{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Updates a configured Access group.","properties":{"path":{"type":"object","properties":{"group_id":{"$ref":"#/definitions/access_uuid"},"account_id":{"$ref":"#/definitions/access_identifier"}},"required":["group_id","account_id"],"additionalProperties":false},"body":{"type":"object","properties":{"exclude":{"$ref":"#/definitions/access_exclude"},"include":{"$ref":"#/definitions/access_include"},"is_default":{"$ref":"#/definitions/access_is_default"},"name":{"$ref":"#/definitions/access_name-6"},"require":{"$ref":"#/definitions/access_require"}},"required":["name","include"]}},"required":["path","body"],"additionalProperties":false,"definitions":{"access_uuid":{"description":"UUID.","type":"string","maxLength":36,"examples":["f174e90a-fafe-4643-bbbc-4a0ed4fc8415"]},"access_identifier":{"description":"Identifier.","type":"string","maxLength":32,"examples":["023e105f4ecef8ad9ca31a8372d0c353"]},"access_exclude":{"description":"Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.","type":"array","items":{"$ref":"#/definitions/access_rule"}},"access_include":{"description":"Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.","type":"array","items":{"$ref":"#/definitions/access_rule"}},"access_is_default":{"description":"Whether this is the default group","type":"boolean"},"access_name-6":{"description":"The name of the Access group.","type":"string","examples":["Allow devs"]},"access_require":{"description":"Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.","type":"array","items":{"$ref":"#/definitions/access_rule"}},"access_rule":{"type":"object","oneOf":[{"$ref":"#/definitions/access_access_group_rule"},{"$ref":"#/definitions/access_any_valid_service_token_rule"},{"$ref":"#/definitions/access_auth_context_rule"},{"$ref":"#/definitions/access_authentication_method_rule"},{"$ref":"#/definitions/access_azure_group_rule"},{"$ref":"#/definitions/access_certificate_rule"},{"$ref":"#/definitions/access_common_name_rule"},{"$ref":"#/definitions/access_country_rule"},{"$ref":"#/definitions/access_device_posture_rule"},{"$ref":"#/definitions/access_domain_rule"},{"$ref":"#/definitions/access_email_list_rule"},{"$ref":"#/definitions/access_email_rule"},{"$ref":"#/definitions/access_everyone_rule"},{"$ref":"#/definitions/access_external_evaluation_rule"},{"$ref":"#/definitions/access_github_organization_rule"},{"$ref":"#/definitions/access_gsuite_group_rule"},{"$ref":"#/definitions/access_login_method_rule"},{"$ref":"#/definitions/access_ip_list_rule"},{"$ref":"#/definitions/access_ip_rule"},{"$ref":"#/definitions/access_okta_group_rule"},{"$ref":"#/definitions/access_saml_group_rule"},{"$ref":"#/definitions/access_oidc_claim_rule"},{"$ref":"#/definitions/access_service_token_rule"},{"$ref":"#/definitions/access_service_token_tag_rule"},{"$ref":"#/definitions/access_linked_app_token_rule"},{"$ref":"#/definitions/access_user_risk_score_rule"},{"$ref":"#/definitions/access_cloudflare_account_member_rule"}]},"access_access_group_rule":{"description":"Matches an Access group.","type":"object","properties":{"group":{"type":"object","properties":{"id":{"description":"The ID of a previously created Access group.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]}},"required":["id"]}},"required":["group"],"title":"Access groups"},"access_any_valid_service_token_rule":{"description":"Matches any valid Access Service Token","type":"object","properties":{"any_valid_service_token":{"description":"An empty object which matches on all service tokens.","type":"object","examples":[{}]}},"required":["any_valid_service_token"],"title":"Any Valid Service Token"},"access_auth_context_rule":{"description":"Matches an Azure Authentication Context.\nRequires an Azure identity provider.","type":"object","properties":{"auth_context":{"type":"object","properties":{"ac_id":{"description":"The ACID of an Authentication context.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]},"id":{"description":"The ID of an Authentication context.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]},"identity_provider_id":{"description":"The ID of your Azure identity provider.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]}},"required":["id","identity_provider_id","ac_id"]}},"required":["auth_context"],"title":"Authentication Context"},"access_authentication_method_rule":{"description":"Enforce different MFA options","type":"object","properties":{"auth_method":{"type":"object","properties":{"auth_method":{"description":"The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.","type":"string","examples":["mfa"]}},"required":["auth_method"]}},"required":["auth_method"],"title":"Authentication method"},"access_azure_group_rule":{"description":"Matches an Azure group.\nRequires an Azure identity provider.","type":"object","properties":{"azureAD":{"type":"object","properties":{"id":{"description":"The ID of an Azure group.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]},"identity_provider_id":{"description":"The ID of your Azure identity provider.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]}},"required":["id","identity_provider_id"]}},"required":["azureAD"],"title":"Azure group"},"access_certificate_rule":{"description":"Matches any valid client certificate.","type":"object","properties":{"certificate":{"type":"object","examples":[{}]}},"required":["certificate"],"title":"Valid certificate","examples":[{"certificate":{}}]},"access_common_name_rule":{"description":"Matches a specific common name.","type":"object","properties":{"common_name":{"type":"object","properties":{"common_name":{"description":"The common name to match.","type":"string","examples":["james@example.com"]}},"required":["common_name"]}},"required":["common_name"],"title":"Common Name"},"access_country_rule":{"description":"Matches a specific country","type":"object","properties":{"geo":{"type":"object","properties":{"country_code":{"description":"The country code that should be matched.","type":"string","examples":["US"]}},"required":["country_code"]}},"required":["geo"],"title":"Country"},"access_device_posture_rule":{"description":"Enforces a device posture rule has run successfully","type":"object","properties":{"device_posture":{"type":"object","properties":{"account_id":{"description":"The ID of the account that owns the device posture integration.","allOf":[{"$ref":"#/definitions/access_identifier"}]},"integration_uid":{"description":"The ID of a device posture integration.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]}},"required":["integration_uid"]}},"required":["device_posture"],"title":"Device Posture"},"access_domain_rule":{"description":"Match an entire email domain.","type":"object","properties":{"email_domain":{"type":"object","properties":{"domain":{"description":"The email domain to match.","type":"string","examples":["example.com"]}},"required":["domain"]}},"required":["email_domain"],"title":"Email domain"},"access_email_list_rule":{"description":"Matches an email address from a list.","type":"object","properties":{"email_list":{"type":"object","properties":{"id":{"description":"The ID of a previously created email list.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]}},"required":["id"]}},"required":["email_list"],"title":"Email list"},"access_email_rule":{"description":"Matches a specific email.","type":"object","properties":{"email":{"type":"object","properties":{"email":{"description":"The email of the user.","type":"string","format":"email","examples":["test@example.com"]}},"required":["email"]}},"required":["email"],"title":"Email"},"access_everyone_rule":{"description":"Matches everyone.","type":"object","properties":{"everyone":{"description":"An empty object which matches on all users.","type":"object","examples":[{}]}},"required":["everyone"],"title":"Everyone"},"access_external_evaluation_rule":{"description":"Create Allow or Block policies which evaluate the user based on custom criteria.","type":"object","properties":{"external_evaluation":{"type":"object","properties":{"evaluate_url":{"description":"The API endpoint containing your business logic.","type":"string","examples":["https://eval.example.com"]},"keys_url":{"description":"The API endpoint containing the key that Access uses to verify that the response came from your API.","type":"string","examples":["https://eval.example.com/keys"]}},"required":["evaluate_url","keys_url"]}},"required":["external_evaluation"],"title":"External Evaluation"},"access_github_organization_rule":{"description":"Matches a Github organization.\nRequires a Github identity provider.","type":"object","properties":{"github-organization":{"type":"object","properties":{"identity_provider_id":{"description":"The ID of your Github identity provider.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]},"name":{"description":"The name of the organization.","type":"string","examples":["cloudflare"]},"team":{"description":"The name of the team","type":"string","examples":["api-team"]}},"required":["name","identity_provider_id"]}},"required":["github-organization"],"title":"Github organization"},"access_gsuite_group_rule":{"description":"Matches a group in Google Workspace.\nRequires a Google Workspace identity provider.","type":"object","properties":{"gsuite":{"type":"object","properties":{"email":{"description":"The email of the Google Workspace group.","type":"string","examples":["devs@cloudflare.com"]},"identity_provider_id":{"description":"The ID of your Google Workspace identity provider.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]}},"required":["email","identity_provider_id"]}},"required":["gsuite"],"title":"Google Workspace group"},"access_login_method_rule":{"description":"Matches a specific identity provider id.","type":"object","properties":{"login_method":{"type":"object","properties":{"id":{"description":"The ID of an identity provider.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]}},"required":["id"]}},"required":["login_method"],"title":"Login Method"},"access_ip_list_rule":{"description":"Matches an IP address from a list.","type":"object","properties":{"ip_list":{"type":"object","properties":{"id":{"description":"The ID of a previously created IP list.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]}},"required":["id"]}},"required":["ip_list"],"title":"IP list"},"access_ip_rule":{"description":"Matches an IP address block.","type":"object","properties":{"ip":{"type":"object","properties":{"ip":{"description":"An IPv4 or IPv6 CIDR block.","type":"string","examples":["2400:cb00:21:10a::/64"]}},"required":["ip"]}},"required":["ip"],"title":"IP ranges"},"access_okta_group_rule":{"description":"Matches an Okta group.\nRequires an Okta identity provider.","type":"object","properties":{"okta":{"type":"object","properties":{"identity_provider_id":{"description":"The ID of your Okta identity provider.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]},"name":{"description":"The name of the Okta group.","type":"string","examples":["devs"]}},"required":["name","identity_provider_id"]}},"required":["okta"],"title":"Okta group"},"access_saml_group_rule":{"description":"Matches a SAML group.\nRequires a SAML identity provider.","type":"object","properties":{"saml":{"type":"object","properties":{"attribute_name":{"description":"The name of the SAML attribute.","type":"string","examples":["group"]},"attribute_value":{"description":"The SAML attribute value to look for.","type":"string","examples":["devs@cloudflare.com"]},"identity_provider_id":{"description":"The ID of your SAML identity provider.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]}},"required":["attribute_name","attribute_value","identity_provider_id"]}},"required":["saml"],"title":"SAML group"},"access_oidc_claim_rule":{"description":"Matches an OIDC claim.\nRequires an OIDC identity provider.","type":"object","properties":{"oidc":{"type":"object","properties":{"claim_name":{"description":"The name of the OIDC claim.","type":"string","examples":["group"]},"claim_value":{"description":"The OIDC claim value to look for.","type":"string","examples":["devs@cloudflare.com"]},"identity_provider_id":{"description":"The ID of your OIDC identity provider.","type":"string","examples":["ea85612a-29c8-46c2-bacb-669d65136971"]}},"required":["claim_name","claim_value","identity_provider_id"]}},"required":["oidc"],"title":"OIDC claim"},"access_service_token_rule":{"description":"Matches a specific Access Service Token","type":"object","properties":{"service_token":{"type":"object","properties":{"token_id":{"description":"The ID of a Service Token.","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]}},"required":["token_id"]}},"required":["service_token"],"title":"Service Token"},"access_service_token_tag_rule":{"description":"Matches an Access service token with the specified tag key and value. Only compatible with non_identity decisions.","type":"object","properties":{"service_token_tag":{"type":"object","properties":{"key":{"description":"The tag key to match. Keys are case-sensitive and may contain Unicode letters and digits, underscores, periods, and hyphens.","type":"string","maxLength":256,"minLength":1,"examples":["environment"]},"value":{"description":"The tag value to match. Values are case-sensitive, preserve whitespace, and must not contain NUL characters.","type":"string","maxLength":256,"minLength":1,"examples":["production"]}},"required":["key","value"]}},"required":["service_token_tag"],"title":"Service Token Tag"},"access_linked_app_token_rule":{"description":"Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.","type":"object","properties":{"linked_app_token":{"type":"object","properties":{"app_uid":{"description":"The ID of an Access OIDC SaaS application","type":"string","examples":["aa0a4aab-672b-4bdb-bc33-a59f1130a11f"]}},"required":["app_uid"]}},"required":["linked_app_token"],"title":"Linked App Token"},"access_user_risk_score_rule":{"description":"Matches a user's risk score.","type":"object","properties":{"user_risk_score":{"type":"object","properties":{"user_risk_score":{"description":"A list of risk score levels to match. Values can be low, medium, high, or unscored.","type":"array","items":{"enum":["low","medium","high","unscored"],"type":"string"},"minItems":1,"examples":[["low","medium"]]}},"required":["user_risk_score"]}},"required":["user_risk_score"],"title":"User Risk Score"},"access_cloudflare_account_member_rule":{"description":"Matches users who are members of a specific Cloudflare account.\nRequires a Cloudflare identity provider.","type":"object","properties":{"cloudflare_account_member":{"type":"object","properties":{"account_id":{"$ref":"#/definitions/access_identifier"}}}},"required":["cloudflare_account_member"],"title":"Cloudflare Account Member"}}},"name":"Update an Access group","id":"cloudflare.access-groups-update-an-access-group","example":{"path":{"group_id":"f174e90a-fafe-4643-bbbc-4a0ed4fc8415","account_id":"023e105f4ecef8ad9ca31a8372d0c353"},"body":{"name":"Allow devs","include":[]}},"maxRequests":1,"summary":false}}