--- title: Gateway --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/typescript) [Zero Trust](https://developers.cloudflare.com/api/typescript/resources/zero_trust) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Gateway ##### [Get Zero Trust account information](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/methods/list) client.zeroTrust.gateway.list(GatewayListParams {account\_id } params, RequestOptionsoptions?): [GatewayListResponse]() {id, gateway\_tag, provider\_name } GET/accounts/{account\_id}/gateway ##### [Create Zero Trust account](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/methods/create) client.zeroTrust.gateway.create(GatewayCreateParams {account\_id } params, RequestOptionsoptions?): [GatewayCreateResponse]() {id, gateway\_tag, provider\_name } POST/accounts/{account\_id}/gateway ##### ModelsExpand Collapse

GatewayListResponse {id, gateway\_tag, provider\_name }

id?: string Specify the Cloudflare account ID. maxLength32 Link to this property gateway\_tag?: string Specify the gateway internal ID. maxLength32 Link to this property provider\_name?: string Specify the provider name (usually Cloudflare). Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway%20%3E%20(model)%20gateway_list_response%20%3E%20(schema)>)

GatewayCreateResponse {id, gateway\_tag, provider\_name }

[Link to this property](<#(resource)%20zero_trust.gateway%20%3E%20(model)%20gateway_create_response%20%3E%20(schema)>) #### GatewayAudit SSH Settings ##### [Get Zero Trust SSH settings](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/audit_ssh_settings/methods/get) client.zeroTrust.gateway.auditSSHSettings.get(AuditSSHSettingGetParams {account\_id } params, RequestOptionsoptions?): [GatewaySettings]() {created\_at, public\_key, seed\_id, updated\_at } GET/accounts/{account\_id}/gateway/audit\_ssh\_settings ##### [Update Zero Trust SSH settings](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/audit_ssh_settings/methods/update) client.zeroTrust.gateway.auditSSHSettings.update(AuditSSHSettingUpdateParams {account\_id, public\_key } params, RequestOptionsoptions?): [GatewaySettings]() {created\_at, public\_key, seed\_id, updated\_at } PUT/accounts/{account\_id}/gateway/audit\_ssh\_settings ##### [Rotate Zero Trust SSH account seed](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/audit_ssh_settings/methods/rotate_seed) client.zeroTrust.gateway.auditSSHSettings.rotateSeed(AuditSSHSettingRotateSeedParams {account\_id } params, RequestOptionsoptions?): [GatewaySettings]() {created\_at, public\_key, seed\_id, updated\_at } POST/accounts/{account\_id}/gateway/audit\_ssh\_settings/rotate\_seed ##### ModelsExpand Collapse

GatewaySettings {created\_at, public\_key, seed\_id, updated\_at }

created\_at?: string formatdate-time Link to this property public\_key?: string Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging. Link to this property seed\_id?: string Identify the seed ID. maxLength36 Link to this property updated\_at?: string formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.audit_ssh_settings%20%3E%20(model)%20gateway_settings%20%3E%20(schema)>) #### GatewayCategories ##### [List categories](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/categories/methods/list) client.zeroTrust.gateway.categories.list(CategoryListParams {account\_id } params, RequestOptionsoptions?): SinglePage< [Category]() {id, beta, class, 3 more } > GET/accounts/{account\_id}/gateway/categories ##### ModelsExpand Collapse

Category {id, beta, class, 3 more }

id?: number Identify this category. Only one category per ID. Link to this property beta?: boolean Indicate whether the category is in beta and subject to change. Link to this property

class?: "free"| "premium"| "blocked"| 2 more Specify which account types can create policies for this category. blocked Blocks unconditionally for all accounts. removalPending Allows removal from policies but disables addition. noBlock Prevents blocking.

One of the following: "free" Link to this property "premium" Link to this property "blocked" Link to this property "removalPending" Link to this property "noBlock" Link to this property

Link to this property description?: string Provide a short summary of domains in the category. Link to this property name?: string Specify the category name. Link to this property

subcategories?: Array<Subcategory> Provide all subcategories for this category.

id?: number Identify this category. Only one category per ID. Link to this property beta?: boolean Indicate whether the category is in beta and subject to change. Link to this property

One of the following: "free" Link to this property "premium" Link to this property "blocked" Link to this property "removalPending" Link to this property "noBlock" Link to this property

Link to this property description?: string Provide a short summary of domains in the category. Link to this property name?: string Specify the category name. Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.categories%20%3E%20(model)%20category%20%3E%20(schema)>) #### GatewayApp Types ##### [List application and application type mappings](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/app_types/methods/list) client.zeroTrust.gateway.appTypes.list(AppTypeListParams {account\_id } params, RequestOptionsoptions?): SinglePage< [AppType]()> GET/accounts/{account\_id}/gateway/app\_types ##### ModelsExpand Collapse

AppType = ZeroTrustGatewayApplication {id, application\_type\_id, created\_at, name } | ZeroTrustGatewayApplicationType {id, created\_at, description, name }

One of the following:

ZeroTrustGatewayApplication {id, application\_type\_id, created\_at, name }

id?: number Identify this application. Only one application per ID. Link to this property application\_type\_id?: number Identify the type of this application. Multiple applications can share the same type. Refers to the id of a returned application type. Link to this property created\_at?: string formatdate-time Link to this property name?: string Specify the name of the application or application type. Link to this property

Link to this property

ZeroTrustGatewayApplicationType {id, created\_at, description, name }

id?: number Identify the type of this application. Multiple applications can share the same type. Refers to the id of a returned application type. Link to this property created\_at?: string formatdate-time Link to this property description?: string Provide a short summary of applications with this type. Link to this property name?: string Specify the name of the application or application type. Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.app_types%20%3E%20(model)%20app_type%20%3E%20(schema)>) #### GatewayConfigurations ##### [Get Zero Trust account configuration](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/configurations/methods/get) client.zeroTrust.gateway.configurations.get(ConfigurationGetParams {account\_id } params, RequestOptionsoptions?): [ConfigurationGetResponse]() {created\_at, settings, updated\_at } GET/accounts/{account\_id}/gateway/configuration ##### [Update Zero Trust account configuration](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/configurations/methods/update) client.zeroTrust.gateway.configurations.update(ConfigurationUpdateParams {account\_id, settings } params, RequestOptionsoptions?): [ConfigurationUpdateResponse]() {created\_at, settings, updated\_at } PUT/accounts/{account\_id}/gateway/configuration ##### [Patch Zero Trust account configuration](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/configurations/methods/edit) client.zeroTrust.gateway.configurations.edit(ConfigurationEditParams {account\_id, settings } params, RequestOptionsoptions?): [ConfigurationEditResponse]() {created\_at, settings, updated\_at } PATCH/accounts/{account\_id}/gateway/configuration ##### ModelsExpand Collapse

ActivityLogSettings {enabled } Specify activity log settings.

enabled?: boolean| null Specify whether to log activity. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20activity_log_settings%20%3E%20(schema)>)

AntiVirusSettings {enabled\_download\_phase, enabled\_upload\_phase, fail\_closed, notification\_settings } Specify anti-virus settings.

enabled\_download\_phase?: boolean| null Specify whether to enable anti-virus scanning on downloads. Link to this property enabled\_upload\_phase?: boolean| null Specify whether to enable anti-virus scanning on uploads. Link to this property fail\_closed?: boolean| null Specify whether to block requests for unscannable files. Link to this property notification\_settings?: NotificationSettings {enabled, include\_context, msg, support\_url } | null Configure the message the user’s device shows during an antivirus scan. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20anti_virus_settings%20%3E%20(schema)>)

BlockPageSettings {background\_color, enabled, footer\_text, 12 more } Specify block page layout settings.

background\_color?: string Specify the block page background color in #rrggbb format when the mode is customized\_block\_page. Link to this property enabled?: boolean| null Specify whether to enable the custom block page. Link to this property footer\_text?: string Specify the block page footer text when the mode is customized\_block\_page. Link to this property header\_text?: string Specify the block page header text when the mode is customized\_block\_page. Link to this property include\_context?: boolean Specify whether to append context to target\_uri as query parameters. This applies only when the mode is redirect\_uri. Link to this property logo\_path?: string Specify the full URL to the logo file when the mode is customized\_block\_page. Link to this property mailto\_address?: string Specify the admin email for users to contact when the mode is customized\_block\_page. Link to this property mailto\_subject?: string Specify the subject line for emails created from the block page when the mode is customized\_block\_page. Link to this property

mode?: ""| "customized\_block\_page"| "redirect\_uri" Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.

One of the following: "" Link to this property "customized\_block\_page" Link to this property "redirect\_uri" Link to this property

Link to this property name?: string Specify the block page title when the mode is customized\_block\_page. Link to this property read\_only?: boolean| null Indicate that this setting was shared via the Orgs API and read only for the current account. Link to this property source\_account?: string| null Indicate the account tag of the account that shared this setting. Link to this property suppress\_footer?: boolean Specify whether to suppress detailed information at the bottom of the block page when the mode is customized\_block\_page. Link to this property target\_uri?: string Specify the URI to redirect users to when the mode is redirect\_uri. formaturi Link to this property version?: number| null Indicate the version number of the setting. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20block_page_settings%20%3E%20(schema)>)

BodyScanningSettings {inspection\_mode } Specify the DLP inspection mode.

inspection\_mode?: "deep"| "shallow" Specify the inspection mode as either deep or shallow.

One of the following: "deep" Link to this property "shallow" Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20body_scanning_settings%20%3E%20(schema)>)

BrowserIsolationSettings {non\_identity\_enabled, url\_browser\_isolation\_enabled } Specify Clientless Browser Isolation settings.

non\_identity\_enabled?: boolean Specify whether to enable non-identity onramp support for Browser Isolation. Link to this property url\_browser\_isolation\_enabled?: boolean Specify whether to enable Clientless Browser Isolation. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20browser_isolation_settings%20%3E%20(schema)>)

CustomCertificateSettings {enabled, id, binding\_status, updated\_at } Specify custom certificate settings for BYO-PKI. This field is deprecated; use certificate instead.

enabled: boolean| null Specify whether to enable a custom certificate authority for signing Gateway traffic. Link to this property id?: string Specify the UUID of the certificate (ID from MTLS certificate store). Link to this property binding\_status?: string Indicate the internal certificate status. Link to this property updated\_at?: string formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20custom_certificate_settings%20%3E%20(schema)>)

ExtendedEmailMatching {enabled, read\_only, source\_account, version } Configures user email settings for firewall policies. When you enable this, the system standardizes email addresses in the identity portion of the rule to match extended email variants in firewall policies. When you disable this setting, the system matches email addresses exactly as you provide them. Enable this setting if your email uses . or + modifiers.

enabled?: boolean| null Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies. Link to this property read\_only?: boolean Indicate that this setting was shared via the Orgs API and read only for the current account. Link to this property source\_account?: string Indicate the account tag of the account that shared this setting. Link to this property version?: number Indicate the version number of the setting. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20extended_email_matching%20%3E%20(schema)>)

FipsSettings {tls } Specify FIPS settings.

tls?: boolean Enforce cipher suites and TLS versions compliant with FIPS 140-2. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20fips_settings%20%3E%20(schema)>)

GatewayConfigurationSettings {activity\_log, antivirus, block\_page, 12 more } Specify account settings.

activity\_log?: ActivityLogSettings {enabled } | null Specify activity log settings. Link to this property antivirus?: AntiVirusSettings {enabled\_download\_phase, enabled\_upload\_phase, fail\_closed, notification\_settings } | null Specify anti-virus settings. Link to this property block\_page?: BlockPageSettings {background\_color, enabled, footer\_text, 12 more } | null Specify block page layout settings. Link to this property body\_scanning?: BodyScanningSettings {inspection\_mode } | null Specify the DLP inspection mode. Link to this property browser\_isolation?: BrowserIsolationSettings {non\_identity\_enabled, url\_browser\_isolation\_enabled } | null Specify Clientless Browser Isolation settings. Link to this property

certificate?: Certificate| null Specify certificate settings for Gateway TLS interception. If unset, the Cloudflare Root CA handles interception.

id: string Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called ‘active’). A nil UUID directs Cloudflare to use the Root CA. Link to this property

Link to this property Deprecatedcustom\_certificate?: CustomCertificateSettings {enabled, id, binding\_status, updated\_at } | null Specify custom certificate settings for BYO-PKI. This field is deprecated; use certificate instead. Link to this property extended\_email\_matching?: ExtendedEmailMatching {enabled, read\_only, source\_account, version } | null Configures user email settings for firewall policies. When you enable this, the system standardizes email addresses in the identity portion of the rule to match extended email variants in firewall policies. When you disable this setting, the system matches email addresses exactly as you provide them. Enable this setting if your email uses . or + modifiers. Link to this property fips?: FipsSettings {tls } | null Specify FIPS settings. Link to this property

host\_selector?: HostSelector| null Enable host selection in egress policies.

enabled?: boolean| null Specify whether to enable filtering via hosts for egress policies. Link to this property

Link to this property

inspection?: Inspection| null Define the proxy inspection mode.

mode?: "static"| "dynamic" Define the proxy inspection mode. 1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443). 2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.

One of the following: "static" Link to this property "dynamic" Link to this property

Link to this property

Link to this property max\_ttl\_secs?: number| null Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location max_ttl setting. maximum36000 minimum60 Link to this property protocol\_detection?: ProtocolDetection {enabled } | null Specify whether to detect protocols from the initial bytes of client traffic. Link to this property

sandbox?: Sandbox| null Specify whether to enable the sandbox.

enabled?: boolean| null Specify whether to enable the sandbox. Link to this property

fallback\_action?: "allow"| "block" Specify the action to take when the system cannot scan the file.

One of the following: "allow" Link to this property "block" Link to this property

Link to this property

Link to this property tls\_decrypt?: TLSSettings {enabled } | null Specify whether to inspect encrypted HTTP traffic. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20gateway_configuration_settings%20%3E%20(schema)>)

NotificationSettings {enabled, include\_context, msg, support\_url } Configure the message the user’s device shows during an antivirus scan.

enabled?: boolean Specify whether to enable notifications. Link to this property include\_context?: boolean Specify whether to include context information as query parameters. Link to this property msg?: string Specify the message to show in the notification. Link to this property support\_url?: string Specify a URL that directs users to more information. If unset, the notification opens a block page. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20notification_settings%20%3E%20(schema)>)

ProtocolDetection {enabled } Specify whether to detect protocols from the initial bytes of client traffic.

enabled?: boolean| null Specify whether to detect protocols from the initial bytes of client traffic. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20protocol_detection%20%3E%20(schema)>)

TLSSettings {enabled } Specify whether to inspect encrypted HTTP traffic.

enabled?: boolean Specify whether to inspect encrypted HTTP traffic. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20tls_settings%20%3E%20(schema)>)

ConfigurationGetResponse {created\_at, settings, updated\_at } Specify account settings.

created\_at?: string formatdate-time Link to this property settings?: GatewayConfigurationSettings {activity\_log, antivirus, block\_page, 12 more } Specify account settings. Link to this property updated\_at?: string formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20configuration_get_response%20%3E%20(schema)>)

ConfigurationUpdateResponse {created\_at, settings, updated\_at } Specify account settings.

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20configuration_update_response%20%3E%20(schema)>)

ConfigurationEditResponse {created\_at, settings, updated\_at } Specify account settings.

[Link to this property](<#(resource)%20zero_trust.gateway.configurations%20%3E%20(model)%20configuration_edit_response%20%3E%20(schema)>) #### GatewayConfigurationsCustom Certificate ##### [Get Zero Trust certificate configuration](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/configurations/subresources/custom_certificate/methods/get) Deprecated client.zeroTrust.gateway.configurations.customCertificate.get(CustomCertificateGetParams {account\_id } params, RequestOptionsoptions?): [CustomCertificateSettings]() {enabled, id, binding\_status, updated\_at } | null GET/accounts/{account\_id}/gateway/configuration/custom\_certificate #### GatewayLists ##### [List Zero Trust lists](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/lists/methods/list) client.zeroTrust.gateway.lists.list(ListListParams {account\_id, direction, filter, 3 more } params, RequestOptionsoptions?): SinglePage< [GatewayList]() {id, count, created\_at, 5 more } > GET/accounts/{account\_id}/gateway/lists ##### [Get Zero Trust list details](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/lists/methods/get) client.zeroTrust.gateway.lists.get(stringlistID, ListGetParams {account\_id } params, RequestOptionsoptions?): [GatewayList]() {id, count, created\_at, 5 more } GET/accounts/{account\_id}/gateway/lists/{list\_id} ##### [Create Zero Trust list](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/lists/methods/create) client.zeroTrust.gateway.lists.create(ListCreateParams {account\_id, name, type, 2 more } params, RequestOptionsoptions?): [ListCreateResponse]() {id, created\_at, description, 4 more } POST/accounts/{account\_id}/gateway/lists ##### [Update Zero Trust list](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/lists/methods/update) client.zeroTrust.gateway.lists.update(stringlistID, ListUpdateParams {account\_id, name, description, items } params, RequestOptionsoptions?): [GatewayList]() {id, count, created\_at, 5 more } PUT/accounts/{account\_id}/gateway/lists/{list\_id} ##### [Patch Zero Trust list.](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/lists/methods/edit) client.zeroTrust.gateway.lists.edit(stringlistID, ListEditParams {account\_id, append, remove } params, RequestOptionsoptions?): [GatewayList]() {id, count, created\_at, 5 more } PATCH/accounts/{account\_id}/gateway/lists/{list\_id} ##### [Delete Zero Trust list](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/lists/methods/delete) client.zeroTrust.gateway.lists.delete(stringlistID, ListDeleteParams {account\_id } params, RequestOptionsoptions?): [ListDeleteResponse]() DELETE/accounts/{account\_id}/gateway/lists/{list\_id} ##### ModelsExpand Collapse

GatewayItem {created\_at, description, value }

created\_at?: string formatdate-time Link to this property description?: string Provide the list item description (optional). minimum0 Link to this property value?: string Specify the item value. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.lists%20%3E%20(model)%20gateway_item%20%3E%20(schema)>)

GatewayList {id, count, created\_at, 5 more }

id?: string Identify the API resource with a UUID. maxLength36 Link to this property count?: number Indicate the number of items in the list. Link to this property created\_at?: string formatdate-time Link to this property description?: string Provide the list description. Link to this property

items?: Array<GatewayItem {created\_at, description, value } > Provide the list items.

Link to this property name?: string Specify the list name. Link to this property

type?: "SERIAL"| "URL"| "DOMAIN"| 6 more Specify the list type.

One of the following: "SERIAL" Link to this property "URL" Link to this property "DOMAIN" Link to this property "EMAIL" Link to this property "IP" Link to this property "CATEGORY" Link to this property "LOCATION" Link to this property "DEVICE" Link to this property "AAGUID" Link to this property

Link to this property updated\_at?: string formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.lists%20%3E%20(model)%20gateway_list%20%3E%20(schema)>)

ListCreateResponse {id, created\_at, description, 4 more }

id?: string Identify the API resource with a UUID. maxLength36 Link to this property created\_at?: string formatdate-time Link to this property description?: string Provide the list description. Link to this property

items?: Array<GatewayItem {created\_at, description, value } > Provide the list items.

Link to this property name?: string Specify the list name. Link to this property

type?: "SERIAL"| "URL"| "DOMAIN"| 6 more Specify the list type.

Link to this property updated\_at?: string formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.lists%20%3E%20(model)%20list_create_response%20%3E%20(schema)>) ListDeleteResponse = unknown [Link to this property](<#(resource)%20zero_trust.gateway.lists%20%3E%20(model)%20list_delete_response%20%3E%20(schema)>) #### GatewayListsItems ##### [Get Zero Trust list items](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/lists/subresources/items/methods/list) client.zeroTrust.gateway.lists.items.list(stringlistID, ItemListParams {account\_id, page, per\_page } params, RequestOptionsoptions?): V4PagePaginationArray< [GatewayItem]() {created\_at, description, value } > GET/accounts/{account\_id}/gateway/lists/{list\_id}/items #### GatewayLocations ##### [List Zero Trust Gateway locations](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/locations/methods/list) client.zeroTrust.gateway.locations.list(LocationListParams {account\_id, direction, filter, 2 more } params, RequestOptionsoptions?): SinglePage< [Location]() {id, client\_default, created\_at, 12 more } > GET/accounts/{account\_id}/gateway/locations ##### [Get Zero Trust Gateway location details](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/locations/methods/get) client.zeroTrust.gateway.locations.get(stringlocationID, LocationGetParams {account\_id } params, RequestOptionsoptions?): [Location]() {id, client\_default, created\_at, 12 more } GET/accounts/{account\_id}/gateway/locations/{location\_id} ##### [Create a Zero Trust Gateway location](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/locations/methods/create) client.zeroTrust.gateway.locations.create(LocationCreateParams {account\_id, name, client\_default, 5 more } params, RequestOptionsoptions?): [Location]() {id, client\_default, created\_at, 12 more } POST/accounts/{account\_id}/gateway/locations ##### [Update a Zero Trust Gateway location](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/locations/methods/update) client.zeroTrust.gateway.locations.update(stringlocationID, LocationUpdateParams {account\_id, name, client\_default, 5 more } params, RequestOptionsoptions?): [Location]() {id, client\_default, created\_at, 12 more } PUT/accounts/{account\_id}/gateway/locations/{location\_id} ##### [Delete a Zero Trust Gateway location](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/locations/methods/delete) client.zeroTrust.gateway.locations.delete(stringlocationID, LocationDeleteParams {account\_id } params, RequestOptionsoptions?): [LocationDeleteResponse]() DELETE/accounts/{account\_id}/gateway/locations/{location\_id} ##### ModelsExpand Collapse

DOHEndpoint {enabled, networks, require\_token }

enabled?: boolean Indicate whether the DOH endpoint is enabled for this location. Link to this property

networks?: Array<IPNetwork {network } >| null Specify the list of allowed source IP network ranges for this endpoint. When the list is empty, the endpoint allows all source IPs. The list takes effect only if the endpoint is enabled for this location.

network: string Specify the IP address or IP CIDR. Link to this property

Link to this property require\_token?: boolean Specify whether the DOH endpoint requires user identity authentication. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20doh_endpoint%20%3E%20(schema)>)

DOTEndpoint {enabled, networks }

enabled?: boolean Indicate whether the DOT endpoint is enabled for this location. Link to this property

network: string Specify the IP address or IP CIDR. Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20dot_endpoint%20%3E%20(schema)>)

Endpoint {doh, dot, ipv4, ipv6 } Configure the destination endpoints for this location.

doh: DOHEndpoint {enabled, networks, require\_token } Link to this property dot: DOTEndpoint {enabled, networks } Link to this property ipv4: IPV4Endpoint {enabled } Link to this property ipv6: IPV6Endpoint {enabled, networks } Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20endpoint%20%3E%20(schema)>)

IPNetwork {network }

network: string Specify the IP address or IP CIDR. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20ip_network%20%3E%20(schema)>)

IPV4Endpoint {enabled }

enabled?: boolean Indicate whether the IPv4 endpoint is enabled for this location. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20ipv4_endpoint%20%3E%20(schema)>)

IPV6Endpoint {enabled, networks }

enabled?: boolean Indicate whether the IPV6 endpoint is enabled for this location. Link to this property

networks?: Array<IPV6Network {network } >| null Specify the list of allowed source IPv6 network ranges for this endpoint. When the list is empty, the endpoint allows all source IPs. The list takes effect only if the endpoint is enabled for this location.

network: string Specify the IPv6 address or IPv6 CIDR. Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20ipv6_endpoint%20%3E%20(schema)>)

IPV6Network {network }

network: string Specify the IPv6 address or IPv6 CIDR. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20ipv6_network%20%3E%20(schema)>)

Location {id, client\_default, created\_at, 12 more }

id?: string Link to this property client\_default?: boolean Indicate whether this location is the default location. Link to this property created\_at?: string formatdate-time Link to this property dns\_destination\_ips\_id?: string Indicate the identifier of the pair of IPv4 addresses assigned to this location. Link to this property dns\_destination\_ipv6\_block\_id?: string| null Specify the UUID of the IPv6 block brought to the gateway so that this location’s IPv6 address is allocated from the Bring Your Own IPv6 (BYOIPv6) block rather than the standard Cloudflare IPv6 block. Link to this property doh\_subdomain?: string Specify the DNS over HTTPS domain that receives DNS requests. Gateway automatically generates this value. Link to this property ecs\_support?: boolean Indicate whether the location must resolve EDNS queries. Link to this property endpoints?: Endpoint {doh, dot, ipv4, ipv6 } | null Configure the destination endpoints for this location. Link to this property ip?: string Defines the automatically generated IPv6 destination IP assigned to this location. Gateway counts all DNS requests sent to this IP as requests under this location. Link to this property ipv4\_destination?: string Show the primary destination IPv4 address from the pair identified dns\_destination\_ips\_id. This field read-only. Link to this property ipv4\_destination\_backup?: string Show the backup destination IPv4 address from the pair identified dns\_destination\_ips\_id. This field read-only. Link to this property

max\_ttl?: MaxTTL| null Controls how DNS response TTLs are capped for this location relative to the account max_ttl_secs setting. Omitting max_ttl on update resets it to inherit.

mode: "inherit"| "override"| "disabled" inherit uses the account max_ttl_secs. override uses this location’s ttl_secs. disabled leaves returned TTLs unchanged.

One of the following: "inherit" Link to this property "override" Link to this property "disabled" Link to this property

Link to this property ttl\_secs?: number| null Location-specific cap on DNS response TTLs, in seconds. Required when mode is override. Must be omitted when mode is inherit or disabled. maximum36000 minimum60 Link to this property

Link to this property name?: string Specify the location name. Link to this property

networks?: Array<Network>| null Specify the list of network ranges from which requests at this location originate. The list takes effect only if it is non-empty and the IPv4 endpoint is enabled for this location.

network: string Specify the IPv4 address or IPv4 CIDR. Limit IPv4 CIDRs to a maximum of /24. Link to this property

Link to this property updated\_at?: string formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20location%20%3E%20(schema)>) LocationDeleteResponse = unknown [Link to this property](<#(resource)%20zero_trust.gateway.locations%20%3E%20(model)%20location_delete_response%20%3E%20(schema)>) #### GatewayLogging ##### [Get logging settings for the Zero Trust account](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/logging/methods/get) client.zeroTrust.gateway.logging.get(LoggingGetParams {account\_id } params, RequestOptionsoptions?): [LoggingSetting]() {redact\_pii, settings\_by\_rule\_type } GET/accounts/{account\_id}/gateway/logging ##### [Update Zero Trust account logging settings](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/logging/methods/update) client.zeroTrust.gateway.logging.update(LoggingUpdateParams {account\_id, redact\_pii, settings\_by\_rule\_type } params, RequestOptionsoptions?): [LoggingSetting]() {redact\_pii, settings\_by\_rule\_type } PUT/accounts/{account\_id}/gateway/logging ##### ModelsExpand Collapse

LoggingSetting {redact\_pii, settings\_by\_rule\_type }

redact\_pii?: boolean Indicate whether to redact personally identifiable information from activity logging (PII fields include source IP, user email, user ID, device ID, URL, referrer, and user agent). Link to this property

settings\_by\_rule\_type?: SettingsByRuleType {dns, http, l4 } Configure logging settings for each rule type.

dns?: DNS {log\_all, log\_blocks } Configure logging settings for DNS firewall.

log\_all?: boolean Specify whether to log all requests to this service. Link to this property log\_blocks?: boolean Specify whether to log only blocking requests to this service. Link to this property

Link to this property

http?: HTTP {log\_all, log\_blocks } Configure logging settings for HTTP/HTTPS firewall.

Link to this property

l4?: L4 {log\_all, log\_blocks } Configure logging settings for Network firewall.

Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.logging%20%3E%20(model)%20logging_setting%20%3E%20(schema)>) #### GatewayProxy Endpoints ##### [List proxy endpoints](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/list) client.zeroTrust.gateway.proxyEndpoints.list(ProxyEndpointListParams {account\_id, direction, filter, 2 more } params, RequestOptionsoptions?): SinglePage< [ProxyEndpoint]()> GET/accounts/{account\_id}/gateway/proxy\_endpoints ##### [Get a proxy endpoint](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/get) client.zeroTrust.gateway.proxyEndpoints.get(stringproxyEndpointID, ProxyEndpointGetParams {account\_id } params, RequestOptionsoptions?): [ProxyEndpoint]() GET/accounts/{account\_id}/gateway/proxy\_endpoints/{proxy\_endpoint\_id} ##### [Create a proxy endpoint](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/create) client.zeroTrust.gateway.proxyEndpoints.create(ProxyEndpointCreateParamsparams, RequestOptionsoptions?): [ProxyEndpoint]() POST/accounts/{account\_id}/gateway/proxy\_endpoints ##### [Update a proxy endpoint](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/edit) client.zeroTrust.gateway.proxyEndpoints.edit(stringproxyEndpointID, ProxyEndpointEditParams {account\_id, ips, name } params, RequestOptionsoptions?): [ProxyEndpoint]() PATCH/accounts/{account\_id}/gateway/proxy\_endpoints/{proxy\_endpoint\_id} ##### [Delete a proxy endpoint](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/proxy_endpoints/methods/delete) client.zeroTrust.gateway.proxyEndpoints.delete(stringproxyEndpointID, ProxyEndpointDeleteParams {account\_id } params, RequestOptionsoptions?): [ProxyEndpointDeleteResponse]() DELETE/accounts/{account\_id}/gateway/proxy\_endpoints/{proxy\_endpoint\_id} ##### ModelsExpand Collapse GatewayIPs = string Specify an IPv4 or IPv6 CIDR. Limit IPv6 to a maximum of /109 and IPv4 to a maximum of /25. [Link to this property](<#(resource)%20zero_trust.gateway.proxy_endpoints%20%3E%20(model)%20gateway_ips%20%3E%20(schema)>)

ProxyEndpoint = ZeroTrustGatewayProxyEndpointIP {ips, name, id, 4 more } | ZeroTrustGatewayProxyEndpointIdentity {kind, name, id, 3 more }

One of the following:

ZeroTrustGatewayProxyEndpointIP {ips, name, id, 4 more }

ips: Array<GatewayIPs> Specify the list of CIDRs to restrict ingress connections. Link to this property name: string Specify the name of the proxy endpoint. Link to this property id?: string Link to this property created\_at?: string formatdate-time Link to this property kind?: "ip" The proxy endpoint kind Link to this property subdomain?: string Specify the subdomain to use as the destination in the proxy client. Link to this property updated\_at?: string formatdate-time Link to this property

Link to this property

ZeroTrustGatewayProxyEndpointIdentity {kind, name, id, 3 more }

kind: "identity" The proxy endpoint kind Link to this property name: string Specify the name of the proxy endpoint. Link to this property id?: string Link to this property created\_at?: string formatdate-time Link to this property subdomain?: string Specify the subdomain to use as the destination in the proxy client. Link to this property updated\_at?: string formatdate-time Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.proxy_endpoints%20%3E%20(model)%20proxy_endpoint%20%3E%20(schema)>) ProxyEndpointDeleteResponse = unknown [Link to this property](<#(resource)%20zero_trust.gateway.proxy_endpoints%20%3E%20(model)%20proxy_endpoint_delete_response%20%3E%20(schema)>) #### GatewayRules ##### [List Zero Trust Gateway rules](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/rules/methods/list) client.zeroTrust.gateway.rules.list(RuleListParams {account\_id, direction, filter, 2 more } params, RequestOptionsoptions?): SinglePage< [GatewayRule]() {action, enabled, filters, 18 more } > GET/accounts/{account\_id}/gateway/rules ##### [Get Zero Trust Gateway rule details.](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/rules/methods/get) client.zeroTrust.gateway.rules.get(stringruleID, RuleGetParams {account\_id } params, RequestOptionsoptions?): [GatewayRule]() {action, enabled, filters, 18 more } GET/accounts/{account\_id}/gateway/rules/{rule\_id} ##### [Create a Zero Trust Gateway rule](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/rules/methods/create) client.zeroTrust.gateway.rules.create(RuleCreateParams {account\_id, action, name, 10 more } params, RequestOptionsoptions?): [GatewayRule]() {action, enabled, filters, 18 more } POST/accounts/{account\_id}/gateway/rules ##### [Update a Zero Trust Gateway rule](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/rules/methods/update) client.zeroTrust.gateway.rules.update(stringruleID, RuleUpdateParams {account\_id, action, name, 10 more } params, RequestOptionsoptions?): [GatewayRule]() {action, enabled, filters, 18 more } PUT/accounts/{account\_id}/gateway/rules/{rule\_id} ##### [Delete a Zero Trust Gateway rule](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/rules/methods/delete) client.zeroTrust.gateway.rules.delete(stringruleID, RuleDeleteParams {account\_id } params, RequestOptionsoptions?): [RuleDeleteResponse]() DELETE/accounts/{account\_id}/gateway/rules/{rule\_id} ##### [List Zero Trust Gateway rules inherited from the parent account](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/rules/methods/list_tenant) client.zeroTrust.gateway.rules.listTenant(RuleListTenantParams {account\_id } params, RequestOptionsoptions?): SinglePage< [GatewayRule]() {action, enabled, filters, 18 more } > GET/accounts/{account\_id}/gateway/rules/tenant ##### [Reset the expiration of a Zero Trust Gateway Rule](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/rules/methods/reset_expiration) client.zeroTrust.gateway.rules.resetExpiration(stringruleID, RuleResetExpirationParams {account\_id } params, RequestOptionsoptions?): [GatewayRule]() {action, enabled, filters, 18 more } POST/accounts/{account\_id}/gateway/rules/{rule\_id}/reset\_expiration ##### ModelsExpand Collapse

DNSResolverSettingsV4 {ip, port, route\_through\_private\_network, vnet\_id }

ip: string Specify the IPv4 address of the upstream resolver. Link to this property port?: number Specify a port number to use for the upstream resolver. Defaults to 53 if unspecified. Link to this property route\_through\_private\_network?: boolean Indicate whether to connect to this resolver over a private network. Must set when vnet\_id set. Link to this property vnet\_id?: string Specify an optional virtual network for this resolver. Uses default virtual network id if omitted. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20dns_resolver_settings_v4%20%3E%20(schema)>)

DNSResolverSettingsV6 {ip, port, route\_through\_private\_network, vnet\_id }

ip: string Specify the IPv6 address of the upstream resolver. Link to this property port?: number Specify a port number to use for the upstream resolver. Defaults to 53 if unspecified. Link to this property route\_through\_private\_network?: boolean Indicate whether to connect to this resolver over a private network. Must set when vnet\_id set. Link to this property vnet\_id?: string Specify an optional virtual network for this resolver. Uses default virtual network id if omitted. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20dns_resolver_settings_v6%20%3E%20(schema)>)

GatewayFilter = "http"| "dns"| "l4"| 2 more Specify the protocol or layer to use.

One of the following: "http" Link to this property "dns" Link to this property "l4" Link to this property "egress" Link to this property "dns\_resolver" Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20gateway_filter%20%3E%20(schema)>)

GatewayRule {action, enabled, filters, 18 more }

action: "on"| "off"| "allow"| 13 more Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to true.

Link to this property enabled: boolean Specify whether the rule is enabled. Link to this property

filters: Array<GatewayFilter> Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.

One of the following: "http" Link to this property "dns" Link to this property "l4" Link to this property "egress" Link to this property "dns\_resolver" Link to this property

Link to this property name: string Specify the rule name. Link to this property precedence: number Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to Order of enforcement to manage precedence via Terraform. Link to this property traffic: string Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response. Link to this property id?: string Identify the API resource with a UUID. formatuuid maxLength36 Link to this property created\_at?: string formatdate-time Link to this property deleted\_at?: string| null Indicate the date of deletion, if any. formatdate-time Link to this property description?: string Specify the rule description. Link to this property device\_posture?: string Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response. Link to this property

expiration?: Expiration| null Defines the expiration time stamp and default duration of a DNS policy. Takes precedence over the policy’s schedule configuration, if any. This does not apply to HTTP or network policies. Settable only for dns rules.

expires\_at: string Show the timestamp when the policy expires and stops applying. The value must follow RFC 3339 and include a UTC offset. The system accepts non-zero offsets but converts them to the equivalent UTC+00:00 value and returns timestamps with a trailing Z. Expiration policies ignore client timezones and expire globally at the specified expires\_at time. formatdate-time Link to this property duration?: number Defines the default duration a policy active in minutes. Must set in order to use the reset_expiration endpoint on this rule. minimum5 Link to this property expired?: boolean Indicates whether the policy is expired. Link to this property

Link to this property identity?: string Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response. Link to this property read\_only?: boolean Indicate that this rule is shared via the Orgs API and read only. Link to this property rule\_settings?: RuleSetting {add\_headers, allow\_child\_bypass, audit\_ssh, 25 more } Defines settings for this rule. Settings apply only to specific rule types and must use compatible selectors. If Terraform detects drift, confirm the setting supports your rule type and check whether the API modifies the value. Use API-returned values in your configuration to prevent drift. Link to this property schedule?: Schedule {fri, mon, sat, 5 more } | null Defines the schedule for activating DNS policies. Settable only for dns and dns_resolver rules. Link to this property sharable?: boolean Indicate that this rule is sharable via the Orgs API. Link to this property source\_account?: string Provide the account tag of the account that created the rule. Link to this property updated\_at?: string formatdate-time Link to this property version?: number Indicate the version number of the rule(read-only). Link to this property warning\_status?: string| null Indicate a warning for a misconfigured rule, if any. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20gateway_rule%20%3E%20(schema)>)

RuleSetting {add\_headers, allow\_child\_bypass, audit\_ssh, 25 more } Defines settings for this rule. Settings apply only to specific rule types and must use compatible selectors. If Terraform detects drift, confirm the setting supports your rule type and check whether the API modifies the value. Use API-returned values in your configuration to prevent drift.

add\_headers?: Record<string, Array<string>>| null Add custom headers to allowed requests as key-value pairs. Use header names as keys that map to arrays of header values. Header values may contain @{selector.name} variable references that are interpolated at the edge. Use @@{ to escape a literal @{. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes and each header value may not exceed 4 KB. Settable only for http rules with the action set to allow. Link to this property allow\_child\_bypass?: boolean| null Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules. Link to this property

audit\_ssh?: AuditSSH| null Define the settings for the Audit SSH action. Settable only for l4 rules with audit_ssh action.

command\_logging?: boolean Enable SSH command logging. Link to this property

Link to this property

biso\_admin\_controls?: BISOAdminControls {copy, dcp, dd, 10 more } Configure browser isolation behavior. Settable only for http rules with the action set to isolate.

copy?: "enabled"| "disabled"| "remote\_only" Configure copy behavior. If set to remote\_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == “v2”.

One of the following: "enabled" Link to this property "disabled" Link to this property "remote\_only" Link to this property

Link to this property dcp?: boolean Set to false to enable copy-pasting. Only applies when version == "v1". Link to this property dd?: boolean Set to false to enable downloading. Only applies when version == "v1". Link to this property dk?: boolean Set to false to enable keyboard usage. Only applies when version == "v1". Link to this property

download?: "enabled"| "disabled"| "remote\_only" Configure download behavior. When set to remote\_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == “v2”.

One of the following: "enabled" Link to this property "disabled" Link to this property "remote\_only" Link to this property

Link to this property dp?: boolean Set to false to enable printing. Only applies when version == "v1". Link to this property du?: boolean Set to false to enable uploading. Only applies when version == "v1". Link to this property

keyboard?: "enabled"| "disabled" Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == “v2”.

One of the following: "enabled" Link to this property "disabled" Link to this property

Link to this property

paste?: "enabled"| "disabled"| "remote\_only" Configure paste behavior. If set to remote\_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == “v2”.

One of the following: "enabled" Link to this property "disabled" Link to this property "remote\_only" Link to this property

Link to this property

printing?: "enabled"| "disabled" Configure print behavior. Default, Printing is enabled. Applies only when version == “v2”.

One of the following: "enabled" Link to this property "disabled" Link to this property

Link to this property

upload?: "enabled"| "disabled" Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == “v2”.

One of the following: "enabled" Link to this property "disabled" Link to this property

Link to this property

version?: "v1"| "v2" Indicate which version of the browser isolation controls should apply.

One of the following: "v1" Link to this property "v2" Link to this property

Link to this property wm\_id?: string Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser. formatuuid maxLength36 minLength1 Link to this property

Link to this property

block\_page?: BlockPage| null Configure custom block page settings. If missing or null, use the account settings. Settable only for http rules with the action set to block.

Link to this property block\_page\_enabled?: boolean Enable the custom block page. Settable only for dns rules with action block. Link to this property block\_reason?: string| null Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for dns, l4, and http rules when the action set to block. Link to this property bypass\_parent\_rule?: boolean| null Set to enable MSP accounts to bypass their parent’s rules. Only MSP child accounts can set this. Settable for all types of rules. Link to this property

check\_session?: CheckSession| null Configure session check behavior. Settable only for l4 and http rules with the action set to allow.

duration?: string Sets the required session freshness threshold. The API returns a normalized version of this value. Link to this property enforce?: boolean Enable session enforcement. Link to this property

Link to this property delete\_headers?: Array<string>| null Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for http rules with the action set to allow. Link to this property

dns\_resolvers?: DNSResolvers| null Configure custom resolvers to route queries that match the resolver policy. Unused with ‘resolve\_dns\_through\_cloudflare’ or ‘resolve\_dns\_internally’ settings. DNS queries get routed to the address closest to their origin. Only valid when a rule’s action set to ‘resolve’. Settable only for dns_resolver rules.

ipv4?: Array<DNSResolverSettingsV4 {ip, port, route\_through\_private\_network, vnet\_id } >

Link to this property

ipv6?: Array<DNSResolverSettingsV6 {ip, port, route\_through\_private\_network, vnet\_id } >

Link to this property

egress?: Egress| null Configure how Gateway Proxy traffic egresses. You can enable this setting for rules with Egress actions and filters, or omit it to indicate local egress via WARP IPs. Settable only for egress rules.

ipv4?: string Specify the IPv4 address to use for egress. Link to this property ipv4\_fallback?: string Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set ‘0.0.0.0’ to indicate local egress via WARP IPs. Link to this property ipv6?: string Specify the IPv6 range to use for egress. Link to this property

Link to this property

forensic\_copy?: ForensicCopy| null Configure whether a copy of the HTTP request will be sent to storage when the rule matches.

enabled?: boolean Enable sending the copy to storage. Link to this property

Link to this property ignore\_cname\_category\_matches?: boolean Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for dns and dns_resolver rules. Link to this property insecure\_disable\_dnssec\_validation?: boolean Specify whether to disable DNSSEC validation (for Allow actions) \[INSECURE]. Settable only for dns rules. Link to this property ip\_categories?: boolean Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for dns and dns_resolver rules. Link to this property ip\_indicator\_feeds?: boolean Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for dns and dns_resolver rules. Link to this property

l4override?: L4override| null Send matching traffic to the supplied destination IP address and port. Settable only for l4 rules with the action set to l4_override.

ip?: string Defines the IPv4 or IPv6 address. Link to this property port?: number Defines a port number to use for TCP/UDP overrides. Link to this property

Link to this property

notification\_settings?: NotificationSettings| null Configure a notification to display on the user’s device when this rule matched. Settable for all types of rules with the action set to block.

enabled?: boolean Enable notification. Link to this property include\_context?: boolean Indicates whether to pass the context information as query parameters. Link to this property msg?: string Customize the message shown in the notification. Link to this property support\_url?: string Defines an optional URL to direct users to additional information. If unset, the notification opens a block page. Link to this property

Link to this property override\_host?: string Defines a hostname for override, for the matching DNS queries. Settable only for dns rules with the action set to override. Link to this property override\_ips?: Array<string>| null Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for dns rules with the action set to override. Link to this property

payload\_log?: PayloadLog| null Configure DLP payload logging. Settable only for http rules.

enabled?: boolean Enable DLP payload logging for this rule. Link to this property

Link to this property

quarantine?: Quarantine| null Configure settings that apply to quarantine rules. Settable only for http rules.

file\_types?: Array<"exe"| "pdf"| "doc"| 10 more> Specify the types of files to sandbox.

One of the following: "exe" Link to this property "pdf" Link to this property "doc" Link to this property "docm" Link to this property "docx" Link to this property "rtf" Link to this property "ppt" Link to this property "pptx" Link to this property "xls" Link to this property "xlsm" Link to this property "xlsx" Link to this property "zip" Link to this property "rar" Link to this property

Link to this property

redirect?: Redirect| null Apply settings to redirect rules. Settable only for http rules with the action set to redirect.

target\_uri: string Specify the URI to which the user is redirected. formaturi Link to this property include\_context?: boolean Specify whether to pass the context information as query parameters. Link to this property preserve\_path\_and\_query?: boolean Specify whether to append the path and query parameters from the original request to target\_uri. Link to this property

Link to this property

resolve\_dns\_internally?: ResolveDNSInternally| null Configure to forward the query to the internal DNS service, passing the specified ‘view\_id’ as input. Not used when ‘dns\_resolvers’ is specified or ‘resolve\_dns\_through\_cloudflare’ is set. Only valid when a rule’s action set to ‘resolve’. Settable only for dns_resolver rules.

fallback?: "none"| "public\_dns" Specify the fallback behavior to apply when the internal DNS response code differs from ‘NOERROR’ or when the response data contains only CNAME records for ‘A’ or ‘AAAA’ queries.

One of the following: "none" Link to this property "public\_dns" Link to this property

Link to this property view\_id?: string Specify the internal DNS view identifier to pass to the internal DNS service. Link to this property

Link to this property resolve\_dns\_through\_cloudflare?: boolean| null Enable to send queries that match the policy to Cloudflare’s default 1.1.1.1 DNS resolver. Cannot set when ‘dns\_resolvers’ specified or ‘resolve\_dns\_internally’ is set. Only valid when a rule’s action set to ‘resolve’. Settable only for dns_resolver rules. Link to this property set\_headers?: Record<string, Array<string>>| null Replace existing headers on allowed requests with the specified key-value pairs. If a header does not exist, it is added. Header values may contain @{selector.name} variable references that are interpolated at the edge. Use @@{ to escape a literal @{. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes and each header value may not exceed 4 KB. Settable only for http rules with the action set to allow. Link to this property

untrusted\_cert?: UntrustedCERT| null Configure behavior when an upstream certificate is invalid or an SSL error occurs. Settable only for http rules with the action set to allow.

action?: "pass\_through"| "block"| "error" Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.

One of the following: "pass\_through" Link to this property "block" Link to this property "error" Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20rule_setting%20%3E%20(schema)>)

Schedule {fri, mon, sat, 5 more } Defines the schedule for activating DNS policies. Settable only for dns and dns_resolver rules.

fri?: string Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property mon?: string Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property sat?: string Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property sun?: string Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property thu?: string Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property time\_zone?: string Specify the time zone for rule evaluation. When a valid time zone city name is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user’s IP address. Colo time zone is used when the user’s IP address does not resolve to a location. Link to this property tue?: string Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property wed?: string Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20schedule%20%3E%20(schema)>) RuleDeleteResponse = unknown [Link to this property](<#(resource)%20zero_trust.gateway.rules%20%3E%20(model)%20rule_delete_response%20%3E%20(schema)>) #### GatewayCertificates ##### [List Zero Trust certificates](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/certificates/methods/list) client.zeroTrust.gateway.certificates.list(CertificateListParams {account\_id } params, RequestOptionsoptions?): SinglePage< [CertificateListResponse]() {id, binding\_status, certificate, 10 more } > GET/accounts/{account\_id}/gateway/certificates ##### [Get Zero Trust certificate details](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/certificates/methods/get) client.zeroTrust.gateway.certificates.get(stringcertificateID, CertificateGetParams {account\_id } params, RequestOptionsoptions?): [CertificateGetResponse]() {id, binding\_status, certificate, 10 more } GET/accounts/{account\_id}/gateway/certificates/{certificate\_id} ##### [Create Zero Trust certificate](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/certificates/methods/create) client.zeroTrust.gateway.certificates.create(CertificateCreateParams {account\_id, validity\_period\_days } params, RequestOptionsoptions?): [CertificateCreateResponse]() {id, binding\_status, certificate, 10 more } POST/accounts/{account\_id}/gateway/certificates ##### [Delete Zero Trust certificate](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/certificates/methods/delete) client.zeroTrust.gateway.certificates.delete(stringcertificateID, CertificateDeleteParams {account\_id } params, RequestOptionsoptions?): [CertificateDeleteResponse]() {id, binding\_status, certificate, 10 more } DELETE/accounts/{account\_id}/gateway/certificates/{certificate\_id} ##### [Activate a Zero Trust certificate](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/certificates/methods/activate) client.zeroTrust.gateway.certificates.activate(stringcertificateID, CertificateActivateParams {account\_id } params, RequestOptionsoptions?): [CertificateActivateResponse]() {id, binding\_status, certificate, 10 more } POST/accounts/{account\_id}/gateway/certificates/{certificate\_id}/activate ##### [Deactivate a Zero Trust certificate](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/certificates/methods/deactivate) client.zeroTrust.gateway.certificates.deactivate(stringcertificateID, CertificateDeactivateParams {account\_id } params, RequestOptionsoptions?): [CertificateDeactivateResponse]() {id, binding\_status, certificate, 10 more } POST/accounts/{account\_id}/gateway/certificates/{certificate\_id}/deactivate ##### ModelsExpand Collapse

CertificateListResponse {id, binding\_status, certificate, 10 more }

id?: string Identify the certificate with a UUID. maxLength36 Link to this property

binding\_status?: "pending\_deployment"| "available"| "pending\_deletion"| "inactive" Indicate the read-only deployment status of the certificate on Cloudflare’s edge. Gateway TLS interception can use certificates in the ‘available’ (previously called ‘active’) state.

One of the following: "pending\_deployment" Link to this property "available" Link to this property "pending\_deletion" Link to this property "inactive" Link to this property

Link to this property certificate?: string Provide the CA certificate (read-only). Link to this property created\_at?: string formatdate-time Link to this property expires\_on?: string formatdate-time Link to this property fingerprint?: string Provide the SHA256 fingerprint of the certificate (read-only). Link to this property in\_use?: boolean Indicate whether Gateway TLS interception uses this certificate (read-only). You cannot set this value directly. To configure interception, use the Gateway configuration setting named certificate (read-only). Link to this property issuer\_org?: string Indicate the organization that issued the certificate (read-only). Link to this property issuer\_raw?: string Provide the entire issuer field of the certificate (read-only). Link to this property region?: string Indicate the read-only region the certificate authority’s key material is pinned to. Omitted for certificates that were created without a region. Link to this property

type?: "custom"| "gateway\_managed" Indicate the read-only certificate type, BYO-PKI (custom) or Gateway-managed.

One of the following: "custom" Link to this property "gateway\_managed" Link to this property

Link to this property updated\_at?: string formatdate-time Link to this property uploaded\_on?: string formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.certificates%20%3E%20(model)%20certificate_list_response%20%3E%20(schema)>)

CertificateGetResponse {id, binding\_status, certificate, 10 more }

id?: string Identify the certificate with a UUID. maxLength36 Link to this property

One of the following: "pending\_deployment" Link to this property "available" Link to this property "pending\_deletion" Link to this property "inactive" Link to this property

type?: "custom"| "gateway\_managed" Indicate the read-only certificate type, BYO-PKI (custom) or Gateway-managed.

One of the following: "custom" Link to this property "gateway\_managed" Link to this property

Link to this property updated\_at?: string formatdate-time Link to this property uploaded\_on?: string formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.certificates%20%3E%20(model)%20certificate_get_response%20%3E%20(schema)>)

CertificateCreateResponse {id, binding\_status, certificate, 10 more }

id?: string Identify the certificate with a UUID. maxLength36 Link to this property

One of the following: "pending\_deployment" Link to this property "available" Link to this property "pending\_deletion" Link to this property "inactive" Link to this property

type?: "custom"| "gateway\_managed" Indicate the read-only certificate type, BYO-PKI (custom) or Gateway-managed.

One of the following: "custom" Link to this property "gateway\_managed" Link to this property

Link to this property updated\_at?: string formatdate-time Link to this property uploaded\_on?: string formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.certificates%20%3E%20(model)%20certificate_create_response%20%3E%20(schema)>)

CertificateDeleteResponse {id, binding\_status, certificate, 10 more }

id?: string Identify the certificate with a UUID. maxLength36 Link to this property

One of the following: "pending\_deployment" Link to this property "available" Link to this property "pending\_deletion" Link to this property "inactive" Link to this property

type?: "custom"| "gateway\_managed" Indicate the read-only certificate type, BYO-PKI (custom) or Gateway-managed.

One of the following: "custom" Link to this property "gateway\_managed" Link to this property

Link to this property updated\_at?: string formatdate-time Link to this property uploaded\_on?: string formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.certificates%20%3E%20(model)%20certificate_delete_response%20%3E%20(schema)>)

CertificateActivateResponse {id, binding\_status, certificate, 10 more }

id?: string Identify the certificate with a UUID. maxLength36 Link to this property

One of the following: "pending\_deployment" Link to this property "available" Link to this property "pending\_deletion" Link to this property "inactive" Link to this property

type?: "custom"| "gateway\_managed" Indicate the read-only certificate type, BYO-PKI (custom) or Gateway-managed.

One of the following: "custom" Link to this property "gateway\_managed" Link to this property

Link to this property updated\_at?: string formatdate-time Link to this property uploaded\_on?: string formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.certificates%20%3E%20(model)%20certificate_activate_response%20%3E%20(schema)>)

CertificateDeactivateResponse {id, binding\_status, certificate, 10 more }

id?: string Identify the certificate with a UUID. maxLength36 Link to this property

One of the following: "pending\_deployment" Link to this property "available" Link to this property "pending\_deletion" Link to this property "inactive" Link to this property

type?: "custom"| "gateway\_managed" Indicate the read-only certificate type, BYO-PKI (custom) or Gateway-managed.

One of the following: "custom" Link to this property "gateway\_managed" Link to this property

Link to this property updated\_at?: string formatdate-time Link to this property uploaded\_on?: string formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.certificates%20%3E%20(model)%20certificate_deactivate_response%20%3E%20(schema)>) #### GatewayPacfiles ##### [List PAC files](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/list) client.zeroTrust.gateway.pacfiles.list(PacfileListParams {account\_id, page, per\_page } params, RequestOptionsoptions?): V4PagePaginationArray< [PacfileListResponse]() {id, created\_at, description, 4 more } > GET/accounts/{account\_id}/gateway/pacfiles ##### [Get a PAC file](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/get) client.zeroTrust.gateway.pacfiles.get(stringpacfileID, PacfileGetParams {account\_id } params, RequestOptionsoptions?): [PacfileGetResponse]() {id, contents, created\_at, 5 more } GET/accounts/{account\_id}/gateway/pacfiles/{pacfile\_id} ##### [Create a PAC file](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/create) client.zeroTrust.gateway.pacfiles.create(PacfileCreateParams {account\_id, contents, name, 2 more } params, RequestOptionsoptions?): [PacfileCreateResponse]() {id, contents, created\_at, 5 more } POST/accounts/{account\_id}/gateway/pacfiles ##### [Update a Zero Trust Gateway PAC file](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/update) client.zeroTrust.gateway.pacfiles.update(stringpacfileID, PacfileUpdateParams {account\_id, contents, description, name } params, RequestOptionsoptions?): [PacfileUpdateResponse]() {id, contents, created\_at, 5 more } PUT/accounts/{account\_id}/gateway/pacfiles/{pacfile\_id} ##### [Delete a PAC file](https://developers.cloudflare.com/api/typescript/resources/zero_trust/subresources/gateway/subresources/pacfiles/methods/delete) client.zeroTrust.gateway.pacfiles.delete(stringpacfileID, PacfileDeleteParams {account\_id } params, RequestOptionsoptions?): [PacfileDeleteResponse]() DELETE/accounts/{account\_id}/gateway/pacfiles/{pacfile\_id} ##### ModelsExpand Collapse

PacfileListResponse {id, created\_at, description, 4 more }

id?: string Link to this property created\_at?: string formatdate-time Link to this property description?: string Detailed description of the PAC file. Link to this property name?: string Name of the PAC file. Link to this property slug?: string URL-friendly version of the PAC file name. Link to this property updated\_at?: string formatdate-time Link to this property url?: string Unique URL to download the PAC file. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.pacfiles%20%3E%20(model)%20pacfile_list_response%20%3E%20(schema)>)

PacfileGetResponse {id, contents, created\_at, 5 more }

id?: string Link to this property contents?: string Actual contents of the PAC file Link to this property created\_at?: string formatdate-time Link to this property description?: string Detailed description of the PAC file. Link to this property name?: string Name of the PAC file. Link to this property slug?: string URL-friendly version of the PAC file name. Link to this property updated\_at?: string formatdate-time Link to this property url?: string Unique URL to download the PAC file. Link to this property

[Link to this property](<#(resource)%20zero_trust.gateway.pacfiles%20%3E%20(model)%20pacfile_get_response%20%3E%20(schema)>)

PacfileCreateResponse {id, contents, created\_at, 5 more }

[Link to this property](<#(resource)%20zero_trust.gateway.pacfiles%20%3E%20(model)%20pacfile_create_response%20%3E%20(schema)>)

PacfileUpdateResponse {id, contents, created\_at, 5 more }

[Link to this property](<#(resource)%20zero_trust.gateway.pacfiles%20%3E%20(model)%20pacfile_update_response%20%3E%20(schema)>) PacfileDeleteResponse = unknown [Link to this property](<#(resource)%20zero_trust.gateway.pacfiles%20%3E%20(model)%20pacfile_delete_response%20%3E%20(schema)>)