strict\_service\_token\_auth: optional boolean
Enables new behaviors for requests made with Access service tokens. Unauthorized requests emit audit logs, and return a 401 or 403 status code in the response instead of redirecting to the login page. Successful requests no longer receive a CF\_Authorization cookie in the response. Zero Trust organizations created on or after October 5, 2026 will have this setting enabled by default, and cannot disable it.
Link to this property
ui\_read\_only\_toggle\_reason: optional string
A description of the reason why the UI read only field is being toggled.
Link to this property
user\_seat\_expiration\_inactive\_time: optional string
The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
Link to this property
warp\_auth\_non\_browser\_401: optional boolean
When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page.
Link to this property
warp\_auth\_session\_duration: optional string
The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20organization%20%3E%20(schema)>)
OrganizationListResponse object {allow\_authenticate\_via\_warp, auth\_domain, auto\_redirect\_to\_identity, 17 more }
allow\_authenticate\_via\_warp: optional boolean
When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
Link to this property
auth\_domain: optional string
The unique subdomain assigned to your Zero Trust organization. If omitted on creation, a unique subdomain is auto-generated in the format adjective-noun-hex4 (e.g. frosty-moon-7a3b.cloudflareaccess.com).
Link to this property
auto\_redirect\_to\_identity: optional boolean
When set to true, users skip the identity provider selection step during login.
Link to this property
custom\_pages: optional object {forbidden, identity\_denied }
forbidden: optional string
The uid of the custom page to use when a user is denied access after failing a non-identity rule.
Link to this property
identity\_denied: optional string
The uid of the custom page to use when a user is denied access.
Link to this property
Link to this property
deny\_unmatched\_requests: optional boolean
Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array.
Link to this property
deny\_unmatched\_requests\_exempted\_zone\_names: optional array of string
Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
Link to this property
is\_ui\_read\_only: optional boolean
Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
Link to this property
login\_design: optional LoginDesign { background\_color, footer\_text, header\_text, 2 more }
Link to this property
mfa\_config: optional object {allowed\_authenticators, amr\_matching\_session\_duration, required\_aaguids, session\_duration }
Configures multi-factor authentication (MFA) settings for an organization.
allowed\_authenticators: optional array of "totp"or "biometrics"or "security\_key"or 2 more
Lists the MFA methods that users can authenticate with. The piv_key and ssh_fido2_key values are supported only for infrastructure applications.
One of the following:
"totp"
Link to this property
"biometrics"
Link to this property
"security\_key"
Link to this property
"piv\_key"
Link to this property
"ssh\_fido2\_key"
Link to this property
Link to this property
amr\_matching\_session\_duration: optional string
Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains “mfa”. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).
Link to this property
required\_aaguids: optional string
Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.
formatuuid
Link to this property
session\_duration: optional string
Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
Link to this property
Link to this property
mfa\_piv\_key\_requirements: optional object {pin\_policy, require\_fips\_device, ssh\_key\_size, 2 more }
Configures PIV key requirements for MFA using hardware security keys.
pin\_policy: optional "never"or "once"or "always"
Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use).
One of the following:
"never"
Link to this property
"once"
Link to this property
"always"
Link to this property
Link to this property
require\_fips\_device: optional boolean
Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.
Link to this property
ssh\_key\_size: optional array of 256or 384or 521or 3 more
Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.
One of the following:
256
Link to this property
384
Link to this property
521
Link to this property
2048
Link to this property
3072
Link to this property
4096
Link to this property
Link to this property
ssh\_key\_type: optional array of "ecdsa"or "ed25519"or "rsa"
Specifies the allowed SSH key types. Valid values are ecdsa, ed25519, and rsa.
One of the following:
"ecdsa"
Link to this property
"ed25519"
Link to this property
"rsa"
Link to this property
Link to this property
touch\_policy: optional "never"or "always"or "cached"
Defines when physical touch is required to use the SSH key. Valid values: never (no touch required), always (touch required for each use), cached (touch cached for 15 seconds).
One of the following:
"never"
Link to this property
"always"
Link to this property
"cached"
Link to this property
Link to this property
Link to this property
mfa\_required\_for\_all\_apps: optional boolean
Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: ‘allowed\_authenticators’ cannot contain only the infrastructure SSH authenticators (‘piv\_key’ and ‘ssh\_fido2\_key’) if the organization has any non-infrastructure applications.
Link to this property
name: optional string
The name of your Zero Trust organization. When omitted on creation, defaults to the provided auth\_domain; when both are omitted, defaults to the auto-generated subdomain slug (e.g. frosty-moon-7a3b).
Link to this property
service\_token\_inactivity: optional object {action, enabled, inactivity\_threshold\_days }
Configures automatic enforcement for inactive service tokens. A service token is inactive if no policy references it, and it has not successfully authenticated with an Access application during the selected inactivity period. This setting applies to every service token in your Zero Trust account.
action: "disable"or "delete"
The action applied to an inactive service token.
One of the following:
"disable"
Link to this property
"delete"
Link to this property
Link to this property
enabled: boolean
Whether automatic enforcement for inactive service tokens is enabled.
Link to this property
inactivity\_threshold\_days: number
The number of days a service token must be inactive before the configured action is applied.
maximum365
minimum30
Link to this property
Link to this property
session\_duration: optional string
The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
Link to this property
strict\_service\_token\_auth: optional boolean
Enables new behaviors for requests made with Access service tokens. Unauthorized requests emit audit logs, and return a 401 or 403 status code in the response instead of redirecting to the login page. Successful requests no longer receive a CF\_Authorization cookie in the response. Zero Trust organizations created on or after October 5, 2026 will have this setting enabled by default, and cannot disable it.
Link to this property
trusted\_accounts: optional array of string
The account tags of organizations trusted by this organization for policy and device posture sharing.
Link to this property
ui\_read\_only\_toggle\_reason: optional string
A description of the reason why the UI read only field is being toggled.
Link to this property
user\_seat\_expiration\_inactive\_time: optional string
The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
Link to this property
warp\_auth\_non\_browser\_401: optional boolean
When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page.
Link to this property
warp\_auth\_session\_duration: optional string
The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20organization_list_response%20%3E%20(schema)>)
OrganizationRevokeUsersResponse = trueor false
One of the following:
true
Link to this property
false
Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations%20%3E%20(model)%20organization_revoke_users_response%20%3E%20(schema)>)
#### Zero TrustOrganizationsDOH
##### [Get your Zero Trust organization DoH settings](https://developers.cloudflare.com/api/resources/zero_trust/subresources/organizations/subresources/doh/methods/get)
GET/accounts/{account\_id}/access/organizations/doh
##### [Update your Zero Trust organization DoH settings](https://developers.cloudflare.com/api/resources/zero_trust/subresources/organizations/subresources/doh/methods/update)
PUT/accounts/{account\_id}/access/organizations/doh
##### ModelsExpand Collapse
DOHGetResponse object {id, client\_id, doh\_jwt\_duration, 4 more }
id: optional string
The ID of the service token.
maxLength36
Link to this property
client\_id: optional string
The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
Link to this property
doh\_jwt\_duration: optional string
The duration the DoH JWT is valid for. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Note that the maximum duration for this setting is the same as the key rotation period on the account.
Link to this property
duration: optional string
The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).
Link to this property
enabled: optional boolean
Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous client_secret stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create.
Link to this property
expires\_at: optional string
formatdate-time
Link to this property
name: optional string
The name of the service token.
Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations.doh%20%3E%20(model)%20doh_get_response%20%3E%20(schema)>)
DOHUpdateResponse object {id, client\_id, doh\_jwt\_duration, 4 more }
id: optional string
The ID of the service token.
maxLength36
Link to this property
client\_id: optional string
The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
Link to this property
doh\_jwt\_duration: optional string
The duration the DoH JWT is valid for. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h
Link to this property
duration: optional string
The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).
Link to this property
enabled: optional boolean
Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous client_secret stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create.
Link to this property
expires\_at: optional string
formatdate-time
Link to this property
name: optional string
The name of the service token.
Link to this property
[Link to this property](<#(resource)%20zero_trust.organizations.doh%20%3E%20(model)%20doh_update_response%20%3E%20(schema)>)
#### Zero TrustSeats
##### [Update a user seat](https://developers.cloudflare.com/api/resources/zero_trust/subresources/seats/methods/edit)
PATCH/accounts/{account\_id}/access/seats
##### ModelsExpand Collapse
Seat object {access\_seat, created\_at, gateway\_seat, 2 more }
access\_seat: optional boolean
True if the seat is part of Access.
Link to this property
created\_at: optional string
formatdate-time
Link to this property
gateway\_seat: optional boolean
True if the seat is part of Gateway.
Link to this property
seat\_uid: optional string
The unique API identifier for the Zero Trust seat.
maxLength36
Link to this property
updated\_at: optional string
formatdate-time
Link to this property
[Link to this property](<#(resource)%20zero_trust.seats%20%3E%20(model)%20seat%20%3E%20(schema)>)
#### Zero TrustAccess
#### Zero TrustAccessAI Controls
#### Zero TrustAccessAI ControlsMcp
#### Zero TrustAccessAI ControlsMcpPortals
##### [List MCP Portals](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/list)
GET/accounts/{account\_id}/access/ai-controls/mcp/portals
##### [Create a new MCP Portal](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/create)
POST/accounts/{account\_id}/access/ai-controls/mcp/portals
##### [Read details of an MCP Portal](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/read)
GET/accounts/{account\_id}/access/ai-controls/mcp/portals/{id}
##### [Update an MCP Portal](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/update)
PUT/accounts/{account\_id}/access/ai-controls/mcp/portals/{id}
##### [Delete an MCP Portal](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/delete)
DELETE/accounts/{account\_id}/access/ai-controls/mcp/portals/{id}
##### ModelsExpand Collapse
PortalListResponse object {id, hostname, name, 9 more }
id: string
Unique identifier for the MCP portal.
maxLength32
minLength1
Link to this property
hostname: string
Hostname where the MCP portal is available.
Link to this property
name: string
Display name for the MCP portal.
maxLength350
Link to this property
servers: array of object {id, auth\_type, hostname, 22 more }
id: string
Unique identifier for the MCP server.
maxLength32
minLength1
Link to this property
auth\_type: "oauth"or "bearer"or "unauthenticated"
Authentication method used to connect to the upstream MCP server.
One of the following:
"oauth"
Link to this property
"bearer"
Link to this property
"unauthenticated"
Link to this property
Link to this property
hostname: string
URL of the upstream MCP endpoint.
formaturi
Link to this property
name: string
Display name for the MCP server.
maxLength350
Link to this property
prompts: array of map\[unknown]
Link to this property
server\_id: string
Unique identifier for the MCP server.
maxLength32
minLength1
Link to this property
tools: array of map\[unknown]
Link to this property
auth\_config\_summary: optional object {auth\_mode, client\_secret\_version, config, 2 more }
Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: optional "dcr"or "manual"
One of the following:
"dcr"
Link to this property
"manual"
Link to this property
Link to this property
client\_secret\_version: optional number
Link to this property
config: optional object {authorization\_endpoint, issuer, resource, 2 more }
authorization\_endpoint: optional string
Link to this property
issuer: optional string
Link to this property
resource: optional string
Link to this property
revocation\_endpoint: optional string
Link to this property
token\_endpoint: optional string
Link to this property
Link to this property
has\_client\_secret: optional boolean
Link to this property
registration\_info: optional object {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method }
client\_id: optional string
Link to this property
redirect\_uris: optional array of string
Link to this property
scope: optional string
Link to this property
token\_endpoint\_auth\_method: optional string
Link to this property
Link to this property
Link to this property
authentication\_status: optional "not\_required"or "required"or "connected"or 2 more
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
One of the following:
"not\_required"
Link to this property
"required"
Link to this property
"connected"
Link to this property
"stale"
Link to this property
"manual"
Link to this property
Link to this property
created\_at: optional string
formatdate-time
Link to this property
created\_by: optional string
Link to this property
default\_disabled: optional boolean
Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts.
Link to this property
description: optional string
Optional description of the MCP server.
maxLength512
Link to this property
error: optional string
Link to this property
error\_details: optional object {cause, is\_upstream, mcp\_code, 2 more }
cause: optional string
Underlying error message
Link to this property
is\_upstream: optional boolean
True = MCP server returned an error. False = couldn’t reach the server
Link to this property
mcp\_code: optional number
MCP protocol error code
Link to this property
retryable: optional boolean
Whether the error is transient and worth retrying
Link to this property
status\_code: optional number
HTTP status code from the server
Link to this property
Link to this property
is\_shared\_oauth\_callback\_enabled: optional boolean
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Link to this property
last\_successful\_sync: optional string
formatdate-time
Link to this property
last\_synced: optional string
formatdate-time
Link to this property
modified\_at: optional string
formatdate-time
Link to this property
modified\_by: optional string
Link to this property
on\_behalf: optional boolean
Link to this property
secure\_web\_gateway: optional boolean
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
Link to this property
status: optional "waiting"or "ready"or "stale"or "error"
Current sync state of the server
One of the following:
"waiting"
Link to this property
"ready"
Link to this property
"stale"
Link to this property
"error"
Link to this property
Link to this property
updated\_prompts: optional array of object {name, enabled, portal\_alias, 3 more }
name: string
Link to this property
enabled: optional boolean
Link to this property
portal\_alias: optional string
Link to this property
portal\_description: optional string
Link to this property
server\_alias: optional string
Link to this property
server\_description: optional string
Link to this property
Link to this property
updated\_tools: optional array of object {name, enabled, portal\_alias, 3 more }
name: string
Link to this property
enabled: optional boolean
Link to this property
portal\_alias: optional string
Link to this property
portal\_description: optional string
Link to this property
server\_alias: optional string
Link to this property
server\_description: optional string
Link to this property
Link to this property
Link to this property
Deprecatedallow\_code\_mode: optional boolean
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
Link to this property
code\_mode: optional "off"or "opt\_in"or "default\_on"or "enforced"
Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
One of the following:
"off"
Link to this property
"opt\_in"
Link to this property
"default\_on"
Link to this property
"enforced"
Link to this property
Link to this property
created\_at: optional string
formatdate-time
Link to this property
created\_by: optional string
Link to this property
description: optional string
Optional description of the MCP portal.
maxLength512
Link to this property
modified\_at: optional string
formatdate-time
Link to this property
modified\_by: optional string
Link to this property
secure\_web\_gateway: optional boolean
Route outbound MCP traffic through Zero Trust Secure Web Gateway.
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_list_response%20%3E%20(schema)>)
PortalCreateResponse object {id, hostname, name, 9 more }
id: string
Unique identifier for the MCP portal.
maxLength32
minLength1
Link to this property
hostname: string
Hostname where the MCP portal is available.
Link to this property
name: string
Display name for the MCP portal.
maxLength350
Link to this property
servers: array of object {id, auth\_type, hostname, 22 more }
id: string
Unique identifier for the MCP server.
maxLength32
minLength1
Link to this property
auth\_type: "oauth"or "bearer"or "unauthenticated"
Authentication method used to connect to the upstream MCP server.
One of the following:
"oauth"
Link to this property
"bearer"
Link to this property
"unauthenticated"
Link to this property
Link to this property
hostname: string
URL of the upstream MCP endpoint.
formaturi
Link to this property
name: string
Display name for the MCP server.
maxLength350
Link to this property
prompts: array of map\[unknown]
Link to this property
server\_id: string
Unique identifier for the MCP server.
maxLength32
minLength1
Link to this property
tools: array of map\[unknown]
Link to this property
auth\_config\_summary: optional object {auth\_mode, client\_secret\_version, config, 2 more }
Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: optional "dcr"or "manual"
One of the following:
"dcr"
Link to this property
"manual"
Link to this property
Link to this property
client\_secret\_version: optional number
Link to this property
config: optional object {authorization\_endpoint, issuer, resource, 2 more }
authorization\_endpoint: optional string
Link to this property
issuer: optional string
Link to this property
resource: optional string
Link to this property
revocation\_endpoint: optional string
Link to this property
token\_endpoint: optional string
Link to this property
Link to this property
has\_client\_secret: optional boolean
Link to this property
registration\_info: optional object {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method }
client\_id: optional string
Link to this property
redirect\_uris: optional array of string
Link to this property
scope: optional string
Link to this property
token\_endpoint\_auth\_method: optional string
Link to this property
Link to this property
Link to this property
authentication\_status: optional "not\_required"or "required"or "connected"or 2 more
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
One of the following:
"not\_required"
Link to this property
"required"
Link to this property
"connected"
Link to this property
"stale"
Link to this property
"manual"
Link to this property
Link to this property
created\_at: optional string
formatdate-time
Link to this property
created\_by: optional string
Link to this property
default\_disabled: optional boolean
Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts.
Link to this property
description: optional string
Optional description of the MCP server.
maxLength512
Link to this property
error: optional string
Link to this property
error\_details: optional object {cause, is\_upstream, mcp\_code, 2 more }
cause: optional string
Underlying error message
Link to this property
is\_upstream: optional boolean
True = MCP server returned an error. False = couldn’t reach the server
Link to this property
mcp\_code: optional number
MCP protocol error code
Link to this property
retryable: optional boolean
Whether the error is transient and worth retrying
Link to this property
status\_code: optional number
HTTP status code from the server
Link to this property
Link to this property
is\_shared\_oauth\_callback\_enabled: optional boolean
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Link to this property
last\_successful\_sync: optional string
formatdate-time
Link to this property
last\_synced: optional string
formatdate-time
Link to this property
modified\_at: optional string
formatdate-time
Link to this property
modified\_by: optional string
Link to this property
on\_behalf: optional boolean
Link to this property
secure\_web\_gateway: optional boolean
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
Link to this property
status: optional "waiting"or "ready"or "stale"or "error"
Current sync state of the server
One of the following:
"waiting"
Link to this property
"ready"
Link to this property
"stale"
Link to this property
"error"
Link to this property
Link to this property
updated\_prompts: optional array of object {name, enabled, portal\_alias, 3 more }
name: string
Link to this property
enabled: optional boolean
Link to this property
portal\_alias: optional string
Link to this property
portal\_description: optional string
Link to this property
server\_alias: optional string
Link to this property
server\_description: optional string
Link to this property
Link to this property
updated\_tools: optional array of object {name, enabled, portal\_alias, 3 more }
name: string
Link to this property
enabled: optional boolean
Link to this property
portal\_alias: optional string
Link to this property
portal\_description: optional string
Link to this property
server\_alias: optional string
Link to this property
server\_description: optional string
Link to this property
Link to this property
Link to this property
Deprecatedallow\_code\_mode: optional boolean
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
Link to this property
code\_mode: optional "off"or "opt\_in"or "default\_on"or "enforced"
Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
One of the following:
"off"
Link to this property
"opt\_in"
Link to this property
"default\_on"
Link to this property
"enforced"
Link to this property
Link to this property
created\_at: optional string
formatdate-time
Link to this property
created\_by: optional string
Link to this property
description: optional string
Optional description of the MCP portal.
maxLength512
Link to this property
modified\_at: optional string
formatdate-time
Link to this property
modified\_by: optional string
Link to this property
secure\_web\_gateway: optional boolean
Route outbound MCP traffic through Zero Trust Secure Web Gateway.
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_create_response%20%3E%20(schema)>)
PortalReadResponse object {id, hostname, name, 9 more }
id: string
Unique identifier for the MCP portal.
maxLength32
minLength1
Link to this property
hostname: string
Hostname where the MCP portal is available.
Link to this property
name: string
Display name for the MCP portal.
maxLength350
Link to this property
servers: array of object {id, auth\_type, hostname, 22 more }
id: string
Unique identifier for the MCP server.
maxLength32
minLength1
Link to this property
auth\_type: "oauth"or "bearer"or "unauthenticated"
Authentication method used to connect to the upstream MCP server.
One of the following:
"oauth"
Link to this property
"bearer"
Link to this property
"unauthenticated"
Link to this property
Link to this property
hostname: string
URL of the upstream MCP endpoint.
formaturi
Link to this property
name: string
Display name for the MCP server.
maxLength350
Link to this property
prompts: array of map\[unknown]
Link to this property
server\_id: string
Unique identifier for the MCP server.
maxLength32
minLength1
Link to this property
tools: array of map\[unknown]
Link to this property
auth\_config\_summary: optional object {auth\_mode, client\_secret\_version, config, 2 more }
Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: optional "dcr"or "manual"
One of the following:
"dcr"
Link to this property
"manual"
Link to this property
Link to this property
client\_secret\_version: optional number
Link to this property
config: optional object {authorization\_endpoint, issuer, resource, 2 more }
authorization\_endpoint: optional string
Link to this property
issuer: optional string
Link to this property
resource: optional string
Link to this property
revocation\_endpoint: optional string
Link to this property
token\_endpoint: optional string
Link to this property
Link to this property
has\_client\_secret: optional boolean
Link to this property
registration\_info: optional object {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method }
client\_id: optional string
Link to this property
redirect\_uris: optional array of string
Link to this property
scope: optional string
Link to this property
token\_endpoint\_auth\_method: optional string
Link to this property
Link to this property
Link to this property
authentication\_status: optional "not\_required"or "required"or "connected"or 2 more
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
One of the following:
"not\_required"
Link to this property
"required"
Link to this property
"connected"
Link to this property
"stale"
Link to this property
"manual"
Link to this property
Link to this property
created\_at: optional string
formatdate-time
Link to this property
created\_by: optional string
Link to this property
default\_disabled: optional boolean
Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts.
Link to this property
description: optional string
Optional description of the MCP server.
maxLength512
Link to this property
error: optional string
Link to this property
error\_details: optional object {cause, is\_upstream, mcp\_code, 2 more }
cause: optional string
Underlying error message
Link to this property
is\_upstream: optional boolean
True = MCP server returned an error. False = couldn’t reach the server
Link to this property
mcp\_code: optional number
MCP protocol error code
Link to this property
retryable: optional boolean
Whether the error is transient and worth retrying
Link to this property
status\_code: optional number
HTTP status code from the server
Link to this property
Link to this property
is\_shared\_oauth\_callback\_enabled: optional boolean
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Link to this property
last\_successful\_sync: optional string
formatdate-time
Link to this property
last\_synced: optional string
formatdate-time
Link to this property
modified\_at: optional string
formatdate-time
Link to this property
modified\_by: optional string
Link to this property
on\_behalf: optional boolean
Link to this property
secure\_web\_gateway: optional boolean
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
Link to this property
status: optional "waiting"or "ready"or "stale"or "error"
Current sync state of the server
One of the following:
"waiting"
Link to this property
"ready"
Link to this property
"stale"
Link to this property
"error"
Link to this property
Link to this property
updated\_prompts: optional array of object {name, enabled, portal\_alias, 3 more }
name: string
Link to this property
enabled: optional boolean
Link to this property
portal\_alias: optional string
Link to this property
portal\_description: optional string
Link to this property
server\_alias: optional string
Link to this property
server\_description: optional string
Link to this property
Link to this property
updated\_tools: optional array of object {name, enabled, portal\_alias, 3 more }
name: string
Link to this property
enabled: optional boolean
Link to this property
portal\_alias: optional string
Link to this property
portal\_description: optional string
Link to this property
server\_alias: optional string
Link to this property
server\_description: optional string
Link to this property
Link to this property
Link to this property
Deprecatedallow\_code\_mode: optional boolean
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
Link to this property
code\_mode: optional "off"or "opt\_in"or "default\_on"or "enforced"
Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
One of the following:
"off"
Link to this property
"opt\_in"
Link to this property
"default\_on"
Link to this property
"enforced"
Link to this property
Link to this property
created\_at: optional string
formatdate-time
Link to this property
created\_by: optional string
Link to this property
description: optional string
Optional description of the MCP portal.
maxLength512
Link to this property
modified\_at: optional string
formatdate-time
Link to this property
modified\_by: optional string
Link to this property
secure\_web\_gateway: optional boolean
Route outbound MCP traffic through Zero Trust Secure Web Gateway.
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_read_response%20%3E%20(schema)>)
PortalUpdateResponse object {id, hostname, name, 9 more }
id: string
Unique identifier for the MCP portal.
maxLength32
minLength1
Link to this property
hostname: string
Hostname where the MCP portal is available.
Link to this property
name: string
Display name for the MCP portal.
maxLength350
Link to this property
servers: array of object {id, auth\_type, hostname, 22 more }
id: string
Unique identifier for the MCP server.
maxLength32
minLength1
Link to this property
auth\_type: "oauth"or "bearer"or "unauthenticated"
Authentication method used to connect to the upstream MCP server.
One of the following:
"oauth"
Link to this property
"bearer"
Link to this property
"unauthenticated"
Link to this property
Link to this property
hostname: string
URL of the upstream MCP endpoint.
formaturi
Link to this property
name: string
Display name for the MCP server.
maxLength350
Link to this property
prompts: array of map\[unknown]
Link to this property
server\_id: string
Unique identifier for the MCP server.
maxLength32
minLength1
Link to this property
tools: array of map\[unknown]
Link to this property
auth\_config\_summary: optional object {auth\_mode, client\_secret\_version, config, 2 more }
Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: optional "dcr"or "manual"
One of the following:
"dcr"
Link to this property
"manual"
Link to this property
Link to this property
client\_secret\_version: optional number
Link to this property
config: optional object {authorization\_endpoint, issuer, resource, 2 more }
authorization\_endpoint: optional string
Link to this property
issuer: optional string
Link to this property
resource: optional string
Link to this property
revocation\_endpoint: optional string
Link to this property
token\_endpoint: optional string
Link to this property
Link to this property
has\_client\_secret: optional boolean
Link to this property
registration\_info: optional object {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method }
client\_id: optional string
Link to this property
redirect\_uris: optional array of string
Link to this property
scope: optional string
Link to this property
token\_endpoint\_auth\_method: optional string
Link to this property
Link to this property
Link to this property
authentication\_status: optional "not\_required"or "required"or "connected"or 2 more
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
One of the following:
"not\_required"
Link to this property
"required"
Link to this property
"connected"
Link to this property
"stale"
Link to this property
"manual"
Link to this property
Link to this property
created\_at: optional string
formatdate-time
Link to this property
created\_by: optional string
Link to this property
default\_disabled: optional boolean
Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts.
Link to this property
description: optional string
Optional description of the MCP server.
maxLength512
Link to this property
error: optional string
Link to this property
error\_details: optional object {cause, is\_upstream, mcp\_code, 2 more }
cause: optional string
Underlying error message
Link to this property
is\_upstream: optional boolean
True = MCP server returned an error. False = couldn’t reach the server
Link to this property
mcp\_code: optional number
MCP protocol error code
Link to this property
retryable: optional boolean
Whether the error is transient and worth retrying
Link to this property
status\_code: optional number
HTTP status code from the server
Link to this property
Link to this property
is\_shared\_oauth\_callback\_enabled: optional boolean
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Link to this property
last\_successful\_sync: optional string
formatdate-time
Link to this property
last\_synced: optional string
formatdate-time
Link to this property
modified\_at: optional string
formatdate-time
Link to this property
modified\_by: optional string
Link to this property
on\_behalf: optional boolean
Link to this property
secure\_web\_gateway: optional boolean
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
Link to this property
status: optional "waiting"or "ready"or "stale"or "error"
Current sync state of the server
One of the following:
"waiting"
Link to this property
"ready"
Link to this property
"stale"
Link to this property
"error"
Link to this property
Link to this property
updated\_prompts: optional array of object {name, enabled, portal\_alias, 3 more }
name: string
Link to this property
enabled: optional boolean
Link to this property
portal\_alias: optional string
Link to this property
portal\_description: optional string
Link to this property
server\_alias: optional string
Link to this property
server\_description: optional string
Link to this property
Link to this property
updated\_tools: optional array of object {name, enabled, portal\_alias, 3 more }
name: string
Link to this property
enabled: optional boolean
Link to this property
portal\_alias: optional string
Link to this property
portal\_description: optional string
Link to this property
server\_alias: optional string
Link to this property
server\_description: optional string
Link to this property
Link to this property
Link to this property
Deprecatedallow\_code\_mode: optional boolean
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
Link to this property
code\_mode: optional "off"or "opt\_in"or "default\_on"or "enforced"
Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
One of the following:
"off"
Link to this property
"opt\_in"
Link to this property
"default\_on"
Link to this property
"enforced"
Link to this property
Link to this property
created\_at: optional string
formatdate-time
Link to this property
created\_by: optional string
Link to this property
description: optional string
Optional description of the MCP portal.
maxLength512
Link to this property
modified\_at: optional string
formatdate-time
Link to this property
modified\_by: optional string
Link to this property
secure\_web\_gateway: optional boolean
Route outbound MCP traffic through Zero Trust Secure Web Gateway.
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_update_response%20%3E%20(schema)>)
PortalDeleteResponse object {id, hostname, name, 8 more }
id: string
Unique identifier for the MCP portal.
maxLength32
minLength1
Link to this property
hostname: string
Hostname where the MCP portal is available.
Link to this property
name: string
Display name for the MCP portal.
maxLength350
Link to this property
Deprecatedallow\_code\_mode: optional boolean
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
Link to this property