--- title: Access --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) [Zero Trust](https://developers.cloudflare.com/api/resources/zero_trust) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Access #### AccessAI Controls #### AccessAI ControlsMcp #### AccessAI ControlsMcpPortals ##### [List MCP Portals](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/list) GET/accounts/{account\_id}/access/ai-controls/mcp/portals ##### [Create a new MCP Portal](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/create) POST/accounts/{account\_id}/access/ai-controls/mcp/portals ##### [Read details of an MCP Portal](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/read) GET/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### [Update an MCP Portal](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/update) PUT/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### [Delete an MCP Portal](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/delete) DELETE/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### ModelsExpand Collapse
PortalListResponse object {id, hostname, name, 9 more } id: string Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: string Hostname where the MCP portal is available. Link to this property name: string Display name for the MCP portal. maxLength350 Link to this property
servers: array of object {id, auth\_type, hostname, 22 more } id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"or "bearer"or "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: array of map\[unknown] Link to this property server\_id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: array of map\[unknown] Link to this property
auth\_config\_summary: optional object {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: optional "dcr"or "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: optional number Link to this property
config: optional object {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint: optional string Link to this property issuer: optional string Link to this property resource: optional string Link to this property revocation\_endpoint: optional string Link to this property token\_endpoint: optional string Link to this property
Link to this property has\_client\_secret: optional boolean Link to this property
registration\_info: optional object {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id: optional string Link to this property redirect\_uris: optional array of string Link to this property scope: optional string Link to this property token\_endpoint\_auth\_method: optional string Link to this property
Link to this property
Link to this property
authentication\_status: optional "not\_required"or "required"or "connected"or 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property created\_by: optional string Link to this property default\_disabled: optional boolean Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description: optional string Optional description of the MCP server. maxLength512 Link to this property error: optional string Link to this property
error\_details: optional object {cause, is\_upstream, mcp\_code, 2 more } cause: optional string Underlying error message Link to this property is\_upstream: optional boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: optional number MCP protocol error code Link to this property retryable: optional boolean Whether the error is transient and worth retrying Link to this property status\_code: optional number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: optional boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: optional string formatdate-time Link to this property last\_synced: optional string formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property modified\_by: optional string Link to this property on\_behalf: optional boolean Link to this property secure\_web\_gateway: optional boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: optional "waiting"or "ready"or "stale"or "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: optional array of object {name, enabled, portal\_alias, 3 more } name: string Link to this property enabled: optional boolean Link to this property portal\_alias: optional string Link to this property portal\_description: optional string Link to this property server\_alias: optional string Link to this property server\_description: optional string Link to this property
Link to this property
updated\_tools: optional array of object {name, enabled, portal\_alias, 3 more } name: string Link to this property enabled: optional boolean Link to this property portal\_alias: optional string Link to this property portal\_description: optional string Link to this property server\_alias: optional string Link to this property server\_description: optional string Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode: optional boolean Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode: optional "off"or "opt\_in"or "default\_on"or "enforced" Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property created\_by: optional string Link to this property description: optional string Optional description of the MCP portal. maxLength512 Link to this property modified\_at: optional string formatdate-time Link to this property modified\_by: optional string Link to this property secure\_web\_gateway: optional boolean Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_list_response%20%3E%20(schema)>)
PortalCreateResponse object {id, hostname, name, 9 more } id: string Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: string Hostname where the MCP portal is available. Link to this property name: string Display name for the MCP portal. maxLength350 Link to this property
servers: array of object {id, auth\_type, hostname, 22 more } id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"or "bearer"or "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: array of map\[unknown] Link to this property server\_id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: array of map\[unknown] Link to this property
auth\_config\_summary: optional object {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: optional "dcr"or "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: optional number Link to this property
config: optional object {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint: optional string Link to this property issuer: optional string Link to this property resource: optional string Link to this property revocation\_endpoint: optional string Link to this property token\_endpoint: optional string Link to this property
Link to this property has\_client\_secret: optional boolean Link to this property
registration\_info: optional object {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id: optional string Link to this property redirect\_uris: optional array of string Link to this property scope: optional string Link to this property token\_endpoint\_auth\_method: optional string Link to this property
Link to this property
Link to this property
authentication\_status: optional "not\_required"or "required"or "connected"or 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property created\_by: optional string Link to this property default\_disabled: optional boolean Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description: optional string Optional description of the MCP server. maxLength512 Link to this property error: optional string Link to this property
error\_details: optional object {cause, is\_upstream, mcp\_code, 2 more } cause: optional string Underlying error message Link to this property is\_upstream: optional boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: optional number MCP protocol error code Link to this property retryable: optional boolean Whether the error is transient and worth retrying Link to this property status\_code: optional number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: optional boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: optional string formatdate-time Link to this property last\_synced: optional string formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property modified\_by: optional string Link to this property on\_behalf: optional boolean Link to this property secure\_web\_gateway: optional boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: optional "waiting"or "ready"or "stale"or "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: optional array of object {name, enabled, portal\_alias, 3 more } name: string Link to this property enabled: optional boolean Link to this property portal\_alias: optional string Link to this property portal\_description: optional string Link to this property server\_alias: optional string Link to this property server\_description: optional string Link to this property
Link to this property
updated\_tools: optional array of object {name, enabled, portal\_alias, 3 more } name: string Link to this property enabled: optional boolean Link to this property portal\_alias: optional string Link to this property portal\_description: optional string Link to this property server\_alias: optional string Link to this property server\_description: optional string Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode: optional boolean Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode: optional "off"or "opt\_in"or "default\_on"or "enforced" Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property created\_by: optional string Link to this property description: optional string Optional description of the MCP portal. maxLength512 Link to this property modified\_at: optional string formatdate-time Link to this property modified\_by: optional string Link to this property secure\_web\_gateway: optional boolean Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_create_response%20%3E%20(schema)>)
PortalReadResponse object {id, hostname, name, 9 more } id: string Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: string Hostname where the MCP portal is available. Link to this property name: string Display name for the MCP portal. maxLength350 Link to this property
servers: array of object {id, auth\_type, hostname, 22 more } id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"or "bearer"or "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: array of map\[unknown] Link to this property server\_id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: array of map\[unknown] Link to this property
auth\_config\_summary: optional object {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: optional "dcr"or "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: optional number Link to this property
config: optional object {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint: optional string Link to this property issuer: optional string Link to this property resource: optional string Link to this property revocation\_endpoint: optional string Link to this property token\_endpoint: optional string Link to this property
Link to this property has\_client\_secret: optional boolean Link to this property
registration\_info: optional object {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id: optional string Link to this property redirect\_uris: optional array of string Link to this property scope: optional string Link to this property token\_endpoint\_auth\_method: optional string Link to this property
Link to this property
Link to this property
authentication\_status: optional "not\_required"or "required"or "connected"or 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property created\_by: optional string Link to this property default\_disabled: optional boolean Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description: optional string Optional description of the MCP server. maxLength512 Link to this property error: optional string Link to this property
error\_details: optional object {cause, is\_upstream, mcp\_code, 2 more } cause: optional string Underlying error message Link to this property is\_upstream: optional boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: optional number MCP protocol error code Link to this property retryable: optional boolean Whether the error is transient and worth retrying Link to this property status\_code: optional number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: optional boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: optional string formatdate-time Link to this property last\_synced: optional string formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property modified\_by: optional string Link to this property on\_behalf: optional boolean Link to this property secure\_web\_gateway: optional boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: optional "waiting"or "ready"or "stale"or "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: optional array of object {name, enabled, portal\_alias, 3 more } name: string Link to this property enabled: optional boolean Link to this property portal\_alias: optional string Link to this property portal\_description: optional string Link to this property server\_alias: optional string Link to this property server\_description: optional string Link to this property
Link to this property
updated\_tools: optional array of object {name, enabled, portal\_alias, 3 more } name: string Link to this property enabled: optional boolean Link to this property portal\_alias: optional string Link to this property portal\_description: optional string Link to this property server\_alias: optional string Link to this property server\_description: optional string Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode: optional boolean Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode: optional "off"or "opt\_in"or "default\_on"or "enforced" Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property created\_by: optional string Link to this property description: optional string Optional description of the MCP portal. maxLength512 Link to this property modified\_at: optional string formatdate-time Link to this property modified\_by: optional string Link to this property secure\_web\_gateway: optional boolean Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_read_response%20%3E%20(schema)>)
PortalUpdateResponse object {id, hostname, name, 9 more } id: string Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: string Hostname where the MCP portal is available. Link to this property name: string Display name for the MCP portal. maxLength350 Link to this property
servers: array of object {id, auth\_type, hostname, 22 more } id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"or "bearer"or "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: array of map\[unknown] Link to this property server\_id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: array of map\[unknown] Link to this property
auth\_config\_summary: optional object {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: optional "dcr"or "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: optional number Link to this property
config: optional object {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint: optional string Link to this property issuer: optional string Link to this property resource: optional string Link to this property revocation\_endpoint: optional string Link to this property token\_endpoint: optional string Link to this property
Link to this property has\_client\_secret: optional boolean Link to this property
registration\_info: optional object {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id: optional string Link to this property redirect\_uris: optional array of string Link to this property scope: optional string Link to this property token\_endpoint\_auth\_method: optional string Link to this property
Link to this property
Link to this property
authentication\_status: optional "not\_required"or "required"or "connected"or 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property created\_by: optional string Link to this property default\_disabled: optional boolean Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description: optional string Optional description of the MCP server. maxLength512 Link to this property error: optional string Link to this property
error\_details: optional object {cause, is\_upstream, mcp\_code, 2 more } cause: optional string Underlying error message Link to this property is\_upstream: optional boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: optional number MCP protocol error code Link to this property retryable: optional boolean Whether the error is transient and worth retrying Link to this property status\_code: optional number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: optional boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: optional string formatdate-time Link to this property last\_synced: optional string formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property modified\_by: optional string Link to this property on\_behalf: optional boolean Link to this property secure\_web\_gateway: optional boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: optional "waiting"or "ready"or "stale"or "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: optional array of object {name, enabled, portal\_alias, 3 more } name: string Link to this property enabled: optional boolean Link to this property portal\_alias: optional string Link to this property portal\_description: optional string Link to this property server\_alias: optional string Link to this property server\_description: optional string Link to this property
Link to this property
updated\_tools: optional array of object {name, enabled, portal\_alias, 3 more } name: string Link to this property enabled: optional boolean Link to this property portal\_alias: optional string Link to this property portal\_description: optional string Link to this property server\_alias: optional string Link to this property server\_description: optional string Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode: optional boolean Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode: optional "off"or "opt\_in"or "default\_on"or "enforced" Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property created\_by: optional string Link to this property description: optional string Optional description of the MCP portal. maxLength512 Link to this property modified\_at: optional string formatdate-time Link to this property modified\_by: optional string Link to this property secure\_web\_gateway: optional boolean Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_update_response%20%3E%20(schema)>)
PortalDeleteResponse object {id, hostname, name, 8 more } id: string Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: string Hostname where the MCP portal is available. Link to this property name: string Display name for the MCP portal. maxLength350 Link to this property Deprecatedallow\_code\_mode: optional boolean Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode: optional "off"or "opt\_in"or "default\_on"or "enforced" Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property created\_by: optional string Link to this property description: optional string Optional description of the MCP portal. maxLength512 Link to this property modified\_at: optional string formatdate-time Link to this property modified\_by: optional string Link to this property secure\_web\_gateway: optional boolean Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_delete_response%20%3E%20(schema)>) #### AccessAI ControlsMcpServers ##### [List MCP Servers](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/list) GET/accounts/{account\_id}/access/ai-controls/mcp/servers ##### [Create a new MCP Server](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/create) POST/accounts/{account\_id}/access/ai-controls/mcp/servers ##### [Read the details of an MCP Server](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/read) GET/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Update an MCP Server](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/update) PUT/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Delete an MCP Server](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/delete) DELETE/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Sync MCP Server Capabilities](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/sync) POST/accounts/{account\_id}/access/ai-controls/mcp/servers/{id}/sync ##### ModelsExpand Collapse
ServerListResponse object {id, auth\_type, hostname, 19 more } id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"or "bearer"or "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: array of map\[unknown] Link to this property tools: array of map\[unknown] Link to this property
auth\_config\_summary: optional object {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: optional "dcr"or "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: optional number Link to this property
config: optional object {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint: optional string Link to this property issuer: optional string Link to this property resource: optional string Link to this property revocation\_endpoint: optional string Link to this property token\_endpoint: optional string Link to this property
Link to this property has\_client\_secret: optional boolean Link to this property
registration\_info: optional object {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id: optional string Link to this property redirect\_uris: optional array of string Link to this property scope: optional string Link to this property token\_endpoint\_auth\_method: optional string Link to this property
Link to this property
Link to this property
authentication\_status: optional "not\_required"or "required"or "connected"or 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property created\_by: optional string Link to this property description: optional string Optional description of the MCP server. maxLength512 Link to this property error: optional string Link to this property
error\_details: optional object {cause, is\_upstream, mcp\_code, 2 more } cause: optional string Underlying error message Link to this property is\_upstream: optional boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: optional number MCP protocol error code Link to this property retryable: optional boolean Whether the error is transient and worth retrying Link to this property status\_code: optional number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: optional boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: optional string formatdate-time Link to this property last\_synced: optional string formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property modified\_by: optional string Link to this property secure\_web\_gateway: optional boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: optional "waiting"or "ready"or "stale"or "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: optional array of object {name, alias, description, enabled } Server-wide prompt capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias: optional string Custom name exposed for the capability. maxLength40 Link to this property description: optional string Custom description exposed for the capability. Link to this property enabled: optional boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools: optional array of object {name, alias, description, enabled } Server-wide tool capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias: optional string Custom name exposed for the capability. maxLength40 Link to this property description: optional string Custom description exposed for the capability. Link to this property enabled: optional boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_list_response%20%3E%20(schema)>)
ServerCreateResponse object {id, auth\_type, hostname, 19 more } id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"or "bearer"or "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: array of map\[unknown] Link to this property tools: array of map\[unknown] Link to this property
auth\_config\_summary: optional object {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: optional "dcr"or "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: optional number Link to this property
config: optional object {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint: optional string Link to this property issuer: optional string Link to this property resource: optional string Link to this property revocation\_endpoint: optional string Link to this property token\_endpoint: optional string Link to this property
Link to this property has\_client\_secret: optional boolean Link to this property
registration\_info: optional object {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id: optional string Link to this property redirect\_uris: optional array of string Link to this property scope: optional string Link to this property token\_endpoint\_auth\_method: optional string Link to this property
Link to this property
Link to this property
authentication\_status: optional "not\_required"or "required"or "connected"or 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property created\_by: optional string Link to this property description: optional string Optional description of the MCP server. maxLength512 Link to this property error: optional string Link to this property
error\_details: optional object {cause, is\_upstream, mcp\_code, 2 more } cause: optional string Underlying error message Link to this property is\_upstream: optional boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: optional number MCP protocol error code Link to this property retryable: optional boolean Whether the error is transient and worth retrying Link to this property status\_code: optional number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: optional boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: optional string formatdate-time Link to this property last\_synced: optional string formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property modified\_by: optional string Link to this property secure\_web\_gateway: optional boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: optional "waiting"or "ready"or "stale"or "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: optional array of object {name, alias, description, enabled } Server-wide prompt capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias: optional string Custom name exposed for the capability. maxLength40 Link to this property description: optional string Custom description exposed for the capability. Link to this property enabled: optional boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools: optional array of object {name, alias, description, enabled } Server-wide tool capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias: optional string Custom name exposed for the capability. maxLength40 Link to this property description: optional string Custom description exposed for the capability. Link to this property enabled: optional boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_create_response%20%3E%20(schema)>)
ServerReadResponse object {id, auth\_type, hostname, 19 more } id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"or "bearer"or "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: array of map\[unknown] Link to this property tools: array of map\[unknown] Link to this property
auth\_config\_summary: optional object {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: optional "dcr"or "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: optional number Link to this property
config: optional object {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint: optional string Link to this property issuer: optional string Link to this property resource: optional string Link to this property revocation\_endpoint: optional string Link to this property token\_endpoint: optional string Link to this property
Link to this property has\_client\_secret: optional boolean Link to this property
registration\_info: optional object {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id: optional string Link to this property redirect\_uris: optional array of string Link to this property scope: optional string Link to this property token\_endpoint\_auth\_method: optional string Link to this property
Link to this property
Link to this property
authentication\_status: optional "not\_required"or "required"or "connected"or 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property created\_by: optional string Link to this property description: optional string Optional description of the MCP server. maxLength512 Link to this property error: optional string Link to this property
error\_details: optional object {cause, is\_upstream, mcp\_code, 2 more } cause: optional string Underlying error message Link to this property is\_upstream: optional boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: optional number MCP protocol error code Link to this property retryable: optional boolean Whether the error is transient and worth retrying Link to this property status\_code: optional number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: optional boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: optional string formatdate-time Link to this property last\_synced: optional string formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property modified\_by: optional string Link to this property secure\_web\_gateway: optional boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: optional "waiting"or "ready"or "stale"or "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: optional array of object {name, alias, description, enabled } Server-wide prompt capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias: optional string Custom name exposed for the capability. maxLength40 Link to this property description: optional string Custom description exposed for the capability. Link to this property enabled: optional boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools: optional array of object {name, alias, description, enabled } Server-wide tool capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias: optional string Custom name exposed for the capability. maxLength40 Link to this property description: optional string Custom description exposed for the capability. Link to this property enabled: optional boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_read_response%20%3E%20(schema)>)
ServerUpdateResponse object {id, auth\_type, hostname, 19 more } id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"or "bearer"or "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: array of map\[unknown] Link to this property tools: array of map\[unknown] Link to this property
auth\_config\_summary: optional object {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: optional "dcr"or "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: optional number Link to this property
config: optional object {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint: optional string Link to this property issuer: optional string Link to this property resource: optional string Link to this property revocation\_endpoint: optional string Link to this property token\_endpoint: optional string Link to this property
Link to this property has\_client\_secret: optional boolean Link to this property
registration\_info: optional object {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id: optional string Link to this property redirect\_uris: optional array of string Link to this property scope: optional string Link to this property token\_endpoint\_auth\_method: optional string Link to this property
Link to this property
Link to this property
authentication\_status: optional "not\_required"or "required"or "connected"or 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property created\_by: optional string Link to this property description: optional string Optional description of the MCP server. maxLength512 Link to this property error: optional string Link to this property
error\_details: optional object {cause, is\_upstream, mcp\_code, 2 more } cause: optional string Underlying error message Link to this property is\_upstream: optional boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: optional number MCP protocol error code Link to this property retryable: optional boolean Whether the error is transient and worth retrying Link to this property status\_code: optional number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: optional boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: optional string formatdate-time Link to this property last\_synced: optional string formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property modified\_by: optional string Link to this property secure\_web\_gateway: optional boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: optional "waiting"or "ready"or "stale"or "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: optional array of object {name, alias, description, enabled } Server-wide prompt capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias: optional string Custom name exposed for the capability. maxLength40 Link to this property description: optional string Custom description exposed for the capability. Link to this property enabled: optional boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools: optional array of object {name, alias, description, enabled } Server-wide tool capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias: optional string Custom name exposed for the capability. maxLength40 Link to this property description: optional string Custom description exposed for the capability. Link to this property enabled: optional boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_update_response%20%3E%20(schema)>)
ServerDeleteResponse object {id, auth\_type, hostname, 19 more } id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"or "bearer"or "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: array of map\[unknown] Link to this property tools: array of map\[unknown] Link to this property
auth\_config\_summary: optional object {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode: optional "dcr"or "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version: optional number Link to this property
config: optional object {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint: optional string Link to this property issuer: optional string Link to this property resource: optional string Link to this property revocation\_endpoint: optional string Link to this property token\_endpoint: optional string Link to this property
Link to this property has\_client\_secret: optional boolean Link to this property
registration\_info: optional object {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id: optional string Link to this property redirect\_uris: optional array of string Link to this property scope: optional string Link to this property token\_endpoint\_auth\_method: optional string Link to this property
Link to this property
Link to this property
authentication\_status: optional "not\_required"or "required"or "connected"or 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property created\_by: optional string Link to this property description: optional string Optional description of the MCP server. maxLength512 Link to this property error: optional string Link to this property
error\_details: optional object {cause, is\_upstream, mcp\_code, 2 more } cause: optional string Underlying error message Link to this property is\_upstream: optional boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: optional number MCP protocol error code Link to this property retryable: optional boolean Whether the error is transient and worth retrying Link to this property status\_code: optional number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled: optional boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync: optional string formatdate-time Link to this property last\_synced: optional string formatdate-time Link to this property modified\_at: optional string formatdate-time Link to this property modified\_by: optional string Link to this property secure\_web\_gateway: optional boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status: optional "waiting"or "ready"or "stale"or "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts: optional array of object {name, alias, description, enabled } Server-wide prompt capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias: optional string Custom name exposed for the capability. maxLength40 Link to this property description: optional string Custom description exposed for the capability. Link to this property enabled: optional boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools: optional array of object {name, alias, description, enabled } Server-wide tool capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias: optional string Custom name exposed for the capability. maxLength40 Link to this property description: optional string Custom description exposed for the capability. Link to this property enabled: optional boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_delete_response%20%3E%20(schema)>)
ServerSyncResponse object {error, error\_details, status } error: optional string Link to this property
error\_details: optional object {cause, is\_upstream, mcp\_code, 2 more } cause: optional string Underlying error message Link to this property is\_upstream: optional boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code: optional number MCP protocol error code Link to this property retryable: optional boolean Whether the error is transient and worth retrying Link to this property status\_code: optional number HTTP status code from the server Link to this property
Link to this property
status: optional "waiting"or "ready"or "stale"or "error" One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_sync_response%20%3E%20(schema)>) #### AccessGateway CA ##### [List SSH Certificate Authorities (CA)](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/list) GET/accounts/{account\_id}/access/gateway\_ca ##### [Add a new SSH Certificate Authority (CA)](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/create) POST/accounts/{account\_id}/access/gateway\_ca ##### [Delete an SSH Certificate Authority (CA)](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/delete) DELETE/accounts/{account\_id}/access/gateway\_ca/{certificate\_id} ##### ModelsExpand Collapse
GatewayCAListResponse object {id, public\_key } id: optional string The key ID of this certificate. Link to this property public\_key: optional string The public key of this certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.gateway_ca%20%3E%20(model)%20gateway_ca_list_response%20%3E%20(schema)>)
GatewayCACreateResponse object {id, public\_key } id: optional string The key ID of this certificate. Link to this property public\_key: optional string The public key of this certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.gateway_ca%20%3E%20(model)%20gateway_ca_create_response%20%3E%20(schema)>)
GatewayCADeleteResponse object {id } id: optional string UUID. maxLength36 Link to this property
[Link to this property](<#(resource)%20zero_trust.access.gateway_ca%20%3E%20(model)%20gateway_ca_delete_response%20%3E%20(schema)>) #### AccessIdP Federation Grants ##### [List IdP federation grants](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/list) GET/accounts/{account\_id}/access/idp\_federation\_grants ##### [Create an IdP federation grant](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/create) POST/accounts/{account\_id}/access/idp\_federation\_grants ##### [Get an IdP federation grant](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/get) GET/accounts/{account\_id}/access/idp\_federation\_grants/{grant\_id} ##### [Delete an IdP federation grant](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/delete) DELETE/accounts/{account\_id}/access/idp\_federation\_grants/{grant\_id} ##### ModelsExpand Collapse
IdPFederationGrant object {id, idp\_id } id: string UID of the IdP federation grant. maxLength32 Link to this property idp\_id: string UID of the identity provider being federated. formatuuid Link to this property
[Link to this property](<#(resource)%20zero_trust.access.idp_federation_grants%20%3E%20(model)%20idp_federation_grant%20%3E%20(schema)>)
IdPFederationGrantListResponse = array of IdPFederationGrant { id, idp\_id } id: string UID of the IdP federation grant. maxLength32 Link to this property idp\_id: string UID of the identity provider being federated. formatuuid Link to this property
[Link to this property](<#(resource)%20zero_trust.access.idp_federation_grants%20%3E%20(model)%20idp_federation_grant_list_response%20%3E%20(schema)>)
IdPFederationGrantDeleteResponse object {id } id: optional string UID of the deleted IdP federation grant. maxLength32 Link to this property
[Link to this property](<#(resource)%20zero_trust.access.idp_federation_grants%20%3E%20(model)%20idp_federation_grant_delete_response%20%3E%20(schema)>) #### AccessSAML Certificates ##### [List SAML certificate sets](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/list) GET/accounts/{account\_id}/access/saml\_certificates ##### [Get SAML certificate set](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/get) GET/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id} ##### [Rotate SAML certificate](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/rotate) POST/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id}/rotate ##### [Download current certificate in PEM format](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/get_pem) GET/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id}/pem ##### ModelsExpand Collapse
SAMLCertificateListResponse object {created\_at, uid, updated\_at, 2 more } created\_at: string When the certificate set was created formatdate-time Link to this property uid: string Unique identifier for the certificate set Link to this property updated\_at: string When the certificate set was last updated formatdate-time Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The current active certificate is\_current: boolean Indicates whether the certificate can be used for IdP configuration. Link to this property not\_after: string Certificate expiration date formatdate-time Link to this property public\_certificate: string The public certificate in PEM format Link to this property uid: string Unique identifier for the certificate Link to this property
Link to this property previous\_certificate: optional unknown The previous certificate (maintained during rotation period). May be null when no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.saml_certificates%20%3E%20(model)%20saml_certificate_list_response%20%3E%20(schema)>)
SAMLCertificateGetResponse object {created\_at, uid, updated\_at, 2 more } created\_at: string When the certificate set was created formatdate-time Link to this property uid: string Unique identifier for the certificate set Link to this property updated\_at: string When the certificate set was last updated formatdate-time Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The current active certificate is\_current: boolean Indicates whether the certificate can be used for IdP configuration. Link to this property not\_after: string Certificate expiration date formatdate-time Link to this property public\_certificate: string The public certificate in PEM format Link to this property uid: string Unique identifier for the certificate Link to this property
Link to this property previous\_certificate: optional unknown The previous certificate (maintained during rotation period). May be null when no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.saml_certificates%20%3E%20(model)%20saml_certificate_get_response%20%3E%20(schema)>)
SAMLCertificateRotateResponse object {created\_at, uid, updated\_at, 2 more } created\_at: string When the certificate set was created formatdate-time Link to this property uid: string Unique identifier for the certificate set Link to this property updated\_at: string When the certificate set was last updated formatdate-time Link to this property
current\_certificate: optional object {is\_current, not\_after, public\_certificate, uid } The current active certificate is\_current: boolean Indicates whether the certificate can be used for IdP configuration. Link to this property not\_after: string Certificate expiration date formatdate-time Link to this property public\_certificate: string The public certificate in PEM format Link to this property uid: string Unique identifier for the certificate Link to this property
Link to this property previous\_certificate: optional unknown The previous certificate (maintained during rotation period). May be null when no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.saml_certificates%20%3E%20(model)%20saml_certificate_rotate_response%20%3E%20(schema)>) #### AccessInfrastructure #### AccessInfrastructureTargets ##### [List all targets](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/list) GET/accounts/{account\_id}/infrastructure/targets ##### [Get target](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/get) GET/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Create new target](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/create) POST/accounts/{account\_id}/infrastructure/targets ##### [Update target](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/update) PUT/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Delete target](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/delete) DELETE/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Create new targets](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_update) PUT/accounts/{account\_id}/infrastructure/targets/batch ##### [Delete targets (Deprecated)](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_delete) Deprecated DELETE/accounts/{account\_id}/infrastructure/targets/batch ##### [Delete targets](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_delete_v2) POST/accounts/{account\_id}/infrastructure/targets/batch\_delete ##### ModelsExpand Collapse
TargetListResponse object {id, created\_at, hostname, 3 more } id: string Target identifier formatuuid maxLength36 Link to this property created\_at: string Date and time at which the target was created formatdate-time Link to this property hostname: string A non-unique field that refers to a target Link to this property
ip: object {ipv4, ipv6 } The IPv4/IPv6 address that identifies where to reach a target
ipv4: optional object {ip\_addr, virtual\_network\_id } The target’s IPv4 address ip\_addr: optional string IP address of the target Link to this property virtual\_network\_id: optional string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6: optional object {ip\_addr, virtual\_network\_id } The target’s IPv6 address ip\_addr: optional string IP address of the target Link to this property virtual\_network\_id: optional string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: string Date and time at which the target was modified formatdate-time Link to this property tags: optional map\[string] Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_list_response%20%3E%20(schema)>)
TargetGetResponse object {id, created\_at, hostname, 3 more } id: string Target identifier formatuuid maxLength36 Link to this property created\_at: string Date and time at which the target was created formatdate-time Link to this property hostname: string A non-unique field that refers to a target Link to this property
ip: object {ipv4, ipv6 } The IPv4/IPv6 address that identifies where to reach a target
ipv4: optional object {ip\_addr, virtual\_network\_id } The target’s IPv4 address ip\_addr: optional string IP address of the target Link to this property virtual\_network\_id: optional string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6: optional object {ip\_addr, virtual\_network\_id } The target’s IPv6 address ip\_addr: optional string IP address of the target Link to this property virtual\_network\_id: optional string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: string Date and time at which the target was modified formatdate-time Link to this property tags: optional map\[string] Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_get_response%20%3E%20(schema)>)
TargetCreateResponse object {id, created\_at, hostname, 3 more } id: string Target identifier formatuuid maxLength36 Link to this property created\_at: string Date and time at which the target was created formatdate-time Link to this property hostname: string A non-unique field that refers to a target Link to this property
ip: object {ipv4, ipv6 } The IPv4/IPv6 address that identifies where to reach a target
ipv4: optional object {ip\_addr, virtual\_network\_id } The target’s IPv4 address ip\_addr: optional string IP address of the target Link to this property virtual\_network\_id: optional string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6: optional object {ip\_addr, virtual\_network\_id } The target’s IPv6 address ip\_addr: optional string IP address of the target Link to this property virtual\_network\_id: optional string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: string Date and time at which the target was modified formatdate-time Link to this property tags: optional map\[string] Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_create_response%20%3E%20(schema)>)
TargetUpdateResponse object {id, created\_at, hostname, 3 more } id: string Target identifier formatuuid maxLength36 Link to this property created\_at: string Date and time at which the target was created formatdate-time Link to this property hostname: string A non-unique field that refers to a target Link to this property
ip: object {ipv4, ipv6 } The IPv4/IPv6 address that identifies where to reach a target
ipv4: optional object {ip\_addr, virtual\_network\_id } The target’s IPv4 address ip\_addr: optional string IP address of the target Link to this property virtual\_network\_id: optional string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6: optional object {ip\_addr, virtual\_network\_id } The target’s IPv6 address ip\_addr: optional string IP address of the target Link to this property virtual\_network\_id: optional string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: string Date and time at which the target was modified formatdate-time Link to this property tags: optional map\[string] Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_update_response%20%3E%20(schema)>)
TargetBulkUpdateResponse object {id, created\_at, hostname, 3 more } id: string Target identifier formatuuid maxLength36 Link to this property created\_at: string Date and time at which the target was created formatdate-time Link to this property hostname: string A non-unique field that refers to a target Link to this property
ip: object {ipv4, ipv6 } The IPv4/IPv6 address that identifies where to reach a target
ipv4: optional object {ip\_addr, virtual\_network\_id } The target’s IPv4 address ip\_addr: optional string IP address of the target Link to this property virtual\_network\_id: optional string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6: optional object {ip\_addr, virtual\_network\_id } The target’s IPv6 address ip\_addr: optional string IP address of the target Link to this property virtual\_network\_id: optional string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: string Date and time at which the target was modified formatdate-time Link to this property tags: optional map\[string] Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_bulk_update_response%20%3E%20(schema)>) #### AccessApplications ##### [List Access applications](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/applications/methods/list) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps ##### [Get an Access application](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/applications/methods/get) GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Add an Access application](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/applications/methods/create) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps ##### [Update an Access application](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/applications/methods/update) PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Delete an Access application](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/applications/methods/delete) DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Revoke application tokens](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/applications/methods/revoke_tokens) POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/revoke\_tokens ##### ModelsExpand Collapse AllowedHeaders = string [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_headers%20%3E%20(schema)>) AllowedIdPs = string The identity providers selected for application. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_idps%20%3E%20(schema)>)
AllowedMethods = "GET"or "POST"or "HEAD"or 6 more One of the following: "GET" Link to this property "POST" Link to this property "HEAD" Link to this property "PUT" Link to this property "DELETE" Link to this property "CONNECT" Link to this property "OPTIONS" Link to this property "TRACE" Link to this property "PATCH" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_methods%20%3E%20(schema)>) AllowedOrigins = string [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_origins%20%3E%20(schema)>) AppID = string Identifier. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20app_id%20%3E%20(schema)>)
Application = object {domain, type, id, 22 more } or object {id, allowed\_idps, app\_launcher\_visible, 9 more } or object {domain, type, id, 22 more } or 5 more One of the following:
SelfHostedApplication object {domain, type, id, 22 more } domain: string The domain and path that Access will secure. Link to this property type: string The application type. Link to this property id: optional string UUID. maxLength36 Link to this property allow\_iframe: optional boolean Enables loading application content in an iFrame. Link to this property allowed\_idps: optional array of AllowedIdPs The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible: optional boolean Displays the application in the App Launcher. Link to this property aud: optional string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: optional boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property cors\_headers: optional CORSHeaders { allow\_all\_headers, allow\_all\_methods, allow\_all\_origins, 5 more } Link to this property created\_at: optional string formatdate-time Link to this property custom\_deny\_message: optional string The custom error message shown to a user when they are denied access to the application. Link to this property custom\_deny\_url: optional string The custom URL a user is redirected to when they are denied access to the application. Link to this property eager\_redirect\_cookie\_setting: optional boolean Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property enable\_binding\_cookie: optional boolean Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property http\_only\_cookie\_attribute: optional boolean Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property logo\_url: optional string The image URL for the logo shown in the App Launcher dashboard. Link to this property name: optional string The name of the application. Link to this property options\_preflight\_bypass: optional boolean Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property same\_site\_cookie\_attribute: optional string Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
scim\_config: optional object {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or object {client\_id, client\_secret, scheme } Multiple authentication schemes One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: optional boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: optional boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings: optional array of SCIMConfigMapping { schema, enabled, filter, 3 more } A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled: optional boolean Whether or not this mapping is enabled. Link to this property filter: optional string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: optional object {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create: optional boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete: optional boolean Whether or not this mapping applies to DELETE operations. Link to this property update: optional boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: optional "strict"or "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: optional string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property service\_auth\_401\_redirect: optional boolean Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property session\_duration: optional string The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property skip\_interstitial: optional boolean Enables automatic authentication through cloudflared. Link to this property updated\_at: optional string formatdate-time Link to this property use\_clientless\_isolation\_app\_launcher\_url: optional boolean Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
SaaSApplication object {id, allowed\_idps, app\_launcher\_visible, 9 more } id: optional string UUID. maxLength36 Link to this property allowed\_idps: optional array of AllowedIdPs The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible: optional boolean Displays the application in the App Launcher. Link to this property aud: optional string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: optional boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property created\_at: optional string formatdate-time Link to this property logo\_url: optional string The image URL for the logo shown in the App Launcher dashboard. Link to this property name: optional string The name of the application. Link to this property
saas\_app: optional object {auth\_type, consumer\_service\_url, created\_at, 8 more } or object {access\_token\_lifetime, allow\_pkce\_without\_client\_secret, app\_launcher\_url, 13 more } One of the following:
AccessSAMLSaaSApp2 object {auth\_type, consumer\_service\_url, created\_at, 8 more }
auth\_type: optional "saml"or "oidc" Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml” One of the following: "saml" Link to this property "oidc" Link to this property
Link to this property consumer\_service\_url: optional string The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion. Link to this property created\_at: optional string formatdate-time Link to this property
custom\_attributes: optional array of object {friendly\_name, name, name\_format, 2 more } friendly\_name: optional string The SAML FriendlyName of the attribute. Link to this property name: optional string The name of the attribute. Link to this property
name\_format: optional "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"or "urn:oasis:names:tc:SAML:2.0:attrname-format:basic"or "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" A globally unique name for an identity or service provider. One of the following: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" Link to this property "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Link to this property "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Link to this property
Link to this property required: optional boolean If the attribute is required when building a SAML assertion. Link to this property
source: optional object {name, name\_by\_idp } name: optional string The name of the IdP attribute. Link to this property name\_by\_idp: optional map\[string] A mapping from IdP ID to attribute name. Link to this property
Link to this property
Link to this property idp\_entity\_id: optional string The unique identifier for your SaaS application. Link to this property name\_id\_format: optional SaaSAppNameIDFormat The format of the name identifier sent to the SaaS application. Link to this property name\_id\_transform\_jsonata: optional string A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting. Link to this property public\_key: optional string The Access public certificate that will be used to verify your identity. Link to this property sp\_entity\_id: optional string A globally unique name for an identity or service provider. Link to this property sso\_endpoint: optional string The endpoint where your SaaS application will send login requests. Link to this property updated\_at: optional string formatdate-time Link to this property
Link to this property
AccessOIDCSaaSApp2 object {access\_token\_lifetime, allow\_pkce\_without\_client\_secret, app\_launcher\_url, 13 more } access\_token\_lifetime: optional string The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h. Link to this property allow\_pkce\_without\_client\_secret: optional boolean If client secret should be required on the token endpoint when authorization\_code\_with\_pkce grant is used. Link to this property app\_launcher\_url: optional string The URL where this applications tile redirects users Link to this property
auth\_type: optional "saml"or "oidc" Identifier of the authentication protocol used for the saas app. Required for OIDC. One of the following: "saml" Link to this property "oidc" Link to this property
Link to this property client\_id: optional string The application client id Link to this property client\_secret: optional string The application client secret, only returned on POST request. Link to this property created\_at: optional string formatdate-time Link to this property
custom\_claims: optional array of object {name, required, scope, source } name: optional string The name of the claim. Link to this property required: optional boolean If the claim is required when building an OIDC token. Link to this property
scope: optional "groups"or "profile"or "email"or "openid" The scope of the claim. One of the following: "groups" Link to this property "profile" Link to this property "email" Link to this property "openid" Link to this property
Link to this property
source: optional object {name, name\_by\_idp } name: optional string The name of the IdP claim. Link to this property
name\_by\_idp: optional array of object {idp\_id, source\_name } A mapping from IdP ID to attribute name. idp\_id: optional string The UID of the IdP. Link to this property source\_name: optional string The name of the IdP provided attribute. Link to this property
Link to this property
Link to this property
Link to this property
grant\_types: optional array of "authorization\_code"or "authorization\_code\_with\_pkce"or "refresh\_tokens"or 2 more The OIDC flows supported by this application One of the following: "authorization\_code" Link to this property "authorization\_code\_with\_pkce" Link to this property "refresh\_tokens" Link to this property "hybrid" Link to this property "implicit" Link to this property
Link to this property group\_filter\_regex: optional string A regex to filter Cloudflare groups returned in ID token and userinfo endpoint. Link to this property
hybrid\_and\_implicit\_options: optional object {return\_access\_token\_from\_authorization\_endpoint, return\_id\_token\_from\_authorization\_endpoint } return\_access\_token\_from\_authorization\_endpoint: optional boolean If an Access Token should be returned from the OIDC Authorization endpoint Link to this property return\_id\_token\_from\_authorization\_endpoint: optional boolean If an ID Token should be returned from the OIDC Authorization endpoint Link to this property
Link to this property public\_key: optional string The Access public certificate that will be used to verify your identity. Link to this property redirect\_uris: optional array of string The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens Link to this property
refresh\_token\_options: optional object {lifetime } lifetime: optional string How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m. Link to this property
Link to this property
scopes: optional array of "openid"or "groups"or "email"or "profile" Define the user information shared with access, “offline\_access” scope will be automatically enabled if refresh tokens are enabled One of the following: "openid" Link to this property "groups" Link to this property "email" Link to this property "profile" Link to this property
Link to this property updated\_at: optional string formatdate-time Link to this property
Link to this property
Link to this property
scim\_config: optional object {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or object {client\_id, client\_secret, scheme } Multiple authentication schemes One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: optional boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: optional boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings: optional array of SCIMConfigMapping { schema, enabled, filter, 3 more } A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled: optional boolean Whether or not this mapping is enabled. Link to this property filter: optional string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: optional object {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create: optional boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete: optional boolean Whether or not this mapping applies to DELETE operations. Link to this property update: optional boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: optional "strict"or "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: optional string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property type: optional string The application type. Link to this property updated\_at: optional string formatdate-time Link to this property
Link to this property
BrowserSSHApplication object {domain, type, id, 22 more } domain: string The domain and path that Access will secure. Link to this property type: string The application type. Link to this property id: optional string UUID. maxLength36 Link to this property allow\_iframe: optional boolean Enables loading application content in an iFrame. Link to this property allowed\_idps: optional array of AllowedIdPs The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible: optional boolean Displays the application in the App Launcher. Link to this property aud: optional string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: optional boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property cors\_headers: optional CORSHeaders { allow\_all\_headers, allow\_all\_methods, allow\_all\_origins, 5 more } Link to this property created\_at: optional string formatdate-time Link to this property custom\_deny\_message: optional string The custom error message shown to a user when they are denied access to the application. Link to this property custom\_deny\_url: optional string The custom URL a user is redirected to when they are denied access to the application. Link to this property eager\_redirect\_cookie\_setting: optional boolean Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property enable\_binding\_cookie: optional boolean Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property http\_only\_cookie\_attribute: optional boolean Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property logo\_url: optional string The image URL for the logo shown in the App Launcher dashboard. Link to this property name: optional string The name of the application. Link to this property options\_preflight\_bypass: optional boolean Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property same\_site\_cookie\_attribute: optional string Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
scim\_config: optional object {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or object {client\_id, client\_secret, scheme } Multiple authentication schemes One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: optional boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: optional boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings: optional array of SCIMConfigMapping { schema, enabled, filter, 3 more } A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled: optional boolean Whether or not this mapping is enabled. Link to this property filter: optional string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: optional object {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create: optional boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete: optional boolean Whether or not this mapping applies to DELETE operations. Link to this property update: optional boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: optional "strict"or "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: optional string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property service\_auth\_401\_redirect: optional boolean Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property session\_duration: optional string The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property skip\_interstitial: optional boolean Enables automatic authentication through cloudflared. Link to this property updated\_at: optional string formatdate-time Link to this property use\_clientless\_isolation\_app\_launcher\_url: optional boolean Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
BrowserVNCApplication object {domain, type, id, 22 more } domain: string The domain and path that Access will secure. Link to this property type: string The application type. Link to this property id: optional string UUID. maxLength36 Link to this property allow\_iframe: optional boolean Enables loading application content in an iFrame. Link to this property allowed\_idps: optional array of AllowedIdPs The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible: optional boolean Displays the application in the App Launcher. Link to this property aud: optional string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: optional boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property cors\_headers: optional CORSHeaders { allow\_all\_headers, allow\_all\_methods, allow\_all\_origins, 5 more } Link to this property created\_at: optional string formatdate-time Link to this property custom\_deny\_message: optional string The custom error message shown to a user when they are denied access to the application. Link to this property custom\_deny\_url: optional string The custom URL a user is redirected to when they are denied access to the application. Link to this property eager\_redirect\_cookie\_setting: optional boolean Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property enable\_binding\_cookie: optional boolean Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property http\_only\_cookie\_attribute: optional boolean Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property logo\_url: optional string The image URL for the logo shown in the App Launcher dashboard. Link to this property name: optional string The name of the application. Link to this property options\_preflight\_bypass: optional boolean Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property same\_site\_cookie\_attribute: optional string Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
scim\_config: optional object {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or object {client\_id, client\_secret, scheme } Multiple authentication schemes One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: optional boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: optional boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings: optional array of SCIMConfigMapping { schema, enabled, filter, 3 more } A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled: optional boolean Whether or not this mapping is enabled. Link to this property filter: optional string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: optional object {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create: optional boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete: optional boolean Whether or not this mapping applies to DELETE operations. Link to this property update: optional boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: optional "strict"or "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: optional string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property service\_auth\_401\_redirect: optional boolean Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property session\_duration: optional string The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property skip\_interstitial: optional boolean Enables automatic authentication through cloudflared. Link to this property updated\_at: optional string formatdate-time Link to this property use\_clientless\_isolation\_app\_launcher\_url: optional boolean Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
AppLauncherApplication object {type, id, allowed\_idps, 8 more }
type: "self\_hosted"or "saas"or "ssh"or 6 more The application type. One of the following: "self\_hosted" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property
Link to this property id: optional string UUID. maxLength36 Link to this property allowed\_idps: optional array of AllowedIdPs The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property aud: optional string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: optional boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property created\_at: optional string formatdate-time Link to this property domain: optional string The domain and path that Access will secure. Link to this property name: optional string The name of the application. Link to this property
scim\_config: optional object {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or object {client\_id, client\_secret, scheme } Multiple authentication schemes One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: optional boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: optional boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings: optional array of SCIMConfigMapping { schema, enabled, filter, 3 more } A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled: optional boolean Whether or not this mapping is enabled. Link to this property filter: optional string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: optional object {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create: optional boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete: optional boolean Whether or not this mapping applies to DELETE operations. Link to this property update: optional boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: optional "strict"or "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: optional string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property session\_duration: optional string The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property updated\_at: optional string formatdate-time Link to this property
Link to this property
DeviceEnrollmentPermissionsApplication object {type, id, allowed\_idps, 8 more }
type: "self\_hosted"or "saas"or "ssh"or 6 more The application type. One of the following: "self\_hosted" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property
Link to this property id: optional string UUID. maxLength36 Link to this property allowed\_idps: optional array of AllowedIdPs The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property aud: optional string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: optional boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property created\_at: optional string formatdate-time Link to this property domain: optional string The domain and path that Access will secure. Link to this property name: optional string The name of the application. Link to this property
scim\_config: optional object {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or object {client\_id, client\_secret, scheme } Multiple authentication schemes One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: optional boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: optional boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings: optional array of SCIMConfigMapping { schema, enabled, filter, 3 more } A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled: optional boolean Whether or not this mapping is enabled. Link to this property filter: optional string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: optional object {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create: optional boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete: optional boolean Whether or not this mapping applies to DELETE operations. Link to this property update: optional boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: optional "strict"or "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: optional string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property session\_duration: optional string The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property updated\_at: optional string formatdate-time Link to this property
Link to this property
BrowserIsolationPermissionsApplication object {type, id, allowed\_idps, 8 more }
type: "self\_hosted"or "saas"or "ssh"or 6 more The application type. One of the following: "self\_hosted" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property
Link to this property id: optional string UUID. maxLength36 Link to this property allowed\_idps: optional array of AllowedIdPs The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property aud: optional string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: optional boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property created\_at: optional string formatdate-time Link to this property domain: optional string The domain and path that Access will secure. Link to this property name: optional string The name of the application. Link to this property
scim\_config: optional object {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or object {client\_id, client\_secret, scheme } Multiple authentication schemes One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: optional boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: optional boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings: optional array of SCIMConfigMapping { schema, enabled, filter, 3 more } A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled: optional boolean Whether or not this mapping is enabled. Link to this property filter: optional string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: optional object {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create: optional boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete: optional boolean Whether or not this mapping applies to DELETE operations. Link to this property update: optional boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: optional "strict"or "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: optional string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property session\_duration: optional string The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property updated\_at: optional string formatdate-time Link to this property
Link to this property
BookmarkApplication object {domain, type, id, 7 more } domain: string The URL or domain of the bookmark. Link to this property type: string The application type. Link to this property id: optional string UUID. maxLength36 Link to this property app\_launcher\_visible: optional boolean Link to this property aud: optional string Audience tag. maxLength64 Link to this property created\_at: optional string formatdate-time Link to this property logo\_url: optional string The image URL for the logo shown in the App Launcher dashboard. Link to this property name: optional string The name of the application. Link to this property
scim\_config: optional object {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object {token, scheme } or SCIMConfigAuthenticationOauth2 { authorization\_url, client\_id, client\_secret, 3 more } or object {client\_id, client\_secret, scheme } Multiple authentication schemes One of the following:
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken object {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete: optional boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled: optional boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings: optional array of SCIMConfigMapping { schema, enabled, filter, 3 more } A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled: optional boolean Whether or not this mapping is enabled. Link to this property filter: optional string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: optional object {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create: optional boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete: optional boolean Whether or not this mapping applies to DELETE operations. Link to this property update: optional boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: optional "strict"or "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: optional string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property updated\_at: optional string formatdate-time Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application%20%3E%20(schema)>)
ApplicationPolicy object {id, approval\_groups, approval\_required, 13 more } id: optional string The UUID of the policy maxLength36 Link to this property
approval\_groups: optional array of ApprovalGroup { approvals\_needed, email\_addresses, email\_list\_uuid } Administrators who can approve a temporary authentication request. approvals\_needed: number The number of approvals needed to obtain access. minimum0 Link to this property email\_addresses: optional array of string A list of emails that can approve the access request. Link to this property email\_list\_uuid: optional string The UUID of an re-usable email list. Link to this property
Link to this property approval\_required: optional boolean Requires the user to request access from an administrator at the start of each session. Link to this property
connection\_rules: optional object {rdp } The rules that define how users may connect to targets secured by your application.
rdp: optional object {allowed\_clipboard\_local\_to\_remote\_formats, allowed\_clipboard\_remote\_to\_local\_formats } The RDP-specific rules that define clipboard behavior for RDP connections.
allowed\_clipboard\_local\_to\_remote\_formats: optional array of "text"or "file" Clipboard formats allowed when copying from local machine to remote RDP session. One of the following: "text" Link to this property "file" Link to this property
Link to this property
allowed\_clipboard\_remote\_to\_local\_formats: optional array of "text"or "file" Clipboard formats allowed when copying from remote RDP session to local machine. One of the following: "text" Link to this property "file" Link to this property
Link to this property
Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property decision: optional Decision The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Link to this property
exclude: optional array of AccessRule Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules. One of the following:
GroupRule object {group } Matches an Access group.
group: object {id } id: string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
AnyValidServiceTokenRule object {any\_valid\_service\_token } Matches any valid Access Service Token any\_valid\_service\_token: object {} An empty object which matches on all service tokens. Link to this property
Link to this property
AccessAuthContextRule object {auth\_context } Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: object {id, ac\_id, identity\_provider\_id } id: string The ID of an Authentication context. Link to this property ac\_id: string The ACID of an Authentication context. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
AuthenticationMethodRule object {auth\_method } Enforce different MFA options
auth\_method: object {auth\_method } auth\_method: string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
AzureGroupRule object {azureAD } Matches an Azure group. Requires an Azure identity provider.
azureAD: object {id, identity\_provider\_id } id: string The ID of an Azure group. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
CertificateRule object {certificate } Matches any valid client certificate. certificate: object {} Link to this property
Link to this property
AccessCommonNameRule object {common\_name } Matches a specific common name.
common\_name: object {common\_name } common\_name: string The common name to match. Link to this property
Link to this property
Link to this property
CountryRule object {geo } Matches a specific country
geo: object {country\_code } country\_code: string The country code that should be matched. Link to this property
Link to this property
Link to this property
AccessDevicePostureRule object {device\_posture } Enforces a device posture rule has run successfully
device\_posture: object {integration\_uid, account\_id } integration\_uid: string The ID of a device posture integration. Link to this property account\_id: optional string The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
DomainRule object {email\_domain } Match an entire email domain.
email\_domain: object {domain } domain: string The email domain to match. Link to this property
Link to this property
Link to this property
EmailListRule object {email\_list } Matches an email address from a list.
email\_list: object {id } id: string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
EmailRule object {email } Matches a specific email.
email: object {email } email: string The email of the user. formatemail Link to this property
Link to this property
Link to this property
EveryoneRule object {everyone } Matches everyone. everyone: object {} An empty object which matches on all users. Link to this property
Link to this property
ExternalEvaluationRule object {external\_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: object {evaluate\_url, keys\_url } evaluate\_url: string The API endpoint containing your business logic. Link to this property keys\_url: string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
GitHubOrganizationRule object {"github-organization" } Matches a Github organization. Requires a Github identity provider.
"github-organization": object {identity\_provider\_id, name, team } identity\_provider\_id: string The ID of your Github identity provider. Link to this property name: string The name of the organization. Link to this property team: optional string The name of the team Link to this property
Link to this property
Link to this property
GSuiteGroupRule object {gsuite } Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: object {email, identity\_provider\_id } email: string The email of the Google Workspace group. Link to this property identity\_provider\_id: string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
AccessLoginMethodRule object {login\_method } Matches a specific identity provider id.
login\_method: object {id } id: string The ID of an identity provider. Link to this property
Link to this property
Link to this property
IPListRule object {ip\_list } Matches an IP address from a list.
ip\_list: object {id } id: string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
IPRule object {ip } Matches an IP address block.
ip: object {ip } ip: string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
OktaGroupRule object {okta } Matches an Okta group. Requires an Okta identity provider.
okta: object {identity\_provider\_id, name } identity\_provider\_id: string The ID of your Okta identity provider. Link to this property name: string The name of the Okta group. Link to this property
Link to this property
Link to this property
SAMLGroupRule object {saml } Matches a SAML group. Requires a SAML identity provider.
saml: object {attribute\_name, attribute\_value, identity\_provider\_id } attribute\_name: string The name of the SAML attribute. Link to this property attribute\_value: string The SAML attribute value to look for. Link to this property identity\_provider\_id: string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
AccessOIDCClaimRule object {oidc } Matches an OIDC claim. Requires an OIDC identity provider.
oidc: object {claim\_name, claim\_value, identity\_provider\_id } claim\_name: string The name of the OIDC claim. Link to this property claim\_value: string The OIDC claim value to look for. Link to this property identity\_provider\_id: string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
ServiceTokenRule object {service\_token } Matches a specific Access Service Token
service\_token: object {token\_id } token\_id: string The ID of a Service Token. Link to this property
Link to this property
Link to this property
AccessLinkedAppTokenRule object {linked\_app\_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
linked\_app\_token: object {app\_uid } app\_uid: string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
AccessUserRiskScoreRule object {user\_risk\_score } Matches a user’s risk score.
user\_risk\_score: object {user\_risk\_score }
user\_risk\_score: array of "low"or "medium"or "high"or "unscored" A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "unscored" Link to this property
Link to this property
Link to this property
Link to this property
AccessCloudflareAccountMemberRule object {cloudflare\_account\_member } Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
cloudflare\_account\_member: object {account\_id } account\_id: optional string Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property
include: optional array of AccessRule Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. One of the following:
GroupRule object {group } Matches an Access group.
group: object {id } id: string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
AnyValidServiceTokenRule object {any\_valid\_service\_token } Matches any valid Access Service Token any\_valid\_service\_token: object {} An empty object which matches on all service tokens. Link to this property
Link to this property
AccessAuthContextRule object {auth\_context } Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: object {id, ac\_id, identity\_provider\_id } id: string The ID of an Authentication context. Link to this property ac\_id: string The ACID of an Authentication context. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
AuthenticationMethodRule object {auth\_method } Enforce different MFA options
auth\_method: object {auth\_method } auth\_method: string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
AzureGroupRule object {azureAD } Matches an Azure group. Requires an Azure identity provider.
azureAD: object {id, identity\_provider\_id } id: string The ID of an Azure group. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
CertificateRule object {certificate } Matches any valid client certificate. certificate: object {} Link to this property
Link to this property
AccessCommonNameRule object {common\_name } Matches a specific common name.
common\_name: object {common\_name } common\_name: string The common name to match. Link to this property
Link to this property
Link to this property
CountryRule object {geo } Matches a specific country
geo: object {country\_code } country\_code: string The country code that should be matched. Link to this property
Link to this property
Link to this property
AccessDevicePostureRule object {device\_posture } Enforces a device posture rule has run successfully
device\_posture: object {integration\_uid, account\_id } integration\_uid: string The ID of a device posture integration. Link to this property account\_id: optional string The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
DomainRule object {email\_domain } Match an entire email domain.
email\_domain: object {domain } domain: string The email domain to match. Link to this property
Link to this property
Link to this property
EmailListRule object {email\_list } Matches an email address from a list.
email\_list: object {id } id: string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
EmailRule object {email } Matches a specific email.
email: object {email } email: string The email of the user. formatemail Link to this property
Link to this property
Link to this property
EveryoneRule object {everyone } Matches everyone. everyone: object {} An empty object which matches on all users. Link to this property
Link to this property
ExternalEvaluationRule object {external\_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: object {evaluate\_url, keys\_url } evaluate\_url: string The API endpoint containing your business logic. Link to this property keys\_url: string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
GitHubOrganizationRule object {"github-organization" } Matches a Github organization. Requires a Github identity provider.
"github-organization": object {identity\_provider\_id, name, team } identity\_provider\_id: string The ID of your Github identity provider. Link to this property name: string The name of the organization. Link to this property team: optional string The name of the team Link to this property
Link to this property
Link to this property
GSuiteGroupRule object {gsuite } Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: object {email, identity\_provider\_id } email: string The email of the Google Workspace group. Link to this property identity\_provider\_id: string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
AccessLoginMethodRule object {login\_method } Matches a specific identity provider id.
login\_method: object {id } id: string The ID of an identity provider. Link to this property
Link to this property
Link to this property
IPListRule object {ip\_list } Matches an IP address from a list.
ip\_list: object {id } id: string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
IPRule object {ip } Matches an IP address block.
ip: object {ip } ip: string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
OktaGroupRule object {okta } Matches an Okta group. Requires an Okta identity provider.
okta: object {identity\_provider\_id, name } identity\_provider\_id: string The ID of your Okta identity provider. Link to this property name: string The name of the Okta group. Link to this property
Link to this property
Link to this property
SAMLGroupRule object {saml } Matches a SAML group. Requires a SAML identity provider.
saml: object {attribute\_name, attribute\_value, identity\_provider\_id } attribute\_name: string The name of the SAML attribute. Link to this property attribute\_value: string The SAML attribute value to look for. Link to this property identity\_provider\_id: string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
AccessOIDCClaimRule object {oidc } Matches an OIDC claim. Requires an OIDC identity provider.
oidc: object {claim\_name, claim\_value, identity\_provider\_id } claim\_name: string The name of the OIDC claim. Link to this property claim\_value: string The OIDC claim value to look for. Link to this property identity\_provider\_id: string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
ServiceTokenRule object {service\_token } Matches a specific Access Service Token
service\_token: object {token\_id } token\_id: string The ID of a Service Token. Link to this property
Link to this property
Link to this property
AccessLinkedAppTokenRule object {linked\_app\_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
linked\_app\_token: object {app\_uid } app\_uid: string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
AccessUserRiskScoreRule object {user\_risk\_score } Matches a user’s risk score.
user\_risk\_score: object {user\_risk\_score }
user\_risk\_score: array of "low"or "medium"or "high"or "unscored" A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "unscored" Link to this property
Link to this property
Link to this property
Link to this property
AccessCloudflareAccountMemberRule object {cloudflare\_account\_member } Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
cloudflare\_account\_member: object {account\_id } account\_id: optional string Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property isolation\_required: optional boolean Require this application to be served in an isolated browser for users matching this policy. ‘Client Web Isolation’ must be on for the account in order to use this feature. Link to this property
mfa\_config: optional object {allowed\_authenticators, mfa\_disabled, session\_duration } Configures multi-factor authentication (MFA) settings.
allowed\_authenticators: optional array of "totp"or "biometrics"or "security\_key" Lists the MFA methods that users can authenticate with. One of the following: "totp" Link to this property "biometrics" Link to this property "security\_key" Link to this property
Link to this property mfa\_disabled: optional boolean Indicates whether to disable MFA for this resource. This option is available at the application and policy level. Link to this property session\_duration: optional string Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property name: optional string The name of the Access policy. Link to this property purpose\_justification\_prompt: optional string A custom message that will appear on the purpose justification screen. Link to this property purpose\_justification\_required: optional boolean Require users to enter a justification when they log in to the application. Link to this property
require: optional array of AccessRule Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules. One of the following:
GroupRule object {group } Matches an Access group.
group: object {id } id: string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
AnyValidServiceTokenRule object {any\_valid\_service\_token } Matches any valid Access Service Token any\_valid\_service\_token: object {} An empty object which matches on all service tokens. Link to this property
Link to this property
AccessAuthContextRule object {auth\_context } Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: object {id, ac\_id, identity\_provider\_id } id: string The ID of an Authentication context. Link to this property ac\_id: string The ACID of an Authentication context. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
AuthenticationMethodRule object {auth\_method } Enforce different MFA options
auth\_method: object {auth\_method } auth\_method: string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
AzureGroupRule object {azureAD } Matches an Azure group. Requires an Azure identity provider.
azureAD: object {id, identity\_provider\_id } id: string The ID of an Azure group. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
CertificateRule object {certificate } Matches any valid client certificate. certificate: object {} Link to this property
Link to this property
AccessCommonNameRule object {common\_name } Matches a specific common name.
common\_name: object {common\_name } common\_name: string The common name to match. Link to this property
Link to this property
Link to this property
CountryRule object {geo } Matches a specific country
geo: object {country\_code } country\_code: string The country code that should be matched. Link to this property
Link to this property
Link to this property
AccessDevicePostureRule object {device\_posture } Enforces a device posture rule has run successfully
device\_posture: object {integration\_uid, account\_id } integration\_uid: string The ID of a device posture integration. Link to this property account\_id: optional string The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
DomainRule object {email\_domain } Match an entire email domain.
email\_domain: object {domain } domain: string The email domain to match. Link to this property
Link to this property
Link to this property
EmailListRule object {email\_list } Matches an email address from a list.
email\_list: object {id } id: string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
EmailRule object {email } Matches a specific email.
email: object {email } email: string The email of the user. formatemail Link to this property
Link to this property
Link to this property
EveryoneRule object {everyone } Matches everyone. everyone: object {} An empty object which matches on all users. Link to this property
Link to this property
ExternalEvaluationRule object {external\_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: object {evaluate\_url, keys\_url } evaluate\_url: string The API endpoint containing your business logic. Link to this property keys\_url: string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
GitHubOrganizationRule object {"github-organization" } Matches a Github organization. Requires a Github identity provider.
"github-organization": object {identity\_provider\_id, name, team } identity\_provider\_id: string The ID of your Github identity provider. Link to this property name: string The name of the organization. Link to this property team: optional string The name of the team Link to this property
Link to this property
Link to this property
GSuiteGroupRule object {gsuite } Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: object {email, identity\_provider\_id } email: string The email of the Google Workspace group. Link to this property identity\_provider\_id: string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
AccessLoginMethodRule object {login\_method } Matches a specific identity provider id.
login\_method: object {id } id: string The ID of an identity provider. Link to this property
Link to this property
Link to this property
IPListRule object {ip\_list } Matches an IP address from a list.
ip\_list: object {id } id: string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
IPRule object {ip } Matches an IP address block.
ip: object {ip } ip: string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
OktaGroupRule object {okta } Matches an Okta group. Requires an Okta identity provider.
okta: object {identity\_provider\_id, name } identity\_provider\_id: string The ID of your Okta identity provider. Link to this property name: string The name of the Okta group. Link to this property
Link to this property
Link to this property
SAMLGroupRule object {saml } Matches a SAML group. Requires a SAML identity provider.
saml: object {attribute\_name, attribute\_value, identity\_provider\_id } attribute\_name: string The name of the SAML attribute. Link to this property attribute\_value: string The SAML attribute value to look for. Link to this property identity\_provider\_id: string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
AccessOIDCClaimRule object {oidc } Matches an OIDC claim. Requires an OIDC identity provider.
oidc: object {claim\_name, claim\_value, identity\_provider\_id } claim\_name: string The name of the OIDC claim. Link to this property claim\_value: string The OIDC claim value to look for. Link to this property identity\_provider\_id: string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
ServiceTokenRule object {service\_token } Matches a specific Access Service Token
service\_token: object {token\_id } token\_id: string The ID of a Service Token. Link to this property
Link to this property
Link to this property
AccessLinkedAppTokenRule object {linked\_app\_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
linked\_app\_token: object {app\_uid } app\_uid: string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
AccessUserRiskScoreRule object {user\_risk\_score } Matches a user’s risk score.
user\_risk\_score: object {user\_risk\_score }
user\_risk\_score: array of "low"or "medium"or "high"or "unscored" A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "unscored" Link to this property
Link to this property
Link to this property
Link to this property
AccessCloudflareAccountMemberRule object {cloudflare\_account\_member } Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
cloudflare\_account\_member: object {account\_id } account\_id: optional string Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property session\_duration: optional string The amount of time that tokens issued for the application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property updated\_at: optional string formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application_policy%20%3E%20(schema)>)
ApplicationType = "self\_hosted"or "end\_user"or "saas"or 12 more The application type. One of the following: "self\_hosted" Link to this property "end\_user" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property "infrastructure" Link to this property "rdp" Link to this property "mcp" Link to this property "mcp\_portal" Link to this property "proxy\_endpoint" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application_type%20%3E%20(schema)>)
CORSHeaders object {allow\_all\_headers, allow\_all\_methods, allow\_all\_origins, 5 more } allow\_all\_headers: optional boolean Allows all HTTP request headers. Link to this property allow\_all\_methods: optional boolean Allows all HTTP request methods. Link to this property allow\_all\_origins: optional boolean Allows all origins. Link to this property allow\_credentials: optional boolean When set to true, includes credentials (cookies, authorization headers, or TLS client certificates) with requests. Link to this property allowed\_headers: optional array of AllowedHeaders Allowed HTTP request headers. Link to this property
allowed\_methods: optional array of AllowedMethods Allowed HTTP request methods. One of the following: "GET" Link to this property "POST" Link to this property "HEAD" Link to this property "PUT" Link to this property "DELETE" Link to this property "CONNECT" Link to this property "OPTIONS" Link to this property "TRACE" Link to this property "PATCH" Link to this property
Link to this property allowed\_origins: optional array of AllowedOrigins Allowed origins. Link to this property max\_age: optional number The maximum number of seconds the results of a preflight request can be cached. maximum86400 minimum-1 Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20cors_headers%20%3E%20(schema)>)
Decision = "allow"or "deny"or "non\_identity"or "bypass" The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. One of the following: "allow" Link to this property "deny" Link to this property "non\_identity" Link to this property "bypass" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20decision%20%3E%20(schema)>)
OIDCSaaSApp object {access\_token\_lifetime, allow\_pkce\_without\_client\_secret, app\_launcher\_url, 11 more } access\_token\_lifetime: optional string The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h. Link to this property allow\_pkce\_without\_client\_secret: optional boolean If client secret should be required on the token endpoint when authorization\_code\_with\_pkce grant is used. Link to this property app\_launcher\_url: optional string The URL where this applications tile redirects users Link to this property
auth\_type: optional "saml"or "oidc" Identifier of the authentication protocol used for the saas app. Required for OIDC. One of the following: "saml" Link to this property "oidc" Link to this property
Link to this property client\_id: optional string The application client id Link to this property client\_secret: optional string The application client secret, only returned on POST request. Link to this property
custom\_claims: optional array of object {name, required, scope, source } name: optional string The name of the claim. Link to this property required: optional boolean If the claim is required when building an OIDC token. Link to this property
scope: optional "groups"or "profile"or "email"or "openid" The scope of the claim. One of the following: "groups" Link to this property "profile" Link to this property "email" Link to this property "openid" Link to this property
Link to this property
source: optional object {name, name\_by\_idp } name: optional string The name of the IdP claim. Link to this property name\_by\_idp: optional map\[string] A mapping from IdP ID to claim name. Link to this property
Link to this property
Link to this property
grant\_types: optional array of "authorization\_code"or "authorization\_code\_with\_pkce"or "refresh\_tokens"or 2 more The OIDC flows supported by this application One of the following: "authorization\_code" Link to this property "authorization\_code\_with\_pkce" Link to this property "refresh\_tokens" Link to this property "hybrid" Link to this property "implicit" Link to this property
Link to this property group\_filter\_regex: optional string A regex to filter Cloudflare groups returned in ID token and userinfo endpoint Link to this property
hybrid\_and\_implicit\_options: optional object {return\_access\_token\_from\_authorization\_endpoint, return\_id\_token\_from\_authorization\_endpoint } return\_access\_token\_from\_authorization\_endpoint: optional boolean If an Access Token should be returned from the OIDC Authorization endpoint Link to this property return\_id\_token\_from\_authorization\_endpoint: optional boolean If an ID Token should be returned from the OIDC Authorization endpoint Link to this property
Link to this property public\_key: optional string The Access public certificate that will be used to verify your identity. Link to this property redirect\_uris: optional array of string The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens Link to this property
refresh\_token\_options: optional object {lifetime } lifetime: optional string How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m. Link to this property
Link to this property
scopes: optional array of "openid"or "groups"or "email"or "profile" Define the user information shared with access, “offline\_access” scope will be automatically enabled if refresh tokens are enabled One of the following: "openid" Link to this property "groups" Link to this property "email" Link to this property "profile" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20oidc_saas_app%20%3E%20(schema)>)
SaaSAppNameIDFormat = "id"or "email" The format of the name identifier sent to the SaaS application. One of the following: "id" Link to this property "email" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20saas_app_name_id_format%20%3E%20(schema)>)
SAMLSaaSApp object {auth\_type, consumer\_service\_url, custom\_attributes, 8 more }
auth\_type: optional "saml"or "oidc" Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml” One of the following: "saml" Link to this property "oidc" Link to this property
Link to this property consumer\_service\_url: optional string The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion. Link to this property
custom\_attributes: optional array of object {friendly\_name, name, name\_format, 2 more } friendly\_name: optional string The SAML FriendlyName of the attribute. Link to this property name: optional string The name of the attribute. Link to this property
name\_format: optional "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"or "urn:oasis:names:tc:SAML:2.0:attrname-format:basic"or "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" A globally unique name for an identity or service provider. One of the following: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" Link to this property "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Link to this property "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Link to this property
Link to this property required: optional boolean If the attribute is required when building a SAML assertion. Link to this property
source: optional object {name, name\_by\_idp } name: optional string The name of the IdP attribute. Link to this property
name\_by\_idp: optional array of object {idp\_id, source\_name } A mapping from IdP ID to attribute name. idp\_id: optional string The UID of the IdP. Link to this property source\_name: optional string The name of the IdP provided attribute. Link to this property
Link to this property
Link to this property
Link to this property default\_relay\_state: optional string The URL that the user will be redirected to after a successful login for IDP initiated logins. Link to this property idp\_entity\_id: optional string The unique identifier for your SaaS application. Link to this property name\_id\_format: optional SaaSAppNameIDFormat The format of the name identifier sent to the SaaS application. Link to this property name\_id\_transform\_jsonata: optional string A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting. Link to this property public\_key: optional string The Access public certificate that will be used to verify your identity. Link to this property saml\_attribute\_transform\_jsonata: optional string A \[JSONata] (https://jsonata.org/) expression that transforms an application’s user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml\_attributes or oidc\_fields of the identity provider used to authenticate. The output of this expression must be a JSON object. Link to this property sp\_entity\_id: optional string A globally unique name for an identity or service provider. Link to this property sso\_endpoint: optional string The endpoint where your SaaS application will send login requests. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20saml_saas_app%20%3E%20(schema)>)
SCIMConfigAuthenticationHTTPBasic object {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_http_basic%20%3E%20(schema)>)
SCIMConfigAuthenticationOAuthBearerToken object {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_oauth_bearer_token%20%3E%20(schema)>)
SCIMConfigAuthenticationOauth2 object {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes: optional array of string The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_oauth2%20%3E%20(schema)>)
SCIMConfigMapping object {schema, enabled, filter, 3 more } Transformations and filters applied to resources before they are provisioned in the remote SCIM service. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled: optional boolean Whether or not this mapping is enabled. Link to this property filter: optional string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations: optional object {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create: optional boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete: optional boolean Whether or not this mapping applies to DELETE operations. Link to this property update: optional boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness: optional "strict"or "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata: optional string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_mapping%20%3E%20(schema)>) SelfHostedDomains = string A domain that Access will secure. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20self_hosted_domains%20%3E%20(schema)>)
ApplicationListResponse = object {oauth\_configuration, type, user\_populations, 7 more } or object {domain, type, id, 31 more } or object {id, allowed\_idps, app\_launcher\_visible, 10 more } or 11 more One of the following:
EndUserApplication object {oauth\_configuration, type, user\_populations, 7 more }
oauth\_configuration: object {dynamic\_client\_registration, enabled, grant } **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support RFC 8707 (Resource Indicators for OAuth 2.0). This feature is currently in beta.
dynamic\_client\_registration: optional object {allow\_any\_on\_localhost, allow\_any\_on\_loopback, allowed\_uris, enabled } Settings for OAuth dynamic client registration. allow\_any\_on\_localhost: optional boolean Allows any client with redirect URIs on localhost. Link to this property allow\_any\_on\_loopback: optional boolean Allows any client with redirect URIs on 127.0.0.1. Link to this property allowed\_uris: optional array of string The URIs that are allowed as redirect URIs for dynamically registered clients. HTTP and HTTPS paths may end in /* to match all sub-paths. Custom-scheme URIs must be explicitly configured and match exactly. Link to this property enabled: optional boolean Whether dynamic client registration is enabled. Link to this property
Link to this property enabled: optional true Managed OAuth is required for end user applications and cannot be disabled. Link to this property
grant: optional object {access\_token\_lifetime, session\_duration } Settings for OAuth grant behavior. access\_token\_lifetime: optional string The lifetime of the access token. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h. Link to this property session\_duration: optional string The duration of the OAuth session. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h. Link to this property
Link to this property
Link to this property
type: "self\_hosted"or "end\_user"or "saas"or 12 more The application type. One of the following: "self\_hosted" Link to this property "end\_user" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property "infrastructure" Link to this property "rdp" Link to this property "mcp" Link to this property "mcp\_portal" Link to this property "proxy\_endpoint" Link to this property
Link to this property user\_populations: array of string The single user population associated with this application. Link to this property id: optional string UUID. maxLength36 Link to this property allowed\_idps: optional array of AllowedIdPs The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property aud: optional string Audience tag. maxLength64 Link to this property
destinations: optional array of object {uri, overrides, type } or object {type, worker\_id, overrides } or object {type, worker\_id, overrides } or 2 more Public hostname and Workers destinations secured by Access. One of the following:
AccessEndUserPublicDestination object {uri, overrides, type } uri: string The public hostname and optional path to secure. Link to this property
overrides: optional array of object {behavior, path\_pattern } Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property type: optional "public" Link to this property
Link to this property
AccessEndUserWorkerDestination object {type, worker\_id, overrides } type: "worker" Link to this property worker\_id: string The ID of the Cloudflare Worker to secure. Link to this property
overrides: optional array of object {behavior, path\_pattern } Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
AccessEndUserPreviewWorkerDestination object {type, worker\_id, overrides } type: "preview\_worker" Link to this property worker\_id: string The ID of the Cloudflare Worker whose previews to secure. Link to this property
overrides: optional array of object {behavior, path\_pattern } Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
AccessEndUserAllWorkersDestination object {type, overrides } type: "all\_workers" Link to this property
overrides: optional array of object {behavior, path\_pattern } Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
AccessEndUserAllPreviewWorkersDestination object {type, overrides } type: "all\_preview\_workers" Link to this property
overrides: optional array of object {behavior, path\_pattern } Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
Link to this property domain: optional string The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher. Link to this property name: optional string The name of the application. Link to this property Deprecatedself\_hosted\_domains: optional array of SelfHostedDomains List of public domains that Access will secure. This field is deprecated in favor of destinations and will be supported until **November 21, 2025.** If destinations are provided, then self_hosted_domains will be ignored. Link to this property
Link to this property
SelfHostedApplication object {domain, type, id, 31 more } domain: string The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher. Link to this property type: ApplicationType The application type. Link to this property id: optional string UUID. maxLength36 Link to this property allow\_authenticate\_via\_warp: optional boolean When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication. Link to this property allow\_iframe: optional boolean Enables loading application content in an iFrame. Link to this property allowed\_idps: optional array of AllowedIdPs The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible: optional boolean Displays the application in the App Launcher. Link to this property aud: optional string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity: optional boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property cors\_headers: optional CORSHeaders { allow\_all\_headers, allow\_all\_methods, allow\_all\_origins, 5 more } Link to this property custom\_deny\_message: optional string The custom error message shown to a user when they are denied access to the application. Link to this property custom\_deny\_url: optional string The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules. Link to this property custom\_non\_identity\_deny\_url: optional string The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules. Link to this property custom\_pages: optional array of string The custom pages that will be displayed when applicable for this application Link to this property
destinations: optional array of object {overrides, type, uri } or object {cidr, hostname, l4\_protocol, 3 more } or object {mcp\_server\_id, type } or 4 more List of destinations secured by Access. This supersedes self_hosted_domains to allow for more flexibility in defining different types of domains. If destinations are provided, then self_hosted_domains will be ignored. One of the following:
PublicDestination object {overrides, type, uri } A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard ’\*’ can be used in the definition.
overrides: optional array of object {behavior, path\_pattern } Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property type: optional "public" Link to this property uri: optional string The URI of the destination. Public destinations’ URIs can include a domain and path with wildcards. Link to this property
Link to this property
PrivateDestination object {cidr, hostname, l4\_protocol, 3 more } cidr: optional string The CIDR range of the destination. Single IPs will be computed as /32. Link to this property hostname: optional string The hostname of the destination. Matches a valid SNI served by an HTTPS origin. Link to this property
l4\_protocol: optional "tcp"or "udp" The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match. One of the following: "tcp" Link to this property "udp" Link to this property
Link to this property port\_range: optional string The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match. Link to this property type: optional "private" Link to this property vnet\_id: optional string The VNET ID to match the destination. When omitted, all VNETs will match. Link to this property
Link to this property
ViaMcpServerPortalDestination object {mcp\_server\_id, type } A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal. mcp\_server\_id: optional string The MCP server id configured in ai-controls. Link to this property type: optional "via\_mcp\_server\_portal" Link to this property
Link to this property
WorkerDestination object {type, worker\_id, overrides } A specific Cloudflare Worker that Access will secure. All requests routed to the specified Worker, including its preview deployments, will be protected. The preview_worker and public destination types takes precedence, so you can create separate applications to override the policies for the Worker’s previews or specific paths. type: "worker" Link to this property worker\_id: string The ID of the Cloudflare Worker to protect with Access. Link to this property
overrides: optional array of object {behavior, path\_pattern } Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
PreviewWorkerDestination object {type, worker\_id, overrides } A specific Cloudflare Worker whose preview deployments Access will secure. Only requests routed to the preview deployments of the specified Worker will be protected. The public destination type takes precedence, so you can create separate applications to override the policies for specific paths. type: "preview\_worker" Link to this property worker\_id: string The ID of the Cloudflare Worker whose preview deployments to protect with Access. Link to this property
overrides: optional array of object {behavior, path\_pattern } Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
AllWorkersDestination object {type, overrides } Protects all Cloudflare Workers on the account with Access, including their preview deployments. At most one destination of this type can exist per account. The worker, preview_worker, all_preview_workers, and public destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths. type: "all\_workers" Link to this property
overrides: optional array of object {behavior, path\_pattern } Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
AllPreviewWorkersDestination object {type, overrides } Protects the preview deployments of all Cloudflare Workers on the account with Access. At most one destination of this type can exist per account. The worker, preview_worker, and public destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths. type: "all\_preview\_workers" Link to this property
overrides: optional array of object {behavior, path\_pattern } Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
Link to this property eager\_redirect\_cookie\_setting: optional boolean Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property enable\_binding\_cookie: optional boolean Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property http\_only\_cookie\_attribute: optional boolean Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property logo\_url: optional string The image URL for the logo shown in the App Launcher dashboard. Link to this property
mfa\_config: optional object {allowed\_authenticators, mfa\_disabled, session\_duration } Configures multi-factor authentication (MFA) settings.
allowed\_authenticators: optional array of "totp"or "biometrics"or "security\_key" Lists the MFA methods that users can authenticate with. One of the following: "totp" Link to this property "biometrics" Link to this property "security\_key" Link to this property
Link to this property mfa\_disabled: optional boolean Indicates whether to disable MFA for this resource. This option is available at the application and policy level. Link to this property session\_duration: optional string Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property name: optional string The name of the application. Link to this property
oauth\_configuration: optional object {dynamic\_client\_registration, enabled, grant } **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support RFC 8707 (Resource Indicators for OAuth 2.0). This feature is currently in beta.
dynamic\_client\_registration: optional object {allow\_any\_on\_localhost, allow\_any\_on\_loopback, allowed\_uris, enabled } Settings for OAuth dynamic client registration. allow\_any\_on\_localhost: optional boolean Allows any client with redirect URIs on localhost. Link to this property allow\_any\_on\_loopback: optional boolean Allows any client with redirect URIs on 127.0.0.1. Link to this property allowed\_uris: optional array of string The URIs that are allowed as redirect URIs for dynamically registered clients. HTTP and HTTPS paths may end in /* to match all sub-paths. Custom-scheme URIs must be explicitly configured and match exactly. Link to this property enabled: optional boolean Whether dynamic client registration is enabled. Link to this property
Link to this property enabled: optional boolean Whether the OAuth configuration is enabled for this application. When set to false, Access will not handle OAuth for this application. Defaults to true if omitted. Link to this property
grant: optional object {access\_token\_lifetime, session\_duration } Settings for OAuth grant behavior. access\_token\_lifetime: optional string The lifetime of the access token. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h. Link to this property session\_duration: optional string The duration of the OAuth session. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h. Link to this property
Link to this property
Link to this property options\_preflight\_bypass: optional boolean Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property path\_cookie\_attribute: optional boolean Enables cookie paths to scope an application’s JWT to the application path. If disabled, the JWT will scope to the hostname by default Link to this property
policies: optional array of object {id, account\_id, approval\_groups, 15 more } id: optional string The UUID of the policy maxLength36 Link to this property account\_id: optional string Identifier. maxLength32 Link to this property
approval\_groups: optional array of ApprovalGroup { approvals\_needed, email\_addresses, email\_list\_uuid } Administrators who can approve a temporary authentication request. approvals\_needed: number The number of approvals needed to obtain access. minimum0 Link to this property email\_addresses: optional array of string A list of emails that can approve the access request. Link to this property email\_list\_uuid: optional string The UUID of an re-usable email list. Link to this property
Link to this property approval\_required: optional boolean Requires the user to request access from an administrator at the start of each session. Link to this property
connection\_rules: optional object {rdp } The rules that define how users may connect to targets secured by your application.
rdp: optional object {allowed\_clipboard\_local\_to\_remote\_formats, allowed\_clipboard\_remote\_to\_local\_formats } The RDP-specific rules that define clipboard behavior for RDP connections.
allowed\_clipboard\_local\_to\_remote\_formats: optional array of "text"or "file" Clipboard formats allowed when copying from local machine to remote RDP session. One of the following: "text" Link to this property "file" Link to this property
Link to this property
allowed\_clipboard\_remote\_to\_local\_formats: optional array of "text"or "file" Clipboard formats allowed when copying from remote RDP session to local machine. One of the following: "text" Link to this property "file" Link to this property
Link to this property
Link to this property
Link to this property created\_at: optional string formatdate-time Link to this property decision: optional Decision The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Link to this property
exclude: optional array of AccessRule Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules. One of the following:
GroupRule object {group } Matches an Access group.
group: object {id } id: string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
AnyValidServiceTokenRule object {any\_valid\_service\_token } Matches any valid Access Service Token any\_valid\_service\_token: object {} An empty object which matches on all service tokens. Link to this property
Link to this property
AccessAuthContextRule object {auth\_context } Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: object {id, ac\_id, identity\_provider\_id } id: string The ID of an Authentication context. Link to this property ac\_id: string The ACID of an Authentication context. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
AuthenticationMethodRule object {auth\_method } Enforce different MFA options
auth\_method: object {auth\_method } auth\_method: string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
AzureGroupRule object {azureAD } Matches an Azure group. Requires an Azure identity provider.
azureAD: object {id, identity\_provider\_id } id: string The ID of an Azure group. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
CertificateRule object {certificate } Matches any valid client certificate. certificate: object {} Link to this property
Link to this property
AccessCommonNameRule object {common\_name } Matches a specific common name.
common\_name: object {common\_name } common\_name: string The common name to match. Link to this property
Link to this property
Link to this property
CountryRule object {geo } Matches a specific country
geo: object {country\_code } country\_code: string The country code that should be matched. Link to this property
Link to this property
Link to this property
AccessDevicePostureRule object {device\_posture } Enforces a device posture rule has run successfully
device\_posture: object {integration\_uid, account\_id } integration\_uid: string The ID of a device posture integration. Link to this property account\_id: optional string The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
DomainRule object {email\_domain } Match an entire email domain.
email\_domain: object {domain } domain: string The email domain to match. Link to this property
Link to this property
Link to this property
EmailListRule object {email\_list } Matches an email address from a list.
email\_list: object {id } id: string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
EmailRule object {email } Matches a specific email.
email: object {email } email: string The email of the user. formatemail Link to this property
Link to this property
Link to this property
EveryoneRule object {everyone } Matches everyone. everyone: object {} An empty object which matches on all users. Link to this property
Link to this property
ExternalEvaluationRule object {external\_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: object {evaluate\_url, keys\_url } evaluate\_url: string The API endpoint containing your business logic. Link to this property keys\_url: string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
GitHubOrganizationRule object {"github-organization" } Matches a Github organization. Requires a Github identity provider.
"github-organization": object {identity\_provider\_id, name, team } identity\_provider\_id: string The ID of your Github identity provider. Link to this property name: string The name of the organization. Link to this property team: optional string The name of the team Link to this property
Link to this property
Link to this property
GSuiteGroupRule object {gsuite } Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: object {email, identity\_provider\_id } email: string The email of the Google Workspace group. Link to this property identity\_provider\_id: string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
AccessLoginMethodRule object {login\_method } Matches a specific identity provider id.
login\_method: object {id } id: string The ID of an identity provider. Link to this property
Link to this property
Link to this property
IPListRule object {ip\_list } Matches an IP address from a list.
ip\_list: object {id } id: string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
IPRule object {ip } Matches an IP address block.
ip: object {ip } ip: string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
OktaGroupRule object {okta } Matches an Okta group. Requires an Okta identity provider.
okta: object {identity\_provider\_id, name } identity\_provider\_id: string The ID of your Okta identity provider. Link to this property name: string The name of the Okta group. Link to this property
Link to this property
Link to this property
SAMLGroupRule object {saml } Matches a SAML group. Requires a SAML identity provider.
saml: object {attribute\_name, attribute\_value, identity\_provider\_id } attribute\_name: string The name of the SAML attribute. Link to this property attribute\_value: string The SAML attribute value to look for. Link to this property identity\_provider\_id: string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
AccessOIDCClaimRule object {oidc } Matches an OIDC claim. Requires an OIDC identity provider.
oidc: object {claim\_name, claim\_value, identity\_provider\_id } claim\_name: string The name of the OIDC claim. Link to this property claim\_value: string The OIDC claim value to look for. Link to this property identity\_provider\_id: string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
ServiceTokenRule object {service\_token } Matches a specific Access Service Token
service\_token: object {token\_id } token\_id: string The ID of a Service Token. Link to this property
Link to this property
Link to this property
AccessLinkedAppTokenRule object {linked\_app\_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
linked\_app\_token: object {app\_uid } app\_uid: string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
AccessUserRiskScoreRule object {user\_risk\_score } Matches a user’s risk score.
user\_risk\_score: object {user\_risk\_score }
user\_risk\_score: array of "low"or "medium"or "high"or "unscored" A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "unscored" Link to this property
Link to this property
Link to this property
Link to this property
AccessCloudflareAccountMemberRule object {cloudflare\_account\_member } Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
cloudflare\_account\_member: object {account\_id } account\_id: optional string Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property
include: optional array of AccessRule Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. One of the following:
GroupRule object {group } Matches an Access group.
group: object {id } id: string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
AnyValidServiceTokenRule object {any\_valid\_service\_token } Matches any valid Access Service Token any\_valid\_service\_token: object {} An empty object which matches on all service tokens. Link to this property
Link to this property
AccessAuthContextRule object {auth\_context } Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: object {id, ac\_id, identity\_provider\_id } id: string The ID of an Authentication context. Link to this property ac\_id: string The ACID of an Authentication context. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
AuthenticationMethodRule object {auth\_method } Enforce different MFA options
auth\_method: object {auth\_method } auth\_method: string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
AzureGroupRule object {azureAD } Matches an Azure group. Requires an Azure identity provider.
azureAD: object {id, identity\_provider\_id } id: string The ID of an Azure group. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
CertificateRule object {certificate } Matches any valid client certificate. certificate: object {} Link to this property
Link to this property
AccessCommonNameRule object {common\_name } Matches a specific common name.
common\_name: object {common\_name } common\_name: string The common name to match. Link to this property
Link to this property
Link to this property
CountryRule object {geo } Matches a specific country
geo: object {country\_code } country\_code: string The country code that should be matched. Link to this property
Link to this property
Link to this property
AccessDevicePostureRule object {device\_posture } Enforces a device posture rule has run successfully
device\_posture: object {integration\_uid, account\_id } integration\_uid: string The ID of a device posture integration. Link to this property account\_id: optional string The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
DomainRule object {email\_domain } Match an entire email domain.
email\_domain: object {domain } domain: string The email domain to match. Link to this property
Link to this property
Link to this property
EmailListRule object {email\_list } Matches an email address from a list.
email\_list: object {id } id: string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
EmailRule object {email } Matches a specific email.
email: object {email } email: string The email of the user. formatemail Link to this property
Link to this property
Link to this property
EveryoneRule object {everyone } Matches everyone. everyone: object {} An empty object which matches on all users. Link to this property
Link to this property
ExternalEvaluationRule object {external\_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: object {evaluate\_url, keys\_url } evaluate\_url: string The API endpoint containing your business logic. Link to this property keys\_url: string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
GitHubOrganizationRule object {"github-organization" } Matches a Github organization. Requires a Github identity provider.
"github-organization": object {identity\_provider\_id, name, team } identity\_provider\_id: string The ID of your Github identity provider. Link to this property name: string The name of the organization. Link to this property team: optional string The name of the team Link to this property
Link to this property
Link to this property
GSuiteGroupRule object {gsuite } Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: object {email, identity\_provider\_id } email: string The email of the Google Workspace group. Link to this property identity\_provider\_id: string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
AccessLoginMethodRule object {login\_method } Matches a specific identity provider id.
login\_method: object {id } id: string The ID of an identity provider. Link to this property
Link to this property
Link to this property
IPListRule object {ip\_list } Matches an IP address from a list.
ip\_list: object {id } id: string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
IPRule object {ip } Matches an IP address block.
ip: object {ip } ip: string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
OktaGroupRule object {okta } Matches an Okta group. Requires an Okta identity provider.
okta: object {identity\_provider\_id, name } identity\_provider\_id: string The ID of your Okta identity provider. Link to this property name: string The name of the Okta group. Link to this property
Link to this property
Link to this property
SAMLGroupRule object {saml } Matches a SAML group. Requires a SAML identity provider.
saml: object {attribute\_name, attribute\_value, identity\_provider\_id } attribute\_name: string The name of the SAML attribute. Link to this property attribute\_value: string The SAML attribute value to look for. Link to this property identity\_provider\_id: string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
AccessOIDCClaimRule object {oidc } Matches an OIDC claim. Requires an OIDC identity provider.
oidc: object {claim\_name, claim\_value, identity\_provider\_id } claim\_name: string The name of the OIDC claim. Link to this property claim\_value: string The OIDC claim value to look for. Link to this property identity\_provider\_id: string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
ServiceTokenRule object {service\_token } Matches a specific Access Service Token
service\_token: object {token\_id } token\_id: string The ID of a Service Token. Link to this property
Link to this property
Link to this property
AccessLinkedAppTokenRule object {linked\_app\_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
linked\_app\_token: object {app\_uid } app\_uid: string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
AccessUserRiskScoreRule object {user\_risk\_score } Matches a user’s risk score.
user\_risk\_score: object {user\_risk\_score }