--- title: Access --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/typescript) [Zero Trust](https://developers.cloudflare.com/api/typescript/resources/zero_trust) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Access #### AccessAI Controls #### AccessAI ControlsMcp #### AccessAI ControlsMcpPortals ##### [List MCP Portals](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/list) client.zeroTrust.access.aiControls.mcp.portals.list(PortalListParams {account\_id, page, per\_page, search } params, RequestOptionsoptions?): V4PagePaginationArray< [PortalListResponse]() {id, hostname, name, 9 more } > GET/accounts/{account\_id}/access/ai-controls/mcp/portals ##### [Create a new MCP Portal](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/create) client.zeroTrust.access.aiControls.mcp.portals.create(PortalCreateParams {account\_id, id, hostname, 6 more } params, RequestOptionsoptions?): [PortalCreateResponse]() {id, hostname, name, 9 more } POST/accounts/{account\_id}/access/ai-controls/mcp/portals ##### [Read details of an MCP Portal](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/read) client.zeroTrust.access.aiControls.mcp.portals.read(stringid, PortalReadParams {account\_id } params, RequestOptionsoptions?): [PortalReadResponse]() {id, hostname, name, 9 more } GET/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### [Update an MCP Portal](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/update) client.zeroTrust.access.aiControls.mcp.portals.update(stringid, PortalUpdateParams {account\_id, allow\_code\_mode, code\_mode, 5 more } params, RequestOptionsoptions?): [PortalUpdateResponse]() {id, hostname, name, 9 more } PUT/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### [Delete an MCP Portal](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/portals/methods/delete) client.zeroTrust.access.aiControls.mcp.portals.delete(stringid, PortalDeleteParams {account\_id } params, RequestOptionsoptions?): [PortalDeleteResponse]() {id, hostname, name, 8 more } DELETE/accounts/{account\_id}/access/ai-controls/mcp/portals/{id} ##### ModelsExpand Collapse
PortalListResponse {id, hostname, name, 9 more } id: string Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: string Hostname where the MCP portal is available. Link to this property name: string Display name for the MCP portal. maxLength350 Link to this property
servers: Array<Server> id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"| "bearer"| "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: Array<Record<string, unknown>> Link to this property server\_id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: Array<Record<string, unknown>> Link to this property
auth\_config\_summary?: AuthConfigSummary {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode?: "dcr"| "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version?: number Link to this property
config?: Config {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint?: string Link to this property issuer?: string Link to this property resource?: string Link to this property revocation\_endpoint?: string Link to this property token\_endpoint?: string Link to this property
Link to this property has\_client\_secret?: boolean Link to this property
registration\_info?: RegistrationInfo {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id?: string Link to this property redirect\_uris?: Array<string> Link to this property scope?: string Link to this property token\_endpoint\_auth\_method?: string Link to this property
Link to this property
Link to this property
authentication\_status?: "not\_required"| "required"| "connected"| 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at?: string formatdate-time Link to this property created\_by?: string Link to this property default\_disabled?: boolean Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description?: string| null Optional description of the MCP server. maxLength512 Link to this property error?: string Link to this property
error\_details?: ErrorDetails {cause, is\_upstream, mcp\_code, 2 more } cause?: string Underlying error message Link to this property is\_upstream?: boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code?: number MCP protocol error code Link to this property retryable?: boolean Whether the error is transient and worth retrying Link to this property status\_code?: number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled?: boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync?: string formatdate-time Link to this property last\_synced?: string formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property modified\_by?: string Link to this property on\_behalf?: boolean Link to this property secure\_web\_gateway?: boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status?: "waiting"| "ready"| "stale"| "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts?: Array<UpdatedPrompt> name: string Link to this property enabled?: boolean Link to this property portal\_alias?: string Link to this property portal\_description?: string Link to this property server\_alias?: string Link to this property server\_description?: string Link to this property
Link to this property
updated\_tools?: Array<UpdatedTool> name: string Link to this property enabled?: boolean Link to this property portal\_alias?: string Link to this property portal\_description?: string Link to this property server\_alias?: string Link to this property server\_description?: string Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode?: boolean Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode?: "off"| "opt\_in"| "default\_on"| "enforced" Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at?: string formatdate-time Link to this property created\_by?: string Link to this property description?: string Optional description of the MCP portal. maxLength512 Link to this property modified\_at?: string formatdate-time Link to this property modified\_by?: string Link to this property secure\_web\_gateway?: boolean Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_list_response%20%3E%20(schema)>)
PortalCreateResponse {id, hostname, name, 9 more } id: string Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: string Hostname where the MCP portal is available. Link to this property name: string Display name for the MCP portal. maxLength350 Link to this property
servers: Array<Server> id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"| "bearer"| "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: Array<Record<string, unknown>> Link to this property server\_id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: Array<Record<string, unknown>> Link to this property
auth\_config\_summary?: AuthConfigSummary {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode?: "dcr"| "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version?: number Link to this property
config?: Config {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint?: string Link to this property issuer?: string Link to this property resource?: string Link to this property revocation\_endpoint?: string Link to this property token\_endpoint?: string Link to this property
Link to this property has\_client\_secret?: boolean Link to this property
registration\_info?: RegistrationInfo {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id?: string Link to this property redirect\_uris?: Array<string> Link to this property scope?: string Link to this property token\_endpoint\_auth\_method?: string Link to this property
Link to this property
Link to this property
authentication\_status?: "not\_required"| "required"| "connected"| 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at?: string formatdate-time Link to this property created\_by?: string Link to this property default\_disabled?: boolean Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description?: string| null Optional description of the MCP server. maxLength512 Link to this property error?: string Link to this property
error\_details?: ErrorDetails {cause, is\_upstream, mcp\_code, 2 more } cause?: string Underlying error message Link to this property is\_upstream?: boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code?: number MCP protocol error code Link to this property retryable?: boolean Whether the error is transient and worth retrying Link to this property status\_code?: number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled?: boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync?: string formatdate-time Link to this property last\_synced?: string formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property modified\_by?: string Link to this property on\_behalf?: boolean Link to this property secure\_web\_gateway?: boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status?: "waiting"| "ready"| "stale"| "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts?: Array<UpdatedPrompt> name: string Link to this property enabled?: boolean Link to this property portal\_alias?: string Link to this property portal\_description?: string Link to this property server\_alias?: string Link to this property server\_description?: string Link to this property
Link to this property
updated\_tools?: Array<UpdatedTool> name: string Link to this property enabled?: boolean Link to this property portal\_alias?: string Link to this property portal\_description?: string Link to this property server\_alias?: string Link to this property server\_description?: string Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode?: boolean Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode?: "off"| "opt\_in"| "default\_on"| "enforced" Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at?: string formatdate-time Link to this property created\_by?: string Link to this property description?: string Optional description of the MCP portal. maxLength512 Link to this property modified\_at?: string formatdate-time Link to this property modified\_by?: string Link to this property secure\_web\_gateway?: boolean Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_create_response%20%3E%20(schema)>)
PortalReadResponse {id, hostname, name, 9 more } id: string Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: string Hostname where the MCP portal is available. Link to this property name: string Display name for the MCP portal. maxLength350 Link to this property
servers: Array<Server> id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"| "bearer"| "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: Array<Record<string, unknown>> Link to this property server\_id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: Array<Record<string, unknown>> Link to this property
auth\_config\_summary?: AuthConfigSummary {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode?: "dcr"| "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version?: number Link to this property
config?: Config {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint?: string Link to this property issuer?: string Link to this property resource?: string Link to this property revocation\_endpoint?: string Link to this property token\_endpoint?: string Link to this property
Link to this property has\_client\_secret?: boolean Link to this property
registration\_info?: RegistrationInfo {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id?: string Link to this property redirect\_uris?: Array<string> Link to this property scope?: string Link to this property token\_endpoint\_auth\_method?: string Link to this property
Link to this property
Link to this property
authentication\_status?: "not\_required"| "required"| "connected"| 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at?: string formatdate-time Link to this property created\_by?: string Link to this property default\_disabled?: boolean Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description?: string| null Optional description of the MCP server. maxLength512 Link to this property error?: string Link to this property
error\_details?: ErrorDetails {cause, is\_upstream, mcp\_code, 2 more } cause?: string Underlying error message Link to this property is\_upstream?: boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code?: number MCP protocol error code Link to this property retryable?: boolean Whether the error is transient and worth retrying Link to this property status\_code?: number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled?: boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync?: string formatdate-time Link to this property last\_synced?: string formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property modified\_by?: string Link to this property on\_behalf?: boolean Link to this property secure\_web\_gateway?: boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status?: "waiting"| "ready"| "stale"| "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts?: Array<UpdatedPrompt> name: string Link to this property enabled?: boolean Link to this property portal\_alias?: string Link to this property portal\_description?: string Link to this property server\_alias?: string Link to this property server\_description?: string Link to this property
Link to this property
updated\_tools?: Array<UpdatedTool> name: string Link to this property enabled?: boolean Link to this property portal\_alias?: string Link to this property portal\_description?: string Link to this property server\_alias?: string Link to this property server\_description?: string Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode?: boolean Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode?: "off"| "opt\_in"| "default\_on"| "enforced" Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at?: string formatdate-time Link to this property created\_by?: string Link to this property description?: string Optional description of the MCP portal. maxLength512 Link to this property modified\_at?: string formatdate-time Link to this property modified\_by?: string Link to this property secure\_web\_gateway?: boolean Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_read_response%20%3E%20(schema)>)
PortalUpdateResponse {id, hostname, name, 9 more } id: string Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: string Hostname where the MCP portal is available. Link to this property name: string Display name for the MCP portal. maxLength350 Link to this property
servers: Array<Server> id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"| "bearer"| "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: Array<Record<string, unknown>> Link to this property server\_id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property tools: Array<Record<string, unknown>> Link to this property
auth\_config\_summary?: AuthConfigSummary {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode?: "dcr"| "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version?: number Link to this property
config?: Config {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint?: string Link to this property issuer?: string Link to this property resource?: string Link to this property revocation\_endpoint?: string Link to this property token\_endpoint?: string Link to this property
Link to this property has\_client\_secret?: boolean Link to this property
registration\_info?: RegistrationInfo {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id?: string Link to this property redirect\_uris?: Array<string> Link to this property scope?: string Link to this property token\_endpoint\_auth\_method?: string Link to this property
Link to this property
Link to this property
authentication\_status?: "not\_required"| "required"| "connected"| 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at?: string formatdate-time Link to this property created\_by?: string Link to this property default\_disabled?: boolean Hide this server’s tools and prompts by default. To expose specific capabilities, set enabled: true for them in updated\_tools or updated\_prompts. Link to this property description?: string| null Optional description of the MCP server. maxLength512 Link to this property error?: string Link to this property
error\_details?: ErrorDetails {cause, is\_upstream, mcp\_code, 2 more } cause?: string Underlying error message Link to this property is\_upstream?: boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code?: number MCP protocol error code Link to this property retryable?: boolean Whether the error is transient and worth retrying Link to this property status\_code?: number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled?: boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync?: string formatdate-time Link to this property last\_synced?: string formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property modified\_by?: string Link to this property on\_behalf?: boolean Link to this property secure\_web\_gateway?: boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status?: "waiting"| "ready"| "stale"| "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts?: Array<UpdatedPrompt> name: string Link to this property enabled?: boolean Link to this property portal\_alias?: string Link to this property portal\_description?: string Link to this property server\_alias?: string Link to this property server\_description?: string Link to this property
Link to this property
updated\_tools?: Array<UpdatedTool> name: string Link to this property enabled?: boolean Link to this property portal\_alias?: string Link to this property portal\_description?: string Link to this property server\_alias?: string Link to this property server\_description?: string Link to this property
Link to this property
Link to this property Deprecatedallow\_code\_mode?: boolean Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode?: "off"| "opt\_in"| "default\_on"| "enforced" Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at?: string formatdate-time Link to this property created\_by?: string Link to this property description?: string Optional description of the MCP portal. maxLength512 Link to this property modified\_at?: string formatdate-time Link to this property modified\_by?: string Link to this property secure\_web\_gateway?: boolean Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_update_response%20%3E%20(schema)>)
PortalDeleteResponse {id, hostname, name, 8 more } id: string Unique identifier for the MCP portal. maxLength32 minLength1 Link to this property hostname: string Hostname where the MCP portal is available. Link to this property name: string Display name for the MCP portal. maxLength350 Link to this property Deprecatedallow\_code\_mode?: boolean Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400. Link to this property
code\_mode?: "off"| "opt\_in"| "default\_on"| "enforced" Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400. One of the following: "off" Link to this property "opt\_in" Link to this property "default\_on" Link to this property "enforced" Link to this property
Link to this property created\_at?: string formatdate-time Link to this property created\_by?: string Link to this property description?: string Optional description of the MCP portal. maxLength512 Link to this property modified\_at?: string formatdate-time Link to this property modified\_by?: string Link to this property secure\_web\_gateway?: boolean Route outbound MCP traffic through Zero Trust Secure Web Gateway. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.portals%20%3E%20(model)%20portal_delete_response%20%3E%20(schema)>) #### AccessAI ControlsMcpServers ##### [List MCP Servers](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/list) client.zeroTrust.access.aiControls.mcp.servers.list(ServerListParams {account\_id, page, per\_page, search } params, RequestOptionsoptions?): V4PagePaginationArray< [ServerListResponse]() {id, auth\_type, hostname, 19 more } > GET/accounts/{account\_id}/access/ai-controls/mcp/servers ##### [Create a new MCP Server](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/create) client.zeroTrust.access.aiControls.mcp.servers.create(ServerCreateParams {account\_id, id, auth\_type, 9 more } params, RequestOptionsoptions?): [ServerCreateResponse]() {id, auth\_type, hostname, 19 more } POST/accounts/{account\_id}/access/ai-controls/mcp/servers ##### [Read the details of an MCP Server](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/read) client.zeroTrust.access.aiControls.mcp.servers.read(stringid, ServerReadParams {account\_id } params, RequestOptionsoptions?): [ServerReadResponse]() {id, auth\_type, hostname, 19 more } GET/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Update an MCP Server](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/update) client.zeroTrust.access.aiControls.mcp.servers.update(stringid, ServerUpdateParams {account\_id, auth\_credentials, client\_secret, 6 more } params, RequestOptionsoptions?): [ServerUpdateResponse]() {id, auth\_type, hostname, 19 more } PUT/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Delete an MCP Server](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/delete) client.zeroTrust.access.aiControls.mcp.servers.delete(stringid, ServerDeleteParams {account\_id } params, RequestOptionsoptions?): [ServerDeleteResponse]() {id, auth\_type, hostname, 19 more } DELETE/accounts/{account\_id}/access/ai-controls/mcp/servers/{id} ##### [Sync MCP Server Capabilities](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/ai_controls/subresources/mcp/subresources/servers/methods/sync) client.zeroTrust.access.aiControls.mcp.servers.sync(stringid, ServerSyncParams {account\_id } params, RequestOptionsoptions?): [ServerSyncResponse]() {error, error\_details, status } POST/accounts/{account\_id}/access/ai-controls/mcp/servers/{id}/sync ##### ModelsExpand Collapse
ServerListResponse {id, auth\_type, hostname, 19 more } id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"| "bearer"| "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: Array<Record<string, unknown>> Link to this property tools: Array<Record<string, unknown>> Link to this property
auth\_config\_summary?: AuthConfigSummary {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode?: "dcr"| "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version?: number Link to this property
config?: Config {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint?: string Link to this property issuer?: string Link to this property resource?: string Link to this property revocation\_endpoint?: string Link to this property token\_endpoint?: string Link to this property
Link to this property has\_client\_secret?: boolean Link to this property
registration\_info?: RegistrationInfo {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id?: string Link to this property redirect\_uris?: Array<string> Link to this property scope?: string Link to this property token\_endpoint\_auth\_method?: string Link to this property
Link to this property
Link to this property
authentication\_status?: "not\_required"| "required"| "connected"| 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at?: string formatdate-time Link to this property created\_by?: string Link to this property description?: string| null Optional description of the MCP server. maxLength512 Link to this property error?: string Link to this property
error\_details?: ErrorDetails {cause, is\_upstream, mcp\_code, 2 more } cause?: string Underlying error message Link to this property is\_upstream?: boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code?: number MCP protocol error code Link to this property retryable?: boolean Whether the error is transient and worth retrying Link to this property status\_code?: number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled?: boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync?: string formatdate-time Link to this property last\_synced?: string formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property modified\_by?: string Link to this property secure\_web\_gateway?: boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status?: "waiting"| "ready"| "stale"| "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts?: Array<UpdatedPrompt> Server-wide prompt capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias?: string Custom name exposed for the capability. maxLength40 Link to this property description?: string Custom description exposed for the capability. Link to this property enabled?: boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools?: Array<UpdatedTool> Server-wide tool capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias?: string Custom name exposed for the capability. maxLength40 Link to this property description?: string Custom description exposed for the capability. Link to this property enabled?: boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_list_response%20%3E%20(schema)>)
ServerCreateResponse {id, auth\_type, hostname, 19 more } id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"| "bearer"| "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: Array<Record<string, unknown>> Link to this property tools: Array<Record<string, unknown>> Link to this property
auth\_config\_summary?: AuthConfigSummary {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode?: "dcr"| "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version?: number Link to this property
config?: Config {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint?: string Link to this property issuer?: string Link to this property resource?: string Link to this property revocation\_endpoint?: string Link to this property token\_endpoint?: string Link to this property
Link to this property has\_client\_secret?: boolean Link to this property
registration\_info?: RegistrationInfo {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id?: string Link to this property redirect\_uris?: Array<string> Link to this property scope?: string Link to this property token\_endpoint\_auth\_method?: string Link to this property
Link to this property
Link to this property
authentication\_status?: "not\_required"| "required"| "connected"| 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at?: string formatdate-time Link to this property created\_by?: string Link to this property description?: string| null Optional description of the MCP server. maxLength512 Link to this property error?: string Link to this property
error\_details?: ErrorDetails {cause, is\_upstream, mcp\_code, 2 more } cause?: string Underlying error message Link to this property is\_upstream?: boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code?: number MCP protocol error code Link to this property retryable?: boolean Whether the error is transient and worth retrying Link to this property status\_code?: number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled?: boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync?: string formatdate-time Link to this property last\_synced?: string formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property modified\_by?: string Link to this property secure\_web\_gateway?: boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status?: "waiting"| "ready"| "stale"| "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts?: Array<UpdatedPrompt> Server-wide prompt capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias?: string Custom name exposed for the capability. maxLength40 Link to this property description?: string Custom description exposed for the capability. Link to this property enabled?: boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools?: Array<UpdatedTool> Server-wide tool capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias?: string Custom name exposed for the capability. maxLength40 Link to this property description?: string Custom description exposed for the capability. Link to this property enabled?: boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_create_response%20%3E%20(schema)>)
ServerReadResponse {id, auth\_type, hostname, 19 more } id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"| "bearer"| "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: Array<Record<string, unknown>> Link to this property tools: Array<Record<string, unknown>> Link to this property
auth\_config\_summary?: AuthConfigSummary {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode?: "dcr"| "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version?: number Link to this property
config?: Config {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint?: string Link to this property issuer?: string Link to this property resource?: string Link to this property revocation\_endpoint?: string Link to this property token\_endpoint?: string Link to this property
Link to this property has\_client\_secret?: boolean Link to this property
registration\_info?: RegistrationInfo {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id?: string Link to this property redirect\_uris?: Array<string> Link to this property scope?: string Link to this property token\_endpoint\_auth\_method?: string Link to this property
Link to this property
Link to this property
authentication\_status?: "not\_required"| "required"| "connected"| 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at?: string formatdate-time Link to this property created\_by?: string Link to this property description?: string| null Optional description of the MCP server. maxLength512 Link to this property error?: string Link to this property
error\_details?: ErrorDetails {cause, is\_upstream, mcp\_code, 2 more } cause?: string Underlying error message Link to this property is\_upstream?: boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code?: number MCP protocol error code Link to this property retryable?: boolean Whether the error is transient and worth retrying Link to this property status\_code?: number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled?: boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync?: string formatdate-time Link to this property last\_synced?: string formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property modified\_by?: string Link to this property secure\_web\_gateway?: boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status?: "waiting"| "ready"| "stale"| "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts?: Array<UpdatedPrompt> Server-wide prompt capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias?: string Custom name exposed for the capability. maxLength40 Link to this property description?: string Custom description exposed for the capability. Link to this property enabled?: boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools?: Array<UpdatedTool> Server-wide tool capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias?: string Custom name exposed for the capability. maxLength40 Link to this property description?: string Custom description exposed for the capability. Link to this property enabled?: boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_read_response%20%3E%20(schema)>)
ServerUpdateResponse {id, auth\_type, hostname, 19 more } id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"| "bearer"| "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: Array<Record<string, unknown>> Link to this property tools: Array<Record<string, unknown>> Link to this property
auth\_config\_summary?: AuthConfigSummary {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode?: "dcr"| "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version?: number Link to this property
config?: Config {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint?: string Link to this property issuer?: string Link to this property resource?: string Link to this property revocation\_endpoint?: string Link to this property token\_endpoint?: string Link to this property
Link to this property has\_client\_secret?: boolean Link to this property
registration\_info?: RegistrationInfo {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id?: string Link to this property redirect\_uris?: Array<string> Link to this property scope?: string Link to this property token\_endpoint\_auth\_method?: string Link to this property
Link to this property
Link to this property
authentication\_status?: "not\_required"| "required"| "connected"| 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at?: string formatdate-time Link to this property created\_by?: string Link to this property description?: string| null Optional description of the MCP server. maxLength512 Link to this property error?: string Link to this property
error\_details?: ErrorDetails {cause, is\_upstream, mcp\_code, 2 more } cause?: string Underlying error message Link to this property is\_upstream?: boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code?: number MCP protocol error code Link to this property retryable?: boolean Whether the error is transient and worth retrying Link to this property status\_code?: number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled?: boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync?: string formatdate-time Link to this property last\_synced?: string formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property modified\_by?: string Link to this property secure\_web\_gateway?: boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status?: "waiting"| "ready"| "stale"| "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts?: Array<UpdatedPrompt> Server-wide prompt capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias?: string Custom name exposed for the capability. maxLength40 Link to this property description?: string Custom description exposed for the capability. Link to this property enabled?: boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools?: Array<UpdatedTool> Server-wide tool capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias?: string Custom name exposed for the capability. maxLength40 Link to this property description?: string Custom description exposed for the capability. Link to this property enabled?: boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_update_response%20%3E%20(schema)>)
ServerDeleteResponse {id, auth\_type, hostname, 19 more } id: string Unique identifier for the MCP server. maxLength32 minLength1 Link to this property
auth\_type: "oauth"| "bearer"| "unauthenticated" Authentication method used to connect to the upstream MCP server. One of the following: "oauth" Link to this property "bearer" Link to this property "unauthenticated" Link to this property
Link to this property hostname: string URL of the upstream MCP endpoint. formaturi Link to this property name: string Display name for the MCP server. maxLength350 Link to this property prompts: Array<Record<string, unknown>> Link to this property tools: Array<Record<string, unknown>> Link to this property
auth\_config\_summary?: AuthConfigSummary {auth\_mode, client\_secret\_version, config, 2 more } Safe subset of auth\_credentials surfaced to the dashboard. Includes auth\_mode (dcr|manual), has\_client\_secret, client\_secret\_version, and the OAuth endpoints + client\_id for manual servers. Never includes the secret value.
auth\_mode?: "dcr"| "manual" One of the following: "dcr" Link to this property "manual" Link to this property
Link to this property client\_secret\_version?: number Link to this property
config?: Config {authorization\_endpoint, issuer, resource, 2 more } authorization\_endpoint?: string Link to this property issuer?: string Link to this property resource?: string Link to this property revocation\_endpoint?: string Link to this property token\_endpoint?: string Link to this property
Link to this property has\_client\_secret?: boolean Link to this property
registration\_info?: RegistrationInfo {client\_id, redirect\_uris, scope, token\_endpoint\_auth\_method } client\_id?: string Link to this property redirect\_uris?: Array<string> Link to this property scope?: string Link to this property token\_endpoint\_auth\_method?: string Link to this property
Link to this property
Link to this property
authentication\_status?: "not\_required"| "required"| "connected"| 2 more Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. One of the following: "not\_required" Link to this property "required" Link to this property "connected" Link to this property "stale" Link to this property "manual" Link to this property
Link to this property created\_at?: string formatdate-time Link to this property created\_by?: string Link to this property description?: string| null Optional description of the MCP server. maxLength512 Link to this property error?: string Link to this property
error\_details?: ErrorDetails {cause, is\_upstream, mcp\_code, 2 more } cause?: string Underlying error message Link to this property is\_upstream?: boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code?: number MCP protocol error code Link to this property retryable?: boolean Whether the error is transient and worth retrying Link to this property status\_code?: number HTTP status code from the server Link to this property
Link to this property is\_shared\_oauth\_callback\_enabled?: boolean When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect\_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Link to this property last\_successful\_sync?: string formatdate-time Link to this property last\_synced?: string formatdate-time Link to this property modified\_at?: string formatdate-time Link to this property modified\_by?: string Link to this property secure\_web\_gateway?: boolean Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. Link to this property
status?: "waiting"| "ready"| "stale"| "error" Current sync state of the server One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
updated\_prompts?: Array<UpdatedPrompt> Server-wide prompt capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias?: string Custom name exposed for the capability. maxLength40 Link to this property description?: string Custom description exposed for the capability. Link to this property enabled?: boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
updated\_tools?: Array<UpdatedTool> Server-wide tool capability overrides. name: string Name of the tool or prompt capability to override. Link to this property alias?: string Custom name exposed for the capability. maxLength40 Link to this property description?: string Custom description exposed for the capability. Link to this property enabled?: boolean Whether the capability is available through the MCP server. Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_delete_response%20%3E%20(schema)>)
ServerSyncResponse {error, error\_details, status } error?: string Link to this property
error\_details?: ErrorDetails {cause, is\_upstream, mcp\_code, 2 more } cause?: string Underlying error message Link to this property is\_upstream?: boolean True = MCP server returned an error. False = couldn’t reach the server Link to this property mcp\_code?: number MCP protocol error code Link to this property retryable?: boolean Whether the error is transient and worth retrying Link to this property status\_code?: number HTTP status code from the server Link to this property
Link to this property
status?: "waiting"| "ready"| "stale"| "error" One of the following: "waiting" Link to this property "ready" Link to this property "stale" Link to this property "error" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.ai_controls.mcp.servers%20%3E%20(model)%20server_sync_response%20%3E%20(schema)>) #### AccessGateway CA ##### [List SSH Certificate Authorities (CA)](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/list) client.zeroTrust.access.gatewayCA.list(GatewayCAListParams {account\_id } params, RequestOptionsoptions?): SinglePage< [GatewayCAListResponse]() {id, public\_key } > GET/accounts/{account\_id}/access/gateway\_ca ##### [Add a new SSH Certificate Authority (CA)](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/create) client.zeroTrust.access.gatewayCA.create(GatewayCACreateParams {account\_id } params, RequestOptionsoptions?): [GatewayCACreateResponse]() {id, public\_key } POST/accounts/{account\_id}/access/gateway\_ca ##### [Delete an SSH Certificate Authority (CA)](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/gateway_ca/methods/delete) client.zeroTrust.access.gatewayCA.delete(stringcertificateID, GatewayCADeleteParams {account\_id } params, RequestOptionsoptions?): [GatewayCADeleteResponse]() {id } DELETE/accounts/{account\_id}/access/gateway\_ca/{certificate\_id} ##### ModelsExpand Collapse
GatewayCAListResponse {id, public\_key } id?: string The key ID of this certificate. Link to this property public\_key?: string The public key of this certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.gateway_ca%20%3E%20(model)%20gateway_ca_list_response%20%3E%20(schema)>)
GatewayCACreateResponse {id, public\_key } id?: string The key ID of this certificate. Link to this property public\_key?: string The public key of this certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.gateway_ca%20%3E%20(model)%20gateway_ca_create_response%20%3E%20(schema)>)
GatewayCADeleteResponse {id } id?: string UUID. maxLength36 Link to this property
[Link to this property](<#(resource)%20zero_trust.access.gateway_ca%20%3E%20(model)%20gateway_ca_delete_response%20%3E%20(schema)>) #### AccessIdP Federation Grants ##### [List IdP federation grants](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/list) client.zeroTrust.access.IdPFederationGrants.list(IdPFederationGrantListParams {account\_id } params, RequestOptionsoptions?): [IdPFederationGrantListResponse]() {id, idp\_id } GET/accounts/{account\_id}/access/idp\_federation\_grants ##### [Create an IdP federation grant](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/create) client.zeroTrust.access.IdPFederationGrants.create(IdPFederationGrantCreateParams {account\_id, idp\_id } params, RequestOptionsoptions?): [IdPFederationGrant]() {id, idp\_id } POST/accounts/{account\_id}/access/idp\_federation\_grants ##### [Get an IdP federation grant](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/get) client.zeroTrust.access.IdPFederationGrants.get(stringgrantID, IdPFederationGrantGetParams {account\_id } params, RequestOptionsoptions?): [IdPFederationGrant]() {id, idp\_id } GET/accounts/{account\_id}/access/idp\_federation\_grants/{grant\_id} ##### [Delete an IdP federation grant](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/idp_federation_grants/methods/delete) client.zeroTrust.access.IdPFederationGrants.delete(stringgrantID, IdPFederationGrantDeleteParams {account\_id } params, RequestOptionsoptions?): [IdPFederationGrantDeleteResponse]() {id } DELETE/accounts/{account\_id}/access/idp\_federation\_grants/{grant\_id} ##### ModelsExpand Collapse
IdPFederationGrant {id, idp\_id } id: string UID of the IdP federation grant. maxLength32 Link to this property idp\_id: string UID of the identity provider being federated. formatuuid Link to this property
[Link to this property](<#(resource)%20zero_trust.access.idp_federation_grants%20%3E%20(model)%20idp_federation_grant%20%3E%20(schema)>)
IdPFederationGrantListResponse = Array<IdPFederationGrant {id, idp\_id } > id: string UID of the IdP federation grant. maxLength32 Link to this property idp\_id: string UID of the identity provider being federated. formatuuid Link to this property
[Link to this property](<#(resource)%20zero_trust.access.idp_federation_grants%20%3E%20(model)%20idp_federation_grant_list_response%20%3E%20(schema)>)
IdPFederationGrantDeleteResponse {id } id?: string UID of the deleted IdP federation grant. maxLength32 Link to this property
[Link to this property](<#(resource)%20zero_trust.access.idp_federation_grants%20%3E%20(model)%20idp_federation_grant_delete_response%20%3E%20(schema)>) #### AccessSAML Certificates ##### [List SAML certificate sets](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/list) client.zeroTrust.access.samlCertificates.list(SAMLCertificateListParams {account\_id, id, page, per\_page } params, RequestOptionsoptions?): V4PagePaginationArray< [SAMLCertificateListResponse]() {created\_at, uid, updated\_at, 2 more } > GET/accounts/{account\_id}/access/saml\_certificates ##### [Get SAML certificate set](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/get) client.zeroTrust.access.samlCertificates.get(stringsamlCERTSetID, SAMLCertificateGetParams {account\_id } params, RequestOptionsoptions?): [SAMLCertificateGetResponse]() {created\_at, uid, updated\_at, 2 more } GET/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id} ##### [Rotate SAML certificate](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/rotate) client.zeroTrust.access.samlCertificates.rotate(stringsamlCERTSetID, SAMLCertificateRotateParams {account\_id } params, RequestOptionsoptions?): [SAMLCertificateRotateResponse]() {created\_at, uid, updated\_at, 2 more } POST/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id}/rotate ##### [Download current certificate in PEM format](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/saml_certificates/methods/get_pem) client.zeroTrust.access.samlCertificates.getPem(stringsamlCERTSetID, SAMLCertificateGetPemParams {account\_id } params, RequestOptionsoptions?): Response GET/accounts/{account\_id}/access/saml\_certificates/{saml\_cert\_set\_id}/pem ##### ModelsExpand Collapse
SAMLCertificateListResponse {created\_at, uid, updated\_at, 2 more } created\_at: string When the certificate set was created formatdate-time Link to this property uid: string Unique identifier for the certificate set Link to this property updated\_at: string When the certificate set was last updated formatdate-time Link to this property
current\_certificate?: CurrentCertificate {is\_current, not\_after, public\_certificate, uid } The current active certificate is\_current: boolean Indicates whether the certificate can be used for IdP configuration. Link to this property not\_after: string Certificate expiration date formatdate-time Link to this property public\_certificate: string The public certificate in PEM format Link to this property uid: string Unique identifier for the certificate Link to this property
Link to this property previous\_certificate?: unknown The previous certificate (maintained during rotation period). May be null when no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.saml_certificates%20%3E%20(model)%20saml_certificate_list_response%20%3E%20(schema)>)
SAMLCertificateGetResponse {created\_at, uid, updated\_at, 2 more } created\_at: string When the certificate set was created formatdate-time Link to this property uid: string Unique identifier for the certificate set Link to this property updated\_at: string When the certificate set was last updated formatdate-time Link to this property
current\_certificate?: CurrentCertificate {is\_current, not\_after, public\_certificate, uid } The current active certificate is\_current: boolean Indicates whether the certificate can be used for IdP configuration. Link to this property not\_after: string Certificate expiration date formatdate-time Link to this property public\_certificate: string The public certificate in PEM format Link to this property uid: string Unique identifier for the certificate Link to this property
Link to this property previous\_certificate?: unknown The previous certificate (maintained during rotation period). May be null when no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.saml_certificates%20%3E%20(model)%20saml_certificate_get_response%20%3E%20(schema)>)
SAMLCertificateRotateResponse {created\_at, uid, updated\_at, 2 more } created\_at: string When the certificate set was created formatdate-time Link to this property uid: string Unique identifier for the certificate set Link to this property updated\_at: string When the certificate set was last updated formatdate-time Link to this property
current\_certificate?: CurrentCertificate {is\_current, not\_after, public\_certificate, uid } The current active certificate is\_current: boolean Indicates whether the certificate can be used for IdP configuration. Link to this property not\_after: string Certificate expiration date formatdate-time Link to this property public\_certificate: string The public certificate in PEM format Link to this property uid: string Unique identifier for the certificate Link to this property
Link to this property previous\_certificate?: unknown The previous certificate (maintained during rotation period). May be null when no rotation has occurred. Mirrors the structure of saml_certificate. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.saml_certificates%20%3E%20(model)%20saml_certificate_rotate_response%20%3E%20(schema)>) #### AccessInfrastructure #### AccessInfrastructureTargets ##### [List all targets](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/list) client.zeroTrust.access.infrastructure.targets.list(TargetListParams {account\_id, created\_after, created\_before, 19 more } params, RequestOptionsoptions?): V4PagePaginationArray< [TargetListResponse]() {id, created\_at, hostname, 3 more } > GET/accounts/{account\_id}/infrastructure/targets ##### [Get target](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/get) client.zeroTrust.access.infrastructure.targets.get(stringtargetID, TargetGetParams {account\_id } params, RequestOptionsoptions?): [TargetGetResponse]() {id, created\_at, hostname, 3 more } GET/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Create new target](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/create) client.zeroTrust.access.infrastructure.targets.create(TargetCreateParams {account\_id, hostname, ip, tags } params, RequestOptionsoptions?): [TargetCreateResponse]() {id, created\_at, hostname, 3 more } POST/accounts/{account\_id}/infrastructure/targets ##### [Update target](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/update) client.zeroTrust.access.infrastructure.targets.update(stringtargetID, TargetUpdateParams {account\_id, hostname, ip, tags } params, RequestOptionsoptions?): [TargetUpdateResponse]() {id, created\_at, hostname, 3 more } PUT/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Delete target](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/delete) client.zeroTrust.access.infrastructure.targets.delete(stringtargetID, TargetDeleteParams {account\_id } params, RequestOptionsoptions?): void DELETE/accounts/{account\_id}/infrastructure/targets/{target\_id} ##### [Create new targets](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_update) client.zeroTrust.access.infrastructure.targets.bulkUpdate(TargetBulkUpdateParams {account\_id, body } params, RequestOptionsoptions?): SinglePage< [TargetBulkUpdateResponse]() {id, created\_at, hostname, 3 more } > PUT/accounts/{account\_id}/infrastructure/targets/batch ##### [Delete targets (Deprecated)](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_delete) Deprecated client.zeroTrust.access.infrastructure.targets.bulkDelete(TargetBulkDeleteParams {account\_id } params, RequestOptionsoptions?): void DELETE/accounts/{account\_id}/infrastructure/targets/batch ##### [Delete targets](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/methods/bulk_delete_v2) client.zeroTrust.access.infrastructure.targets.bulkDeleteV2(TargetBulkDeleteV2Params {account\_id, target\_ids } params, RequestOptionsoptions?): void POST/accounts/{account\_id}/infrastructure/targets/batch\_delete ##### ModelsExpand Collapse
TargetListResponse {id, created\_at, hostname, 3 more } id: string Target identifier formatuuid maxLength36 Link to this property created\_at: string Date and time at which the target was created formatdate-time Link to this property hostname: string A non-unique field that refers to a target Link to this property
ip: IP {ipv4, ipv6 } The IPv4/IPv6 address that identifies where to reach a target
ipv4?: IPV4 {ip\_addr, virtual\_network\_id } The target’s IPv4 address ip\_addr?: string IP address of the target Link to this property virtual\_network\_id?: string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6?: IPV6 {ip\_addr, virtual\_network\_id } The target’s IPv6 address ip\_addr?: string IP address of the target Link to this property virtual\_network\_id?: string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: string Date and time at which the target was modified formatdate-time Link to this property tags?: Record<string, string>| null Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_list_response%20%3E%20(schema)>)
TargetGetResponse {id, created\_at, hostname, 3 more } id: string Target identifier formatuuid maxLength36 Link to this property created\_at: string Date and time at which the target was created formatdate-time Link to this property hostname: string A non-unique field that refers to a target Link to this property
ip: IP {ipv4, ipv6 } The IPv4/IPv6 address that identifies where to reach a target
ipv4?: IPV4 {ip\_addr, virtual\_network\_id } The target’s IPv4 address ip\_addr?: string IP address of the target Link to this property virtual\_network\_id?: string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6?: IPV6 {ip\_addr, virtual\_network\_id } The target’s IPv6 address ip\_addr?: string IP address of the target Link to this property virtual\_network\_id?: string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: string Date and time at which the target was modified formatdate-time Link to this property tags?: Record<string, string>| null Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_get_response%20%3E%20(schema)>)
TargetCreateResponse {id, created\_at, hostname, 3 more } id: string Target identifier formatuuid maxLength36 Link to this property created\_at: string Date and time at which the target was created formatdate-time Link to this property hostname: string A non-unique field that refers to a target Link to this property
ip: IP {ipv4, ipv6 } The IPv4/IPv6 address that identifies where to reach a target
ipv4?: IPV4 {ip\_addr, virtual\_network\_id } The target’s IPv4 address ip\_addr?: string IP address of the target Link to this property virtual\_network\_id?: string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6?: IPV6 {ip\_addr, virtual\_network\_id } The target’s IPv6 address ip\_addr?: string IP address of the target Link to this property virtual\_network\_id?: string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: string Date and time at which the target was modified formatdate-time Link to this property tags?: Record<string, string>| null Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_create_response%20%3E%20(schema)>)
TargetUpdateResponse {id, created\_at, hostname, 3 more } id: string Target identifier formatuuid maxLength36 Link to this property created\_at: string Date and time at which the target was created formatdate-time Link to this property hostname: string A non-unique field that refers to a target Link to this property
ip: IP {ipv4, ipv6 } The IPv4/IPv6 address that identifies where to reach a target
ipv4?: IPV4 {ip\_addr, virtual\_network\_id } The target’s IPv4 address ip\_addr?: string IP address of the target Link to this property virtual\_network\_id?: string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6?: IPV6 {ip\_addr, virtual\_network\_id } The target’s IPv6 address ip\_addr?: string IP address of the target Link to this property virtual\_network\_id?: string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: string Date and time at which the target was modified formatdate-time Link to this property tags?: Record<string, string>| null Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_update_response%20%3E%20(schema)>)
TargetBulkUpdateResponse {id, created\_at, hostname, 3 more } id: string Target identifier formatuuid maxLength36 Link to this property created\_at: string Date and time at which the target was created formatdate-time Link to this property hostname: string A non-unique field that refers to a target Link to this property
ip: IP {ipv4, ipv6 } The IPv4/IPv6 address that identifies where to reach a target
ipv4?: IPV4 {ip\_addr, virtual\_network\_id } The target’s IPv4 address ip\_addr?: string IP address of the target Link to this property virtual\_network\_id?: string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
ipv6?: IPV6 {ip\_addr, virtual\_network\_id } The target’s IPv6 address ip\_addr?: string IP address of the target Link to this property virtual\_network\_id?: string (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used. formatuuid Link to this property
Link to this property
Link to this property modified\_at: string Date and time at which the target was modified formatdate-time Link to this property tags?: Record<string, string>| null Tags assigned to the target. Empty when no tags are assigned. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.infrastructure.targets%20%3E%20(model)%20target_bulk_update_response%20%3E%20(schema)>) #### AccessApplications ##### [List Access applications](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/applications/methods/list) client.zeroTrust.access.applications.list(ApplicationListParams {account\_id, zone\_id, aud, 7 more } params?, RequestOptionsoptions?): V4PagePaginationArray< [ApplicationListResponse]()> GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps ##### [Get an Access application](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/applications/methods/get) client.zeroTrust.access.applications.get([AppID]()appID, ApplicationGetParams {account\_id, zone\_id } params?, RequestOptionsoptions?): [ApplicationGetResponse]() GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Add an Access application](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/applications/methods/create) client.zeroTrust.access.applications.create(ApplicationCreateParamsparams, RequestOptionsoptions?): [ApplicationCreateResponse]() POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps ##### [Update an Access application](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/applications/methods/update) client.zeroTrust.access.applications.update([AppID]()appID, ApplicationUpdateParamsparams, RequestOptionsoptions?): [ApplicationUpdateResponse]() PUT/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Delete an Access application](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/applications/methods/delete) client.zeroTrust.access.applications.delete([AppID]()appID, ApplicationDeleteParams {account\_id, zone\_id } params?, RequestOptionsoptions?): [ApplicationDeleteResponse]() {id } DELETE/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id} ##### [Revoke application tokens](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/access/subresources/applications/methods/revoke_tokens) client.zeroTrust.access.applications.revokeTokens([AppID]()appID, ApplicationRevokeTokensParams {account\_id, zone\_id } params?, RequestOptionsoptions?): [ApplicationRevokeTokensResponse]()| null POST/{accounts\_or\_zones}/{account\_or\_zone\_id}/access/apps/{app\_id}/revoke\_tokens ##### ModelsExpand Collapse AllowedHeaders = string [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_headers%20%3E%20(schema)>) AllowedIdPs = string The identity providers selected for application. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_idps%20%3E%20(schema)>)
AllowedMethods = "GET"| "POST"| "HEAD"| 6 more One of the following: "GET" Link to this property "POST" Link to this property "HEAD" Link to this property "PUT" Link to this property "DELETE" Link to this property "CONNECT" Link to this property "OPTIONS" Link to this property "TRACE" Link to this property "PATCH" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_methods%20%3E%20(schema)>) AllowedOrigins = string [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20allowed_origins%20%3E%20(schema)>) AppID = string Identifier. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20app_id%20%3E%20(schema)>)
Application = SelfHostedApplication {domain, type, id, 22 more } | SaaSApplication {id, allowed\_idps, app\_launcher\_visible, 9 more } | BrowserSSHApplication {domain, type, id, 22 more } | 5 more One of the following:
SelfHostedApplication {domain, type, id, 22 more } domain: string The domain and path that Access will secure. Link to this property type: string The application type. Link to this property id?: string UUID. maxLength36 Link to this property allow\_iframe?: boolean Enables loading application content in an iFrame. Link to this property allowed\_idps?: Array<AllowedIdPs> The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible?: boolean Displays the application in the App Launcher. Link to this property aud?: string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity?: boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property cors\_headers?: CORSHeaders {allow\_all\_headers, allow\_all\_methods, allow\_all\_origins, 5 more } Link to this property created\_at?: string formatdate-time Link to this property custom\_deny\_message?: string The custom error message shown to a user when they are denied access to the application. Link to this property custom\_deny\_url?: string The custom URL a user is redirected to when they are denied access to the application. Link to this property eager\_redirect\_cookie\_setting?: boolean Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property enable\_binding\_cookie?: boolean Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property http\_only\_cookie\_attribute?: boolean Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property logo\_url?: string The image URL for the logo shown in the App Launcher dashboard. Link to this property name?: string The name of the application. Link to this property options\_preflight\_bypass?: boolean Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property same\_site\_cookie\_attribute?: string Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
scim\_config?: SCIMConfig {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication?: SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Array<SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } >
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete?: boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled?: boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings?: Array<SCIMConfigMapping {schema, enabled, filter, 3 more } > A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled?: boolean Whether or not this mapping is enabled. Link to this property filter?: string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations?: Operations {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create?: boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete?: boolean Whether or not this mapping applies to DELETE operations. Link to this property update?: boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness?: "strict"| "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata?: string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property service\_auth\_401\_redirect?: boolean Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property session\_duration?: string The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property skip\_interstitial?: boolean Enables automatic authentication through cloudflared. Link to this property updated\_at?: string formatdate-time Link to this property use\_clientless\_isolation\_app\_launcher\_url?: boolean Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
SaaSApplication {id, allowed\_idps, app\_launcher\_visible, 9 more } id?: string UUID. maxLength36 Link to this property allowed\_idps?: Array<AllowedIdPs> The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible?: boolean Displays the application in the App Launcher. Link to this property aud?: string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity?: boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property created\_at?: string formatdate-time Link to this property logo\_url?: string The image URL for the logo shown in the App Launcher dashboard. Link to this property name?: string The name of the application. Link to this property
saas\_app?: AccessSAMLSaaSApp2 {auth\_type, consumer\_service\_url, created\_at, 8 more } | AccessOIDCSaaSApp2 {access\_token\_lifetime, allow\_pkce\_without\_client\_secret, app\_launcher\_url, 13 more } One of the following:
AccessSAMLSaaSApp2 {auth\_type, consumer\_service\_url, created\_at, 8 more }
auth\_type?: "saml"| "oidc" Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml” One of the following: "saml" Link to this property "oidc" Link to this property
Link to this property consumer\_service\_url?: string The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion. Link to this property created\_at?: string formatdate-time Link to this property
custom\_attributes?: Array<CustomAttribute> friendly\_name?: string The SAML FriendlyName of the attribute. Link to this property name?: string The name of the attribute. Link to this property
name\_format?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"| "urn:oasis:names:tc:SAML:2.0:attrname-format:basic"| "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" A globally unique name for an identity or service provider. One of the following: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" Link to this property "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Link to this property "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Link to this property
Link to this property required?: boolean If the attribute is required when building a SAML assertion. Link to this property
source?: Source {name, name\_by\_idp } name?: string The name of the IdP attribute. Link to this property name\_by\_idp?: Record<string, string> A mapping from IdP ID to attribute name. Link to this property
Link to this property
Link to this property idp\_entity\_id?: string The unique identifier for your SaaS application. Link to this property name\_id\_format?: SaaSAppNameIDFormat The format of the name identifier sent to the SaaS application. Link to this property name\_id\_transform\_jsonata?: string A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting. Link to this property public\_key?: string The Access public certificate that will be used to verify your identity. Link to this property sp\_entity\_id?: string A globally unique name for an identity or service provider. Link to this property sso\_endpoint?: string The endpoint where your SaaS application will send login requests. Link to this property updated\_at?: string formatdate-time Link to this property
Link to this property
AccessOIDCSaaSApp2 {access\_token\_lifetime, allow\_pkce\_without\_client\_secret, app\_launcher\_url, 13 more } access\_token\_lifetime?: string The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h. Link to this property allow\_pkce\_without\_client\_secret?: boolean If client secret should be required on the token endpoint when authorization\_code\_with\_pkce grant is used. Link to this property app\_launcher\_url?: string The URL where this applications tile redirects users Link to this property
auth\_type?: "saml"| "oidc" Identifier of the authentication protocol used for the saas app. Required for OIDC. One of the following: "saml" Link to this property "oidc" Link to this property
Link to this property client\_id?: string The application client id Link to this property client\_secret?: string The application client secret, only returned on POST request. Link to this property created\_at?: string formatdate-time Link to this property
custom\_claims?: Array<CustomClaim> name?: string The name of the claim. Link to this property required?: boolean If the claim is required when building an OIDC token. Link to this property
scope?: "groups"| "profile"| "email"| "openid" The scope of the claim. One of the following: "groups" Link to this property "profile" Link to this property "email" Link to this property "openid" Link to this property
Link to this property
source?: Source {name, name\_by\_idp } name?: string The name of the IdP claim. Link to this property
name\_by\_idp?: Array<NameByIdP> A mapping from IdP ID to attribute name. idp\_id?: string The UID of the IdP. Link to this property source\_name?: string The name of the IdP provided attribute. Link to this property
Link to this property
Link to this property
Link to this property
grant\_types?: Array<"authorization\_code"| "authorization\_code\_with\_pkce"| "refresh\_tokens"| 2 more> The OIDC flows supported by this application One of the following: "authorization\_code" Link to this property "authorization\_code\_with\_pkce" Link to this property "refresh\_tokens" Link to this property "hybrid" Link to this property "implicit" Link to this property
Link to this property group\_filter\_regex?: string A regex to filter Cloudflare groups returned in ID token and userinfo endpoint. Link to this property
hybrid\_and\_implicit\_options?: HybridAndImplicitOptions {return\_access\_token\_from\_authorization\_endpoint, return\_id\_token\_from\_authorization\_endpoint } return\_access\_token\_from\_authorization\_endpoint?: boolean If an Access Token should be returned from the OIDC Authorization endpoint Link to this property return\_id\_token\_from\_authorization\_endpoint?: boolean If an ID Token should be returned from the OIDC Authorization endpoint Link to this property
Link to this property public\_key?: string The Access public certificate that will be used to verify your identity. Link to this property redirect\_uris?: Array<string> The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens Link to this property
refresh\_token\_options?: RefreshTokenOptions {lifetime } lifetime?: string How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m. Link to this property
Link to this property
scopes?: Array<"openid"| "groups"| "email"| "profile"> Define the user information shared with access, “offline\_access” scope will be automatically enabled if refresh tokens are enabled One of the following: "openid" Link to this property "groups" Link to this property "email" Link to this property "profile" Link to this property
Link to this property updated\_at?: string formatdate-time Link to this property
Link to this property
Link to this property
scim\_config?: SCIMConfig {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication?: SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Array<SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } >
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete?: boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled?: boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings?: Array<SCIMConfigMapping {schema, enabled, filter, 3 more } > A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled?: boolean Whether or not this mapping is enabled. Link to this property filter?: string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations?: Operations {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create?: boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete?: boolean Whether or not this mapping applies to DELETE operations. Link to this property update?: boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness?: "strict"| "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata?: string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property type?: string The application type. Link to this property updated\_at?: string formatdate-time Link to this property
Link to this property
BrowserSSHApplication {domain, type, id, 22 more } domain: string The domain and path that Access will secure. Link to this property type: string The application type. Link to this property id?: string UUID. maxLength36 Link to this property allow\_iframe?: boolean Enables loading application content in an iFrame. Link to this property allowed\_idps?: Array<AllowedIdPs> The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible?: boolean Displays the application in the App Launcher. Link to this property aud?: string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity?: boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property cors\_headers?: CORSHeaders {allow\_all\_headers, allow\_all\_methods, allow\_all\_origins, 5 more } Link to this property created\_at?: string formatdate-time Link to this property custom\_deny\_message?: string The custom error message shown to a user when they are denied access to the application. Link to this property custom\_deny\_url?: string The custom URL a user is redirected to when they are denied access to the application. Link to this property eager\_redirect\_cookie\_setting?: boolean Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property enable\_binding\_cookie?: boolean Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property http\_only\_cookie\_attribute?: boolean Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property logo\_url?: string The image URL for the logo shown in the App Launcher dashboard. Link to this property name?: string The name of the application. Link to this property options\_preflight\_bypass?: boolean Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property same\_site\_cookie\_attribute?: string Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
scim\_config?: SCIMConfig {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication?: SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Array<SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } >
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete?: boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled?: boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings?: Array<SCIMConfigMapping {schema, enabled, filter, 3 more } > A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled?: boolean Whether or not this mapping is enabled. Link to this property filter?: string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations?: Operations {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create?: boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete?: boolean Whether or not this mapping applies to DELETE operations. Link to this property update?: boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness?: "strict"| "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata?: string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property service\_auth\_401\_redirect?: boolean Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property session\_duration?: string The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property skip\_interstitial?: boolean Enables automatic authentication through cloudflared. Link to this property updated\_at?: string formatdate-time Link to this property use\_clientless\_isolation\_app\_launcher\_url?: boolean Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
BrowserVNCApplication {domain, type, id, 22 more } domain: string The domain and path that Access will secure. Link to this property type: string The application type. Link to this property id?: string UUID. maxLength36 Link to this property allow\_iframe?: boolean Enables loading application content in an iFrame. Link to this property allowed\_idps?: Array<AllowedIdPs> The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible?: boolean Displays the application in the App Launcher. Link to this property aud?: string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity?: boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property cors\_headers?: CORSHeaders {allow\_all\_headers, allow\_all\_methods, allow\_all\_origins, 5 more } Link to this property created\_at?: string formatdate-time Link to this property custom\_deny\_message?: string The custom error message shown to a user when they are denied access to the application. Link to this property custom\_deny\_url?: string The custom URL a user is redirected to when they are denied access to the application. Link to this property eager\_redirect\_cookie\_setting?: boolean Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property enable\_binding\_cookie?: boolean Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property http\_only\_cookie\_attribute?: boolean Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property logo\_url?: string The image URL for the logo shown in the App Launcher dashboard. Link to this property name?: string The name of the application. Link to this property options\_preflight\_bypass?: boolean Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property same\_site\_cookie\_attribute?: string Sets the SameSite cookie setting, which provides increased security against CSRF attacks. Link to this property
scim\_config?: SCIMConfig {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication?: SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Array<SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } >
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete?: boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled?: boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings?: Array<SCIMConfigMapping {schema, enabled, filter, 3 more } > A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled?: boolean Whether or not this mapping is enabled. Link to this property filter?: string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations?: Operations {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create?: boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete?: boolean Whether or not this mapping applies to DELETE operations. Link to this property update?: boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness?: "strict"| "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata?: string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property service\_auth\_401\_redirect?: boolean Returns a 401 status code when the request is blocked by a Service Auth policy. Link to this property session\_duration?: string The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property skip\_interstitial?: boolean Enables automatic authentication through cloudflared. Link to this property updated\_at?: string formatdate-time Link to this property use\_clientless\_isolation\_app\_launcher\_url?: boolean Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application. Link to this property
Link to this property
AppLauncherApplication {type, id, allowed\_idps, 8 more }
type: "self\_hosted"| "saas"| "ssh"| 6 more The application type. One of the following: "self\_hosted" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property
Link to this property id?: string UUID. maxLength36 Link to this property allowed\_idps?: Array<AllowedIdPs> The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property aud?: string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity?: boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property created\_at?: string formatdate-time Link to this property domain?: string The domain and path that Access will secure. Link to this property name?: string The name of the application. Link to this property
scim\_config?: SCIMConfig {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication?: SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Array<SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } >
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete?: boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled?: boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings?: Array<SCIMConfigMapping {schema, enabled, filter, 3 more } > A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled?: boolean Whether or not this mapping is enabled. Link to this property filter?: string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations?: Operations {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create?: boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete?: boolean Whether or not this mapping applies to DELETE operations. Link to this property update?: boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness?: "strict"| "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata?: string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property session\_duration?: string The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property updated\_at?: string formatdate-time Link to this property
Link to this property
DeviceEnrollmentPermissionsApplication {type, id, allowed\_idps, 8 more }
type: "self\_hosted"| "saas"| "ssh"| 6 more The application type. One of the following: "self\_hosted" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property
Link to this property id?: string UUID. maxLength36 Link to this property allowed\_idps?: Array<AllowedIdPs> The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property aud?: string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity?: boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property created\_at?: string formatdate-time Link to this property domain?: string The domain and path that Access will secure. Link to this property name?: string The name of the application. Link to this property
scim\_config?: SCIMConfig {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication?: SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Array<SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } >
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete?: boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled?: boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings?: Array<SCIMConfigMapping {schema, enabled, filter, 3 more } > A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled?: boolean Whether or not this mapping is enabled. Link to this property filter?: string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations?: Operations {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create?: boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete?: boolean Whether or not this mapping applies to DELETE operations. Link to this property update?: boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness?: "strict"| "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata?: string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property session\_duration?: string The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property updated\_at?: string formatdate-time Link to this property
Link to this property
BrowserIsolationPermissionsApplication {type, id, allowed\_idps, 8 more }
type: "self\_hosted"| "saas"| "ssh"| 6 more The application type. One of the following: "self\_hosted" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property
Link to this property id?: string UUID. maxLength36 Link to this property allowed\_idps?: Array<AllowedIdPs> The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property aud?: string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity?: boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property created\_at?: string formatdate-time Link to this property domain?: string The domain and path that Access will secure. Link to this property name?: string The name of the application. Link to this property
scim\_config?: SCIMConfig {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication?: SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Array<SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } >
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete?: boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled?: boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings?: Array<SCIMConfigMapping {schema, enabled, filter, 3 more } > A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled?: boolean Whether or not this mapping is enabled. Link to this property filter?: string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations?: Operations {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create?: boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete?: boolean Whether or not this mapping applies to DELETE operations. Link to this property update?: boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness?: "strict"| "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata?: string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property session\_duration?: string The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property updated\_at?: string formatdate-time Link to this property
Link to this property
BookmarkApplication {domain, type, id, 7 more } domain: string The URL or domain of the bookmark. Link to this property type: string The application type. Link to this property id?: string UUID. maxLength36 Link to this property app\_launcher\_visible?: boolean Link to this property aud?: string Audience tag. maxLength64 Link to this property created\_at?: string formatdate-time Link to this property logo\_url?: string The image URL for the logo shown in the App Launcher dashboard. Link to this property name?: string The name of the application. Link to this property
scim\_config?: SCIMConfig {idp\_uid, remote\_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta. idp\_uid: string The UID of the IdP to use as the source for SCIM resources to provision to this application. Link to this property remote\_uri: string The base URI for the application’s SCIM-compatible API. Link to this property
authentication?: SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | 2 more Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. One of the following:
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Array<SCIMConfigAuthenticationHTTPBasic {password, scheme, user } | AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } | SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } | AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } >
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationOAuthBearerToken2 {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
Link to this property
AccessSCIMConfigAuthenticationAccessServiceToken {client\_id, client\_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application. client\_id: string Client ID of the Access service token used to authenticate with the remote service. Link to this property client\_secret: string Client secret of the Access service token used to authenticate with the remote service. Link to this property scheme: "access\_service\_token" The authentication scheme to use when making SCIM requests to this application. Link to this property
Link to this property
Link to this property
Link to this property deactivate\_on\_delete?: boolean If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations. Link to this property enabled?: boolean Whether SCIM provisioning is turned on for this application. Link to this property
mappings?: Array<SCIMConfigMapping {schema, enabled, filter, 3 more } > A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled?: boolean Whether or not this mapping is enabled. Link to this property filter?: string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations?: Operations {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create?: boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete?: boolean Whether or not this mapping applies to DELETE operations. Link to this property update?: boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness?: "strict"| "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata?: string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
Link to this property
Link to this property updated\_at?: string formatdate-time Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application%20%3E%20(schema)>)
ApplicationPolicy {id, approval\_groups, approval\_required, 13 more } id?: string The UUID of the policy maxLength36 Link to this property
approval\_groups?: Array<ApprovalGroup {approvals\_needed, email\_addresses, email\_list\_uuid } > Administrators who can approve a temporary authentication request. approvals\_needed: number The number of approvals needed to obtain access. minimum0 Link to this property email\_addresses?: Array<string> A list of emails that can approve the access request. Link to this property email\_list\_uuid?: string The UUID of an re-usable email list. Link to this property
Link to this property approval\_required?: boolean Requires the user to request access from an administrator at the start of each session. Link to this property
connection\_rules?: ConnectionRules {rdp } The rules that define how users may connect to targets secured by your application.
rdp?: RDP {allowed\_clipboard\_local\_to\_remote\_formats, allowed\_clipboard\_remote\_to\_local\_formats } The RDP-specific rules that define clipboard behavior for RDP connections.
allowed\_clipboard\_local\_to\_remote\_formats?: Array<"text"| "file"> Clipboard formats allowed when copying from local machine to remote RDP session. One of the following: "text" Link to this property "file" Link to this property
Link to this property
allowed\_clipboard\_remote\_to\_local\_formats?: Array<"text"| "file"> Clipboard formats allowed when copying from remote RDP session to local machine. One of the following: "text" Link to this property "file" Link to this property
Link to this property
Link to this property
Link to this property created\_at?: string formatdate-time Link to this property decision?: Decision The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Link to this property
exclude?: Array<AccessRule> Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules. One of the following:
GroupRule {group } Matches an Access group.
group: Group {id } id: string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
AnyValidServiceTokenRule {any\_valid\_service\_token } Matches any valid Access Service Token any\_valid\_service\_token: AnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
AccessAuthContextRule {auth\_context } Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: AuthContext {id, ac\_id, identity\_provider\_id } id: string The ID of an Authentication context. Link to this property ac\_id: string The ACID of an Authentication context. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
AuthenticationMethodRule {auth\_method } Enforce different MFA options
auth\_method: AuthMethod {auth\_method } auth\_method: string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
AzureGroupRule {azureAD } Matches an Azure group. Requires an Azure identity provider.
azureAD: AzureAD {id, identity\_provider\_id } id: string The ID of an Azure group. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
CertificateRule {certificate } Matches any valid client certificate. certificate: Certificate Link to this property
Link to this property
AccessCommonNameRule {common\_name } Matches a specific common name.
common\_name: CommonName {common\_name } common\_name: string The common name to match. Link to this property
Link to this property
Link to this property
CountryRule {geo } Matches a specific country
geo: Geo {country\_code } country\_code: string The country code that should be matched. Link to this property
Link to this property
Link to this property
AccessDevicePostureRule {device\_posture } Enforces a device posture rule has run successfully
device\_posture: DevicePosture {integration\_uid, account\_id } integration\_uid: string The ID of a device posture integration. Link to this property account\_id?: string The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
DomainRule {email\_domain } Match an entire email domain.
email\_domain: EmailDomain {domain } domain: string The email domain to match. Link to this property
Link to this property
Link to this property
EmailListRule {email\_list } Matches an email address from a list.
email\_list: EmailList {id } id: string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
EmailRule {email } Matches a specific email.
email: Email {email } email: string The email of the user. formatemail Link to this property
Link to this property
Link to this property
EveryoneRule {everyone } Matches everyone. everyone: Everyone An empty object which matches on all users. Link to this property
Link to this property
ExternalEvaluationRule {external\_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: ExternalEvaluation {evaluate\_url, keys\_url } evaluate\_url: string The API endpoint containing your business logic. Link to this property keys\_url: string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
GitHubOrganizationRule {github-organization } Matches a Github organization. Requires a Github identity provider.
"github-organization": GitHubOrganization {identity\_provider\_id, name, team } identity\_provider\_id: string The ID of your Github identity provider. Link to this property name: string The name of the organization. Link to this property team?: string The name of the team Link to this property
Link to this property
Link to this property
GSuiteGroupRule {gsuite } Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: GSuite {email, identity\_provider\_id } email: string The email of the Google Workspace group. Link to this property identity\_provider\_id: string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
AccessLoginMethodRule {login\_method } Matches a specific identity provider id.
login\_method: LoginMethod {id } id: string The ID of an identity provider. Link to this property
Link to this property
Link to this property
IPListRule {ip\_list } Matches an IP address from a list.
ip\_list: IPList {id } id: string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
IPRule {ip } Matches an IP address block.
ip: IP {ip } ip: string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
OktaGroupRule {okta } Matches an Okta group. Requires an Okta identity provider.
okta: Okta {identity\_provider\_id, name } identity\_provider\_id: string The ID of your Okta identity provider. Link to this property name: string The name of the Okta group. Link to this property
Link to this property
Link to this property
SAMLGroupRule {saml } Matches a SAML group. Requires a SAML identity provider.
saml: SAML {attribute\_name, attribute\_value, identity\_provider\_id } attribute\_name: string The name of the SAML attribute. Link to this property attribute\_value: string The SAML attribute value to look for. Link to this property identity\_provider\_id: string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
AccessOIDCClaimRule {oidc } Matches an OIDC claim. Requires an OIDC identity provider.
oidc: OIDC {claim\_name, claim\_value, identity\_provider\_id } claim\_name: string The name of the OIDC claim. Link to this property claim\_value: string The OIDC claim value to look for. Link to this property identity\_provider\_id: string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
ServiceTokenRule {service\_token } Matches a specific Access Service Token
service\_token: ServiceToken {token\_id } token\_id: string The ID of a Service Token. Link to this property
Link to this property
Link to this property
AccessLinkedAppTokenRule {linked\_app\_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
linked\_app\_token: LinkedAppToken {app\_uid } app\_uid: string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
AccessUserRiskScoreRule {user\_risk\_score } Matches a user’s risk score.
user\_risk\_score: UserRiskScore {user\_risk\_score }
user\_risk\_score: Array<"low"| "medium"| "high"| "unscored"> A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "unscored" Link to this property
Link to this property
Link to this property
Link to this property
AccessCloudflareAccountMemberRule {cloudflare\_account\_member } Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
cloudflare\_account\_member: CloudflareAccountMember {account\_id } account\_id?: string Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property
include?: Array<AccessRule> Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. One of the following:
GroupRule {group } Matches an Access group.
group: Group {id } id: string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
AnyValidServiceTokenRule {any\_valid\_service\_token } Matches any valid Access Service Token any\_valid\_service\_token: AnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
AccessAuthContextRule {auth\_context } Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: AuthContext {id, ac\_id, identity\_provider\_id } id: string The ID of an Authentication context. Link to this property ac\_id: string The ACID of an Authentication context. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
AuthenticationMethodRule {auth\_method } Enforce different MFA options
auth\_method: AuthMethod {auth\_method } auth\_method: string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
AzureGroupRule {azureAD } Matches an Azure group. Requires an Azure identity provider.
azureAD: AzureAD {id, identity\_provider\_id } id: string The ID of an Azure group. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
CertificateRule {certificate } Matches any valid client certificate. certificate: Certificate Link to this property
Link to this property
AccessCommonNameRule {common\_name } Matches a specific common name.
common\_name: CommonName {common\_name } common\_name: string The common name to match. Link to this property
Link to this property
Link to this property
CountryRule {geo } Matches a specific country
geo: Geo {country\_code } country\_code: string The country code that should be matched. Link to this property
Link to this property
Link to this property
AccessDevicePostureRule {device\_posture } Enforces a device posture rule has run successfully
device\_posture: DevicePosture {integration\_uid, account\_id } integration\_uid: string The ID of a device posture integration. Link to this property account\_id?: string The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
DomainRule {email\_domain } Match an entire email domain.
email\_domain: EmailDomain {domain } domain: string The email domain to match. Link to this property
Link to this property
Link to this property
EmailListRule {email\_list } Matches an email address from a list.
email\_list: EmailList {id } id: string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
EmailRule {email } Matches a specific email.
email: Email {email } email: string The email of the user. formatemail Link to this property
Link to this property
Link to this property
EveryoneRule {everyone } Matches everyone. everyone: Everyone An empty object which matches on all users. Link to this property
Link to this property
ExternalEvaluationRule {external\_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: ExternalEvaluation {evaluate\_url, keys\_url } evaluate\_url: string The API endpoint containing your business logic. Link to this property keys\_url: string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
GitHubOrganizationRule {github-organization } Matches a Github organization. Requires a Github identity provider.
"github-organization": GitHubOrganization {identity\_provider\_id, name, team } identity\_provider\_id: string The ID of your Github identity provider. Link to this property name: string The name of the organization. Link to this property team?: string The name of the team Link to this property
Link to this property
Link to this property
GSuiteGroupRule {gsuite } Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: GSuite {email, identity\_provider\_id } email: string The email of the Google Workspace group. Link to this property identity\_provider\_id: string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
AccessLoginMethodRule {login\_method } Matches a specific identity provider id.
login\_method: LoginMethod {id } id: string The ID of an identity provider. Link to this property
Link to this property
Link to this property
IPListRule {ip\_list } Matches an IP address from a list.
ip\_list: IPList {id } id: string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
IPRule {ip } Matches an IP address block.
ip: IP {ip } ip: string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
OktaGroupRule {okta } Matches an Okta group. Requires an Okta identity provider.
okta: Okta {identity\_provider\_id, name } identity\_provider\_id: string The ID of your Okta identity provider. Link to this property name: string The name of the Okta group. Link to this property
Link to this property
Link to this property
SAMLGroupRule {saml } Matches a SAML group. Requires a SAML identity provider.
saml: SAML {attribute\_name, attribute\_value, identity\_provider\_id } attribute\_name: string The name of the SAML attribute. Link to this property attribute\_value: string The SAML attribute value to look for. Link to this property identity\_provider\_id: string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
AccessOIDCClaimRule {oidc } Matches an OIDC claim. Requires an OIDC identity provider.
oidc: OIDC {claim\_name, claim\_value, identity\_provider\_id } claim\_name: string The name of the OIDC claim. Link to this property claim\_value: string The OIDC claim value to look for. Link to this property identity\_provider\_id: string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
ServiceTokenRule {service\_token } Matches a specific Access Service Token
service\_token: ServiceToken {token\_id } token\_id: string The ID of a Service Token. Link to this property
Link to this property
Link to this property
AccessLinkedAppTokenRule {linked\_app\_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
linked\_app\_token: LinkedAppToken {app\_uid } app\_uid: string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
AccessUserRiskScoreRule {user\_risk\_score } Matches a user’s risk score.
user\_risk\_score: UserRiskScore {user\_risk\_score }
user\_risk\_score: Array<"low"| "medium"| "high"| "unscored"> A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "unscored" Link to this property
Link to this property
Link to this property
Link to this property
AccessCloudflareAccountMemberRule {cloudflare\_account\_member } Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
cloudflare\_account\_member: CloudflareAccountMember {account\_id } account\_id?: string Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property isolation\_required?: boolean Require this application to be served in an isolated browser for users matching this policy. ‘Client Web Isolation’ must be on for the account in order to use this feature. Link to this property
mfa\_config?: MfaConfig {allowed\_authenticators, mfa\_disabled, session\_duration } Configures multi-factor authentication (MFA) settings.
allowed\_authenticators?: Array<"totp"| "biometrics"| "security\_key"> Lists the MFA methods that users can authenticate with. One of the following: "totp" Link to this property "biometrics" Link to this property "security\_key" Link to this property
Link to this property mfa\_disabled?: boolean Indicates whether to disable MFA for this resource. This option is available at the application and policy level. Link to this property session\_duration?: string Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property name?: string The name of the Access policy. Link to this property purpose\_justification\_prompt?: string A custom message that will appear on the purpose justification screen. Link to this property purpose\_justification\_required?: boolean Require users to enter a justification when they log in to the application. Link to this property
require?: Array<AccessRule> Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules. One of the following:
GroupRule {group } Matches an Access group.
group: Group {id } id: string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
AnyValidServiceTokenRule {any\_valid\_service\_token } Matches any valid Access Service Token any\_valid\_service\_token: AnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
AccessAuthContextRule {auth\_context } Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: AuthContext {id, ac\_id, identity\_provider\_id } id: string The ID of an Authentication context. Link to this property ac\_id: string The ACID of an Authentication context. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
AuthenticationMethodRule {auth\_method } Enforce different MFA options
auth\_method: AuthMethod {auth\_method } auth\_method: string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
AzureGroupRule {azureAD } Matches an Azure group. Requires an Azure identity provider.
azureAD: AzureAD {id, identity\_provider\_id } id: string The ID of an Azure group. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
CertificateRule {certificate } Matches any valid client certificate. certificate: Certificate Link to this property
Link to this property
AccessCommonNameRule {common\_name } Matches a specific common name.
common\_name: CommonName {common\_name } common\_name: string The common name to match. Link to this property
Link to this property
Link to this property
CountryRule {geo } Matches a specific country
geo: Geo {country\_code } country\_code: string The country code that should be matched. Link to this property
Link to this property
Link to this property
AccessDevicePostureRule {device\_posture } Enforces a device posture rule has run successfully
device\_posture: DevicePosture {integration\_uid, account\_id } integration\_uid: string The ID of a device posture integration. Link to this property account\_id?: string The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
DomainRule {email\_domain } Match an entire email domain.
email\_domain: EmailDomain {domain } domain: string The email domain to match. Link to this property
Link to this property
Link to this property
EmailListRule {email\_list } Matches an email address from a list.
email\_list: EmailList {id } id: string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
EmailRule {email } Matches a specific email.
email: Email {email } email: string The email of the user. formatemail Link to this property
Link to this property
Link to this property
EveryoneRule {everyone } Matches everyone. everyone: Everyone An empty object which matches on all users. Link to this property
Link to this property
ExternalEvaluationRule {external\_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: ExternalEvaluation {evaluate\_url, keys\_url } evaluate\_url: string The API endpoint containing your business logic. Link to this property keys\_url: string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
GitHubOrganizationRule {github-organization } Matches a Github organization. Requires a Github identity provider.
"github-organization": GitHubOrganization {identity\_provider\_id, name, team } identity\_provider\_id: string The ID of your Github identity provider. Link to this property name: string The name of the organization. Link to this property team?: string The name of the team Link to this property
Link to this property
Link to this property
GSuiteGroupRule {gsuite } Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: GSuite {email, identity\_provider\_id } email: string The email of the Google Workspace group. Link to this property identity\_provider\_id: string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
AccessLoginMethodRule {login\_method } Matches a specific identity provider id.
login\_method: LoginMethod {id } id: string The ID of an identity provider. Link to this property
Link to this property
Link to this property
IPListRule {ip\_list } Matches an IP address from a list.
ip\_list: IPList {id } id: string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
IPRule {ip } Matches an IP address block.
ip: IP {ip } ip: string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
OktaGroupRule {okta } Matches an Okta group. Requires an Okta identity provider.
okta: Okta {identity\_provider\_id, name } identity\_provider\_id: string The ID of your Okta identity provider. Link to this property name: string The name of the Okta group. Link to this property
Link to this property
Link to this property
SAMLGroupRule {saml } Matches a SAML group. Requires a SAML identity provider.
saml: SAML {attribute\_name, attribute\_value, identity\_provider\_id } attribute\_name: string The name of the SAML attribute. Link to this property attribute\_value: string The SAML attribute value to look for. Link to this property identity\_provider\_id: string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
AccessOIDCClaimRule {oidc } Matches an OIDC claim. Requires an OIDC identity provider.
oidc: OIDC {claim\_name, claim\_value, identity\_provider\_id } claim\_name: string The name of the OIDC claim. Link to this property claim\_value: string The OIDC claim value to look for. Link to this property identity\_provider\_id: string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
ServiceTokenRule {service\_token } Matches a specific Access Service Token
service\_token: ServiceToken {token\_id } token\_id: string The ID of a Service Token. Link to this property
Link to this property
Link to this property
AccessLinkedAppTokenRule {linked\_app\_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
linked\_app\_token: LinkedAppToken {app\_uid } app\_uid: string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
AccessUserRiskScoreRule {user\_risk\_score } Matches a user’s risk score.
user\_risk\_score: UserRiskScore {user\_risk\_score }
user\_risk\_score: Array<"low"| "medium"| "high"| "unscored"> A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "unscored" Link to this property
Link to this property
Link to this property
Link to this property
AccessCloudflareAccountMemberRule {cloudflare\_account\_member } Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
cloudflare\_account\_member: CloudflareAccountMember {account\_id } account\_id?: string Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property session\_duration?: string| null The amount of time that tokens issued for the application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Link to this property updated\_at?: string formatdate-time Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application_policy%20%3E%20(schema)>)
ApplicationType = "self\_hosted"| "end\_user"| "saas"| 12 more The application type. One of the following: "self\_hosted" Link to this property "end\_user" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property "infrastructure" Link to this property "rdp" Link to this property "mcp" Link to this property "mcp\_portal" Link to this property "proxy\_endpoint" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20application_type%20%3E%20(schema)>)
CORSHeaders {allow\_all\_headers, allow\_all\_methods, allow\_all\_origins, 5 more } allow\_all\_headers?: boolean Allows all HTTP request headers. Link to this property allow\_all\_methods?: boolean Allows all HTTP request methods. Link to this property allow\_all\_origins?: boolean Allows all origins. Link to this property allow\_credentials?: boolean When set to true, includes credentials (cookies, authorization headers, or TLS client certificates) with requests. Link to this property allowed\_headers?: Array<AllowedHeaders> Allowed HTTP request headers. Link to this property
allowed\_methods?: Array<AllowedMethods> Allowed HTTP request methods. One of the following: "GET" Link to this property "POST" Link to this property "HEAD" Link to this property "PUT" Link to this property "DELETE" Link to this property "CONNECT" Link to this property "OPTIONS" Link to this property "TRACE" Link to this property "PATCH" Link to this property
Link to this property allowed\_origins?: Array<AllowedOrigins> Allowed origins. Link to this property max\_age?: number The maximum number of seconds the results of a preflight request can be cached. maximum86400 minimum-1 Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20cors_headers%20%3E%20(schema)>)
Decision = "allow"| "deny"| "non\_identity"| "bypass" The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. One of the following: "allow" Link to this property "deny" Link to this property "non\_identity" Link to this property "bypass" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20decision%20%3E%20(schema)>)
OIDCSaaSApp {access\_token\_lifetime, allow\_pkce\_without\_client\_secret, app\_launcher\_url, 11 more } access\_token\_lifetime?: string The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h. Link to this property allow\_pkce\_without\_client\_secret?: boolean If client secret should be required on the token endpoint when authorization\_code\_with\_pkce grant is used. Link to this property app\_launcher\_url?: string The URL where this applications tile redirects users Link to this property
auth\_type?: "saml"| "oidc" Identifier of the authentication protocol used for the saas app. Required for OIDC. One of the following: "saml" Link to this property "oidc" Link to this property
Link to this property client\_id?: string The application client id Link to this property client\_secret?: string The application client secret, only returned on POST request. Link to this property
custom\_claims?: Array<CustomClaim> name?: string The name of the claim. Link to this property required?: boolean If the claim is required when building an OIDC token. Link to this property
scope?: "groups"| "profile"| "email"| "openid" The scope of the claim. One of the following: "groups" Link to this property "profile" Link to this property "email" Link to this property "openid" Link to this property
Link to this property
source?: Source {name, name\_by\_idp } name?: string The name of the IdP claim. Link to this property name\_by\_idp?: Record<string, string> A mapping from IdP ID to claim name. Link to this property
Link to this property
Link to this property
grant\_types?: Array<"authorization\_code"| "authorization\_code\_with\_pkce"| "refresh\_tokens"| 2 more> The OIDC flows supported by this application One of the following: "authorization\_code" Link to this property "authorization\_code\_with\_pkce" Link to this property "refresh\_tokens" Link to this property "hybrid" Link to this property "implicit" Link to this property
Link to this property group\_filter\_regex?: string A regex to filter Cloudflare groups returned in ID token and userinfo endpoint Link to this property
hybrid\_and\_implicit\_options?: HybridAndImplicitOptions {return\_access\_token\_from\_authorization\_endpoint, return\_id\_token\_from\_authorization\_endpoint } return\_access\_token\_from\_authorization\_endpoint?: boolean If an Access Token should be returned from the OIDC Authorization endpoint Link to this property return\_id\_token\_from\_authorization\_endpoint?: boolean If an ID Token should be returned from the OIDC Authorization endpoint Link to this property
Link to this property public\_key?: string The Access public certificate that will be used to verify your identity. Link to this property redirect\_uris?: Array<string> The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens Link to this property
refresh\_token\_options?: RefreshTokenOptions {lifetime } lifetime?: string How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m. Link to this property
Link to this property
scopes?: Array<"openid"| "groups"| "email"| "profile"> Define the user information shared with access, “offline\_access” scope will be automatically enabled if refresh tokens are enabled One of the following: "openid" Link to this property "groups" Link to this property "email" Link to this property "profile" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20oidc_saas_app%20%3E%20(schema)>)
SaaSAppNameIDFormat = "id"| "email" The format of the name identifier sent to the SaaS application. One of the following: "id" Link to this property "email" Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20saas_app_name_id_format%20%3E%20(schema)>)
SAMLSaaSApp {auth\_type, consumer\_service\_url, custom\_attributes, 8 more }
auth\_type?: "saml"| "oidc" Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml” One of the following: "saml" Link to this property "oidc" Link to this property
Link to this property consumer\_service\_url?: string The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion. Link to this property
custom\_attributes?: Array<CustomAttribute> friendly\_name?: string The SAML FriendlyName of the attribute. Link to this property name?: string The name of the attribute. Link to this property
name\_format?: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"| "urn:oasis:names:tc:SAML:2.0:attrname-format:basic"| "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" A globally unique name for an identity or service provider. One of the following: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" Link to this property "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Link to this property "urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Link to this property
Link to this property required?: boolean If the attribute is required when building a SAML assertion. Link to this property
source?: Source {name, name\_by\_idp } name?: string The name of the IdP attribute. Link to this property
name\_by\_idp?: Array<NameByIdP> A mapping from IdP ID to attribute name. idp\_id?: string The UID of the IdP. Link to this property source\_name?: string The name of the IdP provided attribute. Link to this property
Link to this property
Link to this property
Link to this property default\_relay\_state?: string The URL that the user will be redirected to after a successful login for IDP initiated logins. Link to this property idp\_entity\_id?: string The unique identifier for your SaaS application. Link to this property name\_id\_format?: SaaSAppNameIDFormat The format of the name identifier sent to the SaaS application. Link to this property name\_id\_transform\_jsonata?: string A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting. Link to this property public\_key?: string The Access public certificate that will be used to verify your identity. Link to this property saml\_attribute\_transform\_jsonata?: string A \[JSONata] (https://jsonata.org/) expression that transforms an application’s user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml\_attributes or oidc\_fields of the identity provider used to authenticate. The output of this expression must be a JSON object. Link to this property sp\_entity\_id?: string A globally unique name for an identity or service provider. Link to this property sso\_endpoint?: string The endpoint where your SaaS application will send login requests. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20saml_saas_app%20%3E%20(schema)>)
SCIMConfigAuthenticationHTTPBasic {password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application. password: string Password used to authenticate with the remote SCIM service. Link to this property scheme: "httpbasic" The authentication scheme to use when making SCIM requests to this application. Link to this property user: string User name used to authenticate with the remote SCIM service. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_http_basic%20%3E%20(schema)>)
SCIMConfigAuthenticationOAuthBearerToken {token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application. token: string Token used to authenticate with the remote SCIM service. Link to this property scheme: "oauthbearertoken" The authentication scheme to use when making SCIM requests to this application. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_oauth_bearer_token%20%3E%20(schema)>)
SCIMConfigAuthenticationOauth2 {authorization\_url, client\_id, client\_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application. authorization\_url: string URL used to generate the auth code used during token generation. Link to this property client\_id: string Client ID used to authenticate when generating a token for authenticating with the remote SCIM service. Link to this property client\_secret: string Secret used to authenticate when generating a token for authenticating with the remove SCIM service. Link to this property scheme: "oauth2" The authentication scheme to use when making SCIM requests to this application. Link to this property token\_url: string URL used to generate the token used to authenticate with the remote SCIM service. Link to this property scopes?: Array<string> The authorization scopes to request when generating the token used to authenticate with the remove SCIM service. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_authentication_oauth2%20%3E%20(schema)>)
SCIMConfigMapping {schema, enabled, filter, 3 more } Transformations and filters applied to resources before they are provisioned in the remote SCIM service. schema: string Which SCIM resource type this mapping applies to. Link to this property enabled?: boolean Whether or not this mapping is enabled. Link to this property filter?: string A SCIM filter expression that matches resources that should be provisioned to this application. Link to this property
operations?: Operations {create, delete, update } Whether or not this mapping applies to creates, updates, or deletes. create?: boolean Whether or not this mapping applies to create (POST) operations. Link to this property delete?: boolean Whether or not this mapping applies to DELETE operations. Link to this property update?: boolean Whether or not this mapping applies to update (PATCH/PUT) operations. Link to this property
Link to this property
strictness?: "strict"| "passthrough" The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. One of the following: "strict" Link to this property "passthrough" Link to this property
Link to this property transform\_jsonata?: string A JSONata expression that transforms the resource before provisioning it in the application. Link to this property
[Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20scim_config_mapping%20%3E%20(schema)>) SelfHostedDomains = string A domain that Access will secure. [Link to this property](<#(resource)%20zero_trust.access.applications%20%3E%20(model)%20self_hosted_domains%20%3E%20(schema)>)
ApplicationListResponse = EndUserApplication {oauth\_configuration, type, user\_populations, 7 more } | SelfHostedApplication {domain, type, id, 31 more } | SaaSApplication {id, allowed\_idps, app\_launcher\_visible, 10 more } | 11 more One of the following:
EndUserApplication {oauth\_configuration, type, user\_populations, 7 more }
oauth\_configuration: OAuthConfiguration {dynamic\_client\_registration, enabled, grant } **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support RFC 8707 (Resource Indicators for OAuth 2.0). This feature is currently in beta.
dynamic\_client\_registration?: DynamicClientRegistration {allow\_any\_on\_localhost, allow\_any\_on\_loopback, allowed\_uris, enabled } Settings for OAuth dynamic client registration. allow\_any\_on\_localhost?: boolean Allows any client with redirect URIs on localhost. Link to this property allow\_any\_on\_loopback?: boolean Allows any client with redirect URIs on 127.0.0.1. Link to this property allowed\_uris?: Array<string> The URIs that are allowed as redirect URIs for dynamically registered clients. HTTP and HTTPS paths may end in /* to match all sub-paths. Custom-scheme URIs must be explicitly configured and match exactly. Link to this property enabled?: boolean Whether dynamic client registration is enabled. Link to this property
Link to this property enabled?: true Managed OAuth is required for end user applications and cannot be disabled. Link to this property
grant?: Grant {access\_token\_lifetime, session\_duration } Settings for OAuth grant behavior. access\_token\_lifetime?: string The lifetime of the access token. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h. Link to this property session\_duration?: string The duration of the OAuth session. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h. Link to this property
Link to this property
Link to this property
type: "self\_hosted"| "end\_user"| "saas"| 12 more The application type. One of the following: "self\_hosted" Link to this property "end\_user" Link to this property "saas" Link to this property "ssh" Link to this property "vnc" Link to this property "app\_launcher" Link to this property "warp" Link to this property "biso" Link to this property "bookmark" Link to this property "dash\_sso" Link to this property "infrastructure" Link to this property "rdp" Link to this property "mcp" Link to this property "mcp\_portal" Link to this property "proxy\_endpoint" Link to this property
Link to this property user\_populations: Array<string> The single user population associated with this application. Link to this property id?: string UUID. maxLength36 Link to this property allowed\_idps?: Array<AllowedIdPs> The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property aud?: string Audience tag. maxLength64 Link to this property
destinations?: Array<AccessEndUserPublicDestination {uri, overrides, type } | AccessEndUserWorkerDestination {type, worker\_id, overrides } | AccessEndUserPreviewWorkerDestination {type, worker\_id, overrides } | 2 more> Public hostname and Workers destinations secured by Access. One of the following:
AccessEndUserPublicDestination {uri, overrides, type } uri: string The public hostname and optional path to secure. Link to this property
overrides?: Array<Override> Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property type?: "public" Link to this property
Link to this property
AccessEndUserWorkerDestination {type, worker\_id, overrides } type: "worker" Link to this property worker\_id: string The ID of the Cloudflare Worker to secure. Link to this property
overrides?: Array<Override> Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
AccessEndUserPreviewWorkerDestination {type, worker\_id, overrides } type: "preview\_worker" Link to this property worker\_id: string The ID of the Cloudflare Worker whose previews to secure. Link to this property
overrides?: Array<Override> Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
AccessEndUserAllWorkersDestination {type, overrides } type: "all\_workers" Link to this property
overrides?: Array<Override> Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
AccessEndUserAllPreviewWorkersDestination {type, overrides } type: "all\_preview\_workers" Link to this property
overrides?: Array<Override> Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
Link to this property domain?: string The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher. Link to this property name?: string The name of the application. Link to this property Deprecatedself\_hosted\_domains?: Array<SelfHostedDomains> List of public domains that Access will secure. This field is deprecated in favor of destinations and will be supported until **November 21, 2025.** If destinations are provided, then self_hosted_domains will be ignored. Link to this property
Link to this property
SelfHostedApplication {domain, type, id, 31 more } domain: string The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher. Link to this property type: ApplicationType The application type. Link to this property id?: string UUID. maxLength36 Link to this property allow\_authenticate\_via\_warp?: boolean When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication. Link to this property allow\_iframe?: boolean Enables loading application content in an iFrame. Link to this property allowed\_idps?: Array<AllowedIdPs> The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. Link to this property app\_launcher\_visible?: boolean Displays the application in the App Launcher. Link to this property aud?: string Audience tag. maxLength64 Link to this property auto\_redirect\_to\_identity?: boolean When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed\_idps. Link to this property cors\_headers?: CORSHeaders {allow\_all\_headers, allow\_all\_methods, allow\_all\_origins, 5 more } Link to this property custom\_deny\_message?: string The custom error message shown to a user when they are denied access to the application. Link to this property custom\_deny\_url?: string The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules. Link to this property custom\_non\_identity\_deny\_url?: string The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules. Link to this property custom\_pages?: Array<string> The custom pages that will be displayed when applicable for this application Link to this property
destinations?: Array<PublicDestination {overrides, type, uri } | PrivateDestination {cidr, hostname, l4\_protocol, 3 more } | ViaMcpServerPortalDestination {mcp\_server\_id, type } | 4 more> List of destinations secured by Access. This supersedes self_hosted_domains to allow for more flexibility in defining different types of domains. If destinations are provided, then self_hosted_domains will be ignored. One of the following:
PublicDestination {overrides, type, uri } A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard ’\*’ can be used in the definition.
overrides?: Array<Override> Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property type?: "public" Link to this property uri?: string The URI of the destination. Public destinations’ URIs can include a domain and path with wildcards. Link to this property
Link to this property
PrivateDestination {cidr, hostname, l4\_protocol, 3 more } cidr?: string The CIDR range of the destination. Single IPs will be computed as /32. Link to this property hostname?: string The hostname of the destination. Matches a valid SNI served by an HTTPS origin. Link to this property
l4\_protocol?: "tcp"| "udp" The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match. One of the following: "tcp" Link to this property "udp" Link to this property
Link to this property port\_range?: string The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match. Link to this property type?: "private" Link to this property vnet\_id?: string The VNET ID to match the destination. When omitted, all VNETs will match. Link to this property
Link to this property
ViaMcpServerPortalDestination {mcp\_server\_id, type } A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal. mcp\_server\_id?: string The MCP server id configured in ai-controls. Link to this property type?: "via\_mcp\_server\_portal" Link to this property
Link to this property
WorkerDestination {type, worker\_id, overrides } A specific Cloudflare Worker that Access will secure. All requests routed to the specified Worker, including its preview deployments, will be protected. The preview_worker and public destination types takes precedence, so you can create separate applications to override the policies for the Worker’s previews or specific paths. type: "worker" Link to this property worker\_id: string The ID of the Cloudflare Worker to protect with Access. Link to this property
overrides?: Array<Override> Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
PreviewWorkerDestination {type, worker\_id, overrides } A specific Cloudflare Worker whose preview deployments Access will secure. Only requests routed to the preview deployments of the specified Worker will be protected. The public destination type takes precedence, so you can create separate applications to override the policies for specific paths. type: "preview\_worker" Link to this property worker\_id: string The ID of the Cloudflare Worker whose preview deployments to protect with Access. Link to this property
overrides?: Array<Override> Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
AllWorkersDestination {type, overrides } Protects all Cloudflare Workers on the account with Access, including their preview deployments. At most one destination of this type can exist per account. The worker, preview_worker, all_preview_workers, and public destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths. type: "all\_workers" Link to this property
overrides?: Array<Override> Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
AllPreviewWorkersDestination {type, overrides } Protects the preview deployments of all Cloudflare Workers on the account with Access. At most one destination of this type can exist per account. The worker, preview_worker, and public destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths. type: "all\_preview\_workers" Link to this property
overrides?: Array<Override> Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations. behavior: "public" The behavior to apply to matching requests. Link to this property path\_pattern: string The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard. maxLength512 Link to this property
Link to this property
Link to this property
Link to this property eager\_redirect\_cookie\_setting?: boolean Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. Link to this property enable\_binding\_cookie?: boolean Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. Link to this property http\_only\_cookie\_attribute?: boolean Enables the HttpOnly cookie attribute, which increases security against XSS attacks. Link to this property logo\_url?: string The image URL for the logo shown in the App Launcher dashboard. Link to this property
mfa\_config?: MfaConfig {allowed\_authenticators, mfa\_disabled, session\_duration } Configures multi-factor authentication (MFA) settings.
allowed\_authenticators?: Array<"totp"| "biometrics"| "security\_key"> Lists the MFA methods that users can authenticate with. One of the following: "totp" Link to this property "biometrics" Link to this property "security\_key" Link to this property
Link to this property mfa\_disabled?: boolean Indicates whether to disable MFA for this resource. This option is available at the application and policy level. Link to this property session\_duration?: string Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h. Link to this property
Link to this property name?: string The name of the application. Link to this property
oauth\_configuration?: OAuthConfiguration {dynamic\_client\_registration, enabled, grant } **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support RFC 8707 (Resource Indicators for OAuth 2.0). This feature is currently in beta.
dynamic\_client\_registration?: DynamicClientRegistration {allow\_any\_on\_localhost, allow\_any\_on\_loopback, allowed\_uris, enabled } Settings for OAuth dynamic client registration. allow\_any\_on\_localhost?: boolean Allows any client with redirect URIs on localhost. Link to this property allow\_any\_on\_loopback?: boolean Allows any client with redirect URIs on 127.0.0.1. Link to this property allowed\_uris?: Array<string> The URIs that are allowed as redirect URIs for dynamically registered clients. HTTP and HTTPS paths may end in /* to match all sub-paths. Custom-scheme URIs must be explicitly configured and match exactly. Link to this property enabled?: boolean Whether dynamic client registration is enabled. Link to this property
Link to this property enabled?: boolean Whether the OAuth configuration is enabled for this application. When set to false, Access will not handle OAuth for this application. Defaults to true if omitted. Link to this property
grant?: Grant {access\_token\_lifetime, session\_duration } Settings for OAuth grant behavior. access\_token\_lifetime?: string The lifetime of the access token. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h. Link to this property session\_duration?: string The duration of the OAuth session. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h. Link to this property
Link to this property
Link to this property options\_preflight\_bypass?: boolean Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors\_headers is set. Link to this property path\_cookie\_attribute?: boolean Enables cookie paths to scope an application’s JWT to the application path. If disabled, the JWT will scope to the hostname by default Link to this property
policies?: Array<Policy> id?: string The UUID of the policy maxLength36 Link to this property account\_id?: string Identifier. maxLength32 Link to this property
approval\_groups?: Array<ApprovalGroup {approvals\_needed, email\_addresses, email\_list\_uuid } > Administrators who can approve a temporary authentication request. approvals\_needed: number The number of approvals needed to obtain access. minimum0 Link to this property email\_addresses?: Array<string> A list of emails that can approve the access request. Link to this property email\_list\_uuid?: string The UUID of an re-usable email list. Link to this property
Link to this property approval\_required?: boolean Requires the user to request access from an administrator at the start of each session. Link to this property
connection\_rules?: ConnectionRules {rdp } The rules that define how users may connect to targets secured by your application.
rdp?: RDP {allowed\_clipboard\_local\_to\_remote\_formats, allowed\_clipboard\_remote\_to\_local\_formats } The RDP-specific rules that define clipboard behavior for RDP connections.
allowed\_clipboard\_local\_to\_remote\_formats?: Array<"text"| "file"> Clipboard formats allowed when copying from local machine to remote RDP session. One of the following: "text" Link to this property "file" Link to this property
Link to this property
allowed\_clipboard\_remote\_to\_local\_formats?: Array<"text"| "file"> Clipboard formats allowed when copying from remote RDP session to local machine. One of the following: "text" Link to this property "file" Link to this property
Link to this property
Link to this property
Link to this property created\_at?: string formatdate-time Link to this property decision?: Decision The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Link to this property
exclude?: Array<AccessRule> Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules. One of the following:
GroupRule {group } Matches an Access group.
group: Group {id } id: string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
AnyValidServiceTokenRule {any\_valid\_service\_token } Matches any valid Access Service Token any\_valid\_service\_token: AnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
AccessAuthContextRule {auth\_context } Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: AuthContext {id, ac\_id, identity\_provider\_id } id: string The ID of an Authentication context. Link to this property ac\_id: string The ACID of an Authentication context. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
AuthenticationMethodRule {auth\_method } Enforce different MFA options
auth\_method: AuthMethod {auth\_method } auth\_method: string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
AzureGroupRule {azureAD } Matches an Azure group. Requires an Azure identity provider.
azureAD: AzureAD {id, identity\_provider\_id } id: string The ID of an Azure group. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
CertificateRule {certificate } Matches any valid client certificate. certificate: Certificate Link to this property
Link to this property
AccessCommonNameRule {common\_name } Matches a specific common name.
common\_name: CommonName {common\_name } common\_name: string The common name to match. Link to this property
Link to this property
Link to this property
CountryRule {geo } Matches a specific country
geo: Geo {country\_code } country\_code: string The country code that should be matched. Link to this property
Link to this property
Link to this property
AccessDevicePostureRule {device\_posture } Enforces a device posture rule has run successfully
device\_posture: DevicePosture {integration\_uid, account\_id } integration\_uid: string The ID of a device posture integration. Link to this property account\_id?: string The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
DomainRule {email\_domain } Match an entire email domain.
email\_domain: EmailDomain {domain } domain: string The email domain to match. Link to this property
Link to this property
Link to this property
EmailListRule {email\_list } Matches an email address from a list.
email\_list: EmailList {id } id: string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
EmailRule {email } Matches a specific email.
email: Email {email } email: string The email of the user. formatemail Link to this property
Link to this property
Link to this property
EveryoneRule {everyone } Matches everyone. everyone: Everyone An empty object which matches on all users. Link to this property
Link to this property
ExternalEvaluationRule {external\_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: ExternalEvaluation {evaluate\_url, keys\_url } evaluate\_url: string The API endpoint containing your business logic. Link to this property keys\_url: string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
GitHubOrganizationRule {github-organization } Matches a Github organization. Requires a Github identity provider.
"github-organization": GitHubOrganization {identity\_provider\_id, name, team } identity\_provider\_id: string The ID of your Github identity provider. Link to this property name: string The name of the organization. Link to this property team?: string The name of the team Link to this property
Link to this property
Link to this property
GSuiteGroupRule {gsuite } Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: GSuite {email, identity\_provider\_id } email: string The email of the Google Workspace group. Link to this property identity\_provider\_id: string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
AccessLoginMethodRule {login\_method } Matches a specific identity provider id.
login\_method: LoginMethod {id } id: string The ID of an identity provider. Link to this property
Link to this property
Link to this property
IPListRule {ip\_list } Matches an IP address from a list.
ip\_list: IPList {id } id: string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
IPRule {ip } Matches an IP address block.
ip: IP {ip } ip: string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
OktaGroupRule {okta } Matches an Okta group. Requires an Okta identity provider.
okta: Okta {identity\_provider\_id, name } identity\_provider\_id: string The ID of your Okta identity provider. Link to this property name: string The name of the Okta group. Link to this property
Link to this property
Link to this property
SAMLGroupRule {saml } Matches a SAML group. Requires a SAML identity provider.
saml: SAML {attribute\_name, attribute\_value, identity\_provider\_id } attribute\_name: string The name of the SAML attribute. Link to this property attribute\_value: string The SAML attribute value to look for. Link to this property identity\_provider\_id: string The ID of your SAML identity provider. Link to this property
Link to this property
Link to this property
AccessOIDCClaimRule {oidc } Matches an OIDC claim. Requires an OIDC identity provider.
oidc: OIDC {claim\_name, claim\_value, identity\_provider\_id } claim\_name: string The name of the OIDC claim. Link to this property claim\_value: string The OIDC claim value to look for. Link to this property identity\_provider\_id: string The ID of your OIDC identity provider. Link to this property
Link to this property
Link to this property
ServiceTokenRule {service\_token } Matches a specific Access Service Token
service\_token: ServiceToken {token\_id } token\_id: string The ID of a Service Token. Link to this property
Link to this property
Link to this property
AccessLinkedAppTokenRule {linked\_app\_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non\_identity and bypass decisions.
linked\_app\_token: LinkedAppToken {app\_uid } app\_uid: string The ID of an Access OIDC SaaS application Link to this property
Link to this property
Link to this property
AccessUserRiskScoreRule {user\_risk\_score } Matches a user’s risk score.
user\_risk\_score: UserRiskScore {user\_risk\_score }
user\_risk\_score: Array<"low"| "medium"| "high"| "unscored"> A list of risk score levels to match. Values can be low, medium, high, or unscored. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "unscored" Link to this property
Link to this property
Link to this property
Link to this property
AccessCloudflareAccountMemberRule {cloudflare\_account\_member } Matches users who are members of a specific Cloudflare account. Requires a Cloudflare identity provider.
cloudflare\_account\_member: CloudflareAccountMember {account\_id } account\_id?: string Identifier. maxLength32 Link to this property
Link to this property
Link to this property
Link to this property
include?: Array<AccessRule> Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. One of the following:
GroupRule {group } Matches an Access group.
group: Group {id } id: string The ID of a previously created Access group. Link to this property
Link to this property
Link to this property
AnyValidServiceTokenRule {any\_valid\_service\_token } Matches any valid Access Service Token any\_valid\_service\_token: AnyValidServiceToken An empty object which matches on all service tokens. Link to this property
Link to this property
AccessAuthContextRule {auth\_context } Matches an Azure Authentication Context. Requires an Azure identity provider.
auth\_context: AuthContext {id, ac\_id, identity\_provider\_id } id: string The ID of an Authentication context. Link to this property ac\_id: string The ACID of an Authentication context. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
AuthenticationMethodRule {auth\_method } Enforce different MFA options
auth\_method: AuthMethod {auth\_method } auth\_method: string The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2. Link to this property
Link to this property
Link to this property
AzureGroupRule {azureAD } Matches an Azure group. Requires an Azure identity provider.
azureAD: AzureAD {id, identity\_provider\_id } id: string The ID of an Azure group. Link to this property identity\_provider\_id: string The ID of your Azure identity provider. Link to this property
Link to this property
Link to this property
CertificateRule {certificate } Matches any valid client certificate. certificate: Certificate Link to this property
Link to this property
AccessCommonNameRule {common\_name } Matches a specific common name.
common\_name: CommonName {common\_name } common\_name: string The common name to match. Link to this property
Link to this property
Link to this property
CountryRule {geo } Matches a specific country
geo: Geo {country\_code } country\_code: string The country code that should be matched. Link to this property
Link to this property
Link to this property
AccessDevicePostureRule {device\_posture } Enforces a device posture rule has run successfully
device\_posture: DevicePosture {integration\_uid, account\_id } integration\_uid: string The ID of a device posture integration. Link to this property account\_id?: string The ID of the account that owns the device posture integration. maxLength32 Link to this property
Link to this property
Link to this property
DomainRule {email\_domain } Match an entire email domain.
email\_domain: EmailDomain {domain } domain: string The email domain to match. Link to this property
Link to this property
Link to this property
EmailListRule {email\_list } Matches an email address from a list.
email\_list: EmailList {id } id: string The ID of a previously created email list. Link to this property
Link to this property
Link to this property
EmailRule {email } Matches a specific email.
email: Email {email } email: string The email of the user. formatemail Link to this property
Link to this property
Link to this property
EveryoneRule {everyone } Matches everyone. everyone: Everyone An empty object which matches on all users. Link to this property
Link to this property
ExternalEvaluationRule {external\_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
external\_evaluation: ExternalEvaluation {evaluate\_url, keys\_url } evaluate\_url: string The API endpoint containing your business logic. Link to this property keys\_url: string The API endpoint containing the key that Access uses to verify that the response came from your API. Link to this property
Link to this property
Link to this property
GitHubOrganizationRule {github-organization } Matches a Github organization. Requires a Github identity provider.
"github-organization": GitHubOrganization {identity\_provider\_id, name, team } identity\_provider\_id: string The ID of your Github identity provider. Link to this property name: string The name of the organization. Link to this property team?: string The name of the team Link to this property
Link to this property
Link to this property
GSuiteGroupRule {gsuite } Matches a group in Google Workspace. Requires a Google Workspace identity provider.
gsuite: GSuite {email, identity\_provider\_id } email: string The email of the Google Workspace group. Link to this property identity\_provider\_id: string The ID of your Google Workspace identity provider. Link to this property
Link to this property
Link to this property
AccessLoginMethodRule {login\_method } Matches a specific identity provider id.
login\_method: LoginMethod {id } id: string The ID of an identity provider. Link to this property
Link to this property
Link to this property
IPListRule {ip\_list } Matches an IP address from a list.
ip\_list: IPList {id } id: string The ID of a previously created IP list. Link to this property
Link to this property
Link to this property
IPRule {ip } Matches an IP address block.
ip: IP {ip } ip: string An IPv4 or IPv6 CIDR block. Link to this property
Link to this property
Link to this property
OktaGroupRule {okta } Matches an Okta group. Requires an Okta identity provider.
okta: Okta {identity\_provider\_id, name } identity\_provider\_id: string The ID of your Okta identity provider. Link to this property name: string The name of the Okta group. Link to this property
Link to this property
Link to this property
SAMLGroupRule {saml } Matches a SAML group. Requires a SAML identity provider.
saml: SAML {attribute\_name, attribute\_value, identity\_provider\_id } attribute\_name: string The name of the SAML attribute. Link to this property attribute\_value: string The SAML attribute value to look for. Link to this property