import * as pulumi from "@pulumi/pulumi";
import { input as inputs } from "../types";
export interface AccessApplicationCorsHeader {
    /**
     * Boolean value to determine whether all
     * HTTP headers are exposed.
     */
    allowAllHeaders?: pulumi.Input<boolean>;
    /**
     * Boolean value to determine whether all
     * methods are exposed.
     */
    allowAllMethods?: pulumi.Input<boolean>;
    /**
     * Boolean value to determine whether all
     * origins are permitted to make CORS requests.
     */
    allowAllOrigins?: pulumi.Input<boolean>;
    /**
     * Boolean value to determine if credentials
     * (cookies, authorization headers, or TLS client certificates) are included with
     * requests.
     */
    allowCredentials?: pulumi.Input<boolean>;
    /**
     * List of HTTP headers to expose via CORS.
     */
    allowedHeaders?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of methods to expose via CORS.
     */
    allowedMethods?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of origins permitted to make CORS requests.
     */
    allowedOrigins?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Integer representing the maximum time a preflight
     * request will be cached.
     */
    maxAge?: pulumi.Input<number>;
}
export interface AccessGroupExclude {
    anyValidServiceToken?: pulumi.Input<boolean>;
    authMethod?: pulumi.Input<string>;
    azures?: pulumi.Input<pulumi.Input<inputs.AccessGroupExcludeAzure>[]>;
    certificate?: pulumi.Input<boolean>;
    commonName?: pulumi.Input<string>;
    devicePostures?: pulumi.Input<pulumi.Input<string>[]>;
    emailDomains?: pulumi.Input<pulumi.Input<string>[]>;
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    everyone?: pulumi.Input<boolean>;
    externalEvaluation?: pulumi.Input<inputs.AccessGroupExcludeExternalEvaluation>;
    geos?: pulumi.Input<pulumi.Input<string>[]>;
    githubs?: pulumi.Input<pulumi.Input<inputs.AccessGroupExcludeGithub>[]>;
    groups?: pulumi.Input<pulumi.Input<string>[]>;
    gsuites?: pulumi.Input<pulumi.Input<inputs.AccessGroupExcludeGsuite>[]>;
    ips?: pulumi.Input<pulumi.Input<string>[]>;
    loginMethods?: pulumi.Input<pulumi.Input<string>[]>;
    oktas?: pulumi.Input<pulumi.Input<inputs.AccessGroupExcludeOkta>[]>;
    samls?: pulumi.Input<pulumi.Input<inputs.AccessGroupExcludeSaml>[]>;
    serviceTokens?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessGroupExcludeAzure {
    identityProviderId?: pulumi.Input<string>;
    ids?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessGroupExcludeExternalEvaluation {
    evaluateUrl?: pulumi.Input<string>;
    keysUrl?: pulumi.Input<string>;
}
export interface AccessGroupExcludeGithub {
    identityProviderId?: pulumi.Input<string>;
    /**
     * Friendly name of the Access Group.
     */
    name?: pulumi.Input<string>;
    teams?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessGroupExcludeGsuite {
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    identityProviderId?: pulumi.Input<string>;
}
export interface AccessGroupExcludeOkta {
    identityProviderId?: pulumi.Input<string>;
    /**
     * Friendly name of the Access Group.
     */
    names?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessGroupExcludeSaml {
    attributeName?: pulumi.Input<string>;
    attributeValue?: pulumi.Input<string>;
    identityProviderId?: pulumi.Input<string>;
}
export interface AccessGroupInclude {
    anyValidServiceToken?: pulumi.Input<boolean>;
    authMethod?: pulumi.Input<string>;
    azures?: pulumi.Input<pulumi.Input<inputs.AccessGroupIncludeAzure>[]>;
    certificate?: pulumi.Input<boolean>;
    commonName?: pulumi.Input<string>;
    devicePostures?: pulumi.Input<pulumi.Input<string>[]>;
    emailDomains?: pulumi.Input<pulumi.Input<string>[]>;
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    everyone?: pulumi.Input<boolean>;
    externalEvaluation?: pulumi.Input<inputs.AccessGroupIncludeExternalEvaluation>;
    geos?: pulumi.Input<pulumi.Input<string>[]>;
    githubs?: pulumi.Input<pulumi.Input<inputs.AccessGroupIncludeGithub>[]>;
    groups?: pulumi.Input<pulumi.Input<string>[]>;
    gsuites?: pulumi.Input<pulumi.Input<inputs.AccessGroupIncludeGsuite>[]>;
    ips?: pulumi.Input<pulumi.Input<string>[]>;
    loginMethods?: pulumi.Input<pulumi.Input<string>[]>;
    oktas?: pulumi.Input<pulumi.Input<inputs.AccessGroupIncludeOkta>[]>;
    samls?: pulumi.Input<pulumi.Input<inputs.AccessGroupIncludeSaml>[]>;
    serviceTokens?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessGroupIncludeAzure {
    identityProviderId?: pulumi.Input<string>;
    ids?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessGroupIncludeExternalEvaluation {
    evaluateUrl?: pulumi.Input<string>;
    keysUrl?: pulumi.Input<string>;
}
export interface AccessGroupIncludeGithub {
    identityProviderId?: pulumi.Input<string>;
    /**
     * Friendly name of the Access Group.
     */
    name?: pulumi.Input<string>;
    teams?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessGroupIncludeGsuite {
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    identityProviderId?: pulumi.Input<string>;
}
export interface AccessGroupIncludeOkta {
    identityProviderId?: pulumi.Input<string>;
    /**
     * Friendly name of the Access Group.
     */
    names?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessGroupIncludeSaml {
    attributeName?: pulumi.Input<string>;
    attributeValue?: pulumi.Input<string>;
    identityProviderId?: pulumi.Input<string>;
}
export interface AccessGroupRequire {
    anyValidServiceToken?: pulumi.Input<boolean>;
    authMethod?: pulumi.Input<string>;
    azures?: pulumi.Input<pulumi.Input<inputs.AccessGroupRequireAzure>[]>;
    certificate?: pulumi.Input<boolean>;
    commonName?: pulumi.Input<string>;
    devicePostures?: pulumi.Input<pulumi.Input<string>[]>;
    emailDomains?: pulumi.Input<pulumi.Input<string>[]>;
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    everyone?: pulumi.Input<boolean>;
    externalEvaluation?: pulumi.Input<inputs.AccessGroupRequireExternalEvaluation>;
    geos?: pulumi.Input<pulumi.Input<string>[]>;
    githubs?: pulumi.Input<pulumi.Input<inputs.AccessGroupRequireGithub>[]>;
    groups?: pulumi.Input<pulumi.Input<string>[]>;
    gsuites?: pulumi.Input<pulumi.Input<inputs.AccessGroupRequireGsuite>[]>;
    ips?: pulumi.Input<pulumi.Input<string>[]>;
    loginMethods?: pulumi.Input<pulumi.Input<string>[]>;
    oktas?: pulumi.Input<pulumi.Input<inputs.AccessGroupRequireOkta>[]>;
    samls?: pulumi.Input<pulumi.Input<inputs.AccessGroupRequireSaml>[]>;
    serviceTokens?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessGroupRequireAzure {
    identityProviderId?: pulumi.Input<string>;
    ids?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessGroupRequireExternalEvaluation {
    evaluateUrl?: pulumi.Input<string>;
    keysUrl?: pulumi.Input<string>;
}
export interface AccessGroupRequireGithub {
    identityProviderId?: pulumi.Input<string>;
    /**
     * Friendly name of the Access Group.
     */
    name?: pulumi.Input<string>;
    teams?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessGroupRequireGsuite {
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    identityProviderId?: pulumi.Input<string>;
}
export interface AccessGroupRequireOkta {
    identityProviderId?: pulumi.Input<string>;
    /**
     * Friendly name of the Access Group.
     */
    names?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessGroupRequireSaml {
    attributeName?: pulumi.Input<string>;
    attributeValue?: pulumi.Input<string>;
    identityProviderId?: pulumi.Input<string>;
}
export interface AccessIdentityProviderConfig {
    apiToken?: pulumi.Input<string>;
    appsDomain?: pulumi.Input<string>;
    attributes?: pulumi.Input<pulumi.Input<string>[]>;
    authUrl?: pulumi.Input<string>;
    centrifyAccount?: pulumi.Input<string>;
    centrifyAppId?: pulumi.Input<string>;
    certsUrl?: pulumi.Input<string>;
    clientId?: pulumi.Input<string>;
    clientSecret?: pulumi.Input<string>;
    directoryId?: pulumi.Input<string>;
    emailAttributeName?: pulumi.Input<string>;
    idpPublicCert?: pulumi.Input<string>;
    issuerUrl?: pulumi.Input<string>;
    oktaAccount?: pulumi.Input<string>;
    oneloginAccount?: pulumi.Input<string>;
    redirectUrl?: pulumi.Input<string>;
    signRequest?: pulumi.Input<boolean>;
    ssoTargetUrl?: pulumi.Input<string>;
    supportGroups?: pulumi.Input<boolean>;
    tokenUrl?: pulumi.Input<string>;
}
export interface AccessPolicyApprovalGroup {
    /**
     * Number of approvals needed.
     */
    approvalsNeeded: pulumi.Input<number>;
    /**
     * List of emails to request approval from.
     */
    emailAddresses?: pulumi.Input<pulumi.Input<string>[]>;
    emailListUuid?: pulumi.Input<string>;
}
export interface AccessPolicyExclude {
    anyValidServiceToken?: pulumi.Input<boolean>;
    authMethod?: pulumi.Input<string>;
    azures?: pulumi.Input<pulumi.Input<inputs.AccessPolicyExcludeAzure>[]>;
    certificate?: pulumi.Input<boolean>;
    commonName?: pulumi.Input<string>;
    devicePostures?: pulumi.Input<pulumi.Input<string>[]>;
    emailDomains?: pulumi.Input<pulumi.Input<string>[]>;
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    everyone?: pulumi.Input<boolean>;
    externalEvaluation?: pulumi.Input<inputs.AccessPolicyExcludeExternalEvaluation>;
    geos?: pulumi.Input<pulumi.Input<string>[]>;
    githubs?: pulumi.Input<pulumi.Input<inputs.AccessPolicyExcludeGithub>[]>;
    groups?: pulumi.Input<pulumi.Input<string>[]>;
    gsuites?: pulumi.Input<pulumi.Input<inputs.AccessPolicyExcludeGsuite>[]>;
    ips?: pulumi.Input<pulumi.Input<string>[]>;
    loginMethods?: pulumi.Input<pulumi.Input<string>[]>;
    oktas?: pulumi.Input<pulumi.Input<inputs.AccessPolicyExcludeOkta>[]>;
    samls?: pulumi.Input<pulumi.Input<inputs.AccessPolicyExcludeSaml>[]>;
    serviceTokens?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessPolicyExcludeAzure {
    identityProviderId?: pulumi.Input<string>;
    ids?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessPolicyExcludeExternalEvaluation {
    evaluateUrl?: pulumi.Input<string>;
    keysUrl?: pulumi.Input<string>;
}
export interface AccessPolicyExcludeGithub {
    identityProviderId?: pulumi.Input<string>;
    /**
     * Friendly name of the Access Application.
     */
    name?: pulumi.Input<string>;
    teams?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessPolicyExcludeGsuite {
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    identityProviderId?: pulumi.Input<string>;
}
export interface AccessPolicyExcludeOkta {
    identityProviderId?: pulumi.Input<string>;
    /**
     * Friendly name of the Access Application.
     */
    names?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessPolicyExcludeSaml {
    attributeName?: pulumi.Input<string>;
    attributeValue?: pulumi.Input<string>;
    identityProviderId?: pulumi.Input<string>;
}
export interface AccessPolicyInclude {
    anyValidServiceToken?: pulumi.Input<boolean>;
    authMethod?: pulumi.Input<string>;
    azures?: pulumi.Input<pulumi.Input<inputs.AccessPolicyIncludeAzure>[]>;
    certificate?: pulumi.Input<boolean>;
    commonName?: pulumi.Input<string>;
    devicePostures?: pulumi.Input<pulumi.Input<string>[]>;
    emailDomains?: pulumi.Input<pulumi.Input<string>[]>;
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    everyone?: pulumi.Input<boolean>;
    externalEvaluation?: pulumi.Input<inputs.AccessPolicyIncludeExternalEvaluation>;
    geos?: pulumi.Input<pulumi.Input<string>[]>;
    githubs?: pulumi.Input<pulumi.Input<inputs.AccessPolicyIncludeGithub>[]>;
    groups?: pulumi.Input<pulumi.Input<string>[]>;
    gsuites?: pulumi.Input<pulumi.Input<inputs.AccessPolicyIncludeGsuite>[]>;
    ips?: pulumi.Input<pulumi.Input<string>[]>;
    loginMethods?: pulumi.Input<pulumi.Input<string>[]>;
    oktas?: pulumi.Input<pulumi.Input<inputs.AccessPolicyIncludeOkta>[]>;
    samls?: pulumi.Input<pulumi.Input<inputs.AccessPolicyIncludeSaml>[]>;
    serviceTokens?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessPolicyIncludeAzure {
    identityProviderId?: pulumi.Input<string>;
    ids?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessPolicyIncludeExternalEvaluation {
    evaluateUrl?: pulumi.Input<string>;
    keysUrl?: pulumi.Input<string>;
}
export interface AccessPolicyIncludeGithub {
    identityProviderId?: pulumi.Input<string>;
    /**
     * Friendly name of the Access Application.
     */
    name?: pulumi.Input<string>;
    teams?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessPolicyIncludeGsuite {
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    identityProviderId?: pulumi.Input<string>;
}
export interface AccessPolicyIncludeOkta {
    identityProviderId?: pulumi.Input<string>;
    /**
     * Friendly name of the Access Application.
     */
    names?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessPolicyIncludeSaml {
    attributeName?: pulumi.Input<string>;
    attributeValue?: pulumi.Input<string>;
    identityProviderId?: pulumi.Input<string>;
}
export interface AccessPolicyRequire {
    anyValidServiceToken?: pulumi.Input<boolean>;
    authMethod?: pulumi.Input<string>;
    azures?: pulumi.Input<pulumi.Input<inputs.AccessPolicyRequireAzure>[]>;
    certificate?: pulumi.Input<boolean>;
    commonName?: pulumi.Input<string>;
    devicePostures?: pulumi.Input<pulumi.Input<string>[]>;
    emailDomains?: pulumi.Input<pulumi.Input<string>[]>;
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    everyone?: pulumi.Input<boolean>;
    externalEvaluation?: pulumi.Input<inputs.AccessPolicyRequireExternalEvaluation>;
    geos?: pulumi.Input<pulumi.Input<string>[]>;
    githubs?: pulumi.Input<pulumi.Input<inputs.AccessPolicyRequireGithub>[]>;
    groups?: pulumi.Input<pulumi.Input<string>[]>;
    gsuites?: pulumi.Input<pulumi.Input<inputs.AccessPolicyRequireGsuite>[]>;
    ips?: pulumi.Input<pulumi.Input<string>[]>;
    loginMethods?: pulumi.Input<pulumi.Input<string>[]>;
    oktas?: pulumi.Input<pulumi.Input<inputs.AccessPolicyRequireOkta>[]>;
    samls?: pulumi.Input<pulumi.Input<inputs.AccessPolicyRequireSaml>[]>;
    serviceTokens?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessPolicyRequireAzure {
    identityProviderId?: pulumi.Input<string>;
    ids?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessPolicyRequireExternalEvaluation {
    evaluateUrl?: pulumi.Input<string>;
    keysUrl?: pulumi.Input<string>;
}
export interface AccessPolicyRequireGithub {
    identityProviderId?: pulumi.Input<string>;
    /**
     * Friendly name of the Access Application.
     */
    name?: pulumi.Input<string>;
    teams?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessPolicyRequireGsuite {
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    identityProviderId?: pulumi.Input<string>;
}
export interface AccessPolicyRequireOkta {
    identityProviderId?: pulumi.Input<string>;
    /**
     * Friendly name of the Access Application.
     */
    names?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessPolicyRequireSaml {
    attributeName?: pulumi.Input<string>;
    attributeValue?: pulumi.Input<string>;
    identityProviderId?: pulumi.Input<string>;
}
export interface AccessRuleConfiguration {
    /**
     * The request property to target. Allowed values: "ip", "ip6", "ipRange", "asn", "country"
     */
    target: pulumi.Input<string>;
    /**
     * The value to target. Depends on target's type.
     */
    value: pulumi.Input<string>;
}
export interface ApiTokenCondition {
    /**
     * Request IP related conditions. See the definition below.
     */
    requestIp?: pulumi.Input<inputs.ApiTokenConditionRequestIp>;
}
export interface ApiTokenConditionRequestIp {
    /**
     * List of IPv4/IPv6 CIDR addresses where
     * the Token can be used from.
     */
    ins?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of IPv4/IPv6 CIDR addresses where
     * the Token cannot be used from.
     */
    notIns?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ApiTokenPolicy {
    /**
     * Policy effect. Valid values are `allow` or `deny`. `allow`
     * is set as default.
     */
    effect?: pulumi.Input<string>;
    /**
     * List of permissions groups
     * ids ([see official docs](https://developers.cloudflare.com/api/tokens/create/permissions)).
     */
    permissionGroups: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Map describes what operations against which resources
     * are allowed or denied.
     */
    resources: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
}
export interface CertificatePackValidationError {
    message?: pulumi.Input<string>;
}
export interface CertificatePackValidationRecord {
    cnameName?: pulumi.Input<string>;
    cnameTarget?: pulumi.Input<string>;
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    httpBody?: pulumi.Input<string>;
    httpUrl?: pulumi.Input<string>;
    txtName?: pulumi.Input<string>;
    txtValue?: pulumi.Input<string>;
}
export interface CustomHostnameSsl {
    certificateAuthority?: pulumi.Input<string>;
    /**
     * If a custom uploaded certificate is used.
     */
    customCertificate?: pulumi.Input<string>;
    /**
     * The key for a custom uploaded certificate.
     */
    customKey?: pulumi.Input<string>;
    /**
     * Domain control validation (DCV) method used for this
     * hostname. Valid values are `"txt"`, `"http"` and `"email"`.
     */
    method?: pulumi.Input<string>;
    /**
     * SSL/TLS settings for the certificate. See further notes below.
     */
    settings?: pulumi.Input<pulumi.Input<inputs.CustomHostnameSslSetting>[]>;
    status?: pulumi.Input<string>;
    /**
     * Level of validation to be used for this hostname. Domain validation ("dv") must be used.
     */
    type?: pulumi.Input<string>;
    validationErrors?: pulumi.Input<pulumi.Input<inputs.CustomHostnameSslValidationError>[]>;
    validationRecords?: pulumi.Input<pulumi.Input<inputs.CustomHostnameSslValidationRecord>[]>;
    /**
     * Indicates whether the certificate covers a wildcard.
     */
    wildcard?: pulumi.Input<boolean>;
}
export interface CustomHostnameSslSetting {
    /**
     * List of SSL/TLS ciphers to associate with this certificate.
     */
    ciphers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Whether or not early hints should be supported. Valid values are `"on"` or `"off"`.
     */
    earlyHints?: pulumi.Input<string>;
    /**
     * Whether or not HTTP2 should be supported. Valid values are `"on"` or `"off"`.
     */
    http2?: pulumi.Input<string>;
    /**
     * Lowest version of TLS this certificate should
     * support. Valid values are `"1.0"`, `"1.1"`, `"1.2"` and `"1.3"`.
     */
    minTlsVersion?: pulumi.Input<string>;
    /**
     * Whether or not TLSv1.3 should be supported. Valid values are `"on"` or `"off"`.
     */
    tls13?: pulumi.Input<string>;
}
export interface CustomHostnameSslValidationError {
    message?: pulumi.Input<string>;
}
export interface CustomHostnameSslValidationRecord {
    cnameName?: pulumi.Input<string>;
    cnameTarget?: pulumi.Input<string>;
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    httpBody?: pulumi.Input<string>;
    httpUrl?: pulumi.Input<string>;
    txtName?: pulumi.Input<string>;
    txtValue?: pulumi.Input<string>;
}
export interface CustomSslCustomSslOptions {
    /**
     * Method of building intermediate certificate chain. A ubiquitous bundle has the highest probability of being verified everywhere, even by clients using outdated or unusual trust stores. An optimal bundle uses the shortest chain and newest intermediates. And the force bundle verifies the chain, but does not otherwise modify it. Valid values are `ubiquitous` (default), `optimal`, `force`.
     */
    bundleMethod?: pulumi.Input<string>;
    /**
     * Certificate certificate and the intermediate(s)
     */
    certificate?: pulumi.Input<string>;
    /**
     * Specifies the region where your private key can be held locally. Valid values are `us`, `eu`, `highestSecurity`.
     */
    geoRestrictions?: pulumi.Input<string>;
    /**
     * Certificate's private key
     */
    privateKey?: pulumi.Input<string>;
    /**
     * Whether to enable support for legacy clients which do not include SNI in the TLS handshake. Valid values are `legacyCustom` (default), `sniCustom`.
     */
    type?: pulumi.Input<string>;
}
export interface CustomSslCustomSslPriority {
    id?: pulumi.Input<string>;
    priority?: pulumi.Input<number>;
}
export interface DevicePostureIntegrationConfig {
    /**
     * The third-party API's URL.
     */
    apiUrl?: pulumi.Input<string>;
    /**
     * The third-party authorization API URL.
     */
    authUrl?: pulumi.Input<string>;
    /**
     * The client identifier for authenticating API calls.
     */
    clientId?: pulumi.Input<string>;
    /**
     * The client secret for authenticating API calls.
     */
    clientSecret?: pulumi.Input<string>;
}
export interface DevicePostureRuleInput {
    complianceStatus?: pulumi.Input<string>;
    connectionId?: pulumi.Input<string>;
    /**
     * = (Required) The domain that the client must join.
     */
    domain?: pulumi.Input<string>;
    /**
     * = (Required) True if the firewall must be enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Checks if the file should exist.
     */
    exists?: pulumi.Input<boolean>;
    /**
     * The Teams List id.
     */
    id?: pulumi.Input<string>;
    /**
     * = (Required) The version comparison operator in (>,>=,<,<=,==)
     */
    operator?: pulumi.Input<string>;
    /**
     * The path to the application.
     */
    path?: pulumi.Input<string>;
    /**
     * = (Required) True if all drives must be encrypted.
     */
    requireAll?: pulumi.Input<boolean>;
    /**
     * Checks if the application should be running.
     */
    running?: pulumi.Input<boolean>;
    /**
     * The sha256 hash of the file.
     */
    sha256?: pulumi.Input<string>;
    /**
     * The thumbprint of the application certificate.
     */
    thumbprint?: pulumi.Input<string>;
    /**
     * = (Required) The operating system semantic version.
     */
    version?: pulumi.Input<string>;
}
export interface DevicePostureRuleMatch {
    /**
     * The platform of the device. Valid values are `windows`, `mac`, `linux`, `android`, and `ios`.
     */
    platform?: pulumi.Input<string>;
}
export interface FallbackDomainDomain {
    /**
     * The description of the domain.
     */
    description?: pulumi.Input<string>;
    /**
     * The DNS servers to receive the redirected request.
     */
    dnsServers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The domain to ignore DNS requests.
     */
    suffix?: pulumi.Input<string>;
}
export interface GetWafGroupsFilter {
    /**
     * Mode of the WAF Rule Groups to lookup. Valid values: on and off.
     */
    mode?: string;
    /**
     * A regular expression matching the name of the WAF Rule Groups to lookup.
     */
    name?: string;
}
export interface GetWafGroupsFilterArgs {
    /**
     * Mode of the WAF Rule Groups to lookup. Valid values: on and off.
     */
    mode?: pulumi.Input<string>;
    /**
     * A regular expression matching the name of the WAF Rule Groups to lookup.
     */
    name?: pulumi.Input<string>;
}
export interface GetWafPackagesFilter {
    /**
     * Action mode of the WAF Rule Packages to lookup. Valid values: simulate, block and challenge.
     */
    actionMode?: string;
    /**
     * Detection mode of the WAF Rule Packages to lookup.
     */
    detectionMode?: string;
    /**
     * A regular expression matching the name of the WAF Rule Packages to lookup.
     */
    name?: string;
    /**
     * Sensitivity of the WAF Rule Packages to lookup. Valid values: high, medium, low and off.
     */
    sensitivity?: string;
}
export interface GetWafPackagesFilterArgs {
    /**
     * Action mode of the WAF Rule Packages to lookup. Valid values: simulate, block and challenge.
     */
    actionMode?: pulumi.Input<string>;
    /**
     * Detection mode of the WAF Rule Packages to lookup.
     */
    detectionMode?: pulumi.Input<string>;
    /**
     * A regular expression matching the name of the WAF Rule Packages to lookup.
     */
    name?: pulumi.Input<string>;
    /**
     * Sensitivity of the WAF Rule Packages to lookup. Valid values: high, medium, low and off.
     */
    sensitivity?: pulumi.Input<string>;
}
export interface GetWafRulesFilter {
    /**
     * A regular expression matching the description of the WAF Rules to lookup.
     */
    description?: string;
    /**
     * The ID of the WAF Rule Group in which the WAF Rules to lookup have to be.
     */
    groupId?: string;
    /**
     * Mode of the WAF Rules to lookup. Valid values: one of ["block", "challenge", "default", "disable", "simulate"] or ["on", "off"] depending on the WAF Rule type.
     */
    mode?: string;
}
export interface GetWafRulesFilterArgs {
    /**
     * A regular expression matching the description of the WAF Rules to lookup.
     */
    description?: pulumi.Input<string>;
    /**
     * The ID of the WAF Rule Group in which the WAF Rules to lookup have to be.
     */
    groupId?: pulumi.Input<string>;
    /**
     * Mode of the WAF Rules to lookup. Valid values: one of ["block", "challenge", "default", "disable", "simulate"] or ["on", "off"] depending on the WAF Rule type.
     */
    mode?: pulumi.Input<string>;
}
export interface GetZonesFilter {
    /**
     * Only search for zones in this account.
     */
    accountId?: string;
    /**
     * The type of search to perform for the `name` value
     * when querying the zone API. Valid values: `"exact"` and `"contains"`. Defaults
     * to `"exact"`.
     */
    lookupType?: string;
    /**
     * A RE2 compatible regular expression to filter the
     * results. This is performed client side whereas the `name` and `lookupType`
     * are performed on the Cloudflare server side.
     */
    match?: string;
    /**
     * A string value to search for.
     */
    name?: string;
    /**
     * Paused status of the zone to lookup. Valid values are
     * `true` or `false`.
     */
    paused?: boolean;
    /**
     * Status of the zone to lookup. Valid values: `"active"`,
     * `"pending"`, `"initializing"`, `"moved"`, `"deleted"`, `"deactivated"` and
     * `"read only"`.
     */
    status?: string;
}
export interface GetZonesFilterArgs {
    /**
     * Only search for zones in this account.
     */
    accountId?: pulumi.Input<string>;
    /**
     * The type of search to perform for the `name` value
     * when querying the zone API. Valid values: `"exact"` and `"contains"`. Defaults
     * to `"exact"`.
     */
    lookupType?: pulumi.Input<string>;
    /**
     * A RE2 compatible regular expression to filter the
     * results. This is performed client side whereas the `name` and `lookupType`
     * are performed on the Cloudflare server side.
     */
    match?: pulumi.Input<string>;
    /**
     * A string value to search for.
     */
    name?: pulumi.Input<string>;
    /**
     * Paused status of the zone to lookup. Valid values are
     * `true` or `false`.
     */
    paused?: pulumi.Input<boolean>;
    /**
     * Status of the zone to lookup. Valid values: `"active"`,
     * `"pending"`, `"initializing"`, `"moved"`, `"deleted"`, `"deactivated"` and
     * `"read only"`.
     */
    status?: pulumi.Input<string>;
}
export interface HealthcheckHeader {
    /**
     * The header name.
     */
    header: pulumi.Input<string>;
    /**
     * A list of string values for the header.
     */
    values: pulumi.Input<pulumi.Input<string>[]>;
}
export interface IpListItem {
    /**
     * A note that can be used to annotate the item.
     */
    comment?: pulumi.Input<string>;
    /**
     * The IPv4 address, IPv4 CIDR or IPv6 CIDR. IPv6 CIDRs are limited to a maximum of /64.
     */
    value: pulumi.Input<string>;
}
export interface LoadBalancerMonitorHeader {
    /**
     * The header name.
     */
    header: pulumi.Input<string>;
    /**
     * A list of string values for the header.
     */
    values: pulumi.Input<pulumi.Input<string>[]>;
}
export interface LoadBalancerPoolLoadShedding {
    /**
     * Percent of traffic to shed 0 - 100.
     */
    defaultPercent?: pulumi.Input<number>;
    /**
     * Method of shedding traffic "", "hash" or "random".
     */
    defaultPolicy?: pulumi.Input<string>;
    /**
     * Percent of session traffic to shed 0 - 100.
     */
    sessionPercent?: pulumi.Input<number>;
    /**
     * Method of shedding session traffic "" or "hash".
     */
    sessionPolicy?: pulumi.Input<string>;
}
export interface LoadBalancerPoolOrigin {
    /**
     * The IP address (IPv4 or IPv6) of the origin, or the publicly addressable hostname. Hostnames entered here should resolve directly to the origin, and not be a hostname proxied by Cloudflare.
     */
    address: pulumi.Input<string>;
    /**
     * Whether to enable (the default) this origin within the Pool. Disabled origins will not receive traffic and are excluded from health checks. The origin will only be disabled for the current pool.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The header name.
     */
    headers?: pulumi.Input<pulumi.Input<inputs.LoadBalancerPoolOriginHeader>[]>;
    /**
     * A human-identifiable name for the origin.
     */
    name: pulumi.Input<string>;
    /**
     * The weight (0.01 - 1.00) of this origin, relative to other origins in the pool. Equal values mean equal weighting. A weight of 0 means traffic will not be sent to this origin, but health is still checked. Default: 1.
     */
    weight?: pulumi.Input<number>;
}
export interface LoadBalancerPoolOriginHeader {
    /**
     * The header name.
     */
    header: pulumi.Input<string>;
    /**
     * A list of string values for the header.
     */
    values: pulumi.Input<pulumi.Input<string>[]>;
}
export interface LoadBalancerPoolOriginSteering {
    /**
     * Either "random" (default) or "hash".
     */
    policy?: pulumi.Input<string>;
}
export interface LoadBalancerPopPool {
    /**
     * A list of pool IDs in failover priority to use for traffic reaching the given PoP.
     */
    poolIds: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A 3-letter code for the Point-of-Presence. Allowed values can be found in the list of datacenters on the [status page](https://www.cloudflarestatus.com/). Multiple entries should not be specified with the same PoP.
     */
    pop: pulumi.Input<string>;
}
export interface LoadBalancerRegionPool {
    /**
     * A list of pool IDs in failover priority to use for traffic reaching the given PoP.
     */
    poolIds: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A region code which must be in the list defined [here](https://support.cloudflare.com/hc/en-us/articles/115000540888-Load-Balancing-Geographic-Regions). Multiple entries should not be specified with the same region.
     */
    region: pulumi.Input<string>;
}
export interface LoadBalancerRule {
    /**
     * The statement to evaluate to determine if this rules effects should be applied. An empty condition is always true. See [load balancing rules](https://developers.cloudflare.com/load-balancing/understand-basics/load-balancing-rules).
     */
    condition?: pulumi.Input<string>;
    /**
     * A disabled rule will be be executed.
     */
    disabled?: pulumi.Input<boolean>;
    /**
     * Settings for a HTTP response to return directly to the eyeball if the condition is true. Note: overrides or fixedResponse must be set. See the field documentation below.
     */
    fixedResponse?: pulumi.Input<inputs.LoadBalancerRuleFixedResponse>;
    /**
     * Human readable name for this rule.
     */
    name: pulumi.Input<string>;
    /**
     * The Load Balancer settings to alter if this rules condition is true. Note: overrides or fixedResponse must be set. See the field documentation below.
     */
    overrides?: pulumi.Input<pulumi.Input<inputs.LoadBalancerRuleOverride>[]>;
    /**
     * Priority used when determining the order of rule execution. Lower values are executed first. If not provided list order will be used.
     */
    priority?: pulumi.Input<number>;
    /**
     * Terminates indicates that if this rule is true no further rules should be executed. Note: setting a fixedResponse forces this field to true.
     */
    terminates?: pulumi.Input<boolean>;
}
export interface LoadBalancerRuleFixedResponse {
    /**
     * The value of the HTTP context-type header for this fixed response.
     */
    contentType?: pulumi.Input<string>;
    /**
     * The value of the HTTP location header for this fixed response.
     */
    location?: pulumi.Input<string>;
    /**
     * The text used as the html body for this fixed response.
     */
    messageBody?: pulumi.Input<string>;
    /**
     * The HTTP status code used for this fixed response.
     */
    statusCode?: pulumi.Input<number>;
}
export interface LoadBalancerRuleOverride {
    /**
     * See defaultPoolIds above.
     */
    defaultPools?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * See fallbackPoolId above.
     */
    fallbackPool?: pulumi.Input<string>;
    /**
     * See popPools above.
     */
    popPools?: pulumi.Input<pulumi.Input<inputs.LoadBalancerRuleOverridePopPool>[]>;
    /**
     * See regionPools above.
     */
    regionPools?: pulumi.Input<pulumi.Input<inputs.LoadBalancerRuleOverrideRegionPool>[]>;
    /**
     * See field above.
     */
    sessionAffinity?: pulumi.Input<string>;
    /**
     * See field above.
     */
    sessionAffinityAttributes?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * See field above.
     */
    sessionAffinityTtl?: pulumi.Input<number>;
    /**
     * See field above.
     */
    steeringPolicy?: pulumi.Input<string>;
    /**
     * See field above.
     */
    ttl?: pulumi.Input<number>;
}
export interface LoadBalancerRuleOverridePopPool {
    /**
     * A list of pool IDs in failover priority to use for traffic reaching the given PoP.
     */
    poolIds: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A 3-letter code for the Point-of-Presence. Allowed values can be found in the list of datacenters on the [status page](https://www.cloudflarestatus.com/). Multiple entries should not be specified with the same PoP.
     */
    pop: pulumi.Input<string>;
}
export interface LoadBalancerRuleOverrideRegionPool {
    /**
     * A list of pool IDs in failover priority to use for traffic reaching the given PoP.
     */
    poolIds: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A region code which must be in the list defined [here](https://support.cloudflare.com/hc/en-us/articles/115000540888-Load-Balancing-Geographic-Regions). Multiple entries should not be specified with the same region.
     */
    region: pulumi.Input<string>;
}
export interface NotificationPolicyEmailIntegration {
    id: pulumi.Input<string>;
    /**
     * The name of the notification policy.
     */
    name?: pulumi.Input<string>;
}
export interface NotificationPolicyFilters {
    /**
     * State of the pool to alert on. Example: `"true"`, `"false"`.
     */
    enableds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Identifier health check.
     */
    healthCheckIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A numerical limit. Example: `"100"`
     */
    limits?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Load balancer pool identifier.
     */
    poolIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Product name. Available values: `"workerRequests"`, `"workerDurableObjectsRequests"`, `"workerDurableObjectsDuration"`, `"workerDurableObjectsDataTransfer"`, `"workerDurableObjectsStoredData"`, `"workerDurableObjectsStorageDeletes"`, `"workerDurableObjectsStorageWrites"`, `"workerDurableObjectsStorageReads"`.
     */
    products?: pulumi.Input<pulumi.Input<string>[]>;
    services?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A numerical limit. Example: `"99.9"`
     */
    slos?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Status to alert on. Example: `"Unhealthy"`, `"Healthy"`.
     */
    statuses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of zone identifiers.
     */
    zones?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface NotificationPolicyPagerdutyIntegration {
    id: pulumi.Input<string>;
    /**
     * The name of the notification policy.
     */
    name?: pulumi.Input<string>;
}
export interface NotificationPolicyWebhooksIntegration {
    id: pulumi.Input<string>;
    /**
     * The name of the notification policy.
     */
    name?: pulumi.Input<string>;
}
export interface PageRuleActions {
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    alwaysOnline?: pulumi.Input<string>;
    /**
     * Boolean of whether this action is enabled. Default: false.
     */
    alwaysUseHttps?: pulumi.Input<boolean>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    automaticHttpsRewrites?: pulumi.Input<string>;
    /**
     * The Time To Live for the browser cache. `0` means 'Respect Existing Headers'
     */
    browserCacheTtl?: pulumi.Input<string>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    browserCheck?: pulumi.Input<string>;
    /**
     * String value of cookie name to conditionally bypass cache the page.
     */
    bypassCacheOnCookie?: pulumi.Input<string>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    cacheByDeviceType?: pulumi.Input<string>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    cacheDeceptionArmor?: pulumi.Input<string>;
    /**
     * Controls how Cloudflare creates Cache Keys used to identify files in cache. See below for full description.
     */
    cacheKeyFields?: pulumi.Input<inputs.PageRuleActionsCacheKeyFields>;
    /**
     * Whether to set the cache level to `"bypass"`, `"basic"`, `"simplified"`, `"aggressive"`, or `"cacheEverything"`.
     */
    cacheLevel?: pulumi.Input<string>;
    /**
     * String value of cookie name to conditionally cache the page.
     */
    cacheOnCookie?: pulumi.Input<string>;
    /**
     * Set cache TTL based on the response status from the origin web server. Can be specified multiple times. See below for full description.
     */
    cacheTtlByStatuses?: pulumi.Input<pulumi.Input<inputs.PageRuleActionsCacheTtlByStatus>[]>;
    /**
     * Boolean of whether this action is enabled. Default: false.
     */
    disableApps?: pulumi.Input<boolean>;
    /**
     * Boolean of whether this action is enabled. Default: false.
     */
    disablePerformance?: pulumi.Input<boolean>;
    /**
     * Boolean of whether this action is enabled. Default: false.
     */
    disableRailgun?: pulumi.Input<boolean>;
    /**
     * Boolean of whether this action is enabled. Default: false.
     */
    disableSecurity?: pulumi.Input<boolean>;
    /**
     * Boolean of whether this action is enabled. Default: false.
     */
    disableZaraz?: pulumi.Input<boolean>;
    /**
     * The Time To Live for the edge cache.
     */
    edgeCacheTtl?: pulumi.Input<number>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    emailObfuscation?: pulumi.Input<string>;
    /**
     * Whether origin Cache-Control action is `"on"` or `"off"`.
     */
    explicitCacheControl?: pulumi.Input<string>;
    /**
     * The URL to forward to, and with what status. See below.
     */
    forwardingUrl?: pulumi.Input<inputs.PageRuleActionsForwardingUrl>;
    /**
     * Value of the Host header to send.
     */
    hostHeaderOverride?: pulumi.Input<string>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    ipGeolocation?: pulumi.Input<string>;
    /**
     * The configuration for HTML, CSS and JS minification. See below for full list of options.
     */
    minifies?: pulumi.Input<pulumi.Input<inputs.PageRuleActionsMinify>[]>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    mirage?: pulumi.Input<string>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    opportunisticEncryption?: pulumi.Input<string>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    originErrorPagePassThru?: pulumi.Input<string>;
    /**
     * Whether this action is `"off"`, `"lossless"` or `"lossy"`.
     */
    polish?: pulumi.Input<string>;
    /**
     * Overridden origin server name.
     */
    resolveOverride?: pulumi.Input<string>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    respectStrongEtag?: pulumi.Input<string>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    responseBuffering?: pulumi.Input<string>;
    /**
     * Whether to set the rocket loader to `"on"`, `"off"`.
     */
    rocketLoader?: pulumi.Input<string>;
    /**
     * Whether to set the security level to `"off"`, `"essentiallyOff"`, `"low"`, `"medium"`, `"high"`, or `"underAttack"`.
     */
    securityLevel?: pulumi.Input<string>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    serverSideExclude?: pulumi.Input<string>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    sortQueryStringForCache?: pulumi.Input<string>;
    /**
     * Whether to set the SSL mode to `"off"`, `"flexible"`, `"full"`, `"strict"`, or `"originPull"`.
     */
    ssl?: pulumi.Input<string>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    trueClientIpHeader?: pulumi.Input<string>;
    /**
     * Whether this action is `"on"` or `"off"`.
     */
    waf?: pulumi.Input<string>;
}
export interface PageRuleActionsCacheKeyFields {
    /**
     * Controls what cookies go into Cache Key:
     */
    cookie: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsCookie>;
    /**
     * Controls what HTTP headers go into Cache Key:
     */
    header: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsHeader>;
    /**
     * Controls which Host header goes into Cache Key:
     */
    host: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsHost>;
    /**
     * Controls which URL query string parameters go into the Cache Key.
     */
    queryString: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsQueryString>;
    /**
     * Controls which end user-related features go into the Cache Key.
     */
    user: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsUser>;
}
export interface PageRuleActionsCacheKeyFieldsCookie {
    /**
     * Check for presence of specified HTTP headers, without including their actual values.
     */
    checkPresences?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Only use values of specified query string parameters in Cache Key.
     */
    includes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface PageRuleActionsCacheKeyFieldsHeader {
    /**
     * Check for presence of specified HTTP headers, without including their actual values.
     */
    checkPresences?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Exclude these query string parameters from Cache Key.
     */
    excludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Only use values of specified query string parameters in Cache Key.
     */
    includes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface PageRuleActionsCacheKeyFieldsHost {
    /**
     * `false` (default) - includes the Host header in the HTTP request sent to the origin; `true` - includes the Host header that was resolved to get the origin IP for the request (e.g. changed with Resolve Override Page Rule).
     */
    resolved?: pulumi.Input<boolean>;
}
export interface PageRuleActionsCacheKeyFieldsQueryString {
    /**
     * Exclude these query string parameters from Cache Key.
     */
    excludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * `false` (default) - all query string parameters are used for Cache Key, unless explicitly excluded; `true` - all query string parameters are ignored; value is ignored if any of `exclude` or `include` is non-empty.
     */
    ignore?: pulumi.Input<boolean>;
    /**
     * Only use values of specified query string parameters in Cache Key.
     */
    includes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface PageRuleActionsCacheKeyFieldsUser {
    /**
     * `true` - classifies a request as “mobile”, “desktop”, or “tablet” based on the User Agent; defaults to `false`.
     */
    deviceType?: pulumi.Input<boolean>;
    /**
     * `true` - includes the client’s country, derived from the IP address; defaults to `false`.
     */
    geo?: pulumi.Input<boolean>;
    /**
     * `true` - includes the first language code contained in the `Accept-Language` header sent by the client; defaults to `false`.
     */
    lang?: pulumi.Input<boolean>;
}
export interface PageRuleActionsCacheTtlByStatus {
    /**
     * A HTTP code (e.g. `404`) or range of codes (e.g. `400-499`)
     */
    codes: pulumi.Input<string>;
    /**
     * Duration a resource lives in the Cloudflare cache.
     * * positive number - cache for specified duration in seconds
     */
    ttl: pulumi.Input<number>;
}
export interface PageRuleActionsForwardingUrl {
    /**
     * The status code to use for the redirection.
     */
    statusCode: pulumi.Input<number>;
    /**
     * The URL to which the page rule should forward.
     */
    url: pulumi.Input<string>;
}
export interface PageRuleActionsMinify {
    /**
     * Whether CSS should be minified. Valid values are `"on"` or `"off"`.
     */
    css: pulumi.Input<string>;
    /**
     * Whether HTML should be minified. Valid values are `"on"` or `"off"`.
     */
    html: pulumi.Input<string>;
    /**
     * Whether Javascript should be minified. Valid values are `"on"` or `"off"`.
     */
    js: pulumi.Input<string>;
}
export interface RateLimitAction {
    /**
     * The type of action to perform. Allowable values are 'simulate', 'ban', 'challenge', 'js_challenge' and 'managed_challenge'.
     */
    mode: pulumi.Input<string>;
    /**
     * Custom content-type and body to return, this overrides the custom error for the zone. This field is not required. Omission will result in default HTML error page. Definition below.
     */
    response?: pulumi.Input<inputs.RateLimitActionResponse>;
    /**
     * The time in seconds as an integer to perform the mitigation action. This field is required if the `mode` is either `simulate` or `ban`. Must be the same or greater than the period (min: 1, max: 86400).
     */
    timeout?: pulumi.Input<number>;
}
export interface RateLimitActionResponse {
    /**
     * The body to return, the content here should conform to the content_type.
     */
    body: pulumi.Input<string>;
    /**
     * The content-type of the body, must be one of: 'text/plain', 'text/xml', 'application/json'.
     */
    contentType: pulumi.Input<string>;
}
export interface RateLimitCorrelate {
    /**
     * If set to 'nat', NAT support will be enabled for rate limiting.
     */
    by?: pulumi.Input<string>;
}
export interface RateLimitMatch {
    /**
     * Matches HTTP requests (from the client to Cloudflare). See definition below.
     */
    request?: pulumi.Input<inputs.RateLimitMatchRequest>;
    /**
     * Custom content-type and body to return, this overrides the custom error for the zone. This field is not required. Omission will result in default HTML error page. Definition below.
     */
    response?: pulumi.Input<inputs.RateLimitMatchResponse>;
}
export interface RateLimitMatchRequest {
    /**
     * HTTP Methods, can be a subset ['POST','PUT'] or all ['\_ALL\_']. Default: ['\_ALL\_'].
     */
    methods?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * HTTP Schemes, can be one ['HTTPS'], both ['HTTP','HTTPS'] or all ['\_ALL\_'].  Default: ['\_ALL\_'].
     */
    schemes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The URL pattern to match comprised of the host and path, i.e. example.org/path. Wildcard are expanded to match applicable traffic, query strings are not matched. Use * for all traffic to your zone. Default: '*'.
     */
    urlPattern?: pulumi.Input<string>;
}
export interface RateLimitMatchResponse {
    /**
     * block is a list of maps with the following attributes:
     */
    headers?: pulumi.Input<pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>[]>;
    /**
     * Only count traffic that has come from your origin servers. If true, cached items that Cloudflare serve will not count towards rate limiting. Default: `true`.
     */
    originTraffic?: pulumi.Input<boolean>;
    /**
     * HTTP Status codes, can be one [403], many [401,403] or indicate all by not providing this value.
     */
    statuses?: pulumi.Input<pulumi.Input<number>[]>;
}
export interface RecordData {
    algorithm?: pulumi.Input<number>;
    altitude?: pulumi.Input<number>;
    certificate?: pulumi.Input<string>;
    content?: pulumi.Input<string>;
    digest?: pulumi.Input<string>;
    digestType?: pulumi.Input<number>;
    fingerprint?: pulumi.Input<string>;
    flags?: pulumi.Input<string>;
    keyTag?: pulumi.Input<number>;
    latDegrees?: pulumi.Input<number>;
    latDirection?: pulumi.Input<string>;
    latMinutes?: pulumi.Input<number>;
    latSeconds?: pulumi.Input<number>;
    longDegrees?: pulumi.Input<number>;
    longDirection?: pulumi.Input<string>;
    longMinutes?: pulumi.Input<number>;
    longSeconds?: pulumi.Input<number>;
    matchingType?: pulumi.Input<number>;
    /**
     * The name of the record
     */
    name?: pulumi.Input<string>;
    order?: pulumi.Input<number>;
    port?: pulumi.Input<number>;
    precisionHorz?: pulumi.Input<number>;
    precisionVert?: pulumi.Input<number>;
    preference?: pulumi.Input<number>;
    /**
     * The priority of the record
     */
    priority?: pulumi.Input<number>;
    proto?: pulumi.Input<string>;
    protocol?: pulumi.Input<number>;
    publicKey?: pulumi.Input<string>;
    regex?: pulumi.Input<string>;
    replacement?: pulumi.Input<string>;
    selector?: pulumi.Input<number>;
    service?: pulumi.Input<string>;
    size?: pulumi.Input<number>;
    tag?: pulumi.Input<string>;
    target?: pulumi.Input<string>;
    /**
     * The type of the record
     */
    type?: pulumi.Input<number>;
    usage?: pulumi.Input<number>;
    /**
     * The (string) value of the record. Either this or `data` must be specified
     */
    value?: pulumi.Input<string>;
    weight?: pulumi.Input<number>;
}
export interface RulesetRule {
    /**
     * Action to perform in the rule-level override. Valid values are `"block"`, `"challenge"`, `"ddosDynamic"`, `"execute"`, `"forceConnectionClose"`, `"jsChallenge"`, `"managedChallenge"`, `"log"`, `"rewrite"`, `"score"`, or `"skip"`.
     */
    action?: pulumi.Input<string>;
    /**
     * List of parameters that configure the behavior of the ruleset rule action (refer to the nested schema).
     */
    actionParameters?: pulumi.Input<inputs.RulesetRuleActionParameters>;
    /**
     * Brief summary of the ruleset rule and its intended use.
     */
    description?: pulumi.Input<string>;
    /**
     * Defines if the current rule-level override enables or disables the rule.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * List of parameters that configure exposed credential checks (refer to the nested schema).
     */
    exposedCredentialCheck?: pulumi.Input<inputs.RulesetRuleExposedCredentialCheck>;
    /**
     * Expression that defines the updated (dynamic) value of the URI path or query string component. Conflicts with `value`.
     */
    expression: pulumi.Input<string>;
    /**
     * Rule ID to apply the override to.
     */
    id?: pulumi.Input<string>;
    /**
     * List parameters to configure how the rule generates logs (refer to the nested schema).
     */
    logging?: pulumi.Input<inputs.RulesetRuleLogging>;
    /**
     * List of parameters that configure HTTP rate limiting behaviour (refer to the nested schema).
     */
    ratelimit?: pulumi.Input<inputs.RulesetRuleRatelimit>;
    /**
     * Rule reference.
     */
    ref?: pulumi.Input<string>;
    version?: pulumi.Input<string>;
}
export interface RulesetRuleActionParameters {
    /**
     * List of cookie values to include as part of custom fields logging.
     */
    cookieFields?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of HTTP header modifications to perform in the ruleset rule (refer to the nested schema).
     */
    headers?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersHeader>[]>;
    /**
     * Host Header that request origin receives.
     */
    hostHeader?: pulumi.Input<string>;
    /**
     * Rule ID to apply the override to.
     */
    id?: pulumi.Input<string>;
    increment?: pulumi.Input<number>;
    /**
     * List of properties to configure WAF payload logging (refer to the nested schema).
     */
    matchedData?: pulumi.Input<inputs.RulesetRuleActionParametersMatchedData>;
    /**
     * List of properties to change request origin (refer to the nested schema).
     */
    origin?: pulumi.Input<inputs.RulesetRuleActionParametersOrigin>;
    /**
     * List of override configurations to apply to the ruleset (refer to the nested schema).
     */
    overrides?: pulumi.Input<inputs.RulesetRuleActionParametersOverrides>;
    phases?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Products to target with the actions. Valid values are `"bic"`, `"hot"`, `"ratelimit"`, `"securityLevel"`, `"uablock"`, `"waf"` or `"zonelockdown"`.
     */
    products?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of request headers to include as part of custom fields logging, in lowercase.
     */
    requestFields?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of response headers to include as part of custom fields logging, in lowercase.
     */
    responseFields?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of parameters that configure the response given to end users (refer to the nested schema).
     */
    responses?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersResponse>[]>;
    /**
     * List of rule-based overrides (refer to the nested schema).
     */
    rules?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * Which ruleset ID to target.
     */
    ruleset?: pulumi.Input<string>;
    /**
     * List of managed WAF rule IDs to target. Only valid when the "action" is set to skip.
     */
    rulesets?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of URI properties to configure for the ruleset rule when performing URL rewrite transformations (refer to the nested schema).
     */
    uri?: pulumi.Input<inputs.RulesetRuleActionParametersUri>;
    version?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersHeader {
    /**
     * Expression that defines the updated (dynamic) value of the URI path or query string component. Conflicts with `value`.
     */
    expression?: pulumi.Input<string>;
    /**
     * Name of the HTTP request header to target.
     */
    name?: pulumi.Input<string>;
    /**
     * Action to perform on the HTTP request header. Valid values are `"set"` or `"remove"`.
     */
    operation?: pulumi.Input<string>;
    /**
     * Static string value of the updated URI path or query string component. Conflicts with `expression`.
     */
    value?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersMatchedData {
    /**
     * Public key to use within WAF Ruleset payload logging to view the HTTP request parameters. You can generate a public key [using the `matched-data-cli` command-line tool](https://developers.cloudflare.com/waf/managed-rulesets/payload-logging/command-line/generate-key-pair) or [in the Cloudflare dashboard](https://developers.cloudflare.com/waf/managed-rulesets/payload-logging/configure).
     */
    publicKey?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersOrigin {
    /**
     * Origin Hostname where request is sent.
     */
    host?: pulumi.Input<string>;
    /**
     * Oirign Port where request is sent.
     */
    port?: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersOverrides {
    /**
     * Action to perform in the rule-level override. Valid values are `"block"`, `"challenge"`, `"ddosDynamic"`, `"execute"`, `"forceConnectionClose"`, `"jsChallenge"`, `"managedChallenge"`, `"log"`, `"rewrite"`, `"score"`, or `"skip"`.
     */
    action?: pulumi.Input<string>;
    /**
     * List of tag-based overrides (refer to the nested schema).
     */
    categories?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersOverridesCategory>[]>;
    /**
     * Defines if the current rule-level override enables or disables the rule.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * List of rule-based overrides (refer to the nested schema).
     */
    rules?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersOverridesRule>[]>;
}
export interface RulesetRuleActionParametersOverridesCategory {
    /**
     * Action to perform in the rule-level override. Valid values are `"block"`, `"challenge"`, `"ddosDynamic"`, `"execute"`, `"forceConnectionClose"`, `"jsChallenge"`, `"managedChallenge"`, `"log"`, `"rewrite"`, `"score"`, or `"skip"`.
     */
    action?: pulumi.Input<string>;
    /**
     * Tag name to apply the ruleset rule override to.
     */
    category?: pulumi.Input<string>;
    /**
     * Defines if the current rule-level override enables or disables the rule.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersOverridesRule {
    /**
     * Action to perform in the rule-level override. Valid values are `"block"`, `"challenge"`, `"ddosDynamic"`, `"execute"`, `"forceConnectionClose"`, `"jsChallenge"`, `"managedChallenge"`, `"log"`, `"rewrite"`, `"score"`, or `"skip"`.
     */
    action?: pulumi.Input<string>;
    /**
     * Defines if the current rule-level override enables or disables the rule.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Rule ID to apply the override to.
     */
    id?: pulumi.Input<string>;
    /**
     * Anomaly score threshold to apply in the ruleset rule override. Only applicable to modsecurity-based rulesets.
     */
    scoreThreshold?: pulumi.Input<number>;
    /**
     * Sensitivity level for a ruleset rule override.
     */
    sensitivityLevel?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersResponse {
    /**
     * Body content to include in the response.
     */
    content?: pulumi.Input<string>;
    /**
     * HTTP content type to send in the response.
     */
    contentType?: pulumi.Input<string>;
    /**
     * HTTP status code to send in the response.
     */
    statusCode?: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersUri {
    /**
     * List of properties to change request origin (refer to the nested schema).
     */
    origin?: pulumi.Input<boolean>;
    /**
     * URI path configuration when performing a URL rewrite (refer to the nested schema).
     */
    path?: pulumi.Input<inputs.RulesetRuleActionParametersUriPath>;
    /**
     * Query string configuration when performing a URL rewrite (refer to the nested schema).
     */
    query?: pulumi.Input<inputs.RulesetRuleActionParametersUriQuery>;
}
export interface RulesetRuleActionParametersUriPath {
    /**
     * Expression that defines the updated (dynamic) value of the URI path or query string component. Conflicts with `value`.
     */
    expression?: pulumi.Input<string>;
    /**
     * Static string value of the updated URI path or query string component. Conflicts with `expression`.
     */
    value?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersUriQuery {
    /**
     * Expression that defines the updated (dynamic) value of the URI path or query string component. Conflicts with `value`.
     */
    expression?: pulumi.Input<string>;
    /**
     * Static string value of the updated URI path or query string component. Conflicts with `expression`.
     */
    value?: pulumi.Input<string>;
}
export interface RulesetRuleExposedCredentialCheck {
    /**
     * Firewall Rules expression language based on Wireshark display filters for where to check for the "password" value. Refer to the [Firewall Rules language](https://developers.cloudflare.com/firewall/cf-firewall-language).
     */
    passwordExpression?: pulumi.Input<string>;
    /**
     * Firewall Rules expression language based on Wireshark display filters for where to check for the "username" value. Refer to the [Firewall Rules language](https://developers.cloudflare.com/firewall/cf-firewall-language).
     */
    usernameExpression?: pulumi.Input<string>;
}
export interface RulesetRuleLogging {
    /**
     * Defines if the current rule-level override enables or disables the rule.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface RulesetRuleRatelimit {
    /**
     * List of parameters that define how Cloudflare tracks the request rate for this rule.
     */
    characteristics?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Criteria for counting HTTP requests to trigger the Rate Limiting action. Uses the Firewall Rules expression language based on Wireshark display filters. Refer to the [Firewall Rules language](https://developers.cloudflare.com/firewall/cf-firewall-language) documentation for all available fields, operators, and functions.
     */
    countingExpression?: pulumi.Input<string>;
    /**
     * Once the request rate is reached, the Rate Limiting rule blocks further requests for the period of time defined in this field.
     */
    mitigationTimeout?: pulumi.Input<number>;
    /**
     * The period of time to consider (in seconds) when evaluating the request rate.
     */
    period?: pulumi.Input<number>;
    /**
     * The number of requests over the period of time that will trigger the Rate Limiting rule.
     */
    requestsPerPeriod?: pulumi.Input<number>;
    /**
     * Whether to include requests to origin within the Rate Limiting count.
     */
    requestsToOrigin?: pulumi.Input<boolean>;
}
export interface SpectrumApplicationDns {
    /**
     * Fully qualified domain name of the origin e.g. origin-ssh.example.com.
     */
    name: pulumi.Input<string>;
    /**
     * The type of DNS record associated with the application. Valid values: `CNAME`.
     */
    type: pulumi.Input<string>;
}
export interface SpectrumApplicationOriginDns {
    /**
     * Fully qualified domain name of the origin e.g. origin-ssh.example.com.
     */
    name: pulumi.Input<string>;
}
export interface SpectrumApplicationOriginPortRange {
    /**
     * Upper bound of the origin port range, e.g. `2000`
     */
    end: pulumi.Input<number>;
    /**
     * Lower bound of the origin port range, e.g. `1000`
     */
    start: pulumi.Input<number>;
}
export interface SplitTunnelTunnel {
    /**
     * The address in CIDR format to include in the tunnel configuration. Conflicts with `"host"`.
     */
    address?: pulumi.Input<string>;
    /**
     * The description of the tunnel.
     */
    description?: pulumi.Input<string>;
    /**
     * The domain name to include in the tunnel configuration. Conflicts with `"address"`.
     */
    host?: pulumi.Input<string>;
}
export interface TeamsAccountAntivirus {
    /**
     * Scan on file download.
     */
    enabledDownloadPhase: pulumi.Input<boolean>;
    /**
     * Scan on file upload.
     */
    enabledUploadPhase: pulumi.Input<boolean>;
    /**
     * Block requests for files that cannot be scanned.
     */
    failClosed: pulumi.Input<boolean>;
}
export interface TeamsAccountBlockPage {
    /**
     * Hex code of block page background color.
     */
    backgroundColor?: pulumi.Input<string>;
    /**
     * Indicator of enablement.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Block page header text.
     */
    footerText?: pulumi.Input<string>;
    /**
     * Block page footer text.
     */
    headerText?: pulumi.Input<string>;
    /**
     * URL of block page logo.
     */
    logoPath?: pulumi.Input<string>;
    /**
     * Name of block page configuration.
     */
    name?: pulumi.Input<string>;
}
export interface TeamsAccountFips {
    /**
     * Only allow FIPS-compliant TLS configuration.
     */
    tls?: pulumi.Input<boolean>;
}
export interface TeamsAccountLogging {
    /**
     * Redact personally identifiable information from activity logging (PII fields are: source IP,
     * user email, user ID, device ID, URL, referrer, user agent).
     */
    redactPii: pulumi.Input<boolean>;
    /**
     * Represents whether all requests are logged or only the blocked requests are
     * logged in DNS, HTTP and L4 filters.
     */
    settingsByRuleType: pulumi.Input<inputs.TeamsAccountLoggingSettingsByRuleType>;
}
export interface TeamsAccountLoggingSettingsByRuleType {
    dns: pulumi.Input<inputs.TeamsAccountLoggingSettingsByRuleTypeDns>;
    http: pulumi.Input<inputs.TeamsAccountLoggingSettingsByRuleTypeHttp>;
    l4: pulumi.Input<inputs.TeamsAccountLoggingSettingsByRuleTypeL4>;
}
export interface TeamsAccountLoggingSettingsByRuleTypeDns {
    logAll: pulumi.Input<boolean>;
    logBlocks: pulumi.Input<boolean>;
}
export interface TeamsAccountLoggingSettingsByRuleTypeHttp {
    logAll: pulumi.Input<boolean>;
    logBlocks: pulumi.Input<boolean>;
}
export interface TeamsAccountLoggingSettingsByRuleTypeL4 {
    logAll: pulumi.Input<boolean>;
    logBlocks: pulumi.Input<boolean>;
}
export interface TeamsAccountProxy {
    /**
     * Whether gateway proxy is enabled on gateway devices for tcp traffic.
     */
    tcp: pulumi.Input<boolean>;
    /**
     * Whether gateway proxy is enabled on gateway devices for udp traffic.
     */
    udp: pulumi.Input<boolean>;
}
export interface TeamsLocationNetwork {
    /**
     * ID of the teams location.
     */
    id?: pulumi.Input<string>;
    network: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettings {
    /**
     * Add custom headers to allowed requests in the form of key-value pairs.
     */
    addHeaders?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    /**
     * Configure how browser isolation behaves (refer to the nested schema).
     */
    bisoAdminControls?: pulumi.Input<inputs.TeamsRuleRuleSettingsBisoAdminControls>;
    /**
     * Indicator of block page enablement.
     */
    blockPageEnabled?: pulumi.Input<boolean>;
    /**
     * The displayed reason for a user being blocked.
     */
    blockPageReason?: pulumi.Input<string>;
    /**
     * Configure how session check behaves (refer to the nested schema).
     */
    checkSession?: pulumi.Input<inputs.TeamsRuleRuleSettingsCheckSession>;
    /**
     * Disable DNSSEC validation (must be Allow rule)
     */
    insecureDisableDnssecValidation?: pulumi.Input<boolean>;
    /**
     * Settings to forward layer 4 traffic (refer to the nested schema).
     */
    l4override?: pulumi.Input<inputs.TeamsRuleRuleSettingsL4override>;
    /**
     * The host to override matching DNS queries with.
     */
    overrideHost?: pulumi.Input<string>;
    /**
     * The IPs to override matching DNS queries with.
     */
    overrideIps?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface TeamsRuleRuleSettingsBisoAdminControls {
    /**
     * Disable copy-paste.
     */
    disableCopyPaste?: pulumi.Input<boolean>;
    /**
     * Disable download.
     */
    disableDownload?: pulumi.Input<boolean>;
    /**
     * Disable keyboard usage.
     */
    disableKeyboard?: pulumi.Input<boolean>;
    /**
     * Disable printing.
     */
    disablePrinting?: pulumi.Input<boolean>;
    /**
     * Disable upload.
     */
    disableUpload?: pulumi.Input<boolean>;
}
export interface TeamsRuleRuleSettingsCheckSession {
    /**
     * Configure how fresh the session needs to be to be considered valid.
     */
    duration: pulumi.Input<string>;
    /**
     * Enable session enforcement for this rule.
     */
    enforce: pulumi.Input<boolean>;
}
export interface TeamsRuleRuleSettingsL4override {
    /**
     * Override IP to forward traffic to.
     */
    ip: pulumi.Input<string>;
    /**
     * Override Port to forward traffic to.
     */
    port: pulumi.Input<number>;
}
export interface WorkerScriptKvNamespaceBinding {
    /**
     * The global variable for the binding in your Worker code.
     */
    name: pulumi.Input<string>;
    namespaceId: pulumi.Input<string>;
}
export interface WorkerScriptPlainTextBinding {
    /**
     * The global variable for the binding in your Worker code.
     */
    name: pulumi.Input<string>;
    /**
     * The secret text you want to store.
     */
    text: pulumi.Input<string>;
}
export interface WorkerScriptSecretTextBinding {
    /**
     * The global variable for the binding in your Worker code.
     */
    name: pulumi.Input<string>;
    /**
     * The secret text you want to store.
     */
    text: pulumi.Input<string>;
}
export interface WorkerScriptWebassemblyBinding {
    /**
     * The base64 encoded wasm module you want to store.
     */
    module: pulumi.Input<string>;
    /**
     * The global variable for the binding in your Worker code.
     */
    name: pulumi.Input<string>;
}
export interface ZoneLockdownConfiguration {
    /**
     * The request property to target. Allowed values: "ip", "ipRange"
     */
    target: pulumi.Input<string>;
    /**
     * The value to target. Depends on target's type. IP addresses should just be standard IPv4/IPv6 notation i.e. `198.51.100.4` or `2001:db8::/32` and IP ranges in CIDR format i.e. `198.51.0.0/16`.
     */
    value: pulumi.Input<string>;
}
export interface ZoneSettingsOverrideInitialSetting {
    alwaysOnline?: pulumi.Input<string>;
    alwaysUseHttps?: pulumi.Input<string>;
    automaticHttpsRewrites?: pulumi.Input<string>;
    binaryAst?: pulumi.Input<string>;
    brotli?: pulumi.Input<string>;
    browserCacheTtl?: pulumi.Input<number>;
    browserCheck?: pulumi.Input<string>;
    /**
     * Allowed values: "aggressive" (default) - delivers a different resource each time the query string changes, "basic" - delivers resources from cache when there is no query string, "simplified" - delivers the same resource to everyone independent of the query string.
     */
    cacheLevel?: pulumi.Input<string>;
    challengeTtl?: pulumi.Input<number>;
    /**
     * An allowlist of ciphers for TLS termination. These ciphers must be in the BoringSSL format.
     */
    ciphers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Allowed values: "flattenAtRoot" (default), "flattenAll", "flattenNone".
     */
    cnameFlattening?: pulumi.Input<string>;
    developmentMode?: pulumi.Input<string>;
    earlyHints?: pulumi.Input<string>;
    emailObfuscation?: pulumi.Input<string>;
    filterLogsToCloudflare?: pulumi.Input<string>;
    /**
     * Allowed values: "on", "off" (default), "custom".
     */
    h2Prioritization?: pulumi.Input<string>;
    hotlinkProtection?: pulumi.Input<string>;
    http2?: pulumi.Input<string>;
    http3?: pulumi.Input<string>;
    /**
     * Allowed values: "on", "off" (default), "open".
     */
    imageResizing?: pulumi.Input<string>;
    ipGeolocation?: pulumi.Input<string>;
    ipv6?: pulumi.Input<string>;
    logToCloudflare?: pulumi.Input<string>;
    maxUpload?: pulumi.Input<number>;
    /**
     * Allowed values: "1.0" (default), "1.1", "1.2", "1.3".
     */
    minTlsVersion?: pulumi.Input<string>;
    minify?: pulumi.Input<inputs.ZoneSettingsOverrideInitialSettingMinify>;
    mirage?: pulumi.Input<string>;
    mobileRedirect?: pulumi.Input<inputs.ZoneSettingsOverrideInitialSettingMobileRedirect>;
    opportunisticEncryption?: pulumi.Input<string>;
    opportunisticOnion?: pulumi.Input<string>;
    orangeToOrange?: pulumi.Input<string>;
    originErrorPagePassThru?: pulumi.Input<string>;
    /**
     * Allowed values: "off" (default), "lossless", "lossy".
     */
    polish?: pulumi.Input<string>;
    prefetchPreload?: pulumi.Input<string>;
    privacyPass?: pulumi.Input<string>;
    proxyReadTimeout?: pulumi.Input<string>;
    /**
     * Allowed values: "off" (default), "addHeader", "overwriteHeader".
     */
    pseudoIpv4?: pulumi.Input<string>;
    responseBuffering?: pulumi.Input<string>;
    rocketLoader?: pulumi.Input<string>;
    securityHeader?: pulumi.Input<inputs.ZoneSettingsOverrideInitialSettingSecurityHeader>;
    /**
     * Allowed values: "off" (Enterprise only), "essentiallyOff", "low", "medium" (default), "high", "underAttack".
     */
    securityLevel?: pulumi.Input<string>;
    serverSideExclude?: pulumi.Input<string>;
    sortQueryStringForCache?: pulumi.Input<string>;
    /**
     * Allowed values: "off" (default), "flexible", "full", "strict", "originPull".
     */
    ssl?: pulumi.Input<string>;
    /**
     * @deprecated tls_1_2_only has been deprecated in favour of using `min_tls_version = "1.2"` instead.
     */
    tls12Only?: pulumi.Input<string>;
    /**
     * Allowed values: "off" (default), "on", "zrt".
     */
    tls13?: pulumi.Input<string>;
    tlsClientAuth?: pulumi.Input<string>;
    trueClientIpHeader?: pulumi.Input<string>;
    universalSsl?: pulumi.Input<string>;
    visitorIp?: pulumi.Input<string>;
    waf?: pulumi.Input<string>;
    /**
     * . Note that the value specified will be ignored unless `polish` is turned on (i.e. is "lossless" or "lossy")
     */
    webp?: pulumi.Input<string>;
    websockets?: pulumi.Input<string>;
    zeroRtt?: pulumi.Input<string>;
}
export interface ZoneSettingsOverrideInitialSettingMinify {
    /**
     * "on"/"off"
     */
    css: pulumi.Input<string>;
    /**
     * "on"/"off"
     */
    html: pulumi.Input<string>;
    /**
     * "on"/"off"
     */
    js: pulumi.Input<string>;
}
export interface ZoneSettingsOverrideInitialSettingMobileRedirect {
    /**
     * String value
     */
    mobileSubdomain: pulumi.Input<string>;
    /**
     * "on"/"off"
     */
    status: pulumi.Input<string>;
    /**
     * true/false
     */
    stripUri: pulumi.Input<boolean>;
}
export interface ZoneSettingsOverrideInitialSettingSecurityHeader {
    /**
     * true/false
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * true/false
     */
    includeSubdomains?: pulumi.Input<boolean>;
    /**
     * Integer
     */
    maxAge?: pulumi.Input<number>;
    /**
     * true/false
     */
    nosniff?: pulumi.Input<boolean>;
    /**
     * true/false
     */
    preload?: pulumi.Input<boolean>;
}
export interface ZoneSettingsOverrideSettings {
    alwaysOnline?: pulumi.Input<string>;
    alwaysUseHttps?: pulumi.Input<string>;
    automaticHttpsRewrites?: pulumi.Input<string>;
    binaryAst?: pulumi.Input<string>;
    brotli?: pulumi.Input<string>;
    browserCacheTtl?: pulumi.Input<number>;
    browserCheck?: pulumi.Input<string>;
    /**
     * Allowed values: "aggressive" (default) - delivers a different resource each time the query string changes, "basic" - delivers resources from cache when there is no query string, "simplified" - delivers the same resource to everyone independent of the query string.
     */
    cacheLevel?: pulumi.Input<string>;
    challengeTtl?: pulumi.Input<number>;
    /**
     * An allowlist of ciphers for TLS termination. These ciphers must be in the BoringSSL format.
     */
    ciphers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Allowed values: "flattenAtRoot" (default), "flattenAll", "flattenNone".
     */
    cnameFlattening?: pulumi.Input<string>;
    developmentMode?: pulumi.Input<string>;
    earlyHints?: pulumi.Input<string>;
    emailObfuscation?: pulumi.Input<string>;
    filterLogsToCloudflare?: pulumi.Input<string>;
    /**
     * Allowed values: "on", "off" (default), "custom".
     */
    h2Prioritization?: pulumi.Input<string>;
    hotlinkProtection?: pulumi.Input<string>;
    http2?: pulumi.Input<string>;
    http3?: pulumi.Input<string>;
    /**
     * Allowed values: "on", "off" (default), "open".
     */
    imageResizing?: pulumi.Input<string>;
    ipGeolocation?: pulumi.Input<string>;
    ipv6?: pulumi.Input<string>;
    logToCloudflare?: pulumi.Input<string>;
    maxUpload?: pulumi.Input<number>;
    /**
     * Allowed values: "1.0" (default), "1.1", "1.2", "1.3".
     */
    minTlsVersion?: pulumi.Input<string>;
    minify?: pulumi.Input<inputs.ZoneSettingsOverrideSettingsMinify>;
    mirage?: pulumi.Input<string>;
    mobileRedirect?: pulumi.Input<inputs.ZoneSettingsOverrideSettingsMobileRedirect>;
    opportunisticEncryption?: pulumi.Input<string>;
    opportunisticOnion?: pulumi.Input<string>;
    orangeToOrange?: pulumi.Input<string>;
    originErrorPagePassThru?: pulumi.Input<string>;
    /**
     * Allowed values: "off" (default), "lossless", "lossy".
     */
    polish?: pulumi.Input<string>;
    prefetchPreload?: pulumi.Input<string>;
    privacyPass?: pulumi.Input<string>;
    proxyReadTimeout?: pulumi.Input<string>;
    /**
     * Allowed values: "off" (default), "addHeader", "overwriteHeader".
     */
    pseudoIpv4?: pulumi.Input<string>;
    responseBuffering?: pulumi.Input<string>;
    rocketLoader?: pulumi.Input<string>;
    securityHeader?: pulumi.Input<inputs.ZoneSettingsOverrideSettingsSecurityHeader>;
    /**
     * Allowed values: "off" (Enterprise only), "essentiallyOff", "low", "medium" (default), "high", "underAttack".
     */
    securityLevel?: pulumi.Input<string>;
    serverSideExclude?: pulumi.Input<string>;
    sortQueryStringForCache?: pulumi.Input<string>;
    /**
     * Allowed values: "off" (default), "flexible", "full", "strict", "originPull".
     */
    ssl?: pulumi.Input<string>;
    /**
     * @deprecated tls_1_2_only has been deprecated in favour of using `min_tls_version = "1.2"` instead.
     */
    tls12Only?: pulumi.Input<string>;
    /**
     * Allowed values: "off" (default), "on", "zrt".
     */
    tls13?: pulumi.Input<string>;
    tlsClientAuth?: pulumi.Input<string>;
    trueClientIpHeader?: pulumi.Input<string>;
    universalSsl?: pulumi.Input<string>;
    visitorIp?: pulumi.Input<string>;
    waf?: pulumi.Input<string>;
    /**
     * . Note that the value specified will be ignored unless `polish` is turned on (i.e. is "lossless" or "lossy")
     */
    webp?: pulumi.Input<string>;
    websockets?: pulumi.Input<string>;
    zeroRtt?: pulumi.Input<string>;
}
export interface ZoneSettingsOverrideSettingsMinify {
    /**
     * "on"/"off"
     */
    css: pulumi.Input<string>;
    /**
     * "on"/"off"
     */
    html: pulumi.Input<string>;
    /**
     * "on"/"off"
     */
    js: pulumi.Input<string>;
}
export interface ZoneSettingsOverrideSettingsMobileRedirect {
    /**
     * String value
     */
    mobileSubdomain: pulumi.Input<string>;
    /**
     * "on"/"off"
     */
    status: pulumi.Input<string>;
    /**
     * true/false
     */
    stripUri: pulumi.Input<boolean>;
}
export interface ZoneSettingsOverrideSettingsSecurityHeader {
    /**
     * true/false
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * true/false
     */
    includeSubdomains?: pulumi.Input<boolean>;
    /**
     * Integer
     */
    maxAge?: pulumi.Input<number>;
    /**
     * true/false
     */
    nosniff?: pulumi.Input<boolean>;
    /**
     * true/false
     */
    preload?: pulumi.Input<boolean>;
}