{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Adds a new application to Access.","properties":{"path":{"type":"object","properties":{"account_id":{"$ref":"#/definitions/access_identifier"}},"required":["account_id"],"additionalProperties":false},"body":{"$ref":"#/definitions/access_app_request"}},"required":["path","body"],"additionalProperties":false,"definitions":{"access_identifier":{"description":"Identifier.","type":"string","maxLength":32,"examples":["023e105f4ecef8ad9ca31a8372d0c353"]},"access_app_request":{"anyOf":[{"allOf":[{"$ref":"#/definitions/access_end_user_props"}],"title":"End User Application","type":"object"},{"allOf":[{"$ref":"#/definitions/access_self_hosted_props"},{"$ref":"#/definitions/access_app_req_embedded_policies"},{"$ref":"#/definitions/access_app_req_embedded_scim_config"}],"title":"Self Hosted Application","type":"object"},{"allOf":[{"$ref":"#/definitions/access_saas_props"},{"$ref":"#/definitions/access_app_req_embedded_policies"},{"$ref":"#/definitions/access_app_req_embedded_scim_config"}],"title":"SaaS Application","type":"object"},{"allOf":[{"$ref":"#/definitions/access_ssh_props"},{"$ref":"#/definitions/access_app_req_embedded_policies"},{"$ref":"#/definitions/access_app_req_embedded_scim_config"}],"title":"Browser SSH Application","type":"object"},{"allOf":[{"$ref":"#/definitions/access_vnc_props"},{"$ref":"#/definitions/access_app_req_embedded_policies"},{"$ref":"#/definitions/access_app_req_embedded_scim_config"}],"title":"Browser VNC Application","type":"object"},{"allOf":[{"$ref":"#/definitions/access_app_launcher_props"},{"$ref":"#/definitions/access_app_req_embedded_policies"}],"title":"App Launcher Application","type":"object"},{"allOf":[{"$ref":"#/definitions/access_warp_props"},{"$ref":"#/definitions/access_app_req_embedded_policies"}],"title":"Device Enrollment Permissions Application","type":"object"},{"allOf":[{"$ref":"#/definitions/access_biso_props"},{"$ref":"#/definitions/access_app_req_embedded_policies"}],"title":"Browser Isolation Permissions Application","type":"object"},{"allOf":[{"$ref":"#/definitions/access_proxy_endpoint_props"},{"$ref":"#/definitions/access_app_req_embedded_policies"}],"title":"Gateway Identity Proxy Endpoint Application","type":"object"},{"allOf":[{"$ref":"#/definitions/access_bookmark_props"},{"$ref":"#/definitions/access_app_req_embedded_policies"}],"title":"Bookmark application","type":"object"},{"allOf":[{"$ref":"#/definitions/access_infra_props"},{"$ref":"#/definitions/access_infra_app_req_embedded_policies"}],"title":"Infrastructure application","type":"object"},{"allOf":[{"$ref":"#/definitions/access_rdp_props"},{"$ref":"#/definitions/access_app_req_embedded_policies"}],"title":"Browser RDP Application","type":"object"},{"allOf":[{"$ref":"#/definitions/access_mcp_props"},{"$ref":"#/definitions/access_app_req_embedded_policies"}],"title":"MCP Server Application","type":"object"},{"allOf":[{"$ref":"#/definitions/access_mcp_portal_props"},{"$ref":"#/definitions/access_app_req_embedded_policies"}],"title":"MCP Server Portal Application","type":"object"}]},"access_end_user_props":{"description":"An end user application is a public self-hosted application backed by exactly one organization-owned user population. End user applications use a canonical allow-everyone policy and do not support custom policies, SCIM configuration, MFA configuration, or private destinations.\n","type":"object","properties":{"allowed_idps":{"$ref":"#/definitions/access_allowed_idps"},"destinations":{"$ref":"#/definitions/access_end_user_destinations"},"domain":{"$ref":"#/definitions/access_domain"},"name":{"$ref":"#/definitions/access_name-8"},"oauth_configuration":{"$ref":"#/definitions/access_end_user_oauth_configuration"},"self_hosted_domains":{"$ref":"#/definitions/access_self_hosted_domains"},"type":{"allOf":[{"$ref":"#/definitions/access_type"},{"enum":["end_user"],"type":"string","examples":["end_user"]}]},"user_populations":{"description":"The single user population associated with this application.","type":"array","items":{"$ref":"#/definitions/access_uuid"},"maxItems":1,"minItems":1}},"required":["type","oauth_configuration","user_populations"],"title":"End User Application"},"access_self_hosted_props":{"type":"object","properties":{"allow_authenticate_via_warp":{"$ref":"#/definitions/access_allow_authenticate_via_warp-2"},"allow_iframe":{"$ref":"#/definitions/access_allow_iframe"},"allowed_idps":{"$ref":"#/definitions/access_allowed_idps"},"app_launcher_visible":{"$ref":"#/definitions/access_app_launcher_visible"},"auto_redirect_to_identity":{"$ref":"#/definitions/access_auto_redirect_to_identity-2"},"cors_headers":{"$ref":"#/definitions/access_cors_headers"},"custom_deny_message":{"$ref":"#/definitions/access_custom_deny_message"},"custom_deny_url":{"$ref":"#/definitions/access_custom_deny_url"},"custom_non_identity_deny_url":{"$ref":"#/definitions/access_custom_non_identity_deny_url"},"custom_pages":{"$ref":"#/definitions/access_custom_pages-2"},"destinations":{"$ref":"#/definitions/access_destinations"},"domain":{"$ref":"#/definitions/access_domain"},"eager_redirect_cookie_setting":{"$ref":"#/definitions/access_eager_redirect_cookie_setting"},"enable_binding_cookie":{"$ref":"#/definitions/access_enable_binding_cookie"},"http_only_cookie_attribute":{"$ref":"#/definitions/access_http_only_cookie_attribute"},"logo_url":{"$ref":"#/definitions/access_logo_url"},"mfa_config":{"$ref":"#/definitions/access_mfa_config"},"name":{"$ref":"#/definitions/access_name-8"},"oauth_configuration":{"$ref":"#/definitions/access_oauth_configuration"},"options_preflight_bypass":{"$ref":"#/definitions/access_options_preflight_bypass"},"path_cookie_attribute":{"$ref":"#/definitions/access_path_cookie_attribute"},"read_service_tokens_from_header":{"$ref":"#/definitions/access_read_service_tokens_from_header"},"same_site_cookie_attribute":{"$ref":"#/definitions/access_same_site_cookie_attribute"},"scim_config":{"$ref":"#/definitions/access_scim_config"},"self_hosted_domains":{"$ref":"#/definitions/access_self_hosted_domains"},"service_auth_401_redirect":{"$ref":"#/definitions/access_service_auth_401_redirect"},"session_duration":{"$ref":"#/definitions/access_session_duration-2"},"skip_interstitial":{"$ref":"#/definitions/access_skip_interstitial"},"tags":{"$ref":"#/definitions/access_tags-2"},"type":{"allOf":[{"$ref":"#/definitions/access_type"},{"not":{"enum":["end_user"],"type":"string"},"type":"string","examples":["self_hosted"]}]},"use_clientless_isolation_app_launcher_url":{"$ref":"#/definitions/access_use_clientless_isolation_app_launcher_url"}},"required":["type","domain"],"title":"Self Hosted Application"},"access_app_req_embedded_policies":{"type":"object","properties":{"policies":{"description":"The policies that Access applies to the application, in ascending order of precedence. Items can reference existing policies or create new policies exclusive to the application. Reusable and inline policies are mutually exclusive.","type":"array","items":{"oneOf":[{"$ref":"#/definitions/access_app_policy_link"},{"allOf":[{"description":"A policy UID to link to this application.","type":"string"},{"$ref":"#/definitions/access_uuid-2"}]},{"allOf":[{"type":"object"},{"description":"An application-scoped policy JSON. If the policy does not yet exist, it will be created.","properties":{"id":{"$ref":"#/definitions/access_uuid-2"}},"type":"object"},{"$ref":"#/definitions/access_app_policy_request"}]}]}}}},"access_app_req_embedded_scim_config":{"type":"object","properties":{"scim_config":{"$ref":"#/definitions/access_scim_config"}}},"access_saas_props":{"type":"object","properties":{"allowed_idps":{"$ref":"#/definitions/access_allowed_idps"},"app_launcher_visible":{"$ref":"#/definitions/access_app_launcher_visible"},"auto_redirect_to_identity":{"$ref":"#/definitions/access_auto_redirect_to_identity-2"},"custom_pages":{"$ref":"#/definitions/access_custom_pages-2"},"logo_url":{"$ref":"#/definitions/access_logo_url"},"name":{"$ref":"#/definitions/access_name-8"},"saas_app":{"type":"object","oneOf":[{"$ref":"#/definitions/access_saml_saas_app"},{"$ref":"#/definitions/access_oidc_saas_app"}]},"scim_config":{"$ref":"#/definitions/access_scim_config"},"tags":{"$ref":"#/definitions/access_tags-2"},"type":{"allOf":[{"$ref":"#/definitions/access_type"},{"type":"string","examples":["saas"]}]}},"title":"SaaS Application"},"access_ssh_props":{"allOf":[{"$ref":"#/definitions/access_self_hosted_props"},{"properties":{"type":{"allOf":[{"$ref":"#/definitions/access_type"},{"type":"string","examples":["ssh"]}]}},"type":"object"}]},"access_vnc_props":{"allOf":[{"$ref":"#/definitions/access_self_hosted_props"},{"properties":{"type":{"allOf":[{"$ref":"#/definitions/access_type"},{"type":"string","examples":["vnc"]}]}},"type":"object"}]},"access_app_launcher_props":{"allOf":[{"$ref":"#/definitions/access_feature_app_props"},{"properties":{"app_launcher_logo_url":{"$ref":"#/definitions/access_app_launcher_logo_url"},"bg_color":{"$ref":"#/definitions/access_bg_color"},"footer_links":{"$ref":"#/definitions/access_footer_links"},"header_bg_color":{"$ref":"#/definitions/access_header_bg_color"},"landing_page_design":{"$ref":"#/definitions/access_landing_page_design"},"skip_app_launcher_login_page":{"$ref":"#/definitions/access_skip_app_launcher_login_page"},"type":{"allOf":[{"$ref":"#/definitions/access_type"},{"type":"string","examples":["app_launcher"]}]}},"type":"object"}]},"access_warp_props":{"allOf":[{"$ref":"#/definitions/access_feature_app_props"},{"properties":{"type":{"allOf":[{"$ref":"#/definitions/access_type"},{"type":"string","examples":["warp"]}]}},"type":"object"}]},"access_biso_props":{"allOf":[{"$ref":"#/definitions/access_feature_app_props"},{"properties":{"type":{"allOf":[{"$ref":"#/definitions/access_type"},{"type":"string","examples":["biso"]}]}},"type":"object"}]},"access_proxy_endpoint_props":{"allOf":[{"$ref":"#/definitions/access_feature_app_props"},{"properties":{"domain":{"description":"The proxy endpoint domain in the format: 10 alphanumeric characters followed by .proxy.cloudflare-gateway.com","type":"string","pattern":"^[A-Za-z0-9]{10}\\.proxy\\.cloudflare-gateway\\.com$","examples":["abcd123456.proxy.cloudflare-gateway.com"]},"name":{"type":"string","default":"Gateway Proxy","examples":["Gateway Proxy"]},"type":{"allOf":[{"$ref":"#/definitions/access_type"},{"type":"string","examples":["proxy_endpoint"]}]}},"type":"object"}]},"access_bookmark_props":{"type":"object","properties":{"app_launcher_visible":{"$ref":"#/definitions/access_app_launcher_visible"},"domain":{"description":"The URL or domain of the bookmark.","type":"string","examples":["https://mybookmark.com"]},"logo_url":{"$ref":"#/definitions/access_logo_url"},"name":{"$ref":"#/definitions/access_name-8"},"tags":{"$ref":"#/definitions/access_tags-2"},"type":{"allOf":[{"$ref":"#/definitions/access_type"},{"type":"string","examples":["bookmark"]}]}},"title":"Bookmark application"},"access_infra_props":{"type":"object","allOf":[{"properties":{"mfa_config":{"$ref":"#/definitions/access_infra_mfa_config"},"name":{"$ref":"#/definitions/access_name-8"},"session_duration":{"description":"The maximum duration of a connection to this application's targets. Connections are terminated once it elapses. Must be in the format `30m` or `2h45m`, in whole seconds. Valid time units are: s, m, h.","type":"string","default":"24h","examples":["8h"]},"type":{"allOf":[{"$ref":"#/definitions/access_type"},{"type":"string","examples":["infrastructure"]}]}},"type":"object"},{"$ref":"#/definitions/access_app_resp_embedded_target_criteria_infra"}],"required":["type","target_criteria"],"title":"Infrastructure Application"},"access_infra_app_req_embedded_policies":{"type":"object","properties":{"policies":{"description":"The policies that Access applies to the application.","type":"array","items":{"$ref":"#/definitions/access_infra_policy_req"}}}},"access_rdp_props":{"allOf":[{"$ref":"#/definitions/access_app_resp_embedded_target_criteria_self_hosted"},{"$ref":"#/definitions/access_self_hosted_props"},{"properties":{"type":{"allOf":[{"$ref":"#/definitions/access_type"},{"type":"string","examples":["rdp"]}]}},"type":"object"}],"required":["target_criteria"]},"access_mcp_props":{"type":"object","properties":{"allow_authenticate_via_warp":{"$ref":"#/definitions/access_allow_authenticate_via_warp-2"},"allowed_idps":{"$ref":"#/definitions/access_allowed_idps"},"auto_redirect_to_identity":{"$ref":"#/definitions/access_auto_redirect_to_identity-2"},"custom_deny_message":{"$ref":"#/definitions/access_custom_deny_message"},"custom_deny_url":{"$ref":"#/definitions/access_custom_deny_url"},"custom_non_identity_deny_url":{"$ref":"#/definitions/access_custom_non_identity_deny_url"},"custom_pages":{"$ref":"#/definitions/access_custom_pages-2"},"destinations":{"$ref":"#/definitions/access_destinations"},"http_only_cookie_attribute":{"$ref":"#/definitions/access_http_only_cookie_attribute"},"logo_url":{"$ref":"#/definitions/access_logo_url"},"name":{"$ref":"#/definitions/access_name-8"},"oauth_configuration":{"$ref":"#/definitions/access_oauth_configuration"},"options_preflight_bypass":{"$ref":"#/definitions/access_options_preflight_bypass"},"same_site_cookie_attribute":{"$ref":"#/definitions/access_same_site_cookie_attribute"},"scim_config":{"$ref":"#/definitions/access_scim_config"},"session_duration":{"$ref":"#/definitions/access_session_duration-2"},"tags":{"$ref":"#/definitions/access_tags-2"},"type":{"allOf":[{"$ref":"#/definitions/access_type"},{"type":"string","examples":["mcp"]}]}},"required":["type"],"title":"MCP Server Application"},"access_mcp_portal_props":{"type":"object","properties":{"allow_authenticate_via_warp":{"$ref":"#/definitions/access_allow_authenticate_via_warp-2"},"allowed_idps":{"$ref":"#/definitions/access_allowed_idps"},"auto_redirect_to_identity":{"$ref":"#/definitions/access_auto_redirect_to_identity-2"},"custom_deny_message":{"$ref":"#/definitions/access_custom_deny_message"},"custom_deny_url":{"$ref":"#/definitions/access_custom_deny_url"},"custom_non_identity_deny_url":{"$ref":"#/definitions/access_custom_non_identity_deny_url"},"custom_pages":{"$ref":"#/definitions/access_custom_pages-2"},"destinations":{"$ref":"#/definitions/access_destinations"},"domain":{"$ref":"#/definitions/access_domain"},"http_only_cookie_attribute":{"$ref":"#/definitions/access_http_only_cookie_attribute"},"logo_url":{"$ref":"#/definitions/access_logo_url"},"name":{"$ref":"#/definitions/access_name-8"},"oauth_configuration":{"$ref":"#/definitions/access_oauth_configuration"},"options_preflight_bypass":{"$ref":"#/definitions/access_options_preflight_bypass"},"same_site_cookie_attribute":{"$ref":"#/definitions/access_same_site_cookie_attribute"},"scim_config":{"$ref":"#/definitions/access_scim_config"},"session_duration":{"$ref":"#/definitions/access_session_duration-2"},"tags":{"$ref":"#/definitions/access_tags-2"},"type":{"allOf":[{"$ref":"#/definitions/access_type"},{"type":"string","examples":["mcp_portal"]}]}},"required":["type"],"title":"MCP Server Portal Application"},"access_allowed_idps":{"description":"The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.","type":"array","items":{"description":"The identity providers selected for application.","type":"string","examples":["699d98642c564d2e855e9661899b7252"]}},"access_end_user_destinations":{"description":"Public hostname and Workers destinations secured by Access.","type":"array","items":{"oneOf":[{"$ref":"#/definitions/access_end_user_public_destination"},{"$ref":"#/definitions/access_end_user_worker_destination"},{"$ref":"#/definitions/access_end_user_preview_worker_destination"},{"$ref":"#/definitions/access_end_user_all_workers_destination"},{"$ref":"#/definitions/access_end_user_all_preview_workers_destination"}]}},"access_domain":{"description":"The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.","type":"string","examples":["test.example.com/admin"]},"access_name-8":{"description":"The name of the application.","type":"string","examples":["Admin Site"]},"access_end_user_oauth_configuration":{"allOf":[{"$ref":"#/definitions/access_oauth_configuration"},{"properties":{"enabled":{"description":"Managed OAuth is required for end user applications and cannot be disabled.","type":"boolean","default":true,"enum":[true]}},"type":"object"}]},"access_self_hosted_domains":{"description":"List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.\n","type":"array","items":{"description":"A domain that Access will secure.","type":"string"},"default":[],"examples":[["test.example.com/admin","test.anotherexample.com/staff"]]},"access_type":{"description":"The application type.","type":"string","enum":["self_hosted","end_user","saas","ssh","vnc","app_launcher","warp","biso","bookmark","dash_sso","infrastructure","rdp","mcp","mcp_portal","proxy_endpoint"],"examples":["self_hosted"]},"access_uuid":{"description":"UUID.","type":"string","maxLength":36,"examples":["f174e90a-fafe-4643-bbbc-4a0ed4fc8415"]},"access_allow_authenticate_via_warp-2":{"description":"When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.","type":"boolean","examples":[true]},"access_allow_iframe":{"description":"Enables loading application content in an iFrame.","type":"boolean","examples":[true]},"access_app_launcher_visible":{"description":"Displays the application in the App Launcher.","type":"boolean","default":true,"examples":[true]},"access_auto_redirect_to_identity-2":{"description":"When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.","type":"boolean","default":false},"access_cors_headers":{"type":"object","properties":{"allow_all_headers":{"$ref":"#/definitions/access_allow_all_headers"},"allow_all_methods":{"$ref":"#/definitions/access_allow_all_methods"},"allow_all_origins":{"$ref":"#/definitions/access_allow_all_origins"},"allow_credentials":{"$ref":"#/definitions/access_allow_credentials"},"allowed_headers":{"$ref":"#/definitions/access_allowed_headers"},"allowed_methods":{"$ref":"#/definitions/access_allowed_methods"},"allowed_origins":{"$ref":"#/definitions/access_allowed_origins"},"max_age":{"$ref":"#/definitions/access_max_age"}}},"access_custom_deny_message":{"description":"The custom error message shown to a user when they are denied access to the application.","type":"string"},"access_custom_deny_url":{"description":"The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.","type":"string"},"access_custom_non_identity_deny_url":{"description":"The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.","type":"string"},"access_custom_pages-2":{"description":"The custom pages that will be displayed when applicable for this application","type":"array","items":{"description":"The custom pages selected for application.","type":"string","examples":["699d98642c564d2e855e9661899b7252"]}},"access_destinations":{"description":"List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.\n","type":"array","items":{"oneOf":[{"description":"A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard '*' can be used in the definition.\n","properties":{"overrides":{"$ref":"#/definitions/access_destination_overrides"},"type":{"type":"string","enum":["public"]},"uri":{"description":"The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).\n","type":"string"}},"title":"Public destination","type":"object"},{"properties":{"cidr":{"description":"The CIDR range of the destination. Single IPs will be computed as /32.","type":"string"},"hostname":{"description":"The hostname of the destination. Matches a valid SNI served by an HTTPS origin.","type":"string"},"l4_protocol":{"description":"The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.","type":"string","enum":["tcp","udp"]},"port_range":{"description":"The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.\n","type":"string"},"type":{"type":"string","enum":["private"]},"vnet_id":{"description":"The VNET ID to match the destination. When omitted, all VNETs will match.","type":"string"}},"title":"Private destination","type":"object"},{"description":"A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.\n","properties":{"mcp_server_id":{"description":"The MCP server id configured in ai-controls.","type":"string"},"type":{"type":"string","enum":["via_mcp_server_portal"]}},"title":"Via MCP Server Portal destination","type":"object"},{"description":"A specific Cloudflare Worker that Access will secure. All requests routed to the specified Worker, including its preview deployments, will be protected. The `preview_worker` and `public` destination types takes precedence, so you can create separate applications to override the policies for the Worker's previews or specific paths.\n","properties":{"overrides":{"$ref":"#/definitions/access_destination_overrides"},"type":{"type":"string","enum":["worker"]},"worker_id":{"description":"The ID of the Cloudflare Worker to protect with Access.","type":"string"}},"required":["type","worker_id"],"title":"Worker destination","type":"object"},{"description":"A specific Cloudflare Worker whose preview deployments Access will secure. Only requests routed to the preview deployments of the specified Worker will be protected. The `public` destination type takes precedence, so you can create separate applications to override the policies for specific paths.\n","properties":{"overrides":{"$ref":"#/definitions/access_destination_overrides"},"type":{"type":"string","enum":["preview_worker"]},"worker_id":{"description":"The ID of the Cloudflare Worker whose preview deployments to protect with Access.","type":"string"}},"required":["type","worker_id"],"title":"Preview Worker destination","type":"object"},{"description":"Protects all Cloudflare Workers on the account with Access, including their preview deployments. At most one destination of this type can exist per account. The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths.\n","properties":{"overrides":{"$ref":"#/definitions/access_destination_overrides"},"type":{"type":"string","enum":["all_workers"]}},"required":["type"],"title":"All Workers destination","type":"object"},{"description":"Protects the preview deployments of all Cloudflare Workers on the account with Access. At most one destination of this type can exist per account. The `worker`, `preview_worker`, and `public` destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths.\n","properties":{"overrides":{"$ref":"#/definitions/access_destination_overrides"},"type":{"type":"string","enum":["all_preview_workers"]}},"required":["type"],"title":"All Preview Workers destination","type":"object"}]},"default":[],"examples":[[{"type":"public","uri":"test.example.com/admin"},{"type":"public","uri":"test.anotherexample.com/staff"},{"cidr":"10.5.0.0/24","port_range":"80-90","type":"private"},{"cidr":"10.5.0.3/32","port_range":"80","type":"private"},{"hostname":"private-sni.example.com","type":"private"},{"mcp_server_id":"mcp-server-1","type":"via_mcp_server_portal"},{"overrides":[{"behavior":"public","path_pattern":"/health/*"}],"type":"worker","worker_id":"617f1d0431a98306ff61e336d79fce86"},{"type":"preview_worker","worker_id":"617f1d0431a98306ff61e336d79fce86"},{"type":"all_workers"},{"type":"all_preview_workers"}]]},"access_eager_redirect_cookie_setting":{"description":"Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.","type":"boolean","default":true,"examples":[true]},"access_enable_binding_cookie":{"description":"Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.","type":"boolean","default":false},"access_http_only_cookie_attribute":{"description":"Enables the HttpOnly cookie attribute, which increases security against XSS attacks.","type":"boolean","default":true,"examples":[true]},"access_logo_url":{"description":"The image URL for the logo shown in the App Launcher dashboard.","type":"string","examples":["https://www.cloudflare.com/img/logo-web-badges/cf-logo-on-white-bg.svg"]},"access_mfa_config":{"description":"Configures multi-factor authentication (MFA) settings.","type":"object","properties":{"allowed_authenticators":{"description":"Lists the MFA methods that users can authenticate with.","type":"array","items":{"enum":["totp","biometrics","security_key"],"type":"string"},"examples":[["totp","biometrics","security_key"]]},"mfa_disabled":{"description":"Indicates whether to disable MFA for this resource. This option is available at the application and policy level.","type":"boolean","examples":[false]},"session_duration":{"description":"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.","type":"string","examples":["24h"]}}},"access_oauth_configuration":{"description":"**Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.\n","type":"object","properties":{"dynamic_client_registration":{"description":"Settings for OAuth dynamic client registration.","type":"object","properties":{"allow_any_on_localhost":{"description":"Allows any client with redirect URIs on localhost.","type":"boolean"},"allow_any_on_loopback":{"description":"Allows any client with redirect URIs on 127.0.0.1.","type":"boolean"},"allowed_uris":{"description":"The URIs that are allowed as redirect URIs for dynamically registered clients. HTTP and HTTPS paths may end in `/*` to match all sub-paths. Custom-scheme URIs must be explicitly configured and match exactly.\n","type":"array","items":{"type":"string"},"examples":[["https://example.com/callback","com.example.app:/oauth/callback"]]},"enabled":{"description":"Whether dynamic client registration is enabled.","type":"boolean"}}},"enabled":{"description":"Whether the OAuth configuration is enabled for this application. When set to `false`, Access will not handle OAuth for this application. Defaults to `true` if omitted.\n","type":"boolean","default":true},"grant":{"description":"Settings for OAuth grant behavior.","type":"object","properties":{"access_token_lifetime":{"description":"The lifetime of the access token. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.","type":"string","examples":["5m"]},"session_duration":{"description":"The duration of the OAuth session. Must be in the format `300ms` or `2h45m`. Valid time units are ns, us (or µs), ms, s, m, h.","type":"string","examples":["24h"]}}}}},"access_options_preflight_bypass":{"description":"Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.","type":"boolean","examples":[true]},"access_path_cookie_attribute":{"description":"Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default","type":"boolean","default":false,"examples":[true]},"access_read_service_tokens_from_header":{"description":"Allows matching Access Service Tokens passed HTTP in a single header with this name.\nThis works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.\nThe header value will be interpreted as a json object similar to:\n  {\n    \"cf-access-client-id\": \"88bf3b6d86161464f6509f7219099e57.access.example.com\",\n    \"cf-access-client-secret\": \"bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5\"\n  }\n","type":"string","examples":["Authorization"]},"access_same_site_cookie_attribute":{"description":"Sets the SameSite cookie setting, which provides increased security against CSRF attacks.","type":"string","examples":["strict"]},"access_scim_config":{"description":"Configuration for provisioning to this application via SCIM. This is currently in closed beta.","type":"object","properties":{"authentication":{"oneOf":[{"$ref":"#/definitions/access_scim_config_single_authentication"},{"$ref":"#/definitions/access_scim_config_multi_authentication"}]},"deactivate_on_delete":{"description":"If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.","type":"boolean"},"enabled":{"description":"Whether SCIM provisioning is turned on for this application.","type":"boolean"},"idp_uid":{"description":"The UID of the IdP to use as the source for SCIM resources to provision to this application.","type":"string"},"mappings":{"description":"A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.","type":"array","items":{"$ref":"#/definitions/access_scim_config_mapping"}},"remote_uri":{"description":"The base URI for the application's SCIM-compatible API.","type":"string"}},"required":["remote_uri","idp_uid"]},"access_service_auth_401_redirect":{"description":"Returns a 401 status code when the request is blocked by a Service Auth policy.","type":"boolean","examples":[true]},"access_session_duration-2":{"description":"The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.","type":"string","default":"24h","examples":["24h"]},"access_skip_interstitial":{"description":"Enables automatic authentication through cloudflared.","type":"boolean","examples":[true]},"access_tags-2":{"description":"The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.","type":"array","items":{"description":"The tag associated with an application.","type":"string","examples":["engineers"]},"default":[]},"access_use_clientless_isolation_app_launcher_url":{"description":"Determines if users can access this application via a clientless browser isolation URL.\nThis allows users to access private domains without connecting to Gateway. The option requires\nClientless Browser Isolation to be set up with policies that allow users of this application.\n","type":"boolean","default":false,"examples":[false]},"access_app_policy_link":{"description":"A JSON that links a reusable policy to an application.","type":"object","properties":{"account_id":{"$ref":"#/definitions/access_identifier"},"id":{"$ref":"#/definitions/access_uuid-2"},"precedence":{"$ref":"#/definitions/access_precedence"}}},"access_uuid-2":{"description":"The UUID of the policy","type":"string","maxLength":36,"examples":["f174e90a-fafe-4643-bbbc-4a0ed4fc8415"]},"access_app_policy_request":{"type":"object","allOf":[{"properties":{"precedence":{"$ref":"#/definitions/access_precedence"}},"type":"object"},{"$ref":"#/definitions/access_policy_req"}]},"access_saml_saas_app":{"type":"object","properties":{"auth_type":{"description":"Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is \"saml\"","type":"string","enum":["saml","oidc"],"examples":["saml"]},"consumer_service_url":{"description":"The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.","type":"string","examples":["https://example.com"]},"created_at":{"$ref":"#/definitions/access_created_at"},"custom_attributes":{"type":"array","items":{"properties":{"friendly_name":{"description":"The SAML FriendlyName of the attribute.","type":"string","examples":["Last Name"]},"name":{"description":"The name of the attribute.","type":"string","examples":["family_name"]},"name_format":{"description":"A globally unique name for an identity or service provider.","type":"string","enum":["urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified","urn:oasis:names:tc:SAML:2.0:attrname-format:basic","urn:oasis:names:tc:SAML:2.0:attrname-format:uri"],"examples":["urn:oasis:names:tc:SAML:2.0:attrname-format:basic"]},"required":{"description":"If the attribute is required when building a SAML assertion.","type":"boolean","examples":[true]},"source":{"type":"object","properties":{"name":{"description":"The name of the IdP attribute.","type":"string","examples":["last_name"]},"name_by_idp":{"description":"A mapping from IdP ID to attribute name.","type":"array","items":{"properties":{"idp_id":{"description":"The UID of the IdP.","type":"string","examples":["exampleIdPID1"]},"source_name":{"description":"The name of the IdP provided attribute.","type":"string","examples":["AttributeName1"]}},"type":"object"}}}}},"type":"object"}},"default_relay_state":{"description":"The URL that the user will be redirected to after a successful login for IDP initiated logins.","type":"string","examples":["https://example.com"]},"idp_entity_id":{"description":"The unique identifier for your SaaS application.","type":"string","examples":["https://example.cloudflareaccess.com"]},"name_id_format":{"description":"The format of the name identifier sent to the SaaS application.","type":"string","enum":["id","email"],"examples":["id"]},"name_id_transform_jsonata":{"description":"A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `name_id_format` setting.\n","type":"string","examples":["$substringBefore(email, '@') & '+sandbox@' & $substringAfter(email, '@')"]},"public_key":{"description":"The Access public certificate that will be used to verify your identity.","type":"string","examples":["example unique name"]},"saml_attribute_transform_jsonata":{"description":"A [JSONata] (https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml_attributes or oidc_fields of the identity provider used to authenticate. The output of this expression must be a JSON object.\n","type":"string","examples":["$ ~>| groups | {'group_name': name} |"]},"sp_entity_id":{"description":"A globally unique name for an identity or service provider.","type":"string","examples":["example unique name"]},"sso_endpoint":{"description":"The endpoint where your SaaS application will send login requests.","type":"string","examples":["https://example.cloudflareaccess.com/cdn-cgi/access/sso/saml/b3f58a2b414e0b51d45c8c2af26fccca0e27c63763c426fa52f98dcf0b3b3bfd"]},"updated_at":{"$ref":"#/definitions/access_updated_at"}},"title":"SAML SaaS App"},"access_oidc_saas_app":{"type":"object","properties":{"access_token_lifetime":{"description":"The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.","type":"string","examples":["5m"]},"allow_pkce_without_client_secret":{"description":"If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.","type":"boolean","examples":[true]},"app_launcher_url":{"description":"The URL where this applications tile redirects users","type":"string","examples":["https://example.com/login"]},"auth_type":{"description":"Identifier of the authentication protocol used for the saas app. Required for OIDC.","type":"string","enum":["saml","oidc"],"examples":["oidc"]},"client_id":{"description":"The application client id","type":"string","examples":["oidc client id"]},"client_secret":{"description":"The application client secret, only returned on POST request.","type":"string","examples":["oidc client secret"]},"created_at":{"$ref":"#/definitions/access_created_at"},"custom_claims":{"type":"array","items":{"properties":{"name":{"description":"The name of the claim.","type":"string","examples":["family_name"]},"required":{"description":"If the claim is required when building an OIDC token.","type":"boolean","examples":[true]},"scope":{"description":"The scope of the claim.","type":"string","enum":["groups","profile","email","openid"],"examples":["profile"]},"source":{"type":"object","properties":{"name":{"description":"The name of the IdP claim.","type":"string","examples":["last_name"]},"name_by_idp":{"description":"A mapping from IdP ID to claim name.","type":"object","additionalProperties":{"type":"string"},"examples":[{"exampleIdPID1":"ClaimName1","exampleIdPID2":"ClaimName2"}]}}}},"type":"object"}},"grant_types":{"description":"The OIDC flows supported by this application","type":"array","items":{"enum":["authorization_code","authorization_code_with_pkce","refresh_tokens","hybrid","implicit"],"type":"string"},"examples":[["authorization_code"]]},"group_filter_regex":{"description":"A regex to filter Cloudflare groups returned in ID token and userinfo endpoint","type":"string","examples":["^GROUP_FILTER-*$"]},"hybrid_and_implicit_options":{"type":"object","properties":{"return_access_token_from_authorization_endpoint":{"description":"If an Access Token should be returned from the OIDC Authorization endpoint","type":"boolean"},"return_id_token_from_authorization_endpoint":{"description":"If an ID Token should be returned from the OIDC Authorization endpoint","type":"boolean"}}},"public_key":{"description":"The Access public certificate that will be used to verify your identity.","type":"string","examples":["example unique name"]},"redirect_uris":{"description":"The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens","type":"array","items":{"type":"string"},"examples":[["https://example.com"]]},"refresh_token_options":{"type":"object","properties":{"lifetime":{"description":"How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.","type":"string","examples":["30d"]}}},"scopes":{"description":"Define the user information shared with access, \"offline_access\" scope will be automatically enabled if refresh tokens are enabled","type":"array","items":{"enum":["openid","groups","email","profile"],"type":"string"},"examples":[["openid","groups","email","profile"]]},"updated_at":{"$ref":"#/definitions/access_updated_at"}},"title":"OIDC SaaS App"},"access_feature_app_props":{"type":"object","properties":{"allowed_idps":{"$ref":"#/definitions/access_allowed_idps"},"auto_redirect_to_identity":{"$ref":"#/definitions/access_auto_redirect_to_identity-2"},"custom_deny_url":{"$ref":"#/definitions/access_custom_deny_url"},"custom_non_identity_deny_url":{"$ref":"#/definitions/access_custom_non_identity_deny_url"},"custom_pages":{"$ref":"#/definitions/access_custom_pages-2"},"domain":{"$ref":"#/definitions/access_domain"},"name":{"$ref":"#/definitions/access_name-8"},"session_duration":{"$ref":"#/definitions/access_session_duration-2"},"type":{"$ref":"#/definitions/access_type"}},"required":["type"]},"access_app_launcher_logo_url":{"description":"The image URL of the logo shown in the App Launcher header.","type":"string","examples":["https://www.cloudflare.com/img/logo-web-badges/cf-logo-on-white-bg.svg"]},"access_bg_color":{"description":"The background color of the App Launcher page.","type":"string","examples":["#ff0000"]},"access_footer_links":{"description":"The links in the App Launcher footer.","type":"array","items":{"properties":{"name":{"description":"The hypertext in the footer link.","type":"string","examples":["Cloudflare's Privacy Policy"]},"url":{"description":"the hyperlink in the footer link.","type":"string","examples":["https://www.cloudflare.com/privacypolicy/"]}},"required":["name","url"],"type":"object"},"examples":[[{"name":"Cloudflare's Privacy Policy","url":"https://www.cloudflare.com/privacypolicy/"}]]},"access_header_bg_color":{"description":"The background color of the App Launcher header.","type":"string","examples":["#ff0000"]},"access_landing_page_design":{"description":"The design of the App Launcher landing page shown to users when they log in.","type":"object","properties":{"button_color":{"$ref":"#/definitions/access_button_color"},"button_text_color":{"$ref":"#/definitions/access_button_text_color"},"image_url":{"$ref":"#/definitions/access_image_url"},"message":{"$ref":"#/definitions/access_message"},"title":{"$ref":"#/definitions/access_title"}}},"access_skip_app_launcher_login_page":{"description":"Determines when to skip the App Launcher landing page.","type":"boolean","default":false,"examples":[true]},"access_infra_mfa_config":{"description":"Configures multi-factor authentication (MFA) settings for infrastructure applications.","type":"object","properties":{"allowed_authenticators":{"description":"Lists the MFA methods that users can authenticate with. For infrastructure applications, supported values are `piv_key` and `ssh_fido2_key`.","type":"array","items":{"enum":["piv_key","ssh_fido2_key"],"type":"string"},"examples":[["piv_key","ssh_fido2_key"]]},"mfa_disabled":{"description":"Indicates whether to disable MFA for this resource. This option is available at the application and policy level.","type":"boolean","examples":[false]},"session_duration":{"description":"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples: `5m` or `24h`.","type":"string","examples":["24h"]}}},"access_app_resp_embedded_target_criteria_infra":{"description":"Contains the targets secured by the application.","type":"object","properties":{"target_criteria":{"type":"array","items":{"$ref":"#/definitions/access_target_criteria_infra_app"}}}},"access_infra_policy_req":{"type":"object","properties":{"connection_rules":{"$ref":"#/definitions/access_connection_rules_infra"},"mfa_config":{"$ref":"#/definitions/access_infra_mfa_config"}},"allOf":[{"$ref":"#/definitions/access_base_policy_req"}]},"access_app_resp_embedded_target_criteria_self_hosted":{"description":"Contains the targets secured by the application.","type":"object","properties":{"target_criteria":{"type":"array","items":{"$ref":"#/definitions/access_target_criteria_self_hosted_app"}}}},"access_end_user_public_destination":{"type":"object","properties":{"overrides":{"$ref":"#/definitions/access_destination_overrides"},"type":{"type":"string","enum":["public"]},"uri":{"description":"The public hostname and optional path to secure.","type":"string"}},"required":["uri"]},"access_end_user_worker_destination":{"type":"object","properties":{"overrides":{"$ref":"#/definitions/access_destination_overrides"},"type":{"type":"string","enum":["worker"]},"worker_id":{"description":"The ID of the Cloudflare Worker to secure.","type":"string"}},"required":["type","worker_id"]},"access_end_user_preview_worker_destination":{"type":"object","properties":{"overrides":{"$ref":"#/definitions/access_destination_overrides"},"type":{"type":"string","enum":["preview_worker"]},"worker_id":{"description":"The ID of the Cloudflare Worker whose previews to secure.","type":"string"}},"required":["type","worker_id"]},"access_end_user_all_workers_destination":{"type":"object","properties":{"overrides":{"$ref":"#/definitions/access_destination_overrides"},"type":{"type":"string","enum":["all_workers"]}},"required":["type"]},"access_end_user_all_preview_workers_destination":{"type":"object","properties":{"overrides":{"$ref":"#/definitions/access_destination_overrides"},"type":{"type":"string","enum":["all_preview_workers"]}},"required":["type"]},"access_allow_all_headers":{"description":"Allows all HTTP request headers.","type":"boolean","examples":[true]},"access_allow_all_methods":{"description":"Allows all HTTP request methods.","type":"boolean"},"access_allow_all_origins":{"description":"Allows all origins.","type":"boolean"},"access_allow_credentials":{"description":"When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.","type":"boolean"},"access_allowed_headers":{"description":"Allowed HTTP request headers.","type":"array","items":{"type":"string"}},"access_allowed_methods":{"description":"Allowed HTTP request methods.","type":"array","items":{"enum":["GET","POST","HEAD","PUT","DELETE","CONNECT","OPTIONS","TRACE","PATCH"],"type":"string"},"examples":[["GET"]]},"access_allowed_origins":{"description":"Allowed origins.","type":"array","items":{"type":"string"},"examples":[["https://example.com"]]},"access_max_age":{"description":"The maximum number of seconds the results of a preflight request can be cached.","type":"number","maximum":86400,"minimum":-1,"examples":[-1]},"access_destination_overrides":{"description":"Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations.\n","type":"array","items":{"properties":{"behavior":{"description":"The behavior to apply to matching requests.","type":"string","enum":["public"]},"path_pattern":{"description":"The request path pattern to match. Wildcards (`*`) are supported, but each path segment may have at most one wildcard. Unlike the `uri` in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard.\n","type":"string","maxLength":512,"pattern":"^/","examples":["/health/*"]}},"required":["path_pattern","behavior"],"type":"object"},"maxItems":25},"access_scim_config_single_authentication":{"oneOf":[{"$ref":"#/definitions/access_scim_config_authentication_http_basic"},{"$ref":"#/definitions/access_scim_config_authentication_oauth_bearer_token"},{"$ref":"#/definitions/access_scim_config_authentication_oauth2"},{"$ref":"#/definitions/access_scim_config_authentication_access_service_token"}]},"access_scim_config_multi_authentication":{"description":"Multiple authentication schemes","type":"array","items":{"$ref":"#/definitions/access_scim_config_single_authentication"}},"access_scim_config_mapping":{"description":"Transformations and filters applied to resources before they are provisioned in the remote SCIM service.","type":"object","properties":{"enabled":{"description":"Whether or not this mapping is enabled.","type":"boolean"},"filter":{"description":"A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.","type":"string","examples":["title pr or userType eq \"Intern\""]},"operations":{"description":"Whether or not this mapping applies to creates, updates, or deletes.","type":"object","properties":{"create":{"description":"Whether or not this mapping applies to create (POST) operations.","type":"boolean"},"delete":{"description":"Whether or not this mapping applies to DELETE operations.","type":"boolean"},"update":{"description":"Whether or not this mapping applies to update (PATCH/PUT) operations.","type":"boolean"}}},"schema":{"description":"Which SCIM resource type this mapping applies to.","type":"string","examples":["urn:ietf:params:scim:schemas:core:2.0:User"]},"strictness":{"description":"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.","type":"string","enum":["strict","passthrough"]},"transform_jsonata":{"description":"A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.","type":"string","examples":["$merge([$, {'userName': $substringBefore($.userName, '@') & '+test@' & $substringAfter($.userName, '@')}])"]}},"required":["schema"]},"access_precedence":{"description":"The order of execution for this policy. Must be unique for each policy within an app.\n","type":"integer"},"access_policy_req":{"type":"object","properties":{"approval_groups":{"$ref":"#/definitions/access_approval_groups"},"approval_required":{"$ref":"#/definitions/access_approval_required"},"connection_rules":{"$ref":"#/definitions/access_connection_rules"},"isolation_required":{"$ref":"#/definitions/access_isolation_required"},"mfa_config":{"$ref":"#/definitions/access_mfa_config"},"purpose_justification_prompt":{"$ref":"#/definitions/access_purpose_justification_prompt"},"purpose_justification_required":{"$ref":"#/definitions/access_purpose_justification_required"},"session_duration":{"$ref":"#/definitions/access_session_duration-3"}},"allOf":[{"$ref":"#/definitions/access_base_policy_req"}]},"access_created_at":{"allOf":[{"type":"string"},{"$ref":"#/definitions/access_timestamp"}]},"access_updated_at":{"allOf":[{"type":"string"},{"$ref":"#/definitions/access_timestamp"}]},"access_button_color":{"description":"The background color of the log in button on the landing page.","type":"string","examples":["#ff0000"]},"access_button_text_color":{"description":"The color of the text in the log in button on the landing page.","type":"string","examples":["#ff0000"]},"access_image_url":{"description":"The URL of the image shown on the landing page.","type":"string","examples":["https://www.cloudflare.com/img/logo-web-badges/cf-logo-on-white-bg.svg"]},"access_message":{"description":"The message shown on the landing page.","type":"string","examples":["Log in below to reach your applications behind Access."]},"access_title":{"description":"The title shown on the landing page.","type":"string","default":"Welcome!","examples":["Welcome back!"]},"access_target_criteria_infra_app":{"allOf":[{"$ref":"#/definitions/access_target_criteria_base"},{"properties":{"protocol":{"type":"string","allOf":[{"$ref":"#/definitions/access_protocol_infra_app"}]}},"type":"object"}]},"access_connection_rules_infra":{"description":"The rules that define how users may connect to the targets secured by your application.","type":"object","properties":{"ssh":{"$ref":"#/definitions/access_connection_rules_ssh"}},"title":"Connection Rules"},"access_base_policy_req":{"type":"object","properties":{"decision":{"$ref":"#/definitions/access_decision"},"exclude":{"$ref":"#/definitions/access_exclude-2"},"include":{"$ref":"#/definitions/access_include-2"},"name":{"$ref":"#/definitions/access_name-9"},"policy_resolution_account_id":{"$ref":"#/definitions/access_policy_resolution_account_id"},"require":{"$ref":"#/definitions/access_require-2"}},"required":["name","decision","include"]},"access_target_criteria_self_hosted_app":{"allOf":[{"$ref":"#/definitions/access_target_criteria_base"},{"properties":{"protocol":{"type":"string","allOf":[{"$ref":"#/definitions/access_protocol_self_hosted_app"}]}},"type":"object"}]},"access_scim_config_authentication_http_basic":{"description":"Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.","type":"object","properties":{"password":{"description":"Password used to authenticate with the remote SCIM service.","type":"string"},"scheme":{"description":"The authentication scheme to use when making SCIM requests to this application.","type":"string","enum":["httpbasic"]},"user":{"description":"User name used to authenticate with the remote SCIM service.","type":"string"}},"required":["scheme","user","password"],"title":"HTTP Basic"},"access_scim_config_authentication_oauth_bearer_token":{"description":"Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.","type":"object","properties":{"scheme":{"description":"The authentication scheme to use when making SCIM requests to this application.","type":"string","enum":["oauthbearertoken"]},"token":{"description":"Token used to authenticate with the remote SCIM service.","type":"string"}},"required":["scheme","token"],"title":"OAuth Bearer Token"},"access_scim_config_authentication_oauth2":{"description":"Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.","type":"object","properties":{"authorization_url":{"description":"URL used to generate the auth code used during token generation.","type":"string"},"client_id":{"description":"Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.","type":"string"},"client_secret":{"description":"Secret used to authenticate when generating a token for authenticating with the remove SCIM service.","type":"string"},"scheme":{"description":"The authentication scheme to use when making SCIM requests to this application.","type":"string","enum":["oauth2"]},"scopes":{"description":"The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.","type":"array","items":{"type":"string"}},"token_url":{"description":"URL used to generate the token used to authenticate with the remote SCIM service.","type":"string"}},"required":["scheme","client_id","client_secret","authorization_url","token_url"],"title":"OAuth 2"},"access_scim_config_authentication_access_service_token":{"description":"Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.","type":"object","properties":{"client_id":{"description":"Client ID of the Access service token used to authenticate with the remote service.","type":"string"},"client_secret":{"description":"Client secret of the Access service token used to authenticate with the remote service.","type":"string"},"scheme":{"description":"The authentication scheme to use when making SCIM requests to this application.","type":"string","enum":["access_service_token"]}},"required":["scheme","client_id","client_secret"],"title":"Access Service Token"},"access_approval_groups":{"description":"Administrators who can approve a temporary authentication request.","type":"array","items":{"$ref":"#/definitions/access_approval_group"},"examples":[[{"approvals_needed":1,"email_addresses":["test1@cloudflare.com","test2@cloudflare.com"]},{"approvals_needed":3,"email_list_uuid":"597147a1-976b-4ef2-9af0-81d5d007fc34"}]]},"access_approval_required":{"description":"Requires the user to request access from an administrator at the start of each session.","type":"boolean","examples":[true]},"access_connection_rules":{"description":"The rules that define how users may connect to targets secured by your application.","type":"object","properties":{"rdp":{"$ref":"#/definitions/access_connection_rules_rdp"}},"title":"Connection Rules"},"access_isolation_required":{"description":"Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.","type":"boolean","examples":[false]},"access_purpose_justification_prompt":{"description":"A custom message that will appear on the purpose justification screen.","type":"string","examples":["Please enter a justification for entering this protected domain."]},"access_purpose_justification_required":{"description":"Require users to enter a justification when they log in to the application.","type":"boolean","examples":[true]},"access_session_duration-3":{"description":"The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.","type":["string","null"],"examples":["24h"]},"access_timestamp":{"type":"string","format":"date-time","examples":["2014-01-01T05:20:00.12345Z"]},"access_target_criteria_base":{"description":"Defines targets covered by the application. Use either the legacy top-level target_attributes format or the rule format, but not both. The rule format requires include; require and exclude are optional.","type":"object","properties":{"exclude":{"description":"Target is excluded when any selector in this rule matches.","type":"object","allOf":[{"$ref":"#/definitions/access_target_rule"}]},"include":{"description":"Target matches when any selector in this rule matches.","type":"object","allOf":[{"$ref":"#/definitions/access_target_rule"}]},"port":{"type":"integer","allOf":[{"$ref":"#/definitions/access_port"}]},"require":{"description":"Target matches only when every selector in this rule matches.","type":"object","allOf":[{"$ref":"#/definitions/access_target_rule"}]},"target_attributes":{"type":"object","allOf":[{"$ref":"#/definitions/access_target_attributes"}]}},"oneOf":[{"not":{"anyOf":[{"required":["include"],"type":"object"},{"required":["require"],"type":"object"},{"required":["exclude"],"type":"object"}],"type":"object"},"required":["target_attributes"],"type":"object"},{"not":{"required":["target_attributes"],"type":"object"},"required":["include"],"type":"object"}],"required":["port","protocol"],"title":"Target Criteria"},"access_protocol_infra_app":{"description":"The communication protocol your application secures.","type":"string","enum":["SSH"],"examples":["SSH"]},"access_connection_rules_ssh":{"description":"The SSH-specific rules that define how users may connect to the targets secured by your application.","type":"object","properties":{"allow_email_alias":{"$ref":"#/definitions/access_allow_email_alias"},"usernames":{"$ref":"#/definitions/access_usernames"}},"required":["usernames"],"title":"SSH Connection Rules"},"access_decision":{"description":"The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.","type":"string","enum":["allow","deny","non_identity","bypass"],"examples":["allow"]},"access_exclude-2":{"description":"Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.","type":"array","items":{"$ref":"#/definitions/access_rule"},"default":[]},"access_include-2":{"description":"Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.","type":"array","items":{"$ref":"#/definitions/access_rule"},"default":[]},"access_name-9":{"description":"The name of the Access policy.","type":"string","examples":["Allow devs"]},"access_policy_resolution_account_id":{"description":"The account ID used to resolve policy resources and identity for cross-account WARP authentication. The account must be trusted by the account that owns this policy.","type":"string"},"access_require-2":{"description":"Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.","type":"array","items":{"$ref":"#/definitions/access_rule"},"default":[]},"access_protocol_self_hosted_app":{"description":"The communication protocol your application secures.","type":"string","enum":["RDP"],"examples":["RDP"]},"access_approval_group":{"description":"A group of email addresses that can approve a temporary authentication request.","type":"object","properties":{"approvals_needed":{"description":"The number of approvals needed to obtain access.","type":"number","minimum":0,"examples":[1]},"email_addresses":{"description":"A list of emails that can approve the access request.","type":"array","items":{"type":"string"},"examples":[["test@cloudflare.com","test2@cloudflare.com"]]},"email_list_uuid":{"description":"The UUID of an re-usable email list.","type":"string"}},"required":["approvals_needed"]},"access_connection_rules_rdp":{"description":"The RDP-specific rules that define clipboard behavior for RDP connections.","type":"object","properties":{"allowed_clipboard_local_to_remote_formats":{"$ref":"#/definitions/access_allowed_clipboard_local_to_remote_formats"},"allowed_clipboard_remote_to_local_formats":{"$ref":"#/definitions/access_allowed_clipboard_remote_to_local_formats"}},"title":"RDP Connection Rules"},"access_target_rule":{"description":"Selectors within an include, require, or exclude rule. At least one of target_attributes or tags must be non-empty.","type":"object","properties":{"tags":{"description":"Map of target tag keys to values. Values within a key are OR'd.","type":"object","additionalProperties":{"items":{"minLength":1,"type":"string"},"maxItems":50,"minItems":1,"type":"array"},"maxProperties":50,"minProperties":1,"examples":[{"environment":["production"]}]},"target_attributes":{"type":"object","allOf":[{"$ref":"#/definitions/access_target_rule_attributes"}]}},"additionalProperties":false,"minProperties":1,"title":"Target Rule"},"access_port":{"description":"The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.","type":"integer","examples":[22]},"access_target_attributes":{"description":"Contains a map of target attribute keys to target attribute values.","type":"object","additionalProperties":{"items":{"type":"string"},"type":"array","examples":[["test-server","production-server"]]},"examples":[{"hostname":["test-server","production-server"]}]},"access_allow_email_alias":{"description":"Enables using Identity Provider email alias as SSH username.","type":"boolean"},"access_usernames":{"description":"Contains the Unix usernames that may be used when connecting over SSH.","type":"array","items":{"type":"string"},"examples":[["root","ubuntu"]]},"access_rule":{"type":"object","oneOf":[{"$ref":"#/definitions/access_access_group_rule"},{"$ref":"#/definitions/access_any_valid_service_token_rule"},{"$ref":"#/definitions/access_auth_context_rule"},{"$ref":"#/definitions/access_authentication_method_rule"},{"$ref":"#/definitions/access_azure_group_rule"},{"$ref":"#/definitions/access_certificate_rule"},{"$ref":"#/definitions/access_common_name_rule"},{"$ref":"#/definitions/access_country_rule"},{"$ref":"#/definitions/access_device_posture_rule"},{"$ref":"#/definitions/access_domain_rule"},{"$ref":"#/definitions/access_email_list_rule"},{"$ref":"#/definitions/access_email_rule"},{"$ref":"#/definitions/access_everyone_rule"},{"$ref":"#/definitions/access_external_evaluation_rule"},{"$ref":"#/definitions/access_github_organization_rule"},{"$ref":"#/definitions/access_gsuite_group_rule"},{"$ref":"#/definitions/access_login_method_rule"},{"$ref":"#/definitions/access_ip_list_rule"},{"$ref":"#/definitions/access_ip_rule"},{"$ref":"#/definitions/access_okta_group_rule"},{"$ref":"#/definitions/access_saml_group_rule"},{"$ref":"#/definitions/access_oidc_claim_rule"},{"$ref":"#/definitions/access_service_token_rule"},{"$ref":"#/definitions/access_service_token_tag_rule"},{"$ref":"#/definitions/access_linked_app_token_rule"},{"$ref":"#/definitions/access_user_risk_score_rule"},{"$ref":"#/definitions/access_cloudflare_account_member_rule"}]},"access_allowed_clipboard_local_to_remote_formats":{"description":"Clipboard formats allowed when copying from local machine to remote RDP session.","type":"array","items":{"$ref":"#/definitions/access_rdp_clipboard_format"},"examples":[["text","file"]]},"access_allowed_clipboard_remote_to_local_formats":{"description":"Clipboard formats allowed when copying from remote RDP session to local machine.","type":"array","items":{"$ref":"#/definitions/access_rdp_clipboard_format"},"examples":[["text","file"]]},"access_target_rule_attributes":{"description":"Hostname selector map for include, require, or exclude rules. This is distinct from the deprecated top-level target_attributes field and only supports the hostname key.","type":"object","properties":{"hostname":{"type":"array","items":{"minLength":1,"type":"string"},"maxItems":5000,"minItems":1}},"additionalProperties":false,"maxProperties":1,"minProperties":1,"examples":[{"hostname":["web-*"]}]},"access_access_group_rule":{"description":"Matches an Access group.","type":"object","properties":{"group":{"type":"object","properties":{"id":{"description":"The ID of a previously created Access group.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]}},"required":["id"]}},"required":["group"],"title":"Access groups"},"access_any_valid_service_token_rule":{"description":"Matches any valid Access Service Token","type":"object","properties":{"any_valid_service_token":{"description":"An empty object which matches on all service tokens.","type":"object","examples":[{}]}},"required":["any_valid_service_token"],"title":"Any Valid Service Token"},"access_auth_context_rule":{"description":"Matches an Azure Authentication Context.\nRequires an Azure identity provider.","type":"object","properties":{"auth_context":{"type":"object","properties":{"ac_id":{"description":"The ACID of an Authentication context.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]},"id":{"description":"The ID of an Authentication context.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]},"identity_provider_id":{"description":"The ID of your Azure identity provider.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]}},"required":["id","identity_provider_id","ac_id"]}},"required":["auth_context"],"title":"Authentication Context"},"access_authentication_method_rule":{"description":"Enforce different MFA options","type":"object","properties":{"auth_method":{"type":"object","properties":{"auth_method":{"description":"The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.","type":"string","examples":["mfa"]}},"required":["auth_method"]}},"required":["auth_method"],"title":"Authentication method"},"access_azure_group_rule":{"description":"Matches an Azure group.\nRequires an Azure identity provider.","type":"object","properties":{"azureAD":{"type":"object","properties":{"id":{"description":"The ID of an Azure group.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]},"identity_provider_id":{"description":"The ID of your Azure identity provider.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]}},"required":["id","identity_provider_id"]}},"required":["azureAD"],"title":"Azure group"},"access_certificate_rule":{"description":"Matches any valid client certificate.","type":"object","properties":{"certificate":{"type":"object","examples":[{}]}},"required":["certificate"],"title":"Valid certificate","examples":[{"certificate":{}}]},"access_common_name_rule":{"description":"Matches a specific common name.","type":"object","properties":{"common_name":{"type":"object","properties":{"common_name":{"description":"The common name to match.","type":"string","examples":["james@example.com"]}},"required":["common_name"]}},"required":["common_name"],"title":"Common Name"},"access_country_rule":{"description":"Matches a specific country","type":"object","properties":{"geo":{"type":"object","properties":{"country_code":{"description":"The country code that should be matched.","type":"string","examples":["US"]}},"required":["country_code"]}},"required":["geo"],"title":"Country"},"access_device_posture_rule":{"description":"Enforces a device posture rule has run successfully","type":"object","properties":{"device_posture":{"type":"object","properties":{"account_id":{"description":"The ID of the account that owns the device posture integration.","allOf":[{"$ref":"#/definitions/access_identifier"}]},"integration_uid":{"description":"The ID of a device posture integration.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]}},"required":["integration_uid"]}},"required":["device_posture"],"title":"Device Posture"},"access_domain_rule":{"description":"Match an entire email domain.","type":"object","properties":{"email_domain":{"type":"object","properties":{"domain":{"description":"The email domain to match.","type":"string","examples":["example.com"]}},"required":["domain"]}},"required":["email_domain"],"title":"Email domain"},"access_email_list_rule":{"description":"Matches an email address from a list.","type":"object","properties":{"email_list":{"type":"object","properties":{"id":{"description":"The ID of a previously created email list.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]}},"required":["id"]}},"required":["email_list"],"title":"Email list"},"access_email_rule":{"description":"Matches a specific email.","type":"object","properties":{"email":{"type":"object","properties":{"email":{"description":"The email of the user.","type":"string","format":"email","examples":["test@example.com"]}},"required":["email"]}},"required":["email"],"title":"Email"},"access_everyone_rule":{"description":"Matches everyone.","type":"object","properties":{"everyone":{"description":"An empty object which matches on all users.","type":"object","examples":[{}]}},"required":["everyone"],"title":"Everyone"},"access_external_evaluation_rule":{"description":"Create Allow or Block policies which evaluate the user based on custom criteria.","type":"object","properties":{"external_evaluation":{"type":"object","properties":{"evaluate_url":{"description":"The API endpoint containing your business logic.","type":"string","examples":["https://eval.example.com"]},"keys_url":{"description":"The API endpoint containing the key that Access uses to verify that the response came from your API.","type":"string","examples":["https://eval.example.com/keys"]}},"required":["evaluate_url","keys_url"]}},"required":["external_evaluation"],"title":"External Evaluation"},"access_github_organization_rule":{"description":"Matches a Github organization.\nRequires a Github identity provider.","type":"object","properties":{"github-organization":{"type":"object","properties":{"identity_provider_id":{"description":"The ID of your Github identity provider.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]},"name":{"description":"The name of the organization.","type":"string","examples":["cloudflare"]},"team":{"description":"The name of the team","type":"string","examples":["api-team"]}},"required":["name","identity_provider_id"]}},"required":["github-organization"],"title":"Github organization"},"access_gsuite_group_rule":{"description":"Matches a group in Google Workspace.\nRequires a Google Workspace identity provider.","type":"object","properties":{"gsuite":{"type":"object","properties":{"email":{"description":"The email of the Google Workspace group.","type":"string","examples":["devs@cloudflare.com"]},"identity_provider_id":{"description":"The ID of your Google Workspace identity provider.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]}},"required":["email","identity_provider_id"]}},"required":["gsuite"],"title":"Google Workspace group"},"access_login_method_rule":{"description":"Matches a specific identity provider id.","type":"object","properties":{"login_method":{"type":"object","properties":{"id":{"description":"The ID of an identity provider.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]}},"required":["id"]}},"required":["login_method"],"title":"Login Method"},"access_ip_list_rule":{"description":"Matches an IP address from a list.","type":"object","properties":{"ip_list":{"type":"object","properties":{"id":{"description":"The ID of a previously created IP list.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]}},"required":["id"]}},"required":["ip_list"],"title":"IP list"},"access_ip_rule":{"description":"Matches an IP address block.","type":"object","properties":{"ip":{"type":"object","properties":{"ip":{"description":"An IPv4 or IPv6 CIDR block.","type":"string","examples":["2400:cb00:21:10a::/64"]}},"required":["ip"]}},"required":["ip"],"title":"IP ranges"},"access_okta_group_rule":{"description":"Matches an Okta group.\nRequires an Okta identity provider.","type":"object","properties":{"okta":{"type":"object","properties":{"identity_provider_id":{"description":"The ID of your Okta identity provider.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]},"name":{"description":"The name of the Okta group.","type":"string","examples":["devs"]}},"required":["name","identity_provider_id"]}},"required":["okta"],"title":"Okta group"},"access_saml_group_rule":{"description":"Matches a SAML group.\nRequires a SAML identity provider.","type":"object","properties":{"saml":{"type":"object","properties":{"attribute_name":{"description":"The name of the SAML attribute.","type":"string","examples":["group"]},"attribute_value":{"description":"The SAML attribute value to look for.","type":"string","examples":["devs@cloudflare.com"]},"identity_provider_id":{"description":"The ID of your SAML identity provider.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]}},"required":["attribute_name","attribute_value","identity_provider_id"]}},"required":["saml"],"title":"SAML group"},"access_oidc_claim_rule":{"description":"Matches an OIDC claim.\nRequires an OIDC identity provider.","type":"object","properties":{"oidc":{"type":"object","properties":{"claim_name":{"description":"The name of the OIDC claim.","type":"string","examples":["group"]},"claim_value":{"description":"The OIDC claim value to look for.","type":"string","examples":["devs@cloudflare.com"]},"identity_provider_id":{"description":"The ID of your OIDC identity provider.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]}},"required":["claim_name","claim_value","identity_provider_id"]}},"required":["oidc"],"title":"OIDC claim"},"access_service_token_rule":{"description":"Matches a specific Access Service Token","type":"object","properties":{"service_token":{"type":"object","properties":{"token_id":{"description":"The ID of a Service Token.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]}},"required":["token_id"]}},"required":["service_token"],"title":"Service Token"},"access_service_token_tag_rule":{"description":"Matches an Access service token with the specified tag key and value. Only compatible with non_identity decisions.","type":"object","properties":{"service_token_tag":{"type":"object","properties":{"key":{"description":"The tag key to match. Keys are case-sensitive and may contain Unicode letters and digits, underscores, periods, and hyphens.","type":"string","maxLength":256,"minLength":1,"examples":["environment"]},"value":{"description":"The tag value to match. Values are case-sensitive, preserve whitespace, and must not contain NUL characters.","type":"string","maxLength":256,"minLength":1,"examples":["production"]}},"required":["key","value"]}},"required":["service_token_tag"],"title":"Service Token Tag"},"access_linked_app_token_rule":{"description":"Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.","type":"object","properties":{"linked_app_token":{"type":"object","properties":{"app_uid":{"description":"The ID of an Access OIDC SaaS application","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]}},"required":["app_uid"]}},"required":["linked_app_token"],"title":"Linked App Token"},"access_user_risk_score_rule":{"description":"Matches a user's risk score.","type":"object","properties":{"user_risk_score":{"type":"object","properties":{"user_risk_score":{"description":"A list of risk score levels to match. Values can be low, medium, high, or unscored.","type":"array","items":{"enum":["low","medium","high","unscored"],"type":"string"},"minItems":1,"examples":[["low","medium"]]}},"required":["user_risk_score"]}},"required":["user_risk_score"],"title":"User Risk Score"},"access_cloudflare_account_member_rule":{"description":"Matches users who are members of a specific Cloudflare account.\nRequires a Cloudflare identity provider.","type":"object","properties":{"cloudflare_account_member":{"type":"object","properties":{"account_id":{"$ref":"#/definitions/access_identifier"}}}},"required":["cloudflare_account_member"],"title":"Cloudflare Account Member"},"access_rdp_clipboard_format":{"description":"Clipboard format for RDP connections.","type":"string","enum":["text","file"]}}},"name":"Add an Access application","id":"cloudflare.access-applications-add-an-application","example":{"path":{"account_id":"023e105f4ecef8ad9ca31a8372d0c353"},"body":{"type":"self_hosted","oauth_configuration":{},"user_populations":["f174e90a-fafe-4643-bbbc-4a0ed4fc8415"]}},"maxRequests":1,"summary":false}}