import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
export interface AccessApplicationCorsHeaders {
    /**
     * Allows all HTTP request headers.
     */
    allowAllHeaders?: pulumi.Input<boolean>;
    /**
     * Allows all HTTP request methods.
     */
    allowAllMethods?: pulumi.Input<boolean>;
    /**
     * Allows all origins.
     */
    allowAllOrigins?: pulumi.Input<boolean>;
    /**
     * When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.
     */
    allowCredentials?: pulumi.Input<boolean>;
    /**
     * Allowed HTTP request headers.
     */
    allowedHeaders?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Allowed HTTP request methods.
     */
    allowedMethods?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Allowed origins.
     */
    allowedOrigins?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The maximum number of seconds the results of a preflight request can be cached.
     */
    maxAge?: pulumi.Input<number>;
}
export interface AccessApplicationDestination {
    /**
     * The CIDR range of the destination. Single IPs will be computed as /32.
     */
    cidr?: pulumi.Input<string>;
    /**
     * The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
     */
    hostname?: pulumi.Input<string>;
    /**
     * The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.
     * Available values: "tcp", "udp".
     */
    l4Protocol?: pulumi.Input<string>;
    /**
     * A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.
     */
    mcpServerId?: pulumi.Input<string>;
    /**
     * The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.
     */
    portRange?: pulumi.Input<string>;
    /**
     * Available values: "public", "private".
     */
    type?: pulumi.Input<string>;
    /**
     * The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
     */
    uri?: pulumi.Input<string>;
    /**
     * The VNET ID to match the destination. When omitted, all VNETs will match.
     */
    vnetId?: pulumi.Input<string>;
}
export interface AccessApplicationFooterLink {
    /**
     * The hypertext in the footer link.
     */
    name: pulumi.Input<string>;
    /**
     * the hyperlink in the footer link.
     */
    url: pulumi.Input<string>;
}
export interface AccessApplicationLandingPageDesign {
    /**
     * The background color of the log in button on the landing page.
     */
    buttonColor?: pulumi.Input<string>;
    /**
     * The color of the text in the log in button on the landing page.
     */
    buttonTextColor?: pulumi.Input<string>;
    /**
     * The URL of the image shown on the landing page.
     */
    imageUrl?: pulumi.Input<string>;
    /**
     * The message shown on the landing page.
     */
    message?: pulumi.Input<string>;
    /**
     * The title shown on the landing page.
     */
    title?: pulumi.Input<string>;
}
export interface AccessApplicationPolicy {
    /**
     * The rules that define how users may connect to the targets secured by your application.
     */
    connectionRules?: pulumi.Input<inputs.AccessApplicationPolicyConnectionRules>;
    /**
     * The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
     * Available values: "allow", "deny", "nonIdentity", "bypass".
     */
    decision?: pulumi.Input<string>;
    /**
     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
     */
    excludes?: pulumi.Input<pulumi.Input<inputs.AccessApplicationPolicyExclude>[]>;
    /**
     * The UUID of the policy
     */
    id?: pulumi.Input<string>;
    /**
     * Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
     */
    includes?: pulumi.Input<pulumi.Input<inputs.AccessApplicationPolicyInclude>[]>;
    /**
     * The name of the Access policy.
     */
    name?: pulumi.Input<string>;
    /**
     * The order of execution for this policy. Must be unique for each policy within an app.
     */
    precedence?: pulumi.Input<number>;
    /**
     * Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
     */
    requires?: pulumi.Input<pulumi.Input<inputs.AccessApplicationPolicyRequire>[]>;
}
export interface AccessApplicationPolicyConnectionRules {
    /**
     * The RDP-specific rules that define clipboard behavior for RDP connections.
     */
    rdp?: pulumi.Input<inputs.AccessApplicationPolicyConnectionRulesRdp>;
    /**
     * The SSH-specific rules that define how users may connect to the targets secured by your application.
     */
    ssh?: pulumi.Input<inputs.AccessApplicationPolicyConnectionRulesSsh>;
}
export interface AccessApplicationPolicyConnectionRulesRdp {
    /**
     * Clipboard formats allowed when copying from local machine to remote RDP session.
     */
    allowedClipboardLocalToRemoteFormats?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Clipboard formats allowed when copying from remote RDP session to local machine.
     */
    allowedClipboardRemoteToLocalFormats?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessApplicationPolicyConnectionRulesSsh {
    /**
     * Enables using Identity Provider email alias as SSH username.
     */
    allowEmailAlias?: pulumi.Input<boolean>;
    /**
     * Contains the Unix usernames that may be used when connecting over SSH.
     */
    usernames: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessApplicationPolicyExclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessApplicationPolicyExcludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessApplicationPolicyExcludeAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessApplicationPolicyExcludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessApplicationPolicyExcludeAzureAd>;
    certificate?: pulumi.Input<inputs.AccessApplicationPolicyExcludeCertificate>;
    commonName?: pulumi.Input<inputs.AccessApplicationPolicyExcludeCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessApplicationPolicyExcludeDevicePosture>;
    email?: pulumi.Input<inputs.AccessApplicationPolicyExcludeEmail>;
    emailDomain?: pulumi.Input<inputs.AccessApplicationPolicyExcludeEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessApplicationPolicyExcludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessApplicationPolicyExcludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessApplicationPolicyExcludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessApplicationPolicyExcludeGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessApplicationPolicyExcludeGithubOrganization>;
    group?: pulumi.Input<inputs.AccessApplicationPolicyExcludeGroup>;
    gsuite?: pulumi.Input<inputs.AccessApplicationPolicyExcludeGsuite>;
    ip?: pulumi.Input<inputs.AccessApplicationPolicyExcludeIp>;
    ipList?: pulumi.Input<inputs.AccessApplicationPolicyExcludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessApplicationPolicyExcludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessApplicationPolicyExcludeLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessApplicationPolicyExcludeOidc>;
    okta?: pulumi.Input<inputs.AccessApplicationPolicyExcludeOkta>;
    saml?: pulumi.Input<inputs.AccessApplicationPolicyExcludeSaml>;
    serviceToken?: pulumi.Input<inputs.AccessApplicationPolicyExcludeServiceToken>;
}
export interface AccessApplicationPolicyExcludeAnyValidServiceToken {
}
export interface AccessApplicationPolicyExcludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeCertificate {
}
export interface AccessApplicationPolicyExcludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeEveryone {
}
export interface AccessApplicationPolicyExcludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyInclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessApplicationPolicyIncludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessApplicationPolicyIncludeAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessApplicationPolicyIncludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessApplicationPolicyIncludeAzureAd>;
    certificate?: pulumi.Input<inputs.AccessApplicationPolicyIncludeCertificate>;
    commonName?: pulumi.Input<inputs.AccessApplicationPolicyIncludeCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessApplicationPolicyIncludeDevicePosture>;
    email?: pulumi.Input<inputs.AccessApplicationPolicyIncludeEmail>;
    emailDomain?: pulumi.Input<inputs.AccessApplicationPolicyIncludeEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessApplicationPolicyIncludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessApplicationPolicyIncludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessApplicationPolicyIncludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessApplicationPolicyIncludeGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessApplicationPolicyIncludeGithubOrganization>;
    group?: pulumi.Input<inputs.AccessApplicationPolicyIncludeGroup>;
    gsuite?: pulumi.Input<inputs.AccessApplicationPolicyIncludeGsuite>;
    ip?: pulumi.Input<inputs.AccessApplicationPolicyIncludeIp>;
    ipList?: pulumi.Input<inputs.AccessApplicationPolicyIncludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessApplicationPolicyIncludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessApplicationPolicyIncludeLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessApplicationPolicyIncludeOidc>;
    okta?: pulumi.Input<inputs.AccessApplicationPolicyIncludeOkta>;
    saml?: pulumi.Input<inputs.AccessApplicationPolicyIncludeSaml>;
    serviceToken?: pulumi.Input<inputs.AccessApplicationPolicyIncludeServiceToken>;
}
export interface AccessApplicationPolicyIncludeAnyValidServiceToken {
}
export interface AccessApplicationPolicyIncludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeCertificate {
}
export interface AccessApplicationPolicyIncludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeEveryone {
}
export interface AccessApplicationPolicyIncludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequire {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessApplicationPolicyRequireAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessApplicationPolicyRequireAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessApplicationPolicyRequireAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessApplicationPolicyRequireAzureAd>;
    certificate?: pulumi.Input<inputs.AccessApplicationPolicyRequireCertificate>;
    commonName?: pulumi.Input<inputs.AccessApplicationPolicyRequireCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessApplicationPolicyRequireDevicePosture>;
    email?: pulumi.Input<inputs.AccessApplicationPolicyRequireEmail>;
    emailDomain?: pulumi.Input<inputs.AccessApplicationPolicyRequireEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessApplicationPolicyRequireEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessApplicationPolicyRequireEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessApplicationPolicyRequireExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessApplicationPolicyRequireGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessApplicationPolicyRequireGithubOrganization>;
    group?: pulumi.Input<inputs.AccessApplicationPolicyRequireGroup>;
    gsuite?: pulumi.Input<inputs.AccessApplicationPolicyRequireGsuite>;
    ip?: pulumi.Input<inputs.AccessApplicationPolicyRequireIp>;
    ipList?: pulumi.Input<inputs.AccessApplicationPolicyRequireIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessApplicationPolicyRequireLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessApplicationPolicyRequireLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessApplicationPolicyRequireOidc>;
    okta?: pulumi.Input<inputs.AccessApplicationPolicyRequireOkta>;
    saml?: pulumi.Input<inputs.AccessApplicationPolicyRequireSaml>;
    serviceToken?: pulumi.Input<inputs.AccessApplicationPolicyRequireServiceToken>;
}
export interface AccessApplicationPolicyRequireAnyValidServiceToken {
}
export interface AccessApplicationPolicyRequireAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireCertificate {
}
export interface AccessApplicationPolicyRequireCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireEveryone {
}
export interface AccessApplicationPolicyRequireExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessApplicationSaasApp {
    /**
     * The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.
     */
    accessTokenLifetime?: pulumi.Input<string>;
    /**
     * If client secret should be required on the token endpoint when authorization*code*with_pkce grant is used.
     */
    allowPkceWithoutClientSecret?: pulumi.Input<boolean>;
    /**
     * The URL where this applications tile redirects users
     */
    appLauncherUrl?: pulumi.Input<string>;
    /**
     * Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"
     * Available values: "saml", "oidc".
     */
    authType?: pulumi.Input<string>;
    /**
     * The application client id
     */
    clientId?: pulumi.Input<string>;
    /**
     * The application client secret, only returned on POST request.
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.
     */
    consumerServiceUrl?: pulumi.Input<string>;
    customAttributes?: pulumi.Input<pulumi.Input<inputs.AccessApplicationSaasAppCustomAttribute>[]>;
    customClaims?: pulumi.Input<pulumi.Input<inputs.AccessApplicationSaasAppCustomClaim>[]>;
    /**
     * The URL that the user will be redirected to after a successful login for IDP initiated logins.
     */
    defaultRelayState?: pulumi.Input<string>;
    /**
     * The OIDC flows supported by this application
     */
    grantTypes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
     */
    groupFilterRegex?: pulumi.Input<string>;
    hybridAndImplicitOptions?: pulumi.Input<inputs.AccessApplicationSaasAppHybridAndImplicitOptions>;
    /**
     * The unique identifier for your SaaS application.
     */
    idpEntityId?: pulumi.Input<string>;
    /**
     * The format of the name identifier sent to the SaaS application.
     * Available values: "id", "email".
     */
    nameIdFormat?: pulumi.Input<string>;
    /**
     * A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `nameIdFormat` setting.
     */
    nameIdTransformJsonata?: pulumi.Input<string>;
    /**
     * The Access public certificate that will be used to verify your identity.
     */
    publicKey?: pulumi.Input<string>;
    /**
     * The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens
     */
    redirectUris?: pulumi.Input<pulumi.Input<string>[]>;
    refreshTokenOptions?: pulumi.Input<inputs.AccessApplicationSaasAppRefreshTokenOptions>;
    /**
     * A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml*attributes or oidc*fields of the identity provider used to authenticate. The output of this expression must be a JSON object.
     */
    samlAttributeTransformJsonata?: pulumi.Input<string>;
    /**
     * Define the user information shared with access, "offlineAccess" scope will be automatically enabled if refresh tokens are enabled
     */
    scopes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A globally unique name for an identity or service provider.
     */
    spEntityId?: pulumi.Input<string>;
    /**
     * The endpoint where your SaaS application will send login requests.
     */
    ssoEndpoint?: pulumi.Input<string>;
}
export interface AccessApplicationSaasAppCustomAttribute {
    /**
     * The SAML FriendlyName of the attribute.
     */
    friendlyName?: pulumi.Input<string>;
    /**
     * The name of the attribute.
     */
    name?: pulumi.Input<string>;
    /**
     * A globally unique name for an identity or service provider.
     * Available values: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified", "urn:oasis:names:tc:SAML:2.0:attrname-format:basic", "urn:oasis:names:tc:SAML:2.0:attrname-format:uri".
     */
    nameFormat?: pulumi.Input<string>;
    /**
     * If the attribute is required when building a SAML assertion.
     */
    required?: pulumi.Input<boolean>;
    source?: pulumi.Input<inputs.AccessApplicationSaasAppCustomAttributeSource>;
}
export interface AccessApplicationSaasAppCustomAttributeSource {
    /**
     * The name of the IdP attribute.
     */
    name?: pulumi.Input<string>;
    /**
     * A mapping from IdP ID to attribute name.
     */
    nameByIdps?: pulumi.Input<pulumi.Input<inputs.AccessApplicationSaasAppCustomAttributeSourceNameByIdp>[]>;
}
export interface AccessApplicationSaasAppCustomAttributeSourceNameByIdp {
    /**
     * The UID of the IdP.
     */
    idpId?: pulumi.Input<string>;
    /**
     * The name of the IdP provided attribute.
     */
    sourceName?: pulumi.Input<string>;
}
export interface AccessApplicationSaasAppCustomClaim {
    /**
     * The name of the claim.
     */
    name?: pulumi.Input<string>;
    /**
     * If the claim is required when building an OIDC token.
     */
    required?: pulumi.Input<boolean>;
    /**
     * The scope of the claim.
     * Available values: "groups", "profile", "email", "openid".
     */
    scope?: pulumi.Input<string>;
    source?: pulumi.Input<inputs.AccessApplicationSaasAppCustomClaimSource>;
}
export interface AccessApplicationSaasAppCustomClaimSource {
    /**
     * The name of the IdP claim.
     */
    name?: pulumi.Input<string>;
    /**
     * A mapping from IdP ID to claim name.
     */
    nameByIdp?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
}
export interface AccessApplicationSaasAppHybridAndImplicitOptions {
    /**
     * If an Access Token should be returned from the OIDC Authorization endpoint
     */
    returnAccessTokenFromAuthorizationEndpoint?: pulumi.Input<boolean>;
    /**
     * If an ID Token should be returned from the OIDC Authorization endpoint
     */
    returnIdTokenFromAuthorizationEndpoint?: pulumi.Input<boolean>;
}
export interface AccessApplicationSaasAppRefreshTokenOptions {
    /**
     * How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.
     */
    lifetime?: pulumi.Input<string>;
}
export interface AccessApplicationScimConfig {
    /**
     * Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
     */
    authentication?: pulumi.Input<inputs.AccessApplicationScimConfigAuthentication>;
    /**
     * If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.
     */
    deactivateOnDelete?: pulumi.Input<boolean>;
    /**
     * Whether SCIM provisioning is turned on for this application.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The UID of the IdP to use as the source for SCIM resources to provision to this application.
     */
    idpUid: pulumi.Input<string>;
    /**
     * A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
     */
    mappings?: pulumi.Input<pulumi.Input<inputs.AccessApplicationScimConfigMapping>[]>;
    /**
     * The base URI for the application's SCIM-compatible API.
     */
    remoteUri: pulumi.Input<string>;
}
export interface AccessApplicationScimConfigAuthentication {
    /**
     * URL used to generate the auth code used during token generation.
     */
    authorizationUrl?: pulumi.Input<string>;
    /**
     * Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.
     */
    clientId?: pulumi.Input<string>;
    /**
     * Secret used to authenticate when generating a token for authenticating with the remove SCIM service.
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * Password used to authenticate with the remote SCIM service.
     */
    password?: pulumi.Input<string>;
    /**
     * The authentication scheme to use when making SCIM requests to this application.
     * Available values: "httpbasic", "oauthbearertoken", "oauth2", "access*service*token".
     */
    scheme: pulumi.Input<string>;
    /**
     * The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.
     */
    scopes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Token used to authenticate with the remote SCIM service.
     */
    token?: pulumi.Input<string>;
    /**
     * URL used to generate the token used to authenticate with the remote SCIM service.
     */
    tokenUrl?: pulumi.Input<string>;
    /**
     * User name used to authenticate with the remote SCIM service.
     */
    user?: pulumi.Input<string>;
}
export interface AccessApplicationScimConfigMapping {
    /**
     * Whether or not this mapping is enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.
     */
    filter?: pulumi.Input<string>;
    /**
     * Whether or not this mapping applies to creates, updates, or deletes.
     */
    operations?: pulumi.Input<inputs.AccessApplicationScimConfigMappingOperations>;
    /**
     * Which SCIM resource type this mapping applies to.
     */
    schema: pulumi.Input<string>;
    /**
     * The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
     * Available values: "strict", "passthrough".
     */
    strictness?: pulumi.Input<string>;
    /**
     * A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.
     */
    transformJsonata?: pulumi.Input<string>;
}
export interface AccessApplicationScimConfigMappingOperations {
    /**
     * Whether or not this mapping applies to create (POST) operations.
     */
    create?: pulumi.Input<boolean>;
    /**
     * Whether or not this mapping applies to DELETE operations.
     */
    delete?: pulumi.Input<boolean>;
    /**
     * Whether or not this mapping applies to update (PATCH/PUT) operations.
     */
    update?: pulumi.Input<boolean>;
}
export interface AccessApplicationTargetCriteria {
    /**
     * The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.
     */
    port: pulumi.Input<number>;
    /**
     * The communication protocol your application secures.
     * Available values: "SSH", "RDP".
     */
    protocol: pulumi.Input<string>;
    /**
     * Contains a map of target attribute keys to target attribute values.
     */
    targetAttributes: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
}
export interface AccessGroupExclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessGroupExcludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessGroupExcludeAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessGroupExcludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessGroupExcludeAzureAd>;
    certificate?: pulumi.Input<inputs.AccessGroupExcludeCertificate>;
    commonName?: pulumi.Input<inputs.AccessGroupExcludeCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessGroupExcludeDevicePosture>;
    email?: pulumi.Input<inputs.AccessGroupExcludeEmail>;
    emailDomain?: pulumi.Input<inputs.AccessGroupExcludeEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessGroupExcludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessGroupExcludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessGroupExcludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessGroupExcludeGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessGroupExcludeGithubOrganization>;
    group?: pulumi.Input<inputs.AccessGroupExcludeGroup>;
    gsuite?: pulumi.Input<inputs.AccessGroupExcludeGsuite>;
    ip?: pulumi.Input<inputs.AccessGroupExcludeIp>;
    ipList?: pulumi.Input<inputs.AccessGroupExcludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessGroupExcludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessGroupExcludeLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessGroupExcludeOidc>;
    okta?: pulumi.Input<inputs.AccessGroupExcludeOkta>;
    saml?: pulumi.Input<inputs.AccessGroupExcludeSaml>;
    serviceToken?: pulumi.Input<inputs.AccessGroupExcludeServiceToken>;
}
export interface AccessGroupExcludeAnyValidServiceToken {
}
export interface AccessGroupExcludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupExcludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessGroupExcludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupExcludeCertificate {
}
export interface AccessGroupExcludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessGroupExcludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessGroupExcludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessGroupExcludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessGroupExcludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupExcludeEveryone {
}
export interface AccessGroupExcludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessGroupExcludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessGroupExcludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessGroupExcludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupExcludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupExcludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessGroupExcludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupExcludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessGroupExcludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupExcludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupExcludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessGroupExcludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupExcludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessGroupInclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessGroupIncludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessGroupIncludeAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessGroupIncludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessGroupIncludeAzureAd>;
    certificate?: pulumi.Input<inputs.AccessGroupIncludeCertificate>;
    commonName?: pulumi.Input<inputs.AccessGroupIncludeCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessGroupIncludeDevicePosture>;
    email?: pulumi.Input<inputs.AccessGroupIncludeEmail>;
    emailDomain?: pulumi.Input<inputs.AccessGroupIncludeEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessGroupIncludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessGroupIncludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessGroupIncludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessGroupIncludeGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessGroupIncludeGithubOrganization>;
    group?: pulumi.Input<inputs.AccessGroupIncludeGroup>;
    gsuite?: pulumi.Input<inputs.AccessGroupIncludeGsuite>;
    ip?: pulumi.Input<inputs.AccessGroupIncludeIp>;
    ipList?: pulumi.Input<inputs.AccessGroupIncludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessGroupIncludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessGroupIncludeLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessGroupIncludeOidc>;
    okta?: pulumi.Input<inputs.AccessGroupIncludeOkta>;
    saml?: pulumi.Input<inputs.AccessGroupIncludeSaml>;
    serviceToken?: pulumi.Input<inputs.AccessGroupIncludeServiceToken>;
}
export interface AccessGroupIncludeAnyValidServiceToken {
}
export interface AccessGroupIncludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupIncludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessGroupIncludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupIncludeCertificate {
}
export interface AccessGroupIncludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessGroupIncludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessGroupIncludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessGroupIncludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessGroupIncludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupIncludeEveryone {
}
export interface AccessGroupIncludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessGroupIncludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessGroupIncludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessGroupIncludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupIncludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupIncludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessGroupIncludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupIncludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessGroupIncludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupIncludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupIncludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessGroupIncludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupIncludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessGroupRequire {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessGroupRequireAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessGroupRequireAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessGroupRequireAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessGroupRequireAzureAd>;
    certificate?: pulumi.Input<inputs.AccessGroupRequireCertificate>;
    commonName?: pulumi.Input<inputs.AccessGroupRequireCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessGroupRequireDevicePosture>;
    email?: pulumi.Input<inputs.AccessGroupRequireEmail>;
    emailDomain?: pulumi.Input<inputs.AccessGroupRequireEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessGroupRequireEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessGroupRequireEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessGroupRequireExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessGroupRequireGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessGroupRequireGithubOrganization>;
    group?: pulumi.Input<inputs.AccessGroupRequireGroup>;
    gsuite?: pulumi.Input<inputs.AccessGroupRequireGsuite>;
    ip?: pulumi.Input<inputs.AccessGroupRequireIp>;
    ipList?: pulumi.Input<inputs.AccessGroupRequireIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessGroupRequireLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessGroupRequireLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessGroupRequireOidc>;
    okta?: pulumi.Input<inputs.AccessGroupRequireOkta>;
    saml?: pulumi.Input<inputs.AccessGroupRequireSaml>;
    serviceToken?: pulumi.Input<inputs.AccessGroupRequireServiceToken>;
}
export interface AccessGroupRequireAnyValidServiceToken {
}
export interface AccessGroupRequireAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupRequireAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessGroupRequireAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupRequireCertificate {
}
export interface AccessGroupRequireCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessGroupRequireDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessGroupRequireEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessGroupRequireEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessGroupRequireEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupRequireEveryone {
}
export interface AccessGroupRequireExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessGroupRequireGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessGroupRequireGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessGroupRequireGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupRequireGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupRequireIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessGroupRequireIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupRequireLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessGroupRequireLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupRequireOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupRequireOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessGroupRequireSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupRequireServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessIdentityProviderConfig {
    /**
     * Your companies TLD
     */
    appsDomain?: pulumi.Input<string>;
    /**
     * A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
     */
    attributes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The authorizationEndpoint URL of your IdP
     */
    authUrl?: pulumi.Input<string>;
    /**
     * Your okta authorization server id
     */
    authorizationServerId?: pulumi.Input<string>;
    /**
     * Your centrify account url
     */
    centrifyAccount?: pulumi.Input<string>;
    /**
     * Your centrify app id
     */
    centrifyAppId?: pulumi.Input<string>;
    /**
     * The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens
     */
    certsUrl?: pulumi.Input<string>;
    /**
     * Custom claims
     */
    claims?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Your OAuth Client ID
     */
    clientId?: pulumi.Input<string>;
    /**
     * Your OAuth Client Secret
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * Should Cloudflare try to load authentication contexts from your account
     */
    conditionalAccessEnabled?: pulumi.Input<boolean>;
    /**
     * Your Azure directory uuid
     */
    directoryId?: pulumi.Input<string>;
    /**
     * The attribute name for email in the SAML response.
     */
    emailAttributeName?: pulumi.Input<string>;
    /**
     * The claim name for email in the idToken response.
     */
    emailClaimName?: pulumi.Input<string>;
    /**
     * Add a list of attribute names that will be returned in the response header from the Access callback.
     */
    headerAttributes?: pulumi.Input<pulumi.Input<inputs.AccessIdentityProviderConfigHeaderAttribute>[]>;
    /**
     * X509 certificate to verify the signature in the SAML authentication response
     */
    idpPublicCerts?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * IdP Entity ID or Issuer URL
     */
    issuerUrl?: pulumi.Input<string>;
    /**
     * Your okta account url
     */
    oktaAccount?: pulumi.Input<string>;
    /**
     * Your OneLogin account url
     */
    oneloginAccount?: pulumi.Input<string>;
    /**
     * Your PingOne environment identifier
     */
    pingEnvId?: pulumi.Input<string>;
    /**
     * Enable Proof Key for Code Exchange (PKCE)
     */
    pkceEnabled?: pulumi.Input<boolean>;
    /**
     * Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interaction*required error. prompt=select*account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
     * Available values: "login", "selectAccount", "none".
     */
    prompt?: pulumi.Input<string>;
    redirectUrl?: pulumi.Input<string>;
    /**
     * OAuth scopes
     */
    scopes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
     */
    signRequest?: pulumi.Input<boolean>;
    /**
     * URL to send the SAML authentication requests to
     */
    ssoTargetUrl?: pulumi.Input<string>;
    /**
     * Should Cloudflare try to load groups from your account
     */
    supportGroups?: pulumi.Input<boolean>;
    /**
     * The tokenEndpoint URL of your IdP
     */
    tokenUrl?: pulumi.Input<string>;
}
export interface AccessIdentityProviderConfigHeaderAttribute {
    /**
     * attribute name from the IDP
     */
    attributeName?: pulumi.Input<string>;
    /**
     * header that will be added on the request to the origin
     */
    headerName?: pulumi.Input<string>;
}
export interface AccessIdentityProviderScimConfig {
    /**
     * A flag to enable or disable SCIM for the identity provider.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no*action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.
     * Available values: "automatic", "reauth", "no*action".
     */
    identityUpdateBehavior?: pulumi.Input<string>;
    /**
     * The base URL of Cloudflare's SCIM V2.0 API endpoint.
     */
    scimBaseUrl?: pulumi.Input<string>;
    /**
     * A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider.  This cannot be enabled unless userDeprovision is also enabled.
     */
    seatDeprovision?: pulumi.Input<boolean>;
    /**
     * A read-only token generated when the SCIM integration is enabled for the first time.  It is redacted on subsequent requests.  If you lose this you will need to refresh it at /access/identity*providers/:idpID/refresh*scim_secret.
     */
    secret?: pulumi.Input<string>;
    /**
     * A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
     */
    userDeprovision?: pulumi.Input<boolean>;
}
export interface AccessMutualTlsHostnameSettingsSetting {
    /**
     * Request client certificates for this hostname in China. Can only be set to true if this zone is china network enabled.
     */
    chinaNetwork: pulumi.Input<boolean>;
    /**
     * Client Certificate Forwarding is a feature that takes the client cert provided by the eyeball to the edge, and forwards it to the origin as a HTTP header to allow logging on the origin.
     */
    clientCertificateForwarding: pulumi.Input<boolean>;
    /**
     * The hostname that these settings apply to.
     */
    hostname: pulumi.Input<string>;
}
export interface AccessOrganizationCustomPages {
    /**
     * The uid of the custom page to use when a user is denied access after failing a non-identity rule.
     */
    forbidden?: pulumi.Input<string>;
    /**
     * The uid of the custom page to use when a user is denied access.
     */
    identityDenied?: pulumi.Input<string>;
}
export interface AccessOrganizationLoginDesign {
    /**
     * The background color on your login page.
     */
    backgroundColor?: pulumi.Input<string>;
    /**
     * The text at the bottom of your login page.
     */
    footerText?: pulumi.Input<string>;
    /**
     * The text at the top of your login page.
     */
    headerText?: pulumi.Input<string>;
    /**
     * The URL of the logo on your login page.
     */
    logoPath?: pulumi.Input<string>;
    /**
     * The text color on your login page.
     */
    textColor?: pulumi.Input<string>;
}
export interface AccessOrganizationMfaConfig {
    /**
     * Lists the MFA methods that users can authenticate with.
     */
    allowedAuthenticators?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
     */
    sessionDuration?: pulumi.Input<string>;
}
export interface AccessPolicyApprovalGroup {
    /**
     * The number of approvals needed to obtain access.
     */
    approvalsNeeded: pulumi.Input<number>;
    /**
     * A list of emails that can approve the access request.
     */
    emailAddresses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The UUID of an re-usable email list.
     */
    emailListUuid?: pulumi.Input<string>;
}
export interface AccessPolicyConnectionRules {
    /**
     * The RDP-specific rules that define clipboard behavior for RDP connections.
     */
    rdp?: pulumi.Input<inputs.AccessPolicyConnectionRulesRdp>;
}
export interface AccessPolicyConnectionRulesRdp {
    /**
     * Clipboard formats allowed when copying from local machine to remote RDP session.
     */
    allowedClipboardLocalToRemoteFormats?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Clipboard formats allowed when copying from remote RDP session to local machine.
     */
    allowedClipboardRemoteToLocalFormats?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessPolicyExclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessPolicyExcludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessPolicyExcludeAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessPolicyExcludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessPolicyExcludeAzureAd>;
    certificate?: pulumi.Input<inputs.AccessPolicyExcludeCertificate>;
    commonName?: pulumi.Input<inputs.AccessPolicyExcludeCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessPolicyExcludeDevicePosture>;
    email?: pulumi.Input<inputs.AccessPolicyExcludeEmail>;
    emailDomain?: pulumi.Input<inputs.AccessPolicyExcludeEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessPolicyExcludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessPolicyExcludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessPolicyExcludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessPolicyExcludeGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessPolicyExcludeGithubOrganization>;
    group?: pulumi.Input<inputs.AccessPolicyExcludeGroup>;
    gsuite?: pulumi.Input<inputs.AccessPolicyExcludeGsuite>;
    ip?: pulumi.Input<inputs.AccessPolicyExcludeIp>;
    ipList?: pulumi.Input<inputs.AccessPolicyExcludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessPolicyExcludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessPolicyExcludeLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessPolicyExcludeOidc>;
    okta?: pulumi.Input<inputs.AccessPolicyExcludeOkta>;
    saml?: pulumi.Input<inputs.AccessPolicyExcludeSaml>;
    serviceToken?: pulumi.Input<inputs.AccessPolicyExcludeServiceToken>;
}
export interface AccessPolicyExcludeAnyValidServiceToken {
}
export interface AccessPolicyExcludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyExcludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessPolicyExcludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyExcludeCertificate {
}
export interface AccessPolicyExcludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessPolicyExcludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessPolicyExcludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessPolicyExcludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessPolicyExcludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyExcludeEveryone {
}
export interface AccessPolicyExcludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessPolicyExcludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessPolicyExcludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessPolicyExcludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyExcludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyExcludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessPolicyExcludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyExcludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessPolicyExcludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyExcludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyExcludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessPolicyExcludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyExcludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessPolicyInclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessPolicyIncludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessPolicyIncludeAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessPolicyIncludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessPolicyIncludeAzureAd>;
    certificate?: pulumi.Input<inputs.AccessPolicyIncludeCertificate>;
    commonName?: pulumi.Input<inputs.AccessPolicyIncludeCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessPolicyIncludeDevicePosture>;
    email?: pulumi.Input<inputs.AccessPolicyIncludeEmail>;
    emailDomain?: pulumi.Input<inputs.AccessPolicyIncludeEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessPolicyIncludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessPolicyIncludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessPolicyIncludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessPolicyIncludeGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessPolicyIncludeGithubOrganization>;
    group?: pulumi.Input<inputs.AccessPolicyIncludeGroup>;
    gsuite?: pulumi.Input<inputs.AccessPolicyIncludeGsuite>;
    ip?: pulumi.Input<inputs.AccessPolicyIncludeIp>;
    ipList?: pulumi.Input<inputs.AccessPolicyIncludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessPolicyIncludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessPolicyIncludeLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessPolicyIncludeOidc>;
    okta?: pulumi.Input<inputs.AccessPolicyIncludeOkta>;
    saml?: pulumi.Input<inputs.AccessPolicyIncludeSaml>;
    serviceToken?: pulumi.Input<inputs.AccessPolicyIncludeServiceToken>;
}
export interface AccessPolicyIncludeAnyValidServiceToken {
}
export interface AccessPolicyIncludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyIncludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessPolicyIncludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyIncludeCertificate {
}
export interface AccessPolicyIncludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessPolicyIncludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessPolicyIncludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessPolicyIncludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessPolicyIncludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyIncludeEveryone {
}
export interface AccessPolicyIncludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessPolicyIncludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessPolicyIncludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessPolicyIncludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyIncludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyIncludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessPolicyIncludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyIncludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessPolicyIncludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyIncludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyIncludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessPolicyIncludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyIncludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessPolicyMfaConfig {
    /**
     * Lists the MFA methods that users can authenticate with.
     */
    allowedAuthenticators?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Indicates whether to bypass MFA for this resource. This option is available at the application and policy level.
     */
    mfaBypass?: pulumi.Input<boolean>;
    /**
     * Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
     */
    sessionDuration?: pulumi.Input<string>;
}
export interface AccessPolicyRequire {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessPolicyRequireAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessPolicyRequireAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessPolicyRequireAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessPolicyRequireAzureAd>;
    certificate?: pulumi.Input<inputs.AccessPolicyRequireCertificate>;
    commonName?: pulumi.Input<inputs.AccessPolicyRequireCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessPolicyRequireDevicePosture>;
    email?: pulumi.Input<inputs.AccessPolicyRequireEmail>;
    emailDomain?: pulumi.Input<inputs.AccessPolicyRequireEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessPolicyRequireEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessPolicyRequireEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessPolicyRequireExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessPolicyRequireGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessPolicyRequireGithubOrganization>;
    group?: pulumi.Input<inputs.AccessPolicyRequireGroup>;
    gsuite?: pulumi.Input<inputs.AccessPolicyRequireGsuite>;
    ip?: pulumi.Input<inputs.AccessPolicyRequireIp>;
    ipList?: pulumi.Input<inputs.AccessPolicyRequireIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessPolicyRequireLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessPolicyRequireLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessPolicyRequireOidc>;
    okta?: pulumi.Input<inputs.AccessPolicyRequireOkta>;
    saml?: pulumi.Input<inputs.AccessPolicyRequireSaml>;
    serviceToken?: pulumi.Input<inputs.AccessPolicyRequireServiceToken>;
}
export interface AccessPolicyRequireAnyValidServiceToken {
}
export interface AccessPolicyRequireAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyRequireAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessPolicyRequireAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyRequireCertificate {
}
export interface AccessPolicyRequireCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessPolicyRequireDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessPolicyRequireEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessPolicyRequireEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessPolicyRequireEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyRequireEveryone {
}
export interface AccessPolicyRequireExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessPolicyRequireGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessPolicyRequireGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessPolicyRequireGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyRequireGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyRequireIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessPolicyRequireIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyRequireLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessPolicyRequireLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyRequireOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyRequireOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessPolicyRequireSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyRequireServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessRuleConfiguration {
    /**
     * The configuration target. You must set the target to `ip` when specifying an IP address in the rule.
     * Available values: "ip", "ip6", "ipRange", "asn", "country".
     */
    target?: pulumi.Input<string>;
    /**
     * The IP address to match. This address will be compared to the IP address of incoming requests.
     */
    value?: pulumi.Input<string>;
}
export interface AccessRuleScope {
    /**
     * The contact email address of the user.
     */
    email?: pulumi.Input<string>;
    /**
     * Defines an identifier.
     */
    id?: pulumi.Input<string>;
    /**
     * Defines the scope of the rule.
     * Available values: "user", "organization".
     */
    type?: pulumi.Input<string>;
}
export interface AccountDnsSettingsZoneDefaults {
    /**
     * Whether to flatten all CNAME records in the zone. Note that, due to DNS limitations, a CNAME record at the zone apex will always be flattened.
     */
    flattenAllCnames?: pulumi.Input<boolean>;
    /**
     * Whether to enable Foundation DNS Advanced Nameservers on the zone.
     */
    foundationDns?: pulumi.Input<boolean>;
    /**
     * Settings for this internal zone.
     */
    internalDns?: pulumi.Input<inputs.AccountDnsSettingsZoneDefaultsInternalDns>;
    /**
     * Whether to enable multi-provider DNS, which causes Cloudflare to activate the zone even when non-Cloudflare NS records exist, and to respect NS records at the zone apex during outbound zone transfers.
     */
    multiProvider?: pulumi.Input<boolean>;
    /**
     * Settings determining the nameservers through which the zone should be available.
     */
    nameservers?: pulumi.Input<inputs.AccountDnsSettingsZoneDefaultsNameservers>;
    /**
     * The time to live (TTL) of the zone's nameserver (NS) records.
     */
    nsTtl?: pulumi.Input<number>;
    /**
     * Allows a Secondary DNS zone to use (proxied) override records and CNAME flattening at the zone apex.
     */
    secondaryOverrides?: pulumi.Input<boolean>;
    /**
     * Components of the zone's SOA record.
     */
    soa?: pulumi.Input<inputs.AccountDnsSettingsZoneDefaultsSoa>;
    /**
     * Whether the zone mode is a regular or CDN/DNS only zone.
     * Available values: "standard", "cdn*only", "dns*only".
     */
    zoneMode?: pulumi.Input<string>;
}
export interface AccountDnsSettingsZoneDefaultsInternalDns {
    /**
     * The ID of the zone to fallback to.
     */
    referenceZoneId?: pulumi.Input<string>;
}
export interface AccountDnsSettingsZoneDefaultsNameservers {
    /**
     * Nameserver type
     * Available values: "cloudflare.standard", "cloudflare.standard.random", "custom.account", "custom.tenant".
     */
    type?: pulumi.Input<string>;
}
export interface AccountDnsSettingsZoneDefaultsSoa {
    /**
     * Time in seconds of being unable to query the primary server after which secondary servers should stop serving the zone.
     */
    expire?: pulumi.Input<number>;
    /**
     * The time to live (TTL) for negative caching of records within the zone.
     */
    minTtl?: pulumi.Input<number>;
    /**
     * The primary nameserver, which may be used for outbound zone transfers. If null, a Cloudflare-assigned value will be used.
     */
    mname?: pulumi.Input<string>;
    /**
     * Time in seconds after which secondary servers should re-check the SOA record to see if the zone has been updated.
     */
    refresh?: pulumi.Input<number>;
    /**
     * Time in seconds after which secondary servers should retry queries after the primary server was unresponsive.
     */
    retry?: pulumi.Input<number>;
    /**
     * The email address of the zone administrator, with the first label representing the local part of the email address.
     */
    rname?: pulumi.Input<string>;
    /**
     * The time to live (TTL) of the SOA record itself.
     */
    ttl?: pulumi.Input<number>;
}
export interface AccountManagedBy {
    /**
     * ID of the parent Organization, if one exists
     */
    parentOrgId?: pulumi.Input<string>;
    /**
     * Name of the parent Organization, if one exists
     */
    parentOrgName?: pulumi.Input<string>;
}
export interface AccountMemberPolicy {
    /**
     * Allow or deny operations against the resources.
     * Available values: "allow", "deny".
     */
    access: pulumi.Input<string>;
    /**
     * A set of permission groups that are specified to the policy.
     */
    permissionGroups: pulumi.Input<pulumi.Input<inputs.AccountMemberPolicyPermissionGroup>[]>;
    /**
     * A list of resource groups that the policy applies to.
     */
    resourceGroups: pulumi.Input<pulumi.Input<inputs.AccountMemberPolicyResourceGroup>[]>;
}
export interface AccountMemberPolicyPermissionGroup {
    /**
     * Identifier of the group.
     */
    id: pulumi.Input<string>;
}
export interface AccountMemberPolicyResourceGroup {
    /**
     * Identifier of the group.
     */
    id: pulumi.Input<string>;
}
export interface AccountMemberUser {
    /**
     * The contact email address of the user.
     */
    email?: pulumi.Input<string>;
    /**
     * User's first name
     */
    firstName?: pulumi.Input<string>;
    /**
     * Identifier
     */
    id?: pulumi.Input<string>;
    /**
     * User's last name
     */
    lastName?: pulumi.Input<string>;
    /**
     * Indicates whether two-factor authentication is enabled for the user account. Does not apply to API authentication.
     */
    twoFactorAuthenticationEnabled?: pulumi.Input<boolean>;
}
export interface AccountSettings {
    /**
     * Sets an abuse contact email to notify for abuse reports.
     */
    abuseContactEmail?: pulumi.Input<string>;
    /**
     * Indicates whether membership in this account requires that
     * Two-Factor Authentication is enabled
     */
    enforceTwofactor?: pulumi.Input<boolean>;
}
export interface AccountSubscriptionRatePlan {
    /**
     * The currency applied to the rate plan subscription.
     */
    currency?: pulumi.Input<string>;
    /**
     * Whether this rate plan is managed externally from Cloudflare.
     */
    externallyManaged?: pulumi.Input<boolean>;
    /**
     * The ID of the rate plan.
     */
    id?: pulumi.Input<string>;
    /**
     * Whether a rate plan is enterprise-based (or newly adopted term contract).
     */
    isContract?: pulumi.Input<boolean>;
    /**
     * The full name of the rate plan.
     */
    publicName?: pulumi.Input<string>;
    /**
     * The scope that this rate plan applies to.
     */
    scope?: pulumi.Input<string>;
    /**
     * The list of sets this rate plan applies to. Returns array of strings.
     */
    sets?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccountTokenCondition {
    /**
     * Client IP restrictions.
     */
    requestIp?: pulumi.Input<inputs.AccountTokenConditionRequestIp>;
}
export interface AccountTokenConditionRequestIp {
    /**
     * List of IPv4/IPv6 CIDR addresses.
     */
    ins?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of IPv4/IPv6 CIDR addresses.
     */
    notIns?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccountTokenPolicy {
    /**
     * Allow or deny operations against the resources.
     * Available values: "allow", "deny".
     */
    effect: pulumi.Input<string>;
    /**
     * A set of permission groups that are specified to the policy.
     */
    permissionGroups: pulumi.Input<pulumi.Input<inputs.AccountTokenPolicyPermissionGroup>[]>;
    /**
     * A json object representing the resources that are specified to the policy.
     */
    resources: pulumi.Input<string>;
}
export interface AccountTokenPolicyPermissionGroup {
    /**
     * Identifier of the permission group.
     */
    id: pulumi.Input<string>;
}
export interface AccountUnit {
    /**
     * Tenant unit ID
     */
    id?: pulumi.Input<string>;
}
export interface AddressMapMembership {
    /**
     * The identifier for the membership (eg. a zone or account tag).
     */
    identifier?: pulumi.Input<string>;
    /**
     * The type of the membership.
     * Available values: "zone", "account".
     */
    kind?: pulumi.Input<string>;
}
export interface AiSearchInstanceCustomMetadata {
    /**
     * Available values: "text", "number", "boolean".
     */
    dataType: pulumi.Input<string>;
    fieldName: pulumi.Input<string>;
}
export interface AiSearchInstanceMetadata {
    createdFromAisearchWizard?: pulumi.Input<boolean>;
    workerDomain?: pulumi.Input<string>;
}
export interface AiSearchInstancePublicEndpointParams {
    authorizedHosts?: pulumi.Input<pulumi.Input<string>[]>;
    chatCompletionsEndpoint?: pulumi.Input<inputs.AiSearchInstancePublicEndpointParamsChatCompletionsEndpoint>;
    enabled?: pulumi.Input<boolean>;
    mcp?: pulumi.Input<inputs.AiSearchInstancePublicEndpointParamsMcp>;
    rateLimit?: pulumi.Input<inputs.AiSearchInstancePublicEndpointParamsRateLimit>;
    searchEndpoint?: pulumi.Input<inputs.AiSearchInstancePublicEndpointParamsSearchEndpoint>;
}
export interface AiSearchInstancePublicEndpointParamsChatCompletionsEndpoint {
    /**
     * Disable chat completions endpoint for this public endpoint
     */
    disabled?: pulumi.Input<boolean>;
}
export interface AiSearchInstancePublicEndpointParamsMcp {
    description?: pulumi.Input<string>;
    /**
     * Disable MCP endpoint for this public endpoint
     */
    disabled?: pulumi.Input<boolean>;
}
export interface AiSearchInstancePublicEndpointParamsRateLimit {
    periodMs?: pulumi.Input<number>;
    requests?: pulumi.Input<number>;
    /**
     * Available values: "fixed", "sliding".
     */
    technique?: pulumi.Input<string>;
}
export interface AiSearchInstancePublicEndpointParamsSearchEndpoint {
    /**
     * Disable search endpoint for this public endpoint
     */
    disabled?: pulumi.Input<boolean>;
}
export interface AiSearchInstanceRetrievalOptions {
    /**
     * Controls how keyword search terms are matched. exact*match requires all terms to appear (AND); fuzzy*match returns results containing any term (OR). Defaults to exact*match.
     * Available values: "exact*match", "fuzzyMatch".
     */
    keywordMatchMode?: pulumi.Input<string>;
}
export interface AiSearchInstanceSourceParams {
    /**
     * List of path patterns to exclude. Uses micromatch glob syntax: * matches within a path segment, ** matches across path segments (e.g., /admin/** matches /admin/users and /admin/settings/advanced)
     */
    excludeItems?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of path patterns to include. Uses micromatch glob syntax: * matches within a path segment, ** matches across path segments (e.g., /blog/** matches /blog/post and /blog/2024/post)
     */
    includeItems?: pulumi.Input<pulumi.Input<string>[]>;
    prefix?: pulumi.Input<string>;
    r2Jurisdiction?: pulumi.Input<string>;
    webCrawler?: pulumi.Input<inputs.AiSearchInstanceSourceParamsWebCrawler>;
}
export interface AiSearchInstanceSourceParamsWebCrawler {
    parseOptions?: pulumi.Input<inputs.AiSearchInstanceSourceParamsWebCrawlerParseOptions>;
    /**
     * Available values: "sitemap", "feed-rss".
     */
    parseType?: pulumi.Input<string>;
    storeOptions?: pulumi.Input<inputs.AiSearchInstanceSourceParamsWebCrawlerStoreOptions>;
}
export interface AiSearchInstanceSourceParamsWebCrawlerParseOptions {
    includeHeaders?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    includeImages?: pulumi.Input<boolean>;
    /**
     * List of specific sitemap URLs to use for crawling. Only valid when parseType is 'sitemap'.
     */
    specificSitemaps?: pulumi.Input<pulumi.Input<string>[]>;
    useBrowserRendering?: pulumi.Input<boolean>;
}
export interface AiSearchInstanceSourceParamsWebCrawlerStoreOptions {
    r2Jurisdiction?: pulumi.Input<string>;
    storageId: pulumi.Input<string>;
    /**
     * Available values: "r2".
     */
    storageType?: pulumi.Input<string>;
}
export interface ApiShieldAuthIdCharacteristic {
    /**
     * The name of the characteristic field, i.e., the header or cookie name. When using type "jwt", this must be a claim location expressed as `$(token_config_id):$(json_path)`, where `tokenConfigId` is the ID of the token configuration used in validating the JWT, and `jsonPath` is a RFC 9535 JSONPath expression.
     */
    name: pulumi.Input<string>;
    /**
     * The type of characteristic.
     * Available values: "header", "cookie", "jwt".
     */
    type: pulumi.Input<string>;
}
export interface ApiShieldOperationFeatures {
    /**
     * API Routing settings on endpoint.
     */
    apiRouting?: pulumi.Input<inputs.ApiShieldOperationFeaturesApiRouting>;
    confidenceIntervals?: pulumi.Input<inputs.ApiShieldOperationFeaturesConfidenceIntervals>;
    parameterSchemas?: pulumi.Input<inputs.ApiShieldOperationFeaturesParameterSchemas>;
    schemaInfo?: pulumi.Input<inputs.ApiShieldOperationFeaturesSchemaInfo>;
    thresholds?: pulumi.Input<inputs.ApiShieldOperationFeaturesThresholds>;
}
export interface ApiShieldOperationFeaturesApiRouting {
    lastUpdated?: pulumi.Input<string>;
    /**
     * Target route.
     */
    route?: pulumi.Input<string>;
}
export interface ApiShieldOperationFeaturesConfidenceIntervals {
    lastUpdated?: pulumi.Input<string>;
    suggestedThreshold?: pulumi.Input<inputs.ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThreshold>;
}
export interface ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThreshold {
    confidenceIntervals?: pulumi.Input<inputs.ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervals>;
    /**
     * Suggested threshold.
     */
    mean?: pulumi.Input<number>;
}
export interface ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervals {
    /**
     * Upper and lower bound for percentile estimate
     */
    p90?: pulumi.Input<inputs.ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervalsP90>;
    /**
     * Upper and lower bound for percentile estimate
     */
    p95?: pulumi.Input<inputs.ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervalsP95>;
    /**
     * Upper and lower bound for percentile estimate
     */
    p99?: pulumi.Input<inputs.ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervalsP99>;
}
export interface ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervalsP90 {
    /**
     * Lower bound for percentile estimate
     */
    lower?: pulumi.Input<number>;
    /**
     * Upper bound for percentile estimate
     */
    upper?: pulumi.Input<number>;
}
export interface ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervalsP95 {
    /**
     * Lower bound for percentile estimate
     */
    lower?: pulumi.Input<number>;
    /**
     * Upper bound for percentile estimate
     */
    upper?: pulumi.Input<number>;
}
export interface ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervalsP99 {
    /**
     * Lower bound for percentile estimate
     */
    lower?: pulumi.Input<number>;
    /**
     * Upper bound for percentile estimate
     */
    upper?: pulumi.Input<number>;
}
export interface ApiShieldOperationFeaturesParameterSchemas {
    lastUpdated?: pulumi.Input<string>;
    /**
     * An operation schema object containing a response.
     */
    parameterSchemas?: pulumi.Input<inputs.ApiShieldOperationFeaturesParameterSchemasParameterSchemas>;
}
export interface ApiShieldOperationFeaturesParameterSchemasParameterSchemas {
    /**
     * An array containing the learned parameter schemas.
     */
    parameters?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * An empty response object. This field is required to yield a valid operation schema.
     */
    responses?: pulumi.Input<string>;
}
export interface ApiShieldOperationFeaturesSchemaInfo {
    /**
     * Schema active on endpoint.
     */
    activeSchema?: pulumi.Input<inputs.ApiShieldOperationFeaturesSchemaInfoActiveSchema>;
    /**
     * True if a Cloudflare-provided learned schema is available for this endpoint.
     */
    learnedAvailable?: pulumi.Input<boolean>;
    /**
     * Action taken on requests failing validation.
     * Available values: "none", "log", "block".
     */
    mitigationAction?: pulumi.Input<string>;
}
export interface ApiShieldOperationFeaturesSchemaInfoActiveSchema {
    createdAt?: pulumi.Input<string>;
    /**
     * UUID.
     */
    id?: pulumi.Input<string>;
    /**
     * True if schema is Cloudflare-provided.
     */
    isLearned?: pulumi.Input<boolean>;
    /**
     * Schema file name.
     */
    name?: pulumi.Input<string>;
}
export interface ApiShieldOperationFeaturesThresholds {
    /**
     * The total number of auth-ids seen across this calculation.
     */
    authIdTokens?: pulumi.Input<number>;
    /**
     * The number of data points used for the threshold suggestion calculation.
     */
    dataPoints?: pulumi.Input<number>;
    lastUpdated?: pulumi.Input<string>;
    /**
     * The p50 quantile of requests (in period_seconds).
     */
    p50?: pulumi.Input<number>;
    /**
     * The p90 quantile of requests (in period_seconds).
     */
    p90?: pulumi.Input<number>;
    /**
     * The p99 quantile of requests (in period_seconds).
     */
    p99?: pulumi.Input<number>;
    /**
     * The period over which this threshold is suggested.
     */
    periodSeconds?: pulumi.Input<number>;
    /**
     * The estimated number of requests covered by these calculations.
     */
    requests?: pulumi.Input<number>;
    /**
     * The suggested threshold in requests done by the same auth*id or period*seconds.
     */
    suggestedThreshold?: pulumi.Input<number>;
}
export interface ApiShieldSchemaSchema {
    createdAt?: pulumi.Input<string>;
    /**
     * Kind of schema
     * Available values: "openapiV3".
     */
    kind?: pulumi.Input<string>;
    /**
     * Name of the schema
     */
    name?: pulumi.Input<string>;
    /**
     * UUID.
     */
    schemaId?: pulumi.Input<string>;
    /**
     * Source of the schema
     */
    source?: pulumi.Input<string>;
    /**
     * Flag whether schema is enabled for validation.
     */
    validationEnabled?: pulumi.Input<boolean>;
}
export interface ApiShieldSchemaUploadDetails {
    /**
     * Diagnostic warning events that occurred during processing. These events are non-critical errors found within the schema.
     */
    warnings?: pulumi.Input<pulumi.Input<inputs.ApiShieldSchemaUploadDetailsWarning>[]>;
}
export interface ApiShieldSchemaUploadDetailsWarning {
    /**
     * Code that identifies the event that occurred.
     */
    code?: pulumi.Input<number>;
    /**
     * JSONPath location(s) in the schema where these events were encountered.  See [https://goessner.net/articles/JsonPath/](https://goessner.net/articles/JsonPath/) for JSONPath specification.
     */
    locations?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Diagnostic message that describes the event.
     */
    message?: pulumi.Input<string>;
}
export interface ApiTokenCondition {
    /**
     * Client IP restrictions.
     */
    requestIp?: pulumi.Input<inputs.ApiTokenConditionRequestIp>;
}
export interface ApiTokenConditionRequestIp {
    /**
     * List of IPv4/IPv6 CIDR addresses.
     */
    ins?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of IPv4/IPv6 CIDR addresses.
     */
    notIns?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ApiTokenPolicy {
    /**
     * Allow or deny operations against the resources.
     * Available values: "allow", "deny".
     */
    effect: pulumi.Input<string>;
    /**
     * A set of permission groups that are specified to the policy.
     */
    permissionGroups: pulumi.Input<pulumi.Input<inputs.ApiTokenPolicyPermissionGroup>[]>;
    /**
     * A json object representing the resources that are specified to the policy.
     */
    resources: pulumi.Input<string>;
}
export interface ApiTokenPolicyPermissionGroup {
    /**
     * Identifier of the permission group.
     */
    id: pulumi.Input<string>;
}
export interface AuthenticatedOriginPullsConfig {
    /**
     * Certificate identifier tag.
     */
    certId?: pulumi.Input<string>;
    /**
     * Indicates whether hostname-level authenticated origin pulls is enabled. A null value voids the association.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The hostname on the origin for which the client certificate uploaded will be used.
     */
    hostname?: pulumi.Input<string>;
}
export interface BotManagementStaleZoneConfiguration {
    /**
     * Indicates that the zone's Bot Fight Mode is turned on.
     */
    fightMode?: pulumi.Input<boolean>;
    /**
     * Indicates that the zone's wordpress optimization for SBFM is turned on.
     */
    optimizeWordpress?: pulumi.Input<boolean>;
    /**
     * Indicates that the zone's definitely automated requests are being blocked or challenged.
     */
    sbfmDefinitelyAutomated?: pulumi.Input<string>;
    /**
     * Indicates that the zone's likely automated requests are being blocked or challenged.
     */
    sbfmLikelyAutomated?: pulumi.Input<string>;
    /**
     * Indicates that the zone's static resource protection is turned on.
     */
    sbfmStaticResourceProtection?: pulumi.Input<string>;
    /**
     * Indicates that the zone's verified bot requests are being blocked.
     */
    sbfmVerifiedBots?: pulumi.Input<string>;
    /**
     * Indicates that the zone's session score tracking is disabled.
     */
    suppressSessionScore?: pulumi.Input<boolean>;
}
export interface CertificatePackCertificate {
    /**
     * Certificate bundle method.
     */
    bundleMethod?: pulumi.Input<string>;
    /**
     * When the certificate from the authority expires.
     */
    expiresOn?: pulumi.Input<string>;
    /**
     * Specify the region where your private key can be held locally.
     */
    geoRestrictions?: pulumi.Input<inputs.CertificatePackCertificateGeoRestrictions>;
    /**
     * Hostnames covered by this certificate.
     */
    hosts?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Certificate identifier.
     */
    id?: pulumi.Input<string>;
    /**
     * The certificate authority that issued the certificate.
     */
    issuer?: pulumi.Input<string>;
    /**
     * When the certificate was last modified.
     */
    modifiedOn?: pulumi.Input<string>;
    /**
     * The order/priority in which the certificate will be used.
     */
    priority?: pulumi.Input<number>;
    /**
     * The type of hash used for the certificate.
     */
    signature?: pulumi.Input<string>;
    /**
     * Certificate status.
     */
    status?: pulumi.Input<string>;
    /**
     * When the certificate was uploaded to Cloudflare.
     */
    uploadedOn?: pulumi.Input<string>;
    /**
     * Identifier.
     */
    zoneId?: pulumi.Input<string>;
}
export interface CertificatePackCertificateGeoRestrictions {
    /**
     * Available values: "us", "eu", "highestSecurity".
     */
    label?: pulumi.Input<string>;
}
export interface CertificatePackDcvDelegationRecord {
    /**
     * The CNAME record hostname for DCV delegation.
     */
    cname?: pulumi.Input<string>;
    /**
     * The CNAME record target value for DCV delegation.
     */
    cnameTarget?: pulumi.Input<string>;
    /**
     * The set of email addresses that the certificate authority (CA) will use to complete domain validation.
     */
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The content that the certificate authority (CA) will expect to find at the httpUrl during the domain validation.
     */
    httpBody?: pulumi.Input<string>;
    /**
     * The url that will be checked during domain validation.
     */
    httpUrl?: pulumi.Input<string>;
    /**
     * Status of the validation record.
     */
    status?: pulumi.Input<string>;
    /**
     * The hostname that the certificate authority (CA) will check for a TXT record during domain validation .
     */
    txtName?: pulumi.Input<string>;
    /**
     * The TXT record that the certificate authority (CA) will check during domain validation.
     */
    txtValue?: pulumi.Input<string>;
}
export interface CertificatePackValidationError {
    /**
     * A domain validation error.
     */
    message?: pulumi.Input<string>;
}
export interface CertificatePackValidationRecord {
    /**
     * The CNAME record hostname for DCV delegation.
     */
    cname?: pulumi.Input<string>;
    /**
     * The CNAME record target value for DCV delegation.
     */
    cnameTarget?: pulumi.Input<string>;
    /**
     * The set of email addresses that the certificate authority (CA) will use to complete domain validation.
     */
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The content that the certificate authority (CA) will expect to find at the httpUrl during the domain validation.
     */
    httpBody?: pulumi.Input<string>;
    /**
     * The url that will be checked during domain validation.
     */
    httpUrl?: pulumi.Input<string>;
    /**
     * Status of the validation record.
     */
    status?: pulumi.Input<string>;
    /**
     * The hostname that the certificate authority (CA) will check for a TXT record during domain validation .
     */
    txtName?: pulumi.Input<string>;
    /**
     * The TXT record that the certificate authority (CA) will check during domain validation.
     */
    txtValue?: pulumi.Input<string>;
}
export interface ClientCertificateCertificateAuthority {
    id?: pulumi.Input<string>;
    name?: pulumi.Input<string>;
}
export interface CloudConnectorRulesRule {
    description?: pulumi.Input<string>;
    enabled?: pulumi.Input<boolean>;
    expression?: pulumi.Input<string>;
    id?: pulumi.Input<string>;
    /**
     * Parameters of Cloud Connector Rule
     */
    parameters?: pulumi.Input<inputs.CloudConnectorRulesRuleParameters>;
    /**
     * Cloud Provider type
     * Available values: "aws*s3", "cloudflare*r2", "gcp*storage", "azure*storage".
     */
    provider?: pulumi.Input<string>;
}
export interface CloudConnectorRulesRuleParameters {
    /**
     * Host to perform Cloud Connection to
     */
    host?: pulumi.Input<string>;
}
export interface ConnectivityDirectoryServiceHost {
    hostname?: pulumi.Input<string>;
    ipv4?: pulumi.Input<string>;
    ipv6?: pulumi.Input<string>;
    network?: pulumi.Input<inputs.ConnectivityDirectoryServiceHostNetwork>;
    resolverNetwork?: pulumi.Input<inputs.ConnectivityDirectoryServiceHostResolverNetwork>;
}
export interface ConnectivityDirectoryServiceHostNetwork {
    tunnelId: pulumi.Input<string>;
}
export interface ConnectivityDirectoryServiceHostResolverNetwork {
    resolverIps?: pulumi.Input<pulumi.Input<string>[]>;
    tunnelId: pulumi.Input<string>;
}
export interface ContentScanningExpressionBody {
    /**
     * Defines the ruleset expression to use in matching content objects.
     */
    payload: pulumi.Input<string>;
}
export interface CustomHostnameOwnershipVerification {
    /**
     * DNS Name for record.
     */
    name?: pulumi.Input<string>;
    /**
     * DNS Record type.
     * Available values: "txt".
     */
    type?: pulumi.Input<string>;
    /**
     * Content for the record.
     */
    value?: pulumi.Input<string>;
}
export interface CustomHostnameOwnershipVerificationHttp {
    /**
     * Token to be served.
     */
    httpBody?: pulumi.Input<string>;
    /**
     * The HTTP URL that will be checked during custom hostname verification and where the customer should host the token.
     */
    httpUrl?: pulumi.Input<string>;
}
export interface CustomHostnameSsl {
    /**
     * A ubiquitous bundle has the highest probability of being verified everywhere, even by clients using outdated or unusual trust stores. An optimal bundle uses the shortest chain and newest intermediates. And the force bundle verifies the chain, but does not otherwise modify it.
     * Available values: "ubiquitous", "optimal", "force".
     */
    bundleMethod?: pulumi.Input<string>;
    /**
     * The Certificate Authority that will issue the certificate
     * Available values: "digicert", "google", "lets*encrypt", "ssl*com".
     */
    certificateAuthority?: pulumi.Input<string>;
    /**
     * Whether or not to add Cloudflare Branding for the order.  This will add a subdomain of sni.cloudflaressl.com as the Common Name if set to true
     */
    cloudflareBranding?: pulumi.Input<boolean>;
    /**
     * Array of custom certificate and key pairs (1 or 2 pairs allowed)
     */
    customCertBundles?: pulumi.Input<pulumi.Input<inputs.CustomHostnameSslCustomCertBundle>[]>;
    /**
     * If a custom uploaded certificate is used.
     */
    customCertificate?: pulumi.Input<string>;
    /**
     * The key for a custom uploaded certificate.
     */
    customKey?: pulumi.Input<string>;
    /**
     * Domain control validation (DCV) method used for this hostname.
     * Available values: "http", "txt", "email".
     */
    method?: pulumi.Input<string>;
    /**
     * SSL specific settings.
     */
    settings?: pulumi.Input<inputs.CustomHostnameSslSettings>;
    /**
     * Level of validation to be used for this hostname. Domain validation (dv) must be used.
     * Available values: "dv".
     */
    type?: pulumi.Input<string>;
    /**
     * Indicates whether the certificate covers a wildcard.
     */
    wildcard?: pulumi.Input<boolean>;
}
export interface CustomHostnameSslCustomCertBundle {
    /**
     * If a custom uploaded certificate is used.
     */
    customCertificate: pulumi.Input<string>;
    /**
     * The key for a custom uploaded certificate.
     */
    customKey: pulumi.Input<string>;
}
export interface CustomHostnameSslSettings {
    /**
     * An allowlist of ciphers for TLS termination. These ciphers must be in the BoringSSL format.
     */
    ciphers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Whether or not Early Hints is enabled.
     * Available values: "on", "off".
     */
    earlyHints?: pulumi.Input<string>;
    /**
     * Whether or not HTTP2 is enabled.
     * Available values: "on", "off".
     */
    http2?: pulumi.Input<string>;
    /**
     * The minimum TLS version supported.
     * Available values: "1.0", "1.1", "1.2", "1.3".
     */
    minTlsVersion?: pulumi.Input<string>;
    /**
     * Whether or not TLS 1.3 is enabled.
     * Available values: "on", "off".
     */
    tls13?: pulumi.Input<string>;
}
export interface CustomSslGeoRestrictions {
    /**
     * Available values: "us", "eu", "highestSecurity".
     */
    label?: pulumi.Input<string>;
}
export interface CustomSslKeylessServer {
    /**
     * When the Keyless SSL was created.
     */
    createdOn?: pulumi.Input<string>;
    /**
     * Whether or not the Keyless SSL is on or off.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The keyless SSL name.
     */
    host?: pulumi.Input<string>;
    /**
     * Keyless certificate identifier tag.
     */
    id?: pulumi.Input<string>;
    /**
     * When the Keyless SSL was last modified.
     */
    modifiedOn?: pulumi.Input<string>;
    /**
     * The keyless SSL name.
     */
    name?: pulumi.Input<string>;
    /**
     * Available permissions for the Keyless SSL for the current user requesting the item.
     */
    permissions?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server.
     */
    port?: pulumi.Input<number>;
    /**
     * Status of the Keyless SSL.
     * Available values: "active", "deleted".
     */
    status?: pulumi.Input<string>;
    /**
     * Configuration for using Keyless SSL through a Cloudflare Tunnel
     */
    tunnel?: pulumi.Input<inputs.CustomSslKeylessServerTunnel>;
}
export interface CustomSslKeylessServerTunnel {
    /**
     * Private IP of the Key Server Host
     */
    privateIp?: pulumi.Input<string>;
    /**
     * Cloudflare Tunnel Virtual Network ID
     */
    vnetId?: pulumi.Input<string>;
}
export interface D1DatabaseReadReplication {
    /**
     * The read replication mode for the database. Use 'auto' to create replicas and allow D1 automatically place them around the world, or 'disabled' to not use any database replicas (it can take a few hours for all replicas to be deleted).
     * Available values: "auto", "disabled".
     */
    mode: pulumi.Input<string>;
}
export interface DeviceManagedNetworksConfig {
    /**
     * The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.
     */
    sha256?: pulumi.Input<string>;
    /**
     * A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.
     */
    tlsSockaddr: pulumi.Input<string>;
}
export interface DevicePostureIntegrationConfig {
    /**
     * If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `apiUrl`.
     */
    accessClientId?: pulumi.Input<string>;
    /**
     * If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `apiUrl`.
     */
    accessClientSecret?: pulumi.Input<string>;
    /**
     * The Workspace One API URL provided in the Workspace One Admin Dashboard.
     */
    apiUrl?: pulumi.Input<string>;
    /**
     * The Workspace One Authorization URL depending on your region.
     */
    authUrl?: pulumi.Input<string>;
    /**
     * The Workspace One client ID provided in the Workspace One Admin Dashboard.
     */
    clientId?: pulumi.Input<string>;
    /**
     * The Uptycs client secret.
     */
    clientKey?: pulumi.Input<string>;
    /**
     * The Workspace One client secret provided in the Workspace One Admin Dashboard.
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * The Crowdstrike customer ID.
     */
    customerId?: pulumi.Input<string>;
}
export interface DevicePostureRuleInput {
    /**
     * The Number of active threats.
     */
    activeThreats?: pulumi.Input<number>;
    /**
     * UUID of Cloudflare managed certificate.
     */
    certificateId?: pulumi.Input<string>;
    /**
     * List of volume names to be checked for encryption.
     */
    checkDisks?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.
     */
    checkPrivateKey?: pulumi.Input<boolean>;
    /**
     * Common Name that is protected by the certificate.
     */
    cn?: pulumi.Input<string>;
    /**
     * Compliance Status.
     * Available values: "compliant", "noncompliant", "unknown", "notapplicable", "ingraceperiod", "error".
     */
    complianceStatus?: pulumi.Input<string>;
    /**
     * Posture Integration ID.
     */
    connectionId?: pulumi.Input<string>;
    /**
     * Count Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    countOperator?: pulumi.Input<string>;
    /**
     * Domain.
     */
    domain?: pulumi.Input<string>;
    /**
     * For more details on eid last seen, refer to the Tanium documentation.
     */
    eidLastSeen?: pulumi.Input<string>;
    /**
     * Enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Whether or not file exists.
     */
    exists?: pulumi.Input<boolean>;
    /**
     * List of values indicating purposes for which the certificate public key can be used.
     */
    extendedKeyUsages?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List ID.
     */
    id?: pulumi.Input<string>;
    /**
     * Whether device is infected.
     */
    infected?: pulumi.Input<boolean>;
    /**
     * Whether device is active.
     */
    isActive?: pulumi.Input<boolean>;
    /**
     * The Number of Issues.
     */
    issueCount?: pulumi.Input<string>;
    /**
     * For more details on last seen, please refer to the Crowdstrike documentation.
     */
    lastSeen?: pulumi.Input<string>;
    locations?: pulumi.Input<inputs.DevicePostureRuleInputLocations>;
    /**
     * Network status of device.
     * Available values: "connected", "disconnected", "disconnecting", "connecting".
     */
    networkStatus?: pulumi.Input<string>;
    /**
     * Operating system.
     * Available values: "windows", "linux", "mac", "android", "ios", "chromeos".
     */
    operatingSystem?: pulumi.Input<string>;
    /**
     * Agent operational state.
     * Available values: "na", "partially*disabled", "auto*fully*disabled", "fully*disabled", "auto*partially*disabled", "disabled*error", "db*corruption".
     */
    operationalState?: pulumi.Input<string>;
    /**
     * Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    operator?: pulumi.Input<string>;
    /**
     * Os Version.
     */
    os?: pulumi.Input<string>;
    /**
     * Operating System Distribution Name (linux only).
     */
    osDistroName?: pulumi.Input<string>;
    /**
     * Version of OS Distribution (linux only).
     */
    osDistroRevision?: pulumi.Input<string>;
    /**
     * Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
     */
    osVersionExtra?: pulumi.Input<string>;
    /**
     * Overall.
     */
    overall?: pulumi.Input<string>;
    /**
     * File path.
     */
    path?: pulumi.Input<string>;
    /**
     * Whether to check all disks for encryption.
     */
    requireAll?: pulumi.Input<boolean>;
    /**
     * For more details on risk level, refer to the Tanium documentation.
     * Available values: "low", "medium", "high", "critical".
     */
    riskLevel?: pulumi.Input<string>;
    /**
     * A value between 0-100 assigned to devices set by the 3rd party posture provider.
     */
    score?: pulumi.Input<number>;
    /**
     * Score Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    scoreOperator?: pulumi.Input<string>;
    /**
     * SensorConfig.
     */
    sensorConfig?: pulumi.Input<string>;
    /**
     * SHA-256.
     */
    sha256?: pulumi.Input<string>;
    /**
     * For more details on state, please refer to the Crowdstrike documentation.
     * Available values: "online", "offline", "unknown".
     */
    state?: pulumi.Input<string>;
    /**
     * List of certificate Subject Alternative Names.
     */
    subjectAlternativeNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Signing certificate thumbprint.
     */
    thumbprint?: pulumi.Input<string>;
    /**
     * For more details on total score, refer to the Tanium documentation.
     */
    totalScore?: pulumi.Input<number>;
    /**
     * Number of days that the antivirus should be updated within.
     */
    updateWindowDays?: pulumi.Input<number>;
    /**
     * Version of OS.
     */
    version?: pulumi.Input<string>;
    /**
     * Version Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    versionOperator?: pulumi.Input<string>;
}
export interface DevicePostureRuleInputLocations {
    /**
     * List of paths to check for client certificate on linux.
     */
    paths?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of trust stores to check for client certificate.
     */
    trustStores?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface DevicePostureRuleMatch {
    /**
     * Available values: "windows", "mac", "linux", "android", "ios", "chromeos".
     */
    platform?: pulumi.Input<string>;
}
export interface DlpCustomProfileContextAwareness {
    /**
     * If true, scan the context of predefined entries to only return matches surrounded by keywords.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Content types to exclude from context analysis and return all matches.
     */
    skip?: pulumi.Input<inputs.DlpCustomProfileContextAwarenessSkip>;
}
export interface DlpCustomProfileContextAwarenessSkip {
    /**
     * If the content type is a file, skip context analysis and return all matches.
     */
    files?: pulumi.Input<boolean>;
}
export interface DlpCustomProfileEntry {
    description?: pulumi.Input<string>;
    enabled: pulumi.Input<boolean>;
    entryId?: pulumi.Input<string>;
    name: pulumi.Input<string>;
    pattern: pulumi.Input<inputs.DlpCustomProfileEntryPattern>;
}
export interface DlpCustomProfileEntryPattern {
    regex: pulumi.Input<string>;
    /**
     * Available values: "luhn".
     *
     * @deprecated This attribute is deprecated.
     */
    validation?: pulumi.Input<string>;
}
export interface DlpCustomProfileSharedEntry {
    enabled: pulumi.Input<boolean>;
    entryId: pulumi.Input<string>;
    /**
     * Available values: "custom", "predefined", "integration", "exact*data", "document*fingerprint".
     */
    entryType: pulumi.Input<string>;
}
export interface DlpPredefinedProfileEntry {
    enabled: pulumi.Input<boolean>;
    id: pulumi.Input<string>;
}
export interface DnsFirewallAttackMitigation {
    /**
     * When enabled, automatically mitigate random-prefix attacks to protect upstream DNS servers
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Only mitigate attacks when upstream servers seem unhealthy
     */
    onlyWhenUpstreamUnhealthy?: pulumi.Input<boolean>;
}
export interface DnsRecordData {
    /**
     * Algorithm.
     */
    algorithm?: pulumi.Input<number>;
    /**
     * Altitude of location in meters.
     */
    altitude?: pulumi.Input<number>;
    /**
     * Certificate.
     */
    certificate?: pulumi.Input<string>;
    /**
     * Digest.
     */
    digest?: pulumi.Input<string>;
    /**
     * Digest Type.
     */
    digestType?: pulumi.Input<number>;
    /**
     * Fingerprint.
     */
    fingerprint?: pulumi.Input<string>;
    /**
     * Flags for the CAA record.
     */
    flags?: any;
    /**
     * Key Tag.
     */
    keyTag?: pulumi.Input<number>;
    /**
     * Degrees of latitude.
     */
    latDegrees?: pulumi.Input<number>;
    /**
     * Latitude direction.
     * Available values: "N", "S".
     */
    latDirection?: pulumi.Input<string>;
    /**
     * Minutes of latitude.
     */
    latMinutes?: pulumi.Input<number>;
    /**
     * Seconds of latitude.
     */
    latSeconds?: pulumi.Input<number>;
    /**
     * Degrees of longitude.
     */
    longDegrees?: pulumi.Input<number>;
    /**
     * Longitude direction.
     * Available values: "E", "W".
     */
    longDirection?: pulumi.Input<string>;
    /**
     * Minutes of longitude.
     */
    longMinutes?: pulumi.Input<number>;
    /**
     * Seconds of longitude.
     */
    longSeconds?: pulumi.Input<number>;
    /**
     * Matching Type.
     */
    matchingType?: pulumi.Input<number>;
    /**
     * Order.
     */
    order?: pulumi.Input<number>;
    /**
     * The port of the service.
     */
    port?: pulumi.Input<number>;
    /**
     * Horizontal precision of location.
     */
    precisionHorz?: pulumi.Input<number>;
    /**
     * Vertical precision of location.
     */
    precisionVert?: pulumi.Input<number>;
    /**
     * Preference.
     */
    preference?: pulumi.Input<number>;
    /**
     * Priority.
     */
    priority?: pulumi.Input<number>;
    /**
     * Protocol.
     */
    protocol?: pulumi.Input<number>;
    /**
     * Public Key.
     */
    publicKey?: pulumi.Input<string>;
    /**
     * Regex.
     */
    regex?: pulumi.Input<string>;
    /**
     * Replacement.
     */
    replacement?: pulumi.Input<string>;
    /**
     * Selector.
     */
    selector?: pulumi.Input<number>;
    /**
     * Service.
     */
    service?: pulumi.Input<string>;
    /**
     * Size of location in meters.
     */
    size?: pulumi.Input<number>;
    /**
     * Name of the property controlled by this record (e.g.: issue, issuewild, iodef).
     */
    tag?: pulumi.Input<string>;
    /**
     * Target.
     */
    target?: pulumi.Input<string>;
    /**
     * Type.
     */
    type?: pulumi.Input<number>;
    /**
     * Usage.
     */
    usage?: pulumi.Input<number>;
    /**
     * Value of the record. This field's semantics depend on the chosen tag.
     */
    value?: pulumi.Input<string>;
    /**
     * The record weight.
     */
    weight?: pulumi.Input<number>;
}
export interface DnsRecordSettings {
    /**
     * If enabled, causes the CNAME record to be resolved externally and the resulting address records (e.g., A and AAAA) to be returned instead of the CNAME record itself. This setting is unavailable for proxied records, since they are always flattened.
     */
    flattenCname?: pulumi.Input<boolean>;
    /**
     * When enabled, only A records will be generated, and AAAA records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
     */
    ipv4Only?: pulumi.Input<boolean>;
    /**
     * When enabled, only AAAA records will be generated, and A records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
     */
    ipv6Only?: pulumi.Input<boolean>;
}
export interface EmailRoutingCatchAllAction {
    /**
     * Type of action for catch-all rule.
     * Available values: "drop", "forward", "worker".
     */
    type: pulumi.Input<string>;
    values?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface EmailRoutingCatchAllMatcher {
    /**
     * Type of matcher. Default is 'all'.
     * Available values: "all".
     */
    type: pulumi.Input<string>;
}
export interface EmailRoutingDnsError {
    code?: pulumi.Input<number>;
    documentationUrl?: pulumi.Input<string>;
    message?: pulumi.Input<string>;
    source?: pulumi.Input<inputs.EmailRoutingDnsErrorSource>;
}
export interface EmailRoutingDnsErrorSource {
    pointer?: pulumi.Input<string>;
}
export interface EmailRoutingDnsMessage {
    code?: pulumi.Input<number>;
    documentationUrl?: pulumi.Input<string>;
    message?: pulumi.Input<string>;
    source?: pulumi.Input<inputs.EmailRoutingDnsMessageSource>;
}
export interface EmailRoutingDnsMessageSource {
    pointer?: pulumi.Input<string>;
}
export interface EmailRoutingDnsResult {
    /**
     * DNS record content.
     */
    content?: pulumi.Input<string>;
    errors?: pulumi.Input<pulumi.Input<inputs.EmailRoutingDnsResultError>[]>;
    /**
     * DNS record name (or @ for the zone apex).
     */
    name?: pulumi.Input<string>;
    /**
     * Required for MX, SRV and URI records. Unused by other record types. Records with lower priorities are preferred.
     */
    priority?: pulumi.Input<number>;
    records?: pulumi.Input<pulumi.Input<inputs.EmailRoutingDnsResultRecord>[]>;
    /**
     * Time to live, in seconds, of the DNS record. Must be between 60 and 86400, or 1 for 'automatic'.
     */
    ttl?: pulumi.Input<number>;
    /**
     * DNS record type.
     * Available values: "A", "AAAA", "CNAME", "HTTPS", "TXT", "SRV", "LOC", "MX", "NS", "CERT", "DNSKEY", "DS", "NAPTR", "SMIMEA", "SSHFP", "SVCB", "TLSA", "URI".
     */
    type?: pulumi.Input<string>;
}
export interface EmailRoutingDnsResultError {
    code?: pulumi.Input<string>;
    /**
     * List of records needed to enable an Email Routing zone.
     */
    missing?: pulumi.Input<inputs.EmailRoutingDnsResultErrorMissing>;
}
export interface EmailRoutingDnsResultErrorMissing {
    /**
     * DNS record content.
     */
    content?: pulumi.Input<string>;
    /**
     * DNS record name (or @ for the zone apex).
     */
    name?: pulumi.Input<string>;
    /**
     * Required for MX, SRV and URI records. Unused by other record types. Records with lower priorities are preferred.
     */
    priority?: pulumi.Input<number>;
    /**
     * Time to live, in seconds, of the DNS record. Must be between 60 and 86400, or 1 for 'automatic'.
     */
    ttl?: pulumi.Input<number>;
    /**
     * DNS record type.
     * Available values: "A", "AAAA", "CNAME", "HTTPS", "TXT", "SRV", "LOC", "MX", "NS", "CERT", "DNSKEY", "DS", "NAPTR", "SMIMEA", "SSHFP", "SVCB", "TLSA", "URI".
     */
    type?: pulumi.Input<string>;
}
export interface EmailRoutingDnsResultInfo {
    /**
     * Total number of results for the requested service.
     */
    emailRoutingDnsCount?: pulumi.Input<number>;
    /**
     * Current page within paginated list of results.
     */
    page?: pulumi.Input<number>;
    /**
     * Number of results per page of results.
     */
    perPage?: pulumi.Input<number>;
    /**
     * Total results available without any search parameters.
     */
    totalCount?: pulumi.Input<number>;
}
export interface EmailRoutingDnsResultRecord {
    /**
     * DNS record content.
     */
    content?: pulumi.Input<string>;
    /**
     * DNS record name (or @ for the zone apex).
     */
    name?: pulumi.Input<string>;
    /**
     * Required for MX, SRV and URI records. Unused by other record types. Records with lower priorities are preferred.
     */
    priority?: pulumi.Input<number>;
    /**
     * Time to live, in seconds, of the DNS record. Must be between 60 and 86400, or 1 for 'automatic'.
     */
    ttl?: pulumi.Input<number>;
    /**
     * DNS record type.
     * Available values: "A", "AAAA", "CNAME", "HTTPS", "TXT", "SRV", "LOC", "MX", "NS", "CERT", "DNSKEY", "DS", "NAPTR", "SMIMEA", "SSHFP", "SVCB", "TLSA", "URI".
     */
    type?: pulumi.Input<string>;
}
export interface EmailRoutingRuleAction {
    /**
     * Type of supported action.
     * Available values: "drop", "forward", "worker".
     */
    type: pulumi.Input<string>;
    values?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface EmailRoutingRuleMatcher {
    /**
     * Field for type matcher.
     * Available values: "to".
     */
    field?: pulumi.Input<string>;
    /**
     * Type of matcher.
     * Available values: "all", "literal".
     */
    type: pulumi.Input<string>;
    /**
     * Value for matcher.
     */
    value?: pulumi.Input<string>;
}
export interface EmailSecurityTrustedDomainsBody {
    comments?: pulumi.Input<string>;
    /**
     * Select to prevent recently registered domains from triggering a
     * Suspicious or Malicious disposition.
     */
    isRecent: pulumi.Input<boolean>;
    isRegex: pulumi.Input<boolean>;
    /**
     * Select for partner or other approved domains that have similar
     * spelling to your connected domains. Prevents listed domains from
     * triggering a Spoof disposition.
     */
    isSimilarity: pulumi.Input<boolean>;
    pattern: pulumi.Input<string>;
}
export interface FilterBody {
    /**
     * An informative summary of the filter.
     */
    description?: pulumi.Input<string>;
    /**
     * The filter expression. For more information, refer to [Expressions](https://developers.cloudflare.com/ruleset-engine/rules-language/expressions/).
     */
    expression?: pulumi.Input<string>;
    /**
     * The unique identifier of the filter.
     */
    id?: pulumi.Input<string>;
    /**
     * When true, indicates that the filter is currently paused.
     */
    paused?: pulumi.Input<boolean>;
    /**
     * A short reference tag. Allows you to select related filters.
     */
    ref?: pulumi.Input<string>;
}
export interface FirewallRuleAction {
    /**
     * The action to perform.
     * Available values: "simulate", "ban", "challenge", "js*challenge", "managed*challenge".
     */
    mode?: pulumi.Input<string>;
    /**
     * A custom content type and reponse to return when the threshold is exceeded. The custom response configured in this object will override the custom error for the zone. This object is optional.
     * Notes: If you omit this object, Cloudflare will use the default HTML error page. If "mode" is "challenge", "managed*challenge", or "js*challenge", Cloudflare will use the zone challenge pages and you should not provide the "response" object.
     */
    response?: pulumi.Input<inputs.FirewallRuleActionResponse>;
    /**
     * The time in seconds during which Cloudflare will perform the mitigation action. Must be an integer value greater than or equal to the period.
     * Notes: If "mode" is "challenge", "managed*challenge", or "js*challenge", Cloudflare will use the zone's Challenge Passage time and you should not provide this value.
     */
    timeout?: pulumi.Input<number>;
}
export interface FirewallRuleActionResponse {
    /**
     * The response body to return. The value must conform to the configured content type.
     */
    body?: pulumi.Input<string>;
    /**
     * The content type of the body. Must be one of the following: `text/plain`, `text/xml`, or `application/json`.
     */
    contentType?: pulumi.Input<string>;
}
export interface FirewallRuleFilter {
    /**
     * An informative summary of the filter.
     */
    description?: pulumi.Input<string>;
    /**
     * The filter expression. For more information, refer to [Expressions](https://developers.cloudflare.com/ruleset-engine/rules-language/expressions/).
     */
    expression?: pulumi.Input<string>;
    /**
     * The unique identifier of the filter.
     */
    id?: pulumi.Input<string>;
    /**
     * When true, indicates that the filter is currently paused.
     */
    paused?: pulumi.Input<boolean>;
    /**
     * A short reference tag. Allows you to select related filters.
     */
    ref?: pulumi.Input<string>;
}
export interface GetAccessRuleFilter {
    configuration?: inputs.GetAccessRuleFilterConfiguration;
    /**
     * Defines the direction used to sort returned rules.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Defines the search requirements. When set to `all`, all the search requirements must match. When set to `any`, only one of the search requirements has to match.
     * Available values: "any", "all".
     */
    match?: string;
    /**
     * The action to apply to a matched request.
     * Available values: "block", "challenge", "whitelist", "js*challenge", "managed*challenge".
     */
    mode?: string;
    /**
     * Defines the string to search for in the notes of existing IP Access rules.
     * Notes: For example, the string 'attack' would match IP Access rules with notes 'Attack 26/02' and 'Attack 27/02'. The search is case insensitive.
     */
    notes?: string;
    /**
     * Defines the field used to sort returned rules.
     * Available values: "configuration.target", "configuration.value", "mode".
     */
    order?: string;
}
export interface GetAccessRuleFilterArgs {
    configuration?: pulumi.Input<inputs.GetAccessRuleFilterConfigurationArgs>;
    /**
     * Defines the direction used to sort returned rules.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Defines the search requirements. When set to `all`, all the search requirements must match. When set to `any`, only one of the search requirements has to match.
     * Available values: "any", "all".
     */
    match?: pulumi.Input<string>;
    /**
     * The action to apply to a matched request.
     * Available values: "block", "challenge", "whitelist", "js*challenge", "managed*challenge".
     */
    mode?: pulumi.Input<string>;
    /**
     * Defines the string to search for in the notes of existing IP Access rules.
     * Notes: For example, the string 'attack' would match IP Access rules with notes 'Attack 26/02' and 'Attack 27/02'. The search is case insensitive.
     */
    notes?: pulumi.Input<string>;
    /**
     * Defines the field used to sort returned rules.
     * Available values: "configuration.target", "configuration.value", "mode".
     */
    order?: pulumi.Input<string>;
}
export interface GetAccessRuleFilterConfiguration {
    /**
     * Defines the target to search in existing rules.
     * Available values: "ip", "ipRange", "asn", "country".
     */
    target?: string;
    /**
     * Defines the target value to search for in existing rules: an IP address, an IP address range, or a country code, depending on the provided `configuration.target`.
     * Notes: You can search for a single IPv4 address, an IP address range with a subnet of '/16' or '/24', or a two-letter ISO-3166-1 alpha-2 country code.
     */
    value?: string;
}
export interface GetAccessRuleFilterConfigurationArgs {
    /**
     * Defines the target to search in existing rules.
     * Available values: "ip", "ipRange", "asn", "country".
     */
    target?: pulumi.Input<string>;
    /**
     * Defines the target value to search for in existing rules: an IP address, an IP address range, or a country code, depending on the provided `configuration.target`.
     * Notes: You can search for a single IPv4 address, an IP address range with a subnet of '/16' or '/24', or a two-letter ISO-3166-1 alpha-2 country code.
     */
    value?: pulumi.Input<string>;
}
export interface GetAccessRulesConfiguration {
    /**
     * Defines the target to search in existing rules.
     * Available values: "ip", "ipRange", "asn", "country".
     */
    target?: string;
    /**
     * Defines the target value to search for in existing rules: an IP address, an IP address range, or a country code, depending on the provided `configuration.target`.
     * Notes: You can search for a single IPv4 address, an IP address range with a subnet of '/16' or '/24', or a two-letter ISO-3166-1 alpha-2 country code.
     */
    value?: string;
}
export interface GetAccessRulesConfigurationArgs {
    /**
     * Defines the target to search in existing rules.
     * Available values: "ip", "ipRange", "asn", "country".
     */
    target?: pulumi.Input<string>;
    /**
     * Defines the target value to search for in existing rules: an IP address, an IP address range, or a country code, depending on the provided `configuration.target`.
     * Notes: You can search for a single IPv4 address, an IP address range with a subnet of '/16' or '/24', or a two-letter ISO-3166-1 alpha-2 country code.
     */
    value?: pulumi.Input<string>;
}
export interface GetAccountDnsSettingsInternalViewFilter {
    /**
     * Direction to order DNS views in.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Whether to match all search requirements or at least one (any). If set to `all`, acts like a logical AND between filters. If set to `any`, acts like a logical OR instead.
     * Available values: "any", "all".
     */
    match?: string;
    name?: inputs.GetAccountDnsSettingsInternalViewFilterName;
    /**
     * Field to order DNS views by.
     * Available values: "name", "created*on", "modified*on".
     */
    order?: string;
    /**
     * A zone ID that exists in the zones list for the view.
     */
    zoneId?: string;
    /**
     * A zone name that exists in the zones list for the view.
     */
    zoneName?: string;
}
export interface GetAccountDnsSettingsInternalViewFilterArgs {
    /**
     * Direction to order DNS views in.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Whether to match all search requirements or at least one (any). If set to `all`, acts like a logical AND between filters. If set to `any`, acts like a logical OR instead.
     * Available values: "any", "all".
     */
    match?: pulumi.Input<string>;
    name?: pulumi.Input<inputs.GetAccountDnsSettingsInternalViewFilterNameArgs>;
    /**
     * Field to order DNS views by.
     * Available values: "name", "created*on", "modified*on".
     */
    order?: pulumi.Input<string>;
    /**
     * A zone ID that exists in the zones list for the view.
     */
    zoneId?: pulumi.Input<string>;
    /**
     * A zone name that exists in the zones list for the view.
     */
    zoneName?: pulumi.Input<string>;
}
export interface GetAccountDnsSettingsInternalViewFilterName {
    /**
     * Substring of the DNS view name.
     */
    contains?: string;
    /**
     * Suffix of the DNS view name.
     */
    endswith?: string;
    /**
     * Exact value of the DNS view name.
     */
    exact?: string;
    /**
     * Prefix of the DNS view name.
     */
    startswith?: string;
}
export interface GetAccountDnsSettingsInternalViewFilterNameArgs {
    /**
     * Substring of the DNS view name.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS view name.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS view name.
     */
    exact?: pulumi.Input<string>;
    /**
     * Prefix of the DNS view name.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetAccountDnsSettingsInternalViewsName {
    /**
     * Substring of the DNS view name.
     */
    contains?: string;
    /**
     * Suffix of the DNS view name.
     */
    endswith?: string;
    /**
     * Exact value of the DNS view name.
     */
    exact?: string;
    /**
     * Prefix of the DNS view name.
     */
    startswith?: string;
}
export interface GetAccountDnsSettingsInternalViewsNameArgs {
    /**
     * Substring of the DNS view name.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS view name.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS view name.
     */
    exact?: pulumi.Input<string>;
    /**
     * Prefix of the DNS view name.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetAccountFilter {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Name of the account.
     */
    name?: string;
}
export interface GetAccountFilterArgs {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Name of the account.
     */
    name?: pulumi.Input<string>;
}
export interface GetAccountMemberFilter {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Field to order results by.
     * Available values: "user.first*name", "user.last*name", "user.email", "status".
     */
    order?: string;
    /**
     * A member's status in the account.
     * Available values: "accepted", "pending", "rejected".
     */
    status?: string;
}
export interface GetAccountMemberFilterArgs {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Field to order results by.
     * Available values: "user.first*name", "user.last*name", "user.email", "status".
     */
    order?: pulumi.Input<string>;
    /**
     * A member's status in the account.
     * Available values: "accepted", "pending", "rejected".
     */
    status?: pulumi.Input<string>;
}
export interface GetAccountTokenFilter {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: string;
}
export interface GetAccountTokenFilterArgs {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
}
export interface GetAiSearchInstanceFilter {
    /**
     * Search by id
     */
    search?: string;
}
export interface GetAiSearchInstanceFilterArgs {
    /**
     * Search by id
     */
    search?: pulumi.Input<string>;
}
export interface GetApiShieldOperationFilter {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Filter results to only include endpoints containing this pattern.
     */
    endpoint?: string;
    /**
     * Add feature(s) to the results. The feature name that is given here corresponds to the resulting feature object. Have a look at the top-level object description for more details on the specific meaning.
     */
    features?: string[];
    /**
     * Filter results to only include the specified hosts.
     */
    hosts?: string[];
    /**
     * Filter results to only include the specified HTTP methods.
     */
    methods?: string[];
    /**
     * Field to order by. When requesting a feature, the feature keys are available for ordering as well, e.g., `thresholds.suggested_threshold`.
     * Available values: "method", "host", "endpoint", "thresholds.$key".
     */
    order?: string;
}
export interface GetApiShieldOperationFilterArgs {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Filter results to only include endpoints containing this pattern.
     */
    endpoint?: pulumi.Input<string>;
    /**
     * Add feature(s) to the results. The feature name that is given here corresponds to the resulting feature object. Have a look at the top-level object description for more details on the specific meaning.
     */
    features?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Filter results to only include the specified hosts.
     */
    hosts?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Filter results to only include the specified HTTP methods.
     */
    methods?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Field to order by. When requesting a feature, the feature keys are available for ordering as well, e.g., `thresholds.suggested_threshold`.
     * Available values: "method", "host", "endpoint", "thresholds.$key".
     */
    order?: pulumi.Input<string>;
}
export interface GetApiTokenFilter {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: string;
}
export interface GetApiTokenFilterArgs {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
}
export interface GetCertificatePackFilter {
    /**
     * Specify the deployment environment for the certificate packs.
     * Available values: "staging", "production".
     */
    deploy?: string;
    /**
     * Include Certificate Packs of all statuses, not just active ones.
     * Available values: "all".
     */
    status?: string;
}
export interface GetCertificatePackFilterArgs {
    /**
     * Specify the deployment environment for the certificate packs.
     * Available values: "staging", "production".
     */
    deploy?: pulumi.Input<string>;
    /**
     * Include Certificate Packs of all statuses, not just active ones.
     * Available values: "all".
     */
    status?: pulumi.Input<string>;
}
export interface GetClientCertificateFilter {
    /**
     * Limit to the number of records returned.
     */
    limit?: number;
    /**
     * Offset the results
     */
    offset?: number;
    /**
     * Client Certitifcate Status to filter results by.
     * Available values: "all", "active", "pending*reactivation", "pending*revocation", "revoked".
     */
    status?: string;
}
export interface GetClientCertificateFilterArgs {
    /**
     * Limit to the number of records returned.
     */
    limit?: pulumi.Input<number>;
    /**
     * Offset the results
     */
    offset?: pulumi.Input<number>;
    /**
     * Client Certitifcate Status to filter results by.
     * Available values: "all", "active", "pending*reactivation", "pending*revocation", "revoked".
     */
    status?: pulumi.Input<string>;
}
export interface GetCloudforceOneRequestFilter {
    /**
     * Retrieve requests completed after this time.
     */
    completedAfter?: string;
    /**
     * Retrieve requests completed before this time.
     */
    completedBefore?: string;
    /**
     * Retrieve requests created after this time.
     */
    createdAfter?: string;
    /**
     * Retrieve requests created before this time.
     */
    createdBefore?: string;
    /**
     * Page number of results.
     */
    page: number;
    /**
     * Number of results per page.
     */
    perPage: number;
    /**
     * Requested information from request.
     */
    requestType?: string;
    /**
     * Field to sort results by.
     */
    sortBy?: string;
    /**
     * Sort order (asc or desc).
     * Available values: "asc", "desc".
     */
    sortOrder?: string;
    /**
     * Request Status.
     * Available values: "open", "accepted", "reported", "approved", "completed", "declined".
     */
    status?: string;
}
export interface GetCloudforceOneRequestFilterArgs {
    /**
     * Retrieve requests completed after this time.
     */
    completedAfter?: pulumi.Input<string>;
    /**
     * Retrieve requests completed before this time.
     */
    completedBefore?: pulumi.Input<string>;
    /**
     * Retrieve requests created after this time.
     */
    createdAfter?: pulumi.Input<string>;
    /**
     * Retrieve requests created before this time.
     */
    createdBefore?: pulumi.Input<string>;
    /**
     * Page number of results.
     */
    page: pulumi.Input<number>;
    /**
     * Number of results per page.
     */
    perPage: pulumi.Input<number>;
    /**
     * Requested information from request.
     */
    requestType?: pulumi.Input<string>;
    /**
     * Field to sort results by.
     */
    sortBy?: pulumi.Input<string>;
    /**
     * Sort order (asc or desc).
     * Available values: "asc", "desc".
     */
    sortOrder?: pulumi.Input<string>;
    /**
     * Request Status.
     * Available values: "open", "accepted", "reported", "approved", "completed", "declined".
     */
    status?: pulumi.Input<string>;
}
export interface GetConnectivityDirectoryServiceFilter {
    /**
     * Available values: "http".
     */
    type?: string;
}
export interface GetConnectivityDirectoryServiceFilterArgs {
    /**
     * Available values: "http".
     */
    type?: pulumi.Input<string>;
}
export interface GetCustomHostnameFilter {
    /**
     * Direction to order hostnames.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Fully qualified domain name to match against. This parameter cannot be used with the 'id' parameter.
     */
    hostname?: string;
    /**
     * Hostname ID to match against. This ID was generated and returned during the initial customHostname creation. This parameter cannot be used with the 'hostname' parameter.
     */
    id?: string;
    /**
     * Field to order hostnames by.
     * Available values: "ssl", "sslStatus".
     */
    order?: string;
    /**
     * Whether to filter hostnames based on if they have SSL enabled.
     * Available values: 0, 1.
     */
    ssl?: number;
}
export interface GetCustomHostnameFilterArgs {
    /**
     * Direction to order hostnames.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Fully qualified domain name to match against. This parameter cannot be used with the 'id' parameter.
     */
    hostname?: pulumi.Input<string>;
    /**
     * Hostname ID to match against. This ID was generated and returned during the initial customHostname creation. This parameter cannot be used with the 'hostname' parameter.
     */
    id?: pulumi.Input<string>;
    /**
     * Field to order hostnames by.
     * Available values: "ssl", "sslStatus".
     */
    order?: pulumi.Input<string>;
    /**
     * Whether to filter hostnames based on if they have SSL enabled.
     * Available values: 0, 1.
     */
    ssl?: pulumi.Input<number>;
}
export interface GetCustomOriginTrustStoreFilter {
    /**
     * Limit to the number of records returned.
     */
    limit?: number;
    /**
     * Offset the results
     */
    offset?: number;
}
export interface GetCustomOriginTrustStoreFilterArgs {
    /**
     * Limit to the number of records returned.
     */
    limit?: pulumi.Input<number>;
    /**
     * Offset the results
     */
    offset?: pulumi.Input<number>;
}
export interface GetCustomSslFilter {
    /**
     * Whether to match all search requirements or at least one (any).
     * Available values: "any", "all".
     */
    match?: string;
    /**
     * Status of the zone's custom SSL.
     * Available values: "active", "expired", "deleted", "pending", "initializing".
     */
    status?: string;
}
export interface GetCustomSslFilterArgs {
    /**
     * Whether to match all search requirements or at least one (any).
     * Available values: "any", "all".
     */
    match?: pulumi.Input<string>;
    /**
     * Status of the zone's custom SSL.
     * Available values: "active", "expired", "deleted", "pending", "initializing".
     */
    status?: pulumi.Input<string>;
}
export interface GetD1DatabaseFilter {
    /**
     * a database name to search for.
     */
    name?: string;
}
export interface GetD1DatabaseFilterArgs {
    /**
     * a database name to search for.
     */
    name?: pulumi.Input<string>;
}
export interface GetDnsRecordFilter {
    comment?: inputs.GetDnsRecordFilterComment;
    content?: inputs.GetDnsRecordFilterContent;
    /**
     * Direction to order DNS records in.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Whether to match all search requirements or at least one (any). If set to `all`, acts like a logical AND between filters. If set to `any`, acts like a logical OR instead. Note that the interaction between tag filters is controlled by the `tag-match` parameter instead.
     * Available values: "any", "all".
     */
    match?: string;
    name?: inputs.GetDnsRecordFilterName;
    /**
     * Field to order DNS records by.
     * Available values: "type", "name", "content", "ttl", "proxied".
     */
    order?: string;
    /**
     * Whether the record is receiving the performance and security benefits of Cloudflare.
     */
    proxied?: boolean;
    /**
     * Allows searching in multiple properties of a DNS record simultaneously. This parameter is intended for human users, not automation. Its exact behavior is intentionally left unspecified and is subject to change in the future. This parameter works independently of the `match` setting. For automated searches, please use the other available parameters.
     */
    search?: string;
    tag?: inputs.GetDnsRecordFilterTag;
    /**
     * Whether to match all tag search requirements or at least one (any). If set to `all`, acts like a logical AND between tag filters. If set to `any`, acts like a logical OR instead. Note that the regular `match` parameter is still used to combine the resulting condition with other filters that aren't related to tags.
     * Available values: "any", "all".
     */
    tagMatch?: string;
    /**
     * Record type.
     * Available values: "A", "AAAA", "CAA", "CERT", "CNAME", "DNSKEY", "DS", "HTTPS", "LOC", "MX", "NAPTR", "NS", "OPENPGPKEY", "PTR", "SMIMEA", "SRV", "SSHFP", "SVCB", "TLSA", "TXT", "URI".
     */
    type?: string;
}
export interface GetDnsRecordFilterArgs {
    comment?: pulumi.Input<inputs.GetDnsRecordFilterCommentArgs>;
    content?: pulumi.Input<inputs.GetDnsRecordFilterContentArgs>;
    /**
     * Direction to order DNS records in.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Whether to match all search requirements or at least one (any). If set to `all`, acts like a logical AND between filters. If set to `any`, acts like a logical OR instead. Note that the interaction between tag filters is controlled by the `tag-match` parameter instead.
     * Available values: "any", "all".
     */
    match?: pulumi.Input<string>;
    name?: pulumi.Input<inputs.GetDnsRecordFilterNameArgs>;
    /**
     * Field to order DNS records by.
     * Available values: "type", "name", "content", "ttl", "proxied".
     */
    order?: pulumi.Input<string>;
    /**
     * Whether the record is receiving the performance and security benefits of Cloudflare.
     */
    proxied?: pulumi.Input<boolean>;
    /**
     * Allows searching in multiple properties of a DNS record simultaneously. This parameter is intended for human users, not automation. Its exact behavior is intentionally left unspecified and is subject to change in the future. This parameter works independently of the `match` setting. For automated searches, please use the other available parameters.
     */
    search?: pulumi.Input<string>;
    tag?: pulumi.Input<inputs.GetDnsRecordFilterTagArgs>;
    /**
     * Whether to match all tag search requirements or at least one (any). If set to `all`, acts like a logical AND between tag filters. If set to `any`, acts like a logical OR instead. Note that the regular `match` parameter is still used to combine the resulting condition with other filters that aren't related to tags.
     * Available values: "any", "all".
     */
    tagMatch?: pulumi.Input<string>;
    /**
     * Record type.
     * Available values: "A", "AAAA", "CAA", "CERT", "CNAME", "DNSKEY", "DS", "HTTPS", "LOC", "MX", "NAPTR", "NS", "OPENPGPKEY", "PTR", "SMIMEA", "SRV", "SSHFP", "SVCB", "TLSA", "TXT", "URI".
     */
    type?: pulumi.Input<string>;
}
export interface GetDnsRecordFilterComment {
    /**
     * If this parameter is present, only records *without* a comment are returned.
     */
    absent?: string;
    /**
     * Substring of the DNS record comment. Comment filters are case-insensitive.
     */
    contains?: string;
    /**
     * Suffix of the DNS record comment. Comment filters are case-insensitive.
     */
    endswith?: string;
    /**
     * Exact value of the DNS record comment. Comment filters are case-insensitive.
     */
    exact?: string;
    /**
     * If this parameter is present, only records *with* a comment are returned.
     */
    present?: string;
    /**
     * Prefix of the DNS record comment. Comment filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordFilterCommentArgs {
    /**
     * If this parameter is present, only records *without* a comment are returned.
     */
    absent?: pulumi.Input<string>;
    /**
     * Substring of the DNS record comment. Comment filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS record comment. Comment filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS record comment. Comment filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * If this parameter is present, only records *with* a comment are returned.
     */
    present?: pulumi.Input<string>;
    /**
     * Prefix of the DNS record comment. Comment filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetDnsRecordFilterContent {
    /**
     * Substring of the DNS record content. Content filters are case-insensitive.
     */
    contains?: string;
    /**
     * Suffix of the DNS record content. Content filters are case-insensitive.
     */
    endswith?: string;
    /**
     * Exact value of the DNS record content. Content filters are case-insensitive.
     */
    exact?: string;
    /**
     * Prefix of the DNS record content. Content filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordFilterContentArgs {
    /**
     * Substring of the DNS record content. Content filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS record content. Content filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS record content. Content filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * Prefix of the DNS record content. Content filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetDnsRecordFilterName {
    /**
     * Substring of the DNS record name. Name filters are case-insensitive.
     */
    contains?: string;
    /**
     * Suffix of the DNS record name. Name filters are case-insensitive.
     */
    endswith?: string;
    /**
     * Exact value of the DNS record name. Name filters are case-insensitive.
     */
    exact?: string;
    /**
     * Prefix of the DNS record name. Name filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordFilterNameArgs {
    /**
     * Substring of the DNS record name. Name filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS record name. Name filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS record name. Name filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * Prefix of the DNS record name. Name filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetDnsRecordFilterTag {
    /**
     * Name of a tag which must *not* be present on the DNS record. Tag filters are case-insensitive.
     */
    absent?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value contains `<tag-value>`. Tag filters are case-insensitive.
     */
    contains?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value ends with `<tag-value>`. Tag filters are case-insensitive.
     */
    endswith?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value is `<tag-value>`. Tag filters are case-insensitive.
     */
    exact?: string;
    /**
     * Name of a tag which must be present on the DNS record. Tag filters are case-insensitive.
     */
    present?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value starts with `<tag-value>`. Tag filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordFilterTagArgs {
    /**
     * Name of a tag which must *not* be present on the DNS record. Tag filters are case-insensitive.
     */
    absent?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value contains `<tag-value>`. Tag filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value ends with `<tag-value>`. Tag filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value is `<tag-value>`. Tag filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * Name of a tag which must be present on the DNS record. Tag filters are case-insensitive.
     */
    present?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value starts with `<tag-value>`. Tag filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetDnsRecordsComment {
    /**
     * If this parameter is present, only records *without* a comment are returned.
     */
    absent?: string;
    /**
     * Substring of the DNS record comment. Comment filters are case-insensitive.
     */
    contains?: string;
    /**
     * Suffix of the DNS record comment. Comment filters are case-insensitive.
     */
    endswith?: string;
    /**
     * Exact value of the DNS record comment. Comment filters are case-insensitive.
     */
    exact?: string;
    /**
     * If this parameter is present, only records *with* a comment are returned.
     */
    present?: string;
    /**
     * Prefix of the DNS record comment. Comment filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordsCommentArgs {
    /**
     * If this parameter is present, only records *without* a comment are returned.
     */
    absent?: pulumi.Input<string>;
    /**
     * Substring of the DNS record comment. Comment filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS record comment. Comment filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS record comment. Comment filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * If this parameter is present, only records *with* a comment are returned.
     */
    present?: pulumi.Input<string>;
    /**
     * Prefix of the DNS record comment. Comment filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetDnsRecordsContent {
    /**
     * Substring of the DNS record content. Content filters are case-insensitive.
     */
    contains?: string;
    /**
     * Suffix of the DNS record content. Content filters are case-insensitive.
     */
    endswith?: string;
    /**
     * Exact value of the DNS record content. Content filters are case-insensitive.
     */
    exact?: string;
    /**
     * Prefix of the DNS record content. Content filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordsContentArgs {
    /**
     * Substring of the DNS record content. Content filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS record content. Content filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS record content. Content filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * Prefix of the DNS record content. Content filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetDnsRecordsName {
    /**
     * Substring of the DNS record name. Name filters are case-insensitive.
     */
    contains?: string;
    /**
     * Suffix of the DNS record name. Name filters are case-insensitive.
     */
    endswith?: string;
    /**
     * Exact value of the DNS record name. Name filters are case-insensitive.
     */
    exact?: string;
    /**
     * Prefix of the DNS record name. Name filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordsNameArgs {
    /**
     * Substring of the DNS record name. Name filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS record name. Name filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS record name. Name filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * Prefix of the DNS record name. Name filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetDnsRecordsTag {
    /**
     * Name of a tag which must *not* be present on the DNS record. Tag filters are case-insensitive.
     */
    absent?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value contains `<tag-value>`. Tag filters are case-insensitive.
     */
    contains?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value ends with `<tag-value>`. Tag filters are case-insensitive.
     */
    endswith?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value is `<tag-value>`. Tag filters are case-insensitive.
     */
    exact?: string;
    /**
     * Name of a tag which must be present on the DNS record. Tag filters are case-insensitive.
     */
    present?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value starts with `<tag-value>`. Tag filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordsTagArgs {
    /**
     * Name of a tag which must *not* be present on the DNS record. Tag filters are case-insensitive.
     */
    absent?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value contains `<tag-value>`. Tag filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value ends with `<tag-value>`. Tag filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value is `<tag-value>`. Tag filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * Name of a tag which must be present on the DNS record. Tag filters are case-insensitive.
     */
    present?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value starts with `<tag-value>`. Tag filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetEmailRoutingAddressFilter {
    /**
     * Sorts results in an ascending or descending order.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Filter by verified destination addresses.
     */
    verified?: boolean;
}
export interface GetEmailRoutingAddressFilterArgs {
    /**
     * Sorts results in an ascending or descending order.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Filter by verified destination addresses.
     */
    verified?: pulumi.Input<boolean>;
}
export interface GetEmailRoutingRuleFilter {
    /**
     * Filter by enabled routing rules.
     */
    enabled?: boolean;
}
export interface GetEmailRoutingRuleFilterArgs {
    /**
     * Filter by enabled routing rules.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface GetEmailSecurityBlockSenderFilter {
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * The field to sort by.
     * Available values: "pattern", "createdAt".
     */
    order?: string;
    pattern?: string;
    /**
     * Available values: "EMAIL", "DOMAIN", "IP", "UNKNOWN".
     */
    patternType?: string;
    /**
     * Allows searching in multiple properties of a record simultaneously.
     * This parameter is intended for human users, not automation. Its exact
     * behavior is intentionally left unspecified and is subject to change
     * in the future.
     */
    search?: string;
}
export interface GetEmailSecurityBlockSenderFilterArgs {
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * The field to sort by.
     * Available values: "pattern", "createdAt".
     */
    order?: pulumi.Input<string>;
    pattern?: pulumi.Input<string>;
    /**
     * Available values: "EMAIL", "DOMAIN", "IP", "UNKNOWN".
     */
    patternType?: pulumi.Input<string>;
    /**
     * Allows searching in multiple properties of a record simultaneously.
     * This parameter is intended for human users, not automation. Its exact
     * behavior is intentionally left unspecified and is subject to change
     * in the future.
     */
    search?: pulumi.Input<string>;
}
export interface GetEmailSecurityImpersonationRegistryFilter {
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * The field to sort by.
     * Available values: "name", "email", "createdAt".
     */
    order?: string;
    /**
     * Available values: "A1S*INTERNAL", "SNOOPY-CASB*OFFICE*365", "SNOOPY-OFFICE*365", "SNOOPY-GOOGLE_DIRECTORY".
     */
    provenance?: string;
    /**
     * Allows searching in multiple properties of a record simultaneously.
     * This parameter is intended for human users, not automation. Its exact
     * behavior is intentionally left unspecified and is subject to change
     * in the future.
     */
    search?: string;
}
export interface GetEmailSecurityImpersonationRegistryFilterArgs {
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * The field to sort by.
     * Available values: "name", "email", "createdAt".
     */
    order?: pulumi.Input<string>;
    /**
     * Available values: "A1S*INTERNAL", "SNOOPY-CASB*OFFICE*365", "SNOOPY-OFFICE*365", "SNOOPY-GOOGLE_DIRECTORY".
     */
    provenance?: pulumi.Input<string>;
    /**
     * Allows searching in multiple properties of a record simultaneously.
     * This parameter is intended for human users, not automation. Its exact
     * behavior is intentionally left unspecified and is subject to change
     * in the future.
     */
    search?: pulumi.Input<string>;
}
export interface GetEmailSecurityTrustedDomainsFilter {
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: string;
    isRecent?: boolean;
    isSimilarity?: boolean;
    /**
     * The field to sort by.
     * Available values: "pattern", "createdAt".
     */
    order?: string;
    pattern?: string;
    /**
     * Allows searching in multiple properties of a record simultaneously.
     * This parameter is intended for human users, not automation. Its exact
     * behavior is intentionally left unspecified and is subject to change
     * in the future.
     */
    search?: string;
}
export interface GetEmailSecurityTrustedDomainsFilterArgs {
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    isRecent?: pulumi.Input<boolean>;
    isSimilarity?: pulumi.Input<boolean>;
    /**
     * The field to sort by.
     * Available values: "pattern", "createdAt".
     */
    order?: pulumi.Input<string>;
    pattern?: pulumi.Input<string>;
    /**
     * Allows searching in multiple properties of a record simultaneously.
     * This parameter is intended for human users, not automation. Its exact
     * behavior is intentionally left unspecified and is subject to change
     * in the future.
     */
    search?: pulumi.Input<string>;
}
export interface GetFilterFilter {
    /**
     * A case-insensitive string to find in the description.
     */
    description?: string;
    /**
     * A case-insensitive string to find in the expression.
     */
    expression?: string;
    /**
     * The unique identifier of the filter.
     */
    id?: string;
    /**
     * When true, indicates that the filter is currently paused.
     */
    paused?: boolean;
    /**
     * The filter ref (a short reference tag) to search for. Must be an exact match.
     */
    ref?: string;
}
export interface GetFilterFilterArgs {
    /**
     * A case-insensitive string to find in the description.
     */
    description?: pulumi.Input<string>;
    /**
     * A case-insensitive string to find in the expression.
     */
    expression?: pulumi.Input<string>;
    /**
     * The unique identifier of the filter.
     */
    id?: pulumi.Input<string>;
    /**
     * When true, indicates that the filter is currently paused.
     */
    paused?: pulumi.Input<boolean>;
    /**
     * The filter ref (a short reference tag) to search for. Must be an exact match.
     */
    ref?: pulumi.Input<string>;
}
export interface GetLoadBalancerPoolFilter {
    /**
     * The ID of the Monitor to use for checking the health of origins within this pool.
     */
    monitor?: string;
}
export interface GetLoadBalancerPoolFilterArgs {
    /**
     * The ID of the Monitor to use for checking the health of origins within this pool.
     */
    monitor?: pulumi.Input<string>;
}
export interface GetMagicTransitSiteFilter {
    /**
     * Identifier
     */
    connectorid?: string;
}
export interface GetMagicTransitSiteFilterArgs {
    /**
     * Identifier
     */
    connectorid?: pulumi.Input<string>;
}
export interface GetOrganizationFilter {
    containing?: inputs.GetOrganizationFilterContaining;
    /**
     * Only return organizations with the specified IDs (ex. id=foo&id=bar). Send multiple elements
     * by repeating the query value.
     */
    ids?: string[];
    name?: inputs.GetOrganizationFilterName;
    /**
     * The amount of items to return. Defaults to 10.
     */
    pageSize?: number;
    /**
     * An opaque token returned from the last list response that when
     * provided will retrieve the next page.
     */
    pageToken?: string;
    parent?: inputs.GetOrganizationFilterParent;
}
export interface GetOrganizationFilterArgs {
    containing?: pulumi.Input<inputs.GetOrganizationFilterContainingArgs>;
    /**
     * Only return organizations with the specified IDs (ex. id=foo&id=bar). Send multiple elements
     * by repeating the query value.
     */
    ids?: pulumi.Input<pulumi.Input<string>[]>;
    name?: pulumi.Input<inputs.GetOrganizationFilterNameArgs>;
    /**
     * The amount of items to return. Defaults to 10.
     */
    pageSize?: pulumi.Input<number>;
    /**
     * An opaque token returned from the last list response that when
     * provided will retrieve the next page.
     */
    pageToken?: pulumi.Input<string>;
    parent?: pulumi.Input<inputs.GetOrganizationFilterParentArgs>;
}
export interface GetOrganizationFilterContaining {
    /**
     * Filter the list of organizations to the ones that contain this particular
     * account.
     */
    account?: string;
    /**
     * Filter the list of organizations to the ones that contain this particular
     * organization.
     */
    organization?: string;
    /**
     * Filter the list of organizations to the ones that contain this particular
     * user.
     */
    user?: string;
}
export interface GetOrganizationFilterContainingArgs {
    /**
     * Filter the list of organizations to the ones that contain this particular
     * account.
     */
    account?: pulumi.Input<string>;
    /**
     * Filter the list of organizations to the ones that contain this particular
     * organization.
     */
    organization?: pulumi.Input<string>;
    /**
     * Filter the list of organizations to the ones that contain this particular
     * user.
     */
    user?: pulumi.Input<string>;
}
export interface GetOrganizationFilterName {
    /**
     * (case-insensitive) Filter the list of organizations to where the name contains a particular
     * string.
     */
    contains?: string;
    /**
     * (case-insensitive) Filter the list of organizations to where the name ends with a particular
     * string.
     */
    endsWith?: string;
    /**
     * (case-insensitive) Filter the list of organizations to where the name starts with a
     * particular string.
     */
    startsWith?: string;
}
export interface GetOrganizationFilterNameArgs {
    /**
     * (case-insensitive) Filter the list of organizations to where the name contains a particular
     * string.
     */
    contains?: pulumi.Input<string>;
    /**
     * (case-insensitive) Filter the list of organizations to where the name ends with a particular
     * string.
     */
    endsWith?: pulumi.Input<string>;
    /**
     * (case-insensitive) Filter the list of organizations to where the name starts with a
     * particular string.
     */
    startsWith?: pulumi.Input<string>;
}
export interface GetOrganizationFilterParent {
    /**
     * Filter the list of organizations to the ones that are a sub-organization
     * of the specified organization.
     */
    id?: string;
}
export interface GetOrganizationFilterParentArgs {
    /**
     * Filter the list of organizations to the ones that are a sub-organization
     * of the specified organization.
     */
    id?: pulumi.Input<string>;
}
export interface GetOrganizationsContaining {
    /**
     * Filter the list of organizations to the ones that contain this particular
     * account.
     */
    account?: string;
    /**
     * Filter the list of organizations to the ones that contain this particular
     * organization.
     */
    organization?: string;
    /**
     * Filter the list of organizations to the ones that contain this particular
     * user.
     */
    user?: string;
}
export interface GetOrganizationsContainingArgs {
    /**
     * Filter the list of organizations to the ones that contain this particular
     * account.
     */
    account?: pulumi.Input<string>;
    /**
     * Filter the list of organizations to the ones that contain this particular
     * organization.
     */
    organization?: pulumi.Input<string>;
    /**
     * Filter the list of organizations to the ones that contain this particular
     * user.
     */
    user?: pulumi.Input<string>;
}
export interface GetOrganizationsName {
    /**
     * (case-insensitive) Filter the list of organizations to where the name contains a particular
     * string.
     */
    contains?: string;
    /**
     * (case-insensitive) Filter the list of organizations to where the name ends with a particular
     * string.
     */
    endsWith?: string;
    /**
     * (case-insensitive) Filter the list of organizations to where the name starts with a
     * particular string.
     */
    startsWith?: string;
}
export interface GetOrganizationsNameArgs {
    /**
     * (case-insensitive) Filter the list of organizations to where the name contains a particular
     * string.
     */
    contains?: pulumi.Input<string>;
    /**
     * (case-insensitive) Filter the list of organizations to where the name ends with a particular
     * string.
     */
    endsWith?: pulumi.Input<string>;
    /**
     * (case-insensitive) Filter the list of organizations to where the name starts with a
     * particular string.
     */
    startsWith?: pulumi.Input<string>;
}
export interface GetOrganizationsParent {
    /**
     * Filter the list of organizations to the ones that are a sub-organization
     * of the specified organization.
     */
    id?: string;
}
export interface GetOrganizationsParentArgs {
    /**
     * Filter the list of organizations to the ones that are a sub-organization
     * of the specified organization.
     */
    id?: pulumi.Input<string>;
}
export interface GetOriginCaCertificateFilter {
    /**
     * Limit to the number of records returned.
     */
    limit?: number;
    /**
     * Offset the results
     */
    offset?: number;
    /**
     * Identifier.
     */
    zoneId: string;
}
export interface GetOriginCaCertificateFilterArgs {
    /**
     * Limit to the number of records returned.
     */
    limit?: pulumi.Input<number>;
    /**
     * Offset the results
     */
    offset?: pulumi.Input<number>;
    /**
     * Identifier.
     */
    zoneId: pulumi.Input<string>;
}
export interface GetSchemaValidationSchemasFilter {
    /**
     * Filter for enabled schemas
     */
    validationEnabled?: boolean;
}
export interface GetSchemaValidationSchemasFilterArgs {
    /**
     * Filter for enabled schemas
     */
    validationEnabled?: pulumi.Input<boolean>;
}
export interface GetSpectrumApplicationFilter {
    /**
     * Sets the direction by which results are ordered.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Application field by which results are ordered.
     * Available values: "protocol", "app*id", "created*on", "modifiedOn", "dns".
     */
    order?: string;
}
export interface GetSpectrumApplicationFilterArgs {
    /**
     * Sets the direction by which results are ordered.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Application field by which results are ordered.
     * Available values: "protocol", "app*id", "created*on", "modifiedOn", "dns".
     */
    order?: pulumi.Input<string>;
}
export interface GetTokenValidationRulesFilter {
    /**
     * Action to take on requests that match operations included in `selector` and fail `expression`.
     * Available values: "log", "block".
     */
    action?: string;
    /**
     * Toggle rule on or off.
     */
    enabled?: boolean;
    /**
     * Select rules with this host in `include`.
     */
    host?: string;
    /**
     * Select rules with this host in `include`.
     */
    hostname?: string;
    /**
     * Select rules with these IDs.
     */
    id?: string;
    /**
     * Select rules using any of these token configurations.
     */
    tokenConfigurations?: string[];
}
export interface GetTokenValidationRulesFilterArgs {
    /**
     * Action to take on requests that match operations included in `selector` and fail `expression`.
     * Available values: "log", "block".
     */
    action?: pulumi.Input<string>;
    /**
     * Toggle rule on or off.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Select rules with this host in `include`.
     */
    host?: pulumi.Input<string>;
    /**
     * Select rules with this host in `include`.
     */
    hostname?: pulumi.Input<string>;
    /**
     * Select rules with these IDs.
     */
    id?: pulumi.Input<string>;
    /**
     * Select rules using any of these token configurations.
     */
    tokenConfigurations?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface GetTurnstileWidgetFilter {
    /**
     * Direction to order widgets.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Filter widgets by field using case-insensitive substring matching.
     * Format: `field:value`
     */
    filter?: string;
    /**
     * Field to order widgets by.
     * Available values: "id", "sitekey", "name", "createdOn", "modifiedOn".
     */
    order?: string;
}
export interface GetTurnstileWidgetFilterArgs {
    /**
     * Direction to order widgets.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Filter widgets by field using case-insensitive substring matching.
     * Format: `field:value`
     */
    filter?: pulumi.Input<string>;
    /**
     * Field to order widgets by.
     * Available values: "id", "sitekey", "name", "createdOn", "modifiedOn".
     */
    order?: pulumi.Input<string>;
}
export interface GetUserAgentBlockingRuleFilter {
    /**
     * A string to search for in the description of existing rules.
     */
    description?: string;
    /**
     * When true, indicates that the rule is currently paused.
     */
    paused?: boolean;
    /**
     * A string to search for in the user agent values of existing rules.
     */
    userAgent?: string;
}
export interface GetUserAgentBlockingRuleFilterArgs {
    /**
     * A string to search for in the description of existing rules.
     */
    description?: pulumi.Input<string>;
    /**
     * When true, indicates that the rule is currently paused.
     */
    paused?: pulumi.Input<boolean>;
    /**
     * A string to search for in the user agent values of existing rules.
     */
    userAgent?: pulumi.Input<string>;
}
export interface GetWebAnalyticsSiteFilter {
    /**
     * The property used to sort the list of results.
     * Available values: "host", "created".
     */
    orderBy?: string;
}
export interface GetWebAnalyticsSiteFilterArgs {
    /**
     * The property used to sort the list of results.
     * Available values: "host", "created".
     */
    orderBy?: pulumi.Input<string>;
}
export interface GetWorkersCustomDomainFilter {
    /**
     * Worker environment associated with the zone and hostname.
     */
    environment?: string;
    /**
     * Hostname of the Worker Domain.
     */
    hostname?: string;
    /**
     * Worker service associated with the zone and hostname.
     */
    service?: string;
    /**
     * Identifier of the zone.
     */
    zoneId?: string;
    /**
     * Name of the zone.
     */
    zoneName?: string;
}
export interface GetWorkersCustomDomainFilterArgs {
    /**
     * Worker environment associated with the zone and hostname.
     */
    environment?: pulumi.Input<string>;
    /**
     * Hostname of the Worker Domain.
     */
    hostname?: pulumi.Input<string>;
    /**
     * Worker service associated with the zone and hostname.
     */
    service?: pulumi.Input<string>;
    /**
     * Identifier of the zone.
     */
    zoneId?: pulumi.Input<string>;
    /**
     * Name of the zone.
     */
    zoneName?: pulumi.Input<string>;
}
export interface GetWorkersKvNamespaceFilter {
    /**
     * Direction to order namespaces.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Field to order results by.
     * Available values: "id", "title".
     */
    order?: string;
}
export interface GetWorkersKvNamespaceFilterArgs {
    /**
     * Direction to order namespaces.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Field to order results by.
     * Available values: "id", "title".
     */
    order?: pulumi.Input<string>;
}
export interface GetWorkersScriptFilter {
    /**
     * Filter scripts by tags. Format: comma-separated list of tag:allowed pairs where allowed is 'yes' or 'no'.
     */
    tags?: string;
}
export interface GetWorkersScriptFilterArgs {
    /**
     * Filter scripts by tags. Format: comma-separated list of tag:allowed pairs where allowed is 'yes' or 'no'.
     */
    tags?: pulumi.Input<string>;
}
export interface GetWorkflowFilter {
    /**
     * Allows filtering workflows` name.
     */
    search?: string;
}
export interface GetWorkflowFilterArgs {
    /**
     * Allows filtering workflows` name.
     */
    search?: pulumi.Input<string>;
}
export interface GetZeroTrustAccessAiControlsMcpPortalFilter {
    /**
     * Search by id, name, hostname
     */
    search?: string;
}
export interface GetZeroTrustAccessAiControlsMcpPortalFilterArgs {
    /**
     * Search by id, name, hostname
     */
    search?: pulumi.Input<string>;
}
export interface GetZeroTrustAccessAiControlsMcpServerFilter {
    /**
     * Search by id, name
     */
    search?: string;
}
export interface GetZeroTrustAccessAiControlsMcpServerFilterArgs {
    /**
     * Search by id, name
     */
    search?: pulumi.Input<string>;
}
export interface GetZeroTrustAccessApplicationFilter {
    /**
     * The aud of the app.
     */
    aud?: string;
    /**
     * The domain of the app.
     */
    domain?: string;
    /**
     * True for only exact string matches against passed name/domain query parameters.
     */
    exact?: boolean;
    /**
     * The name of the app.
     */
    name?: string;
    /**
     * Search for apps by other listed query parameters.
     */
    search?: string;
}
export interface GetZeroTrustAccessApplicationFilterArgs {
    /**
     * The aud of the app.
     */
    aud?: pulumi.Input<string>;
    /**
     * The domain of the app.
     */
    domain?: pulumi.Input<string>;
    /**
     * True for only exact string matches against passed name/domain query parameters.
     */
    exact?: pulumi.Input<boolean>;
    /**
     * The name of the app.
     */
    name?: pulumi.Input<string>;
    /**
     * Search for apps by other listed query parameters.
     */
    search?: pulumi.Input<string>;
}
export interface GetZeroTrustAccessGroupFilter {
    /**
     * The name of the group.
     */
    name?: string;
    /**
     * Search for groups by other listed query parameters.
     */
    search?: string;
}
export interface GetZeroTrustAccessGroupFilterArgs {
    /**
     * The name of the group.
     */
    name?: pulumi.Input<string>;
    /**
     * Search for groups by other listed query parameters.
     */
    search?: pulumi.Input<string>;
}
export interface GetZeroTrustAccessIdentityProviderFilter {
    /**
     * Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
     */
    scimEnabled?: string;
}
export interface GetZeroTrustAccessIdentityProviderFilterArgs {
    /**
     * Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
     */
    scimEnabled?: pulumi.Input<string>;
}
export interface GetZeroTrustAccessInfrastructureTargetFilter {
    /**
     * Date and time at which the target was created after (inclusive)
     */
    createdAfter?: string;
    /**
     * Date and time at which the target was created before (inclusive)
     */
    createdBefore?: string;
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Hostname of a target
     */
    hostname?: string;
    /**
     * Partial match to the hostname of a target
     */
    hostnameContains?: string;
    /**
     * Filters for targets whose IP addresses look like the specified string.
     * Supports `*` as a wildcard character
     */
    ipLike?: string;
    /**
     * IPv4 address of the target
     */
    ipV4?: string;
    /**
     * IPv6 address of the target
     */
    ipV6?: string;
    /**
     * Filters for targets that have any of the following IP addresses. Specify
     * `ips` multiple times in query parameter to build list of candidates.
     */
    ips?: string[];
    /**
     * Defines an IPv4 filter range's ending value (inclusive). Requires
     * `ipv4Start` to be specified as well.
     */
    ipv4End?: string;
    /**
     * Defines an IPv4 filter range's starting value (inclusive). Requires
     * `ipv4End` to be specified as well.
     */
    ipv4Start?: string;
    /**
     * Defines an IPv6 filter range's ending value (inclusive). Requires
     * `ipv6Start` to be specified as well.
     */
    ipv6End?: string;
    /**
     * Defines an IPv6 filter range's starting value (inclusive). Requires
     * `ipv6End` to be specified as well.
     */
    ipv6Start?: string;
    /**
     * Date and time at which the target was modified after (inclusive)
     */
    modifiedAfter?: string;
    /**
     * Date and time at which the target was modified before (inclusive)
     */
    modifiedBefore?: string;
    /**
     * The field to sort by.
     * Available values: "hostname", "createdAt".
     */
    order?: string;
    /**
     * Filters for targets that have any of the following UUIDs. Specify
     * `targetIds` multiple times in query parameter to build list of
     * candidates.
     */
    targetIds?: string[];
    /**
     * Private virtual network identifier of the target
     */
    virtualNetworkId?: string;
}
export interface GetZeroTrustAccessInfrastructureTargetFilterArgs {
    /**
     * Date and time at which the target was created after (inclusive)
     */
    createdAfter?: pulumi.Input<string>;
    /**
     * Date and time at which the target was created before (inclusive)
     */
    createdBefore?: pulumi.Input<string>;
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Hostname of a target
     */
    hostname?: pulumi.Input<string>;
    /**
     * Partial match to the hostname of a target
     */
    hostnameContains?: pulumi.Input<string>;
    /**
     * Filters for targets whose IP addresses look like the specified string.
     * Supports `*` as a wildcard character
     */
    ipLike?: pulumi.Input<string>;
    /**
     * IPv4 address of the target
     */
    ipV4?: pulumi.Input<string>;
    /**
     * IPv6 address of the target
     */
    ipV6?: pulumi.Input<string>;
    /**
     * Filters for targets that have any of the following IP addresses. Specify
     * `ips` multiple times in query parameter to build list of candidates.
     */
    ips?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Defines an IPv4 filter range's ending value (inclusive). Requires
     * `ipv4Start` to be specified as well.
     */
    ipv4End?: pulumi.Input<string>;
    /**
     * Defines an IPv4 filter range's starting value (inclusive). Requires
     * `ipv4End` to be specified as well.
     */
    ipv4Start?: pulumi.Input<string>;
    /**
     * Defines an IPv6 filter range's ending value (inclusive). Requires
     * `ipv6Start` to be specified as well.
     */
    ipv6End?: pulumi.Input<string>;
    /**
     * Defines an IPv6 filter range's starting value (inclusive). Requires
     * `ipv6End` to be specified as well.
     */
    ipv6Start?: pulumi.Input<string>;
    /**
     * Date and time at which the target was modified after (inclusive)
     */
    modifiedAfter?: pulumi.Input<string>;
    /**
     * Date and time at which the target was modified before (inclusive)
     */
    modifiedBefore?: pulumi.Input<string>;
    /**
     * The field to sort by.
     * Available values: "hostname", "createdAt".
     */
    order?: pulumi.Input<string>;
    /**
     * Filters for targets that have any of the following UUIDs. Specify
     * `targetIds` multiple times in query parameter to build list of
     * candidates.
     */
    targetIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Private virtual network identifier of the target
     */
    virtualNetworkId?: pulumi.Input<string>;
}
export interface GetZeroTrustAccessServiceTokenFilter {
    /**
     * The name of the service token.
     */
    name?: string;
    /**
     * Search for service tokens by other listed query parameters.
     */
    search?: string;
}
export interface GetZeroTrustAccessServiceTokenFilterArgs {
    /**
     * The name of the service token.
     */
    name?: pulumi.Input<string>;
    /**
     * Search for service tokens by other listed query parameters.
     */
    search?: pulumi.Input<string>;
}
export interface GetZeroTrustDexTestFilter {
    /**
     * Filter by test type
     * Available values: "http", "traceroute".
     */
    kind?: string;
    /**
     * Filter by test name
     */
    testName?: string;
}
export interface GetZeroTrustDexTestFilterArgs {
    /**
     * Filter by test type
     * Available values: "http", "traceroute".
     */
    kind?: pulumi.Input<string>;
    /**
     * Filter by test name
     */
    testName?: pulumi.Input<string>;
}
export interface GetZeroTrustDexTestTargetPolicy {
    /**
     * Whether the DEX rule is the account default
     */
    default?: boolean;
    /**
     * API Resource UUID tag.
     */
    id?: string;
    /**
     * The name of the DEX rule
     */
    name?: string;
}
export interface GetZeroTrustDexTestTargetPolicyArgs {
    /**
     * Whether the DEX rule is the account default
     */
    default?: pulumi.Input<boolean>;
    /**
     * API Resource UUID tag.
     */
    id?: pulumi.Input<string>;
    /**
     * The name of the DEX rule
     */
    name?: pulumi.Input<string>;
}
export interface GetZeroTrustListFilter {
    /**
     * Specify the list type.
     * Available values: "SERIAL", "URL", "DOMAIN", "EMAIL", "IP", "CATEGORY", "LOCATION", "DEVICE".
     */
    type?: string;
}
export interface GetZeroTrustListFilterArgs {
    /**
     * Specify the list type.
     * Available values: "SERIAL", "URL", "DOMAIN", "EMAIL", "IP", "CATEGORY", "LOCATION", "DEVICE".
     */
    type?: pulumi.Input<string>;
}
export interface GetZeroTrustNetworkHostnameRouteFilter {
    /**
     * If set, only list hostname routes with the given comment.
     */
    comment?: string;
    /**
     * If provided, include only resources that were created (and not deleted) before this time. URL encoded.
     */
    existedAt?: string;
    /**
     * If set, only list hostname routes that contain a substring of the given value, the filter is case-insensitive.
     */
    hostname?: string;
    /**
     * The hostname route ID.
     */
    id?: string;
    /**
     * If `true`, only return deleted hostname routes. If `false`, exclude deleted hostname routes.
     */
    isDeleted?: boolean;
    /**
     * If set, only list hostname routes that point to a specific tunnel.
     */
    tunnelId?: string;
}
export interface GetZeroTrustNetworkHostnameRouteFilterArgs {
    /**
     * If set, only list hostname routes with the given comment.
     */
    comment?: pulumi.Input<string>;
    /**
     * If provided, include only resources that were created (and not deleted) before this time. URL encoded.
     */
    existedAt?: pulumi.Input<string>;
    /**
     * If set, only list hostname routes that contain a substring of the given value, the filter is case-insensitive.
     */
    hostname?: pulumi.Input<string>;
    /**
     * The hostname route ID.
     */
    id?: pulumi.Input<string>;
    /**
     * If `true`, only return deleted hostname routes. If `false`, exclude deleted hostname routes.
     */
    isDeleted?: pulumi.Input<boolean>;
    /**
     * If set, only list hostname routes that point to a specific tunnel.
     */
    tunnelId?: pulumi.Input<string>;
}
export interface GetZeroTrustTunnelCloudflaredFilter {
    excludePrefix?: string;
    /**
     * If provided, include only resources that were created (and not deleted) before this time. URL encoded.
     */
    existedAt?: string;
    includePrefix?: string;
    /**
     * If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included.
     */
    isDeleted?: boolean;
    /**
     * A user-friendly name for a tunnel.
     */
    name?: string;
    /**
     * The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
     * Available values: "inactive", "degraded", "healthy", "down".
     */
    status?: string;
    /**
     * UUID of the tunnel.
     */
    uuid?: string;
    wasActiveAt?: string;
    wasInactiveAt?: string;
}
export interface GetZeroTrustTunnelCloudflaredFilterArgs {
    excludePrefix?: pulumi.Input<string>;
    /**
     * If provided, include only resources that were created (and not deleted) before this time. URL encoded.
     */
    existedAt?: pulumi.Input<string>;
    includePrefix?: pulumi.Input<string>;
    /**
     * If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included.
     */
    isDeleted?: pulumi.Input<boolean>;
    /**
     * A user-friendly name for a tunnel.
     */
    name?: pulumi.Input<string>;
    /**
     * The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
     * Available values: "inactive", "degraded", "healthy", "down".
     */
    status?: pulumi.Input<string>;
    /**
     * UUID of the tunnel.
     */
    uuid?: pulumi.Input<string>;
    wasActiveAt?: pulumi.Input<string>;
    wasInactiveAt?: pulumi.Input<string>;
}
export interface GetZeroTrustTunnelCloudflaredRouteFilter {
    /**
     * Optional remark describing the route.
     */
    comment?: string;
    /**
     * If provided, include only resources that were created (and not deleted) before this time. URL encoded.
     */
    existedAt?: string;
    /**
     * If `true`, only include deleted routes. If `false`, exclude deleted routes. If empty, all routes will be included.
     */
    isDeleted?: boolean;
    /**
     * If set, only list routes that are contained within this IP range.
     */
    networkSubset?: string;
    /**
     * If set, only list routes that contain this IP range.
     */
    networkSuperset?: string;
    /**
     * The types of tunnels to filter by, separated by commas.
     */
    tunTypes?: string[];
    /**
     * UUID of the tunnel.
     */
    tunnelId?: string;
    /**
     * UUID of the virtual network.
     */
    virtualNetworkId?: string;
}
export interface GetZeroTrustTunnelCloudflaredRouteFilterArgs {
    /**
     * Optional remark describing the route.
     */
    comment?: pulumi.Input<string>;
    /**
     * If provided, include only resources that were created (and not deleted) before this time. URL encoded.
     */
    existedAt?: pulumi.Input<string>;
    /**
     * If `true`, only include deleted routes. If `false`, exclude deleted routes. If empty, all routes will be included.
     */
    isDeleted?: pulumi.Input<boolean>;
    /**
     * If set, only list routes that are contained within this IP range.
     */
    networkSubset?: pulumi.Input<string>;
    /**
     * If set, only list routes that contain this IP range.
     */
    networkSuperset?: pulumi.Input<string>;
    /**
     * The types of tunnels to filter by, separated by commas.
     */
    tunTypes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * UUID of the tunnel.
     */
    tunnelId?: pulumi.Input<string>;
    /**
     * UUID of the virtual network.
     */
    virtualNetworkId?: pulumi.Input<string>;
}
export interface GetZeroTrustTunnelCloudflaredVirtualNetworkFilter {
    /**
     * UUID of the virtual network.
     */
    id?: string;
    /**
     * If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included.
     */
    isDefault?: boolean;
    /**
     * If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included.
     */
    isDefaultNetwork?: boolean;
    /**
     * If `true`, only include deleted virtual networks. If `false`, exclude deleted virtual networks. If empty, all virtual networks will be included.
     */
    isDeleted?: boolean;
    /**
     * A user-friendly name for the virtual network.
     */
    name?: string;
}
export interface GetZeroTrustTunnelCloudflaredVirtualNetworkFilterArgs {
    /**
     * UUID of the virtual network.
     */
    id?: pulumi.Input<string>;
    /**
     * If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included.
     */
    isDefault?: pulumi.Input<boolean>;
    /**
     * If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included.
     */
    isDefaultNetwork?: pulumi.Input<boolean>;
    /**
     * If `true`, only include deleted virtual networks. If `false`, exclude deleted virtual networks. If empty, all virtual networks will be included.
     */
    isDeleted?: pulumi.Input<boolean>;
    /**
     * A user-friendly name for the virtual network.
     */
    name?: pulumi.Input<string>;
}
export interface GetZeroTrustTunnelWarpConnectorFilter {
    excludePrefix?: string;
    /**
     * If provided, include only resources that were created (and not deleted) before this time. URL encoded.
     */
    existedAt?: string;
    includePrefix?: string;
    /**
     * If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included.
     */
    isDeleted?: boolean;
    /**
     * A user-friendly name for the tunnel.
     */
    name?: string;
    /**
     * The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
     * Available values: "inactive", "degraded", "healthy", "down".
     */
    status?: string;
    /**
     * UUID of the tunnel.
     */
    uuid?: string;
    wasActiveAt?: string;
    wasInactiveAt?: string;
}
export interface GetZeroTrustTunnelWarpConnectorFilterArgs {
    excludePrefix?: pulumi.Input<string>;
    /**
     * If provided, include only resources that were created (and not deleted) before this time. URL encoded.
     */
    existedAt?: pulumi.Input<string>;
    includePrefix?: pulumi.Input<string>;
    /**
     * If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included.
     */
    isDeleted?: pulumi.Input<boolean>;
    /**
     * A user-friendly name for the tunnel.
     */
    name?: pulumi.Input<string>;
    /**
     * The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
     * Available values: "inactive", "degraded", "healthy", "down".
     */
    status?: pulumi.Input<string>;
    /**
     * UUID of the tunnel.
     */
    uuid?: pulumi.Input<string>;
    wasActiveAt?: pulumi.Input<string>;
    wasInactiveAt?: pulumi.Input<string>;
}
export interface GetZoneFilter {
    account?: inputs.GetZoneFilterAccount;
    /**
     * Direction to order zones.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Whether to match all search requirements or at least one (any).
     * Available values: "any", "all".
     */
    match?: string;
    /**
     * A domain name. Optional filter operators can be provided to extend refine the search:
     *   * `equal` (default)
     *   * `notEqual`
     *   * `startsWith`
     *   * `endsWith`
     *   * `contains`
     *   * `startsWithCaseSensitive`
     *   * `endsWithCaseSensitive`
     *   * `containsCaseSensitive`
     */
    name?: string;
    /**
     * Field to order zones by.
     * Available values: "name", "status", "account.id", "account.name", "plan.id".
     */
    order?: string;
    /**
     * Specify a zone status to filter by.
     * Available values: "initializing", "pending", "active", "moved".
     */
    status?: string;
}
export interface GetZoneFilterArgs {
    account?: pulumi.Input<inputs.GetZoneFilterAccountArgs>;
    /**
     * Direction to order zones.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Whether to match all search requirements or at least one (any).
     * Available values: "any", "all".
     */
    match?: pulumi.Input<string>;
    /**
     * A domain name. Optional filter operators can be provided to extend refine the search:
     *   * `equal` (default)
     *   * `notEqual`
     *   * `startsWith`
     *   * `endsWith`
     *   * `contains`
     *   * `startsWithCaseSensitive`
     *   * `endsWithCaseSensitive`
     *   * `containsCaseSensitive`
     */
    name?: pulumi.Input<string>;
    /**
     * Field to order zones by.
     * Available values: "name", "status", "account.id", "account.name", "plan.id".
     */
    order?: pulumi.Input<string>;
    /**
     * Specify a zone status to filter by.
     * Available values: "initializing", "pending", "active", "moved".
     */
    status?: pulumi.Input<string>;
}
export interface GetZoneFilterAccount {
    /**
     * Filter by an account ID.
     */
    id?: string;
    /**
     * An account Name. Optional filter operators can be provided to extend refine the search:
     *   * `equal` (default)
     *   * `notEqual`
     *   * `startsWith`
     *   * `endsWith`
     *   * `contains`
     *   * `startsWithCaseSensitive`
     *   * `endsWithCaseSensitive`
     *   * `containsCaseSensitive`
     */
    name?: string;
}
export interface GetZoneFilterAccountArgs {
    /**
     * Filter by an account ID.
     */
    id?: pulumi.Input<string>;
    /**
     * An account Name. Optional filter operators can be provided to extend refine the search:
     *   * `equal` (default)
     *   * `notEqual`
     *   * `startsWith`
     *   * `endsWith`
     *   * `contains`
     *   * `startsWithCaseSensitive`
     *   * `endsWithCaseSensitive`
     *   * `containsCaseSensitive`
     */
    name?: pulumi.Input<string>;
}
export interface GetZoneLockdownFilter {
    /**
     * The timestamp of when the rule was created.
     */
    createdOn?: string;
    /**
     * A string to search for in the description of existing rules.
     */
    description?: string;
    /**
     * A string to search for in the description of existing rules.
     */
    descriptionSearch?: string;
    /**
     * A single IP address to search for in existing rules.
     */
    ip?: string;
    /**
     * A single IP address range to search for in existing rules.
     */
    ipRangeSearch?: string;
    /**
     * A single IP address to search for in existing rules.
     */
    ipSearch?: string;
    /**
     * The timestamp of when the rule was last modified.
     */
    modifiedOn?: string;
    /**
     * The priority of the rule to control the processing order. A lower number indicates higher priority. If not provided, any rules with a configured priority will be processed before rules without a priority.
     */
    priority?: number;
    /**
     * A single URI to search for in the list of URLs of existing rules.
     */
    uriSearch?: string;
}
export interface GetZoneLockdownFilterArgs {
    /**
     * The timestamp of when the rule was created.
     */
    createdOn?: pulumi.Input<string>;
    /**
     * A string to search for in the description of existing rules.
     */
    description?: pulumi.Input<string>;
    /**
     * A string to search for in the description of existing rules.
     */
    descriptionSearch?: pulumi.Input<string>;
    /**
     * A single IP address to search for in existing rules.
     */
    ip?: pulumi.Input<string>;
    /**
     * A single IP address range to search for in existing rules.
     */
    ipRangeSearch?: pulumi.Input<string>;
    /**
     * A single IP address to search for in existing rules.
     */
    ipSearch?: pulumi.Input<string>;
    /**
     * The timestamp of when the rule was last modified.
     */
    modifiedOn?: pulumi.Input<string>;
    /**
     * The priority of the rule to control the processing order. A lower number indicates higher priority. If not provided, any rules with a configured priority will be processed before rules without a priority.
     */
    priority?: pulumi.Input<number>;
    /**
     * A single URI to search for in the list of URLs of existing rules.
     */
    uriSearch?: pulumi.Input<string>;
}
export interface GetZonesAccount {
    /**
     * Filter by an account ID.
     */
    id?: string;
    /**
     * An account Name. Optional filter operators can be provided to extend refine the search:
     *   * `equal` (default)
     *   * `notEqual`
     *   * `startsWith`
     *   * `endsWith`
     *   * `contains`
     *   * `startsWithCaseSensitive`
     *   * `endsWithCaseSensitive`
     *   * `containsCaseSensitive`
     */
    name?: string;
}
export interface GetZonesAccountArgs {
    /**
     * Filter by an account ID.
     */
    id?: pulumi.Input<string>;
    /**
     * An account Name. Optional filter operators can be provided to extend refine the search:
     *   * `equal` (default)
     *   * `notEqual`
     *   * `startsWith`
     *   * `endsWith`
     *   * `contains`
     *   * `startsWithCaseSensitive`
     *   * `endsWithCaseSensitive`
     *   * `containsCaseSensitive`
     */
    name?: pulumi.Input<string>;
}
export interface HealthcheckHttpConfig {
    /**
     * Do not validate the certificate when the health check uses HTTPS.
     */
    allowInsecure?: pulumi.Input<boolean>;
    /**
     * A case-insensitive sub-string to look for in the response body. If this string is not found, the origin will be marked as unhealthy.
     */
    expectedBody?: pulumi.Input<string>;
    /**
     * The expected HTTP response codes (e.g. "200") or code ranges (e.g. "2xx" for all codes starting with 2) of the health check.
     */
    expectedCodes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Follow redirects if the origin returns a 3xx status code.
     */
    followRedirects?: pulumi.Input<boolean>;
    /**
     * The HTTP request headers to send in the health check. It is recommended you set a Host header by default. The User-Agent header cannot be overridden.
     */
    header?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * The HTTP method to use for the health check.
     * Available values: "GET", "HEAD".
     */
    method?: pulumi.Input<string>;
    /**
     * The endpoint path to health check against.
     */
    path?: pulumi.Input<string>;
    /**
     * Port number to connect to for the health check. Defaults to 80 if type is HTTP or 443 if type is HTTPS.
     */
    port?: pulumi.Input<number>;
}
export interface HealthcheckTcpConfig {
    /**
     * The TCP connection method to use for the health check.
     * Available values: "connectionEstablished".
     */
    method?: pulumi.Input<string>;
    /**
     * Port number to connect to for the health check. Defaults to 80.
     */
    port?: pulumi.Input<number>;
}
export interface HyperdriveConfigCaching {
    /**
     * Set to true to disable caching of SQL responses. Default is false.
     */
    disabled?: pulumi.Input<boolean>;
    /**
     * Specify the maximum duration (in seconds) items should persist in the cache. Defaults to 60 seconds if not specified.
     */
    maxAge?: pulumi.Input<number>;
    /**
     * Specify the number of seconds the cache may serve a stale response. Defaults to 15 seconds if not specified.
     */
    staleWhileRevalidate?: pulumi.Input<number>;
}
export interface HyperdriveConfigMtls {
    /**
     * Define CA certificate ID obtained after uploading CA cert.
     */
    caCertificateId?: pulumi.Input<string>;
    /**
     * Define mTLS certificate ID obtained after uploading client cert.
     */
    mtlsCertificateId?: pulumi.Input<string>;
    /**
     * Set SSL mode to 'require', 'verify-ca', or 'verify-full' to verify the CA.
     */
    sslmode?: pulumi.Input<string>;
}
export interface HyperdriveConfigOrigin {
    /**
     * Defines the Client ID of the Access token to use when connecting to the origin database.
     */
    accessClientId?: pulumi.Input<string>;
    /**
     * Defines the Client Secret of the Access Token to use when connecting to the origin database. The API never returns this write-only value.
     */
    accessClientSecret?: pulumi.Input<string>;
    /**
     * Set the name of your origin database.
     */
    database: pulumi.Input<string>;
    /**
     * Defines the host (hostname or IP) of your origin database.
     */
    host: pulumi.Input<string>;
    /**
     * Set the password needed to access your origin database. The API never returns this write-only value.
     */
    password: pulumi.Input<string>;
    /**
     * Defines the port of your origin database. Defaults to 5432 for PostgreSQL or 3306 for MySQL if not specified.
     */
    port?: pulumi.Input<number>;
    /**
     * Specifies the URL scheme used to connect to your origin database.
     * Available values: "postgres", "postgresql", "mysql".
     */
    scheme: pulumi.Input<string>;
    /**
     * Set the user of your origin database.
     */
    user: pulumi.Input<string>;
}
export interface ImageVariantOptions {
    /**
     * The fit property describes how the width and height dimensions should be interpreted.
     * Available values: "scale-down", "contain", "cover", "crop", "pad".
     */
    fit: pulumi.Input<string>;
    /**
     * Maximum height in image pixels.
     */
    height: pulumi.Input<number>;
    /**
     * What EXIF data should be preserved in the output image.
     * Available values: "keep", "copyright", "none".
     */
    metadata: pulumi.Input<string>;
    /**
     * Maximum width in image pixels.
     */
    width: pulumi.Input<number>;
}
export interface ImageVariantVariant {
    id?: pulumi.Input<string>;
    /**
     * Indicates whether the variant can access an image without a signature, regardless of image access control.
     */
    neverRequireSignedUrls?: pulumi.Input<boolean>;
    /**
     * Allows you to define image resizing sizes for different use cases.
     */
    options?: pulumi.Input<inputs.ImageVariantVariantOptions>;
}
export interface ImageVariantVariantOptions {
    /**
     * The fit property describes how the width and height dimensions should be interpreted.
     * Available values: "scale-down", "contain", "cover", "crop", "pad".
     */
    fit?: pulumi.Input<string>;
    /**
     * Maximum height in image pixels.
     */
    height?: pulumi.Input<number>;
    /**
     * What EXIF data should be preserved in the output image.
     * Available values: "keep", "copyright", "none".
     */
    metadata?: pulumi.Input<string>;
    /**
     * Maximum width in image pixels.
     */
    width?: pulumi.Input<number>;
}
export interface KeylessCertificateTunnel {
    /**
     * Private IP of the Key Server Host
     */
    privateIp: pulumi.Input<string>;
    /**
     * Cloudflare Tunnel Virtual Network ID
     */
    vnetId: pulumi.Input<string>;
}
export interface ListItem {
    /**
     * A non-negative 32 bit integer
     */
    asn?: pulumi.Input<number>;
    /**
     * An informative summary of the list item.
     */
    comment?: pulumi.Input<string>;
    /**
     * Valid characters for hostnames are ASCII(7) letters from a to z, the digits from 0 to 9, wildcards (*), and the hyphen (-).
     */
    hostname?: pulumi.Input<inputs.ListItemHostname>;
    /**
     * An IPv4 address, an IPv4 CIDR, an IPv6 address, or an IPv6 CIDR.
     */
    ip?: pulumi.Input<string>;
    /**
     * The definition of the redirect.
     */
    redirect?: pulumi.Input<inputs.ListItemRedirect>;
}
export interface ListItemHostname {
    /**
     * Only applies to wildcard hostnames (e.g., *.example.com). When true (default), only subdomains are blocked. When false, both the root domain and subdomains are blocked.
     */
    excludeExactHostname?: pulumi.Input<boolean>;
    urlHostname: pulumi.Input<string>;
}
export interface ListItemRedirect {
    includeSubdomains?: pulumi.Input<boolean>;
    preservePathSuffix?: pulumi.Input<boolean>;
    preserveQueryString?: pulumi.Input<boolean>;
    sourceUrl: pulumi.Input<string>;
    /**
     * Available values: 301, 302, 307, 308.
     */
    statusCode?: pulumi.Input<number>;
    subpathMatching?: pulumi.Input<boolean>;
    targetUrl: pulumi.Input<string>;
}
export interface LoadBalancerAdaptiveRouting {
    /**
     * Extends zero-downtime failover of requests to healthy origins from alternate pools, when no healthy alternate exists in the same pool, according to the failover order defined by traffic and origin steering. When set false (the default) zero-downtime failover will only occur between origins within the same pool. See `sessionAffinityAttributes` for control over when sessions are broken or reassigned.
     */
    failoverAcrossPools?: pulumi.Input<boolean>;
}
export interface LoadBalancerLocationStrategy {
    /**
     * Determines the authoritative location when ECS is not preferred, does not exist in the request, or its GeoIP lookup is unsuccessful.
     */
    mode?: pulumi.Input<string>;
    /**
     * Whether the EDNS Client Subnet (ECS) GeoIP should be preferred as the authoritative location.
     */
    preferEcs?: pulumi.Input<string>;
}
export interface LoadBalancerPoolLoadShedding {
    /**
     * The percent of traffic to shed from the pool, according to the default policy. Applies to new sessions and traffic without session affinity.
     */
    defaultPercent?: pulumi.Input<number>;
    /**
     * The default policy to use when load shedding. A random policy randomly sheds a given percent of requests. A hash policy computes a hash over the CF-Connecting-IP address and sheds all requests originating from a percent of IPs.
     * Available values: "random", "hash".
     */
    defaultPolicy?: pulumi.Input<string>;
    /**
     * The percent of existing sessions to shed from the pool, according to the session policy.
     */
    sessionPercent?: pulumi.Input<number>;
    /**
     * Only the hash policy is supported for existing sessions (to avoid exponential decay).
     * Available values: "hash".
     */
    sessionPolicy?: pulumi.Input<string>;
}
export interface LoadBalancerPoolNotificationFilter {
    /**
     * Filter options for a particular resource type (pool or origin). Use null to reset.
     */
    origin?: pulumi.Input<inputs.LoadBalancerPoolNotificationFilterOrigin>;
    /**
     * Filter options for a particular resource type (pool or origin). Use null to reset.
     */
    pool?: pulumi.Input<inputs.LoadBalancerPoolNotificationFilterPool>;
}
export interface LoadBalancerPoolNotificationFilterOrigin {
    /**
     * If set true, disable notifications for this type of resource (pool or origin).
     */
    disable?: pulumi.Input<boolean>;
    /**
     * If present, send notifications only for this health status (e.g. false for only DOWN events). Use null to reset (all events).
     */
    healthy?: pulumi.Input<boolean>;
}
export interface LoadBalancerPoolNotificationFilterPool {
    /**
     * If set true, disable notifications for this type of resource (pool or origin).
     */
    disable?: pulumi.Input<boolean>;
    /**
     * If present, send notifications only for this health status (e.g. false for only DOWN events). Use null to reset (all events).
     */
    healthy?: pulumi.Input<boolean>;
}
export interface LoadBalancerPoolOrigin {
    /**
     * The IP address (IPv4 or IPv6) of the origin, or its publicly addressable hostname. Hostnames entered here should resolve directly to the origin, and not be a hostname proxied by Cloudflare. To set an internal/reserved address, virtual*network*id must also be set.
     */
    address?: pulumi.Input<string>;
    /**
     * This field shows up only if the origin is disabled. This field is set with the time the origin was disabled.
     */
    disabledAt?: pulumi.Input<string>;
    /**
     * Whether to enable (the default) this origin within the pool. Disabled origins will not receive traffic and are excluded from health checks. The origin will only be disabled for the current pool.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The request header is used to pass additional information with an HTTP request. Currently supported header is 'Host'.
     */
    header?: pulumi.Input<inputs.LoadBalancerPoolOriginHeader>;
    /**
     * A human-identifiable name for the origin.
     */
    name?: pulumi.Input<string>;
    /**
     * The port for upstream connections. A value of 0 means the default port for the protocol will be used.
     */
    port?: pulumi.Input<number>;
    /**
     * The virtual network subnet ID the origin belongs in. Virtual network must also belong to the account.
     */
    virtualNetworkId?: pulumi.Input<string>;
    /**
     * The weight of this origin relative to other origins in the pool. Based on the configured weight the total traffic is distributed among origins within the pool.
     */
    weight?: pulumi.Input<number>;
}
export interface LoadBalancerPoolOriginHeader {
    /**
     * The 'Host' header allows to override the hostname set in the HTTP request. Current support is 1 'Host' header override per origin.
     */
    hosts?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface LoadBalancerPoolOriginSteering {
    /**
     * The type of origin steering policy to use.
     */
    policy?: pulumi.Input<string>;
}
export interface LoadBalancerRandomSteering {
    /**
     * The default weight for pools in the load balancer that are not specified in the poolWeights map.
     */
    defaultWeight?: pulumi.Input<number>;
    /**
     * A mapping of pool IDs to custom weights. The weight is relative to other pools in the load balancer.
     */
    poolWeights?: pulumi.Input<{
        [key: string]: pulumi.Input<number>;
    }>;
}
export interface LoadBalancerRule {
    /**
     * The condition expressions to evaluate. If the condition evaluates to true, the overrides or fixedResponse in this rule will be applied. An empty condition is always true. For more details on condition expressions, please see https://developers.cloudflare.com/load-balancing/understand-basics/load-balancing-rules/expressions.
     */
    condition?: pulumi.Input<string>;
    /**
     * Disable this specific rule. It will no longer be evaluated by this load balancer.
     */
    disabled?: pulumi.Input<boolean>;
    /**
     * A collection of fields used to directly respond to the eyeball instead of routing to a pool. If a fixed*response is supplied the rule will be marked as terminates.
     */
    fixedResponse?: pulumi.Input<inputs.LoadBalancerRuleFixedResponse>;
    /**
     * Name of this rule. Only used for human readability.
     */
    name?: pulumi.Input<string>;
    /**
     * A collection of overrides to apply to the load balancer when this rule's condition is true. All fields are optional.
     */
    overrides?: pulumi.Input<inputs.LoadBalancerRuleOverrides>;
    /**
     * The order in which rules should be executed in relation to each other. Lower values are executed first. Values do not need to be sequential. If no value is provided for any rule the array order of the rules field will be used to assign a priority.
     */
    priority?: pulumi.Input<number>;
    /**
     * If this rule's condition is true, this causes rule evaluation to stop after processing this rule.
     */
    terminates?: pulumi.Input<boolean>;
}
export interface LoadBalancerRuleFixedResponse {
    /**
     * The http 'Content-Type' header to include in the response.
     */
    contentType?: pulumi.Input<string>;
    /**
     * The http 'Location' header to include in the response.
     */
    location?: pulumi.Input<string>;
    /**
     * Text to include as the http body.
     */
    messageBody?: pulumi.Input<string>;
    /**
     * The http status code to respond with.
     */
    statusCode?: pulumi.Input<number>;
}
export interface LoadBalancerRuleOverrides {
    /**
     * Controls features that modify the routing of requests to pools and origins in response to dynamic conditions, such as during the interval between active health monitoring requests. For example, zero-downtime failover occurs immediately when an origin becomes unavailable due to HTTP 521, 522, or 523 response codes. If there is another healthy origin in the same pool, the request is retried once against this alternate origin.
     */
    adaptiveRouting?: pulumi.Input<inputs.LoadBalancerRuleOverridesAdaptiveRouting>;
    /**
     * A mapping of country codes to a list of pool IDs (ordered by their failover priority) for the given country. Any country not explicitly defined will fall back to using the corresponding region*pool mapping if it exists else to default*pools.
     */
    countryPools?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * A list of pool IDs ordered by their failover priority. Pools defined here are used by default, or when regionPools are not configured for a given region.
     */
    defaultPools?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The pool ID to use when all other pools are detected as unhealthy.
     */
    fallbackPool?: pulumi.Input<string>;
    /**
     * Controls location-based steering for non-proxied requests. See `steeringPolicy` to learn how steering is affected.
     */
    locationStrategy?: pulumi.Input<inputs.LoadBalancerRuleOverridesLocationStrategy>;
    /**
     * Enterprise only: A mapping of Cloudflare PoP identifiers to a list of pool IDs (ordered by their failover priority) for the PoP (datacenter). Any PoPs not explicitly defined will fall back to using the corresponding country*pool, then region*pool mapping if it exists else to default_pools.
     */
    popPools?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * Configures pool weights.
     */
    randomSteering?: pulumi.Input<inputs.LoadBalancerRuleOverridesRandomSteering>;
    /**
     * A mapping of region codes to a list of pool IDs (ordered by their failover priority) for the given region. Any regions not explicitly defined will fall back to using default_pools.
     */
    regionPools?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * Specifies the type of session affinity the load balancer should use unless specified as `"none"`. The supported types are: - `"cookie"`: On the first request to a proxied load balancer, a cookie is generated, encoding information of which origin the request will be forwarded to. Subsequent requests, by the same client to the same load balancer, will be sent to the origin server the cookie encodes, for the duration of the cookie and as long as the origin server remains healthy. If the cookie has expired or the origin server is unhealthy, then a new origin server is calculated and used. - `"ipCookie"`: Behaves the same as `"cookie"` except the initial origin selection is stable and based on the client's ip address. - `"header"`: On the first request to a proxied load balancer, a session key based on the configured HTTP headers (see `session_affinity_attributes.headers`) is generated, encoding the request headers used for storing in the load balancer session state which origin the request will be forwarded to. Subsequent requests to the load balancer with the same headers will be sent to the same origin server, for the duration of the session and as long as the origin server remains healthy. If the session has been idle for the duration of `sessionAffinityTtl` seconds or the origin server is unhealthy, then a new origin server is calculated and used. See `headers` in `sessionAffinityAttributes` for additional required configuration.
     * Available values: "none", "cookie", "ipCookie", "header".
     */
    sessionAffinity?: pulumi.Input<string>;
    /**
     * Configures attributes for session affinity.
     */
    sessionAffinityAttributes?: pulumi.Input<inputs.LoadBalancerRuleOverridesSessionAffinityAttributes>;
    /**
     * Time, in seconds, until a client's session expires after being created. Once the expiry time has been reached, subsequent requests may get sent to a different origin server. The accepted ranges per `sessionAffinity` policy are: - `"cookie"` / `"ipCookie"`: The current default of 23 hours will be used unless explicitly set. The accepted range of values is between [1800, 604800]. - `"header"`: The current default of 1800 seconds will be used unless explicitly set. The accepted range of values is between [30, 3600]. Note: With session affinity by header, sessions only expire after they haven't been used for the number of seconds specified.
     */
    sessionAffinityTtl?: pulumi.Input<number>;
    /**
     * Steering Policy for this load balancer.
     */
    steeringPolicy?: pulumi.Input<string>;
    /**
     * Time to live (TTL) of the DNS entry for the IP address returned by this load balancer. This only applies to gray-clouded (unproxied) load balancers.
     */
    ttl?: pulumi.Input<number>;
}
export interface LoadBalancerRuleOverridesAdaptiveRouting {
    /**
     * Extends zero-downtime failover of requests to healthy origins from alternate pools, when no healthy alternate exists in the same pool, according to the failover order defined by traffic and origin steering. When set false (the default) zero-downtime failover will only occur between origins within the same pool. See `sessionAffinityAttributes` for control over when sessions are broken or reassigned.
     */
    failoverAcrossPools?: pulumi.Input<boolean>;
}
export interface LoadBalancerRuleOverridesLocationStrategy {
    /**
     * Determines the authoritative location when ECS is not preferred, does not exist in the request, or its GeoIP lookup is unsuccessful.
     */
    mode?: pulumi.Input<string>;
    /**
     * Whether the EDNS Client Subnet (ECS) GeoIP should be preferred as the authoritative location.
     */
    preferEcs?: pulumi.Input<string>;
}
export interface LoadBalancerRuleOverridesRandomSteering {
    /**
     * The default weight for pools in the load balancer that are not specified in the poolWeights map.
     */
    defaultWeight?: pulumi.Input<number>;
    /**
     * A mapping of pool IDs to custom weights. The weight is relative to other pools in the load balancer.
     */
    poolWeights?: pulumi.Input<{
        [key: string]: pulumi.Input<number>;
    }>;
}
export interface LoadBalancerRuleOverridesSessionAffinityAttributes {
    /**
     * Configures the drain duration in seconds. This field is only used when session affinity is enabled on the load balancer.
     */
    drainDuration?: pulumi.Input<number>;
    /**
     * Configures the names of HTTP headers to base session affinity on when header `sessionAffinity` is enabled. At least one HTTP header name must be provided. To specify the exact cookies to be used, include an item in the following format: `"cookie:<cookie-name-1>,<cookie-name-2>"` (example) where everything after the colon is a comma-separated list of cookie names. Providing only `"cookie"` will result in all cookies being used. The default max number of HTTP header names that can be provided depends on your plan: 5 for Enterprise, 1 for all other plans.
     */
    headers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * When header `sessionAffinity` is enabled, this option can be used to specify how HTTP headers on load balancing requests will be used. The supported values are: - `"true"`: Load balancing requests must contain *all* of the HTTP headers specified by the `headers` session affinity attribute, otherwise sessions aren't created. - `"false"`: Load balancing requests must contain *at least one* of the HTTP headers specified by the `headers` session affinity attribute, otherwise sessions aren't created.
     */
    requireAllHeaders?: pulumi.Input<boolean>;
    /**
     * Configures the SameSite attribute on session affinity cookie. Value "Auto" will be translated to "Lax" or "None" depending if Always Use HTTPS is enabled. Note: when using value "None", the secure attribute can not be set to "Never".
     * Available values: "Auto", "Lax", "None", "Strict".
     */
    samesite?: pulumi.Input<string>;
    /**
     * Configures the Secure attribute on session affinity cookie. Value "Always" indicates the Secure attribute will be set in the Set-Cookie header, "Never" indicates the Secure attribute will not be set, and "Auto" will set the Secure attribute depending if Always Use HTTPS is enabled.
     * Available values: "Auto", "Always", "Never".
     */
    secure?: pulumi.Input<string>;
    /**
     * Configures the zero-downtime failover between origins within a pool when session affinity is enabled. This feature is currently incompatible with Argo, Tiered Cache, and Bandwidth Alliance. The supported values are: - `"none"`: No failover takes place for sessions pinned to the origin (default). - `"temporary"`: Traffic will be sent to another other healthy origin until the originally pinned origin is available; note that this can potentially result in heavy origin flapping. - `"sticky"`: The session affinity cookie is updated and subsequent requests are sent to the new origin. Note: Zero-downtime failover with sticky sessions is currently not supported for session affinity by header.
     * Available values: "none", "temporary", "sticky".
     */
    zeroDowntimeFailover?: pulumi.Input<string>;
}
export interface LoadBalancerSessionAffinityAttributes {
    /**
     * Configures the drain duration in seconds. This field is only used when session affinity is enabled on the load balancer.
     */
    drainDuration?: pulumi.Input<number>;
    /**
     * Configures the names of HTTP headers to base session affinity on when header `sessionAffinity` is enabled. At least one HTTP header name must be provided. To specify the exact cookies to be used, include an item in the following format: `"cookie:<cookie-name-1>,<cookie-name-2>"` (example) where everything after the colon is a comma-separated list of cookie names. Providing only `"cookie"` will result in all cookies being used. The default max number of HTTP header names that can be provided depends on your plan: 5 for Enterprise, 1 for all other plans.
     */
    headers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * When header `sessionAffinity` is enabled, this option can be used to specify how HTTP headers on load balancing requests will be used. The supported values are: - `"true"`: Load balancing requests must contain *all* of the HTTP headers specified by the `headers` session affinity attribute, otherwise sessions aren't created. - `"false"`: Load balancing requests must contain *at least one* of the HTTP headers specified by the `headers` session affinity attribute, otherwise sessions aren't created.
     */
    requireAllHeaders?: pulumi.Input<boolean>;
    /**
     * Configures the SameSite attribute on session affinity cookie. Value "Auto" will be translated to "Lax" or "None" depending if Always Use HTTPS is enabled. Note: when using value "None", the secure attribute can not be set to "Never".
     * Available values: "Auto", "Lax", "None", "Strict".
     */
    samesite?: pulumi.Input<string>;
    /**
     * Configures the Secure attribute on session affinity cookie. Value "Always" indicates the Secure attribute will be set in the Set-Cookie header, "Never" indicates the Secure attribute will not be set, and "Auto" will set the Secure attribute depending if Always Use HTTPS is enabled.
     * Available values: "Auto", "Always", "Never".
     */
    secure?: pulumi.Input<string>;
    /**
     * Configures the zero-downtime failover between origins within a pool when session affinity is enabled. This feature is currently incompatible with Argo, Tiered Cache, and Bandwidth Alliance. The supported values are: - `"none"`: No failover takes place for sessions pinned to the origin (default). - `"temporary"`: Traffic will be sent to another other healthy origin until the originally pinned origin is available; note that this can potentially result in heavy origin flapping. - `"sticky"`: The session affinity cookie is updated and subsequent requests are sent to the new origin. Note: Zero-downtime failover with sticky sessions is currently not supported for session affinity by header.
     * Available values: "none", "temporary", "sticky".
     */
    zeroDowntimeFailover?: pulumi.Input<string>;
}
export interface LogpushJobOutputOptions {
    /**
     * String to be prepended before each batch.
     */
    batchPrefix?: pulumi.Input<string>;
    /**
     * String to be appended after each batch.
     */
    batchSuffix?: pulumi.Input<string>;
    /**
     * If set to true, will cause all occurrences of `${` in the generated files to be replaced with `x{`.
     */
    cve202144228?: pulumi.Input<boolean>;
    /**
     * String to join fields. This field be ignored when `recordTemplate` is set.
     */
    fieldDelimiter?: pulumi.Input<string>;
    /**
     * List of field names to be included in the Logpush output. For the moment, there is no option to add all fields at once, so you must specify all the fields names you are interested in.
     */
    fieldNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Specifies the output type, such as `ndjson` or `csv`. This sets default values for the rest of the settings, depending on the chosen output type. Some formatting rules, like string quoting, are different between output types.
     * Available values: "ndjson", "csv".
     */
    outputType?: pulumi.Input<string>;
    /**
     * String to be inserted in-between the records as separator.
     */
    recordDelimiter?: pulumi.Input<string>;
    /**
     * String to be prepended before each record.
     */
    recordPrefix?: pulumi.Input<string>;
    /**
     * String to be appended after each record.
     */
    recordSuffix?: pulumi.Input<string>;
    /**
     * String to use as template for each record instead of the default json key value mapping. All fields used in the template must be present in `fieldNames` as well, otherwise they will end up as null. Format as a Go `text/template` without any standard functions, like conditionals, loops, sub-templates, etc.
     */
    recordTemplate?: pulumi.Input<string>;
    /**
     * Floating number to specify sampling rate. Sampling is applied on top of filtering, and regardless of the current `sampleInterval` of the data.
     */
    sampleRate?: pulumi.Input<number>;
    /**
     * String to specify the format for timestamps, such as `unixnano`, `unix`, or `rfc3339`.
     * Available values: "unixnano", "unix", "rfc3339".
     */
    timestampFormat?: pulumi.Input<string>;
}
export interface MagicNetworkMonitoringConfigurationWarpDevice {
    /**
     * Unique identifier for the warp device.
     */
    id: pulumi.Input<string>;
    /**
     * Name of the warp device.
     */
    name: pulumi.Input<string>;
    /**
     * IPv4 CIDR of the router sourcing flow data associated with this warp device. Only /32 addresses are currently supported.
     */
    routerIp: pulumi.Input<string>;
}
export interface MagicTransitConnectorDevice {
    id?: pulumi.Input<string>;
    /**
     * Set to true to provision a license key for this connector. Only used during resource creation. This is a write-only field that will not be stored in state.
     */
    provisionLicense?: pulumi.Input<boolean>;
    serialNumber?: pulumi.Input<string>;
}
export interface MagicTransitSiteAclLan1 {
    /**
     * The identifier for the LAN you want to create an ACL policy with.
     */
    lanId: pulumi.Input<string>;
    /**
     * The name of the LAN based on the provided lan_id.
     */
    lanName?: pulumi.Input<string>;
    /**
     * Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.
     */
    portRanges?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.
     */
    ports?: pulumi.Input<pulumi.Input<number>[]>;
    /**
     * Array of subnet IPs within the LAN that will be included in the ACL. If no subnets are provided, communication on any subnets on this LAN are allowed.
     */
    subnets?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface MagicTransitSiteAclLan2 {
    /**
     * The identifier for the LAN you want to create an ACL policy with.
     */
    lanId: pulumi.Input<string>;
    /**
     * The name of the LAN based on the provided lan_id.
     */
    lanName?: pulumi.Input<string>;
    /**
     * Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.
     */
    portRanges?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.
     */
    ports?: pulumi.Input<pulumi.Input<number>[]>;
    /**
     * Array of subnet IPs within the LAN that will be included in the ACL. If no subnets are provided, communication on any subnets on this LAN are allowed.
     */
    subnets?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface MagicTransitSiteLanNat {
    /**
     * A valid CIDR notation representing an IP range.
     */
    staticPrefix?: pulumi.Input<string>;
}
export interface MagicTransitSiteLanRoutedSubnet {
    nat?: pulumi.Input<inputs.MagicTransitSiteLanRoutedSubnetNat>;
    /**
     * A valid IPv4 address.
     */
    nextHop: pulumi.Input<string>;
    /**
     * A valid CIDR notation representing an IP range.
     */
    prefix: pulumi.Input<string>;
}
export interface MagicTransitSiteLanRoutedSubnetNat {
    /**
     * A valid CIDR notation representing an IP range.
     */
    staticPrefix?: pulumi.Input<string>;
}
export interface MagicTransitSiteLanStaticAddressing {
    /**
     * A valid CIDR notation representing an IP range.
     */
    address: pulumi.Input<string>;
    dhcpRelay?: pulumi.Input<inputs.MagicTransitSiteLanStaticAddressingDhcpRelay>;
    dhcpServer?: pulumi.Input<inputs.MagicTransitSiteLanStaticAddressingDhcpServer>;
    /**
     * A valid CIDR notation representing an IP range.
     */
    secondaryAddress?: pulumi.Input<string>;
    /**
     * A valid CIDR notation representing an IP range.
     */
    virtualAddress?: pulumi.Input<string>;
}
export interface MagicTransitSiteLanStaticAddressingDhcpRelay {
    /**
     * List of DHCP server IPs.
     */
    serverAddresses?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface MagicTransitSiteLanStaticAddressingDhcpServer {
    /**
     * A valid IPv4 address.
     */
    dhcpPoolEnd?: pulumi.Input<string>;
    /**
     * A valid IPv4 address.
     */
    dhcpPoolStart?: pulumi.Input<string>;
    /**
     * A valid IPv4 address.
     */
    dnsServer?: pulumi.Input<string>;
    dnsServers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Mapping of MAC addresses to IP addresses
     */
    reservations?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
}
export interface MagicTransitSiteLocation {
    /**
     * Latitude
     */
    lat?: pulumi.Input<string>;
    /**
     * Longitude
     */
    lon?: pulumi.Input<string>;
}
export interface MagicTransitSiteWanStaticAddressing {
    /**
     * A valid CIDR notation representing an IP range.
     */
    address: pulumi.Input<string>;
    /**
     * A valid IPv4 address.
     */
    gatewayAddress: pulumi.Input<string>;
    /**
     * A valid CIDR notation representing an IP range.
     */
    secondaryAddress?: pulumi.Input<string>;
}
export interface MagicWanGreTunnelBgp {
    /**
     * ASN used on the customer end of the BGP session
     */
    customerAsn: pulumi.Input<number>;
    /**
     * Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.
     */
    extraPrefixes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * MD5 key to use for session authentication.
     */
    md5Key?: pulumi.Input<string>;
}
export interface MagicWanGreTunnelBgpStatus {
    bgpState?: pulumi.Input<string>;
    cfSpeakerIp?: pulumi.Input<string>;
    cfSpeakerPort?: pulumi.Input<number>;
    customerSpeakerIp?: pulumi.Input<string>;
    customerSpeakerPort?: pulumi.Input<number>;
    /**
     * Available values: "BGP*DOWN", "BGP*UP", "BGP_ESTABLISHING".
     */
    state?: pulumi.Input<string>;
    tcpEstablished?: pulumi.Input<boolean>;
    updatedAt?: pulumi.Input<string>;
}
export interface MagicWanGreTunnelHealthCheck {
    /**
     * The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.
     * Available values: "unidirectional", "bidirectional".
     */
    direction?: pulumi.Input<string>;
    /**
     * Determines whether to run healthchecks for a tunnel.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * How frequent the health check is run. The default value is `mid`.
     * Available values: "low", "mid", "high".
     */
    rate?: pulumi.Input<string>;
    /**
     * The destination address in a request type health check. After the healthcheck is decapsulated at the customer end of the tunnel, the ICMP echo will be forwarded to this address. This field defaults to `customerGreEndpoint address`. This field is ignored for bidirectional healthchecks as the interface*address (not assigned to the Cloudflare side of the tunnel) is used as the target. Must be in object form if the x-magic-new-hc-target header is set to true and string form if x-magic-new-hc-target is absent or set to false.
     */
    target?: pulumi.Input<inputs.MagicWanGreTunnelHealthCheckTarget>;
    /**
     * The type of healthcheck to run, reply or request. The default value is `reply`.
     * Available values: "reply", "request".
     */
    type?: pulumi.Input<string>;
}
export interface MagicWanGreTunnelHealthCheckTarget {
    /**
     * The effective health check target. If 'saved' is empty, then this field will be populated with the calculated default value on GET requests. Ignored in POST, PUT, and PATCH requests.
     */
    effective?: pulumi.Input<string>;
    /**
     * The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.
     */
    saved?: pulumi.Input<string>;
}
export interface MagicWanIpsecTunnelBgp {
    /**
     * ASN used on the customer end of the BGP session
     */
    customerAsn: pulumi.Input<number>;
    /**
     * Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.
     */
    extraPrefixes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * MD5 key to use for session authentication.
     */
    md5Key?: pulumi.Input<string>;
}
export interface MagicWanIpsecTunnelBgpStatus {
    bgpState?: pulumi.Input<string>;
    cfSpeakerIp?: pulumi.Input<string>;
    cfSpeakerPort?: pulumi.Input<number>;
    customerSpeakerIp?: pulumi.Input<string>;
    customerSpeakerPort?: pulumi.Input<number>;
    /**
     * Available values: "BGP*DOWN", "BGP*UP", "BGP_ESTABLISHING".
     */
    state?: pulumi.Input<string>;
    tcpEstablished?: pulumi.Input<boolean>;
    updatedAt?: pulumi.Input<string>;
}
export interface MagicWanIpsecTunnelCustomRemoteIdentities {
    /**
     * A custom IKE ID of type FQDN that may be used to identity the IPsec tunnel. The
     * generated IKE IDs can still be used even if this custom value is specified.
     */
    fqdnId?: pulumi.Input<string>;
}
export interface MagicWanIpsecTunnelHealthCheck {
    /**
     * The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.
     * Available values: "unidirectional", "bidirectional".
     */
    direction?: pulumi.Input<string>;
    /**
     * Determines whether to run healthchecks for a tunnel.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * How frequent the health check is run. The default value is `mid`.
     * Available values: "low", "mid", "high".
     */
    rate?: pulumi.Input<string>;
    /**
     * The destination address in a request type health check. After the healthcheck is decapsulated at the customer end of the tunnel, the ICMP echo will be forwarded to this address. This field defaults to `customerGreEndpoint address`. This field is ignored for bidirectional healthchecks as the interface*address (not assigned to the Cloudflare side of the tunnel) is used as the target. Must be in object form if the x-magic-new-hc-target header is set to true and string form if x-magic-new-hc-target is absent or set to false.
     */
    target?: pulumi.Input<inputs.MagicWanIpsecTunnelHealthCheckTarget>;
    /**
     * The type of healthcheck to run, reply or request. The default value is `reply`.
     * Available values: "reply", "request".
     */
    type?: pulumi.Input<string>;
}
export interface MagicWanIpsecTunnelHealthCheckTarget {
    /**
     * The effective health check target. If 'saved' is empty, then this field will be populated with the calculated default value on GET requests. Ignored in POST, PUT, and PATCH requests.
     */
    effective?: pulumi.Input<string>;
    /**
     * The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.
     */
    saved?: pulumi.Input<string>;
}
export interface MagicWanIpsecTunnelPskMetadata {
    /**
     * The date and time the tunnel was last modified.
     */
    lastGeneratedOn?: pulumi.Input<string>;
}
export interface MagicWanStaticRouteScope {
    /**
     * List of colo names for the ECMP scope.
     */
    coloNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of colo regions for the ECMP scope.
     */
    coloRegions?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ManagedHeadersManagedRequestHeader {
    /**
     * Whether the Managed Transform is enabled.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The human-readable identifier of the Managed Transform.
     */
    id: pulumi.Input<string>;
}
export interface ManagedHeadersManagedResponseHeader {
    /**
     * Whether the Managed Transform is enabled.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The human-readable identifier of the Managed Transform.
     */
    id: pulumi.Input<string>;
}
export interface ManagedTransformsManagedRequestHeader {
    /**
     * Whether the Managed Transform is enabled.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The human-readable identifier of the Managed Transform.
     */
    id: pulumi.Input<string>;
}
export interface ManagedTransformsManagedResponseHeader {
    /**
     * Whether the Managed Transform is enabled.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The human-readable identifier of the Managed Transform.
     */
    id: pulumi.Input<string>;
}
export interface NotificationPolicyFilters {
    /**
     * Usage depends on specific alert type
     */
    actions?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring radar_notification
     */
    affectedAsns?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring incident_alert
     */
    affectedComponents?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring radar_notification
     */
    affectedLocations?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring maintenance*event*notification
     */
    airportCodes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    alertTriggerPreferences?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    alertTriggerPreferencesValues?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring load*balancing*pool*enablement*alert
     */
    enableds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring pages*event*alert
     */
    environments?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring load*balancing*health_alert
     */
    eventSources?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    eventTypes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring pages*event*alert
     */
    events?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    groupBies?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring health*check*status_notification
     */
    healthCheckIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring incident_alert
     */
    incidentImpacts?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring stream*live*notifications
     */
    inputIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring security*insights*alert
     */
    insightClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring billing*usage*alert
     */
    limits?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring logo*match*alert
     */
    logoTags?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring advanced*ddos*attack*l4*alert
     */
    megabitsPerSeconds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring load*balancing*health_alert
     */
    newHealths?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring tunnel*health*event
     */
    newStatuses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring advanced*ddos*attack*l4*alert
     */
    packetsPerSeconds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    poolIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    popNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring billing*usage*alert
     */
    products?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring pages*event*alert
     */
    projectIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring advanced*ddos*attack*l4*alert
     */
    protocols?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    queryTags?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring advanced*ddos*attack*l7*alert
     */
    requestsPerSeconds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    selectors?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring clickhouse*alert*fw*ent*anomaly
     */
    services?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    slos?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring health*check*status_notification
     */
    statuses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring advanced*ddos*attack*l7*alert
     */
    targetHostnames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring advanced*ddos*attack*l4*alert
     */
    targetIps?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring advanced*ddos*attack*l7*alert
     */
    targetZoneNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring traffic*anomalies*alert
     */
    trafficExclusions?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring tunnel*health*event
     */
    tunnelIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    tunnelNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    types?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    wheres?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    zones?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface NotificationPolicyMechanisms {
    emails?: pulumi.Input<pulumi.Input<inputs.NotificationPolicyMechanismsEmail>[]>;
    pagerduties?: pulumi.Input<pulumi.Input<inputs.NotificationPolicyMechanismsPagerduty>[]>;
    webhooks?: pulumi.Input<pulumi.Input<inputs.NotificationPolicyMechanismsWebhook>[]>;
}
export interface NotificationPolicyMechanismsEmail {
    /**
     * The email address
     */
    id?: pulumi.Input<string>;
}
export interface NotificationPolicyMechanismsPagerduty {
    /**
     * UUID
     */
    id?: pulumi.Input<string>;
}
export interface NotificationPolicyMechanismsWebhook {
    /**
     * UUID
     */
    id?: pulumi.Input<string>;
}
export interface ObservatoryScheduledTestSchedule {
    /**
     * The frequency of the test.
     * Available values: "DAILY", "WEEKLY".
     */
    frequency?: pulumi.Input<string>;
    /**
     * A test region.
     * Available values: "asia-east1", "asia-northeast1", "asia-northeast2", "asia-south1", "asia-southeast1", "australia-southeast1", "europe-north1", "europe-southwest1", "europe-west1", "europe-west2", "europe-west3", "europe-west4", "europe-west8", "europe-west9", "me-west1", "southamerica-east1", "us-central1", "us-east1", "us-east4", "us-south1", "us-west1".
     */
    region?: pulumi.Input<string>;
    /**
     * A URL.
     */
    url?: pulumi.Input<string>;
}
export interface ObservatoryScheduledTestTest {
    date?: pulumi.Input<string>;
    /**
     * The Lighthouse report.
     */
    desktopReport?: pulumi.Input<inputs.ObservatoryScheduledTestTestDesktopReport>;
    /**
     * UUID.
     */
    id?: pulumi.Input<string>;
    /**
     * The Lighthouse report.
     */
    mobileReport?: pulumi.Input<inputs.ObservatoryScheduledTestTestMobileReport>;
    /**
     * A test region with a label.
     */
    region?: pulumi.Input<inputs.ObservatoryScheduledTestTestRegion>;
    /**
     * The frequency of the test.
     * Available values: "DAILY", "WEEKLY".
     */
    scheduleFrequency?: pulumi.Input<string>;
    /**
     * A URL.
     */
    url?: pulumi.Input<string>;
}
export interface ObservatoryScheduledTestTestDesktopReport {
    /**
     * Cumulative Layout Shift.
     */
    cls?: pulumi.Input<number>;
    /**
     * The type of device.
     * Available values: "DESKTOP", "MOBILE".
     */
    deviceType?: pulumi.Input<string>;
    error?: pulumi.Input<inputs.ObservatoryScheduledTestTestDesktopReportError>;
    /**
     * First Contentful Paint.
     */
    fcp?: pulumi.Input<number>;
    /**
     * The URL to the full Lighthouse JSON report.
     */
    jsonReportUrl?: pulumi.Input<string>;
    /**
     * Largest Contentful Paint.
     */
    lcp?: pulumi.Input<number>;
    /**
     * The Lighthouse performance score.
     */
    performanceScore?: pulumi.Input<number>;
    /**
     * Speed Index.
     */
    si?: pulumi.Input<number>;
    /**
     * The state of the Lighthouse report.
     * Available values: "RUNNING", "COMPLETE", "FAILED".
     */
    state?: pulumi.Input<string>;
    /**
     * Total Blocking Time.
     */
    tbt?: pulumi.Input<number>;
    /**
     * Time To First Byte.
     */
    ttfb?: pulumi.Input<number>;
    /**
     * Time To Interactive.
     */
    tti?: pulumi.Input<number>;
}
export interface ObservatoryScheduledTestTestDesktopReportError {
    /**
     * The error code of the Lighthouse result.
     * Available values: "NOT*REACHABLE", "DNS*FAILURE", "NOT*HTML", "LIGHTHOUSE*TIMEOUT", "UNKNOWN".
     */
    code?: pulumi.Input<string>;
    /**
     * Detailed error message.
     */
    detail?: pulumi.Input<string>;
    /**
     * The final URL displayed to the user.
     */
    finalDisplayedUrl?: pulumi.Input<string>;
}
export interface ObservatoryScheduledTestTestMobileReport {
    /**
     * Cumulative Layout Shift.
     */
    cls?: pulumi.Input<number>;
    /**
     * The type of device.
     * Available values: "DESKTOP", "MOBILE".
     */
    deviceType?: pulumi.Input<string>;
    error?: pulumi.Input<inputs.ObservatoryScheduledTestTestMobileReportError>;
    /**
     * First Contentful Paint.
     */
    fcp?: pulumi.Input<number>;
    /**
     * The URL to the full Lighthouse JSON report.
     */
    jsonReportUrl?: pulumi.Input<string>;
    /**
     * Largest Contentful Paint.
     */
    lcp?: pulumi.Input<number>;
    /**
     * The Lighthouse performance score.
     */
    performanceScore?: pulumi.Input<number>;
    /**
     * Speed Index.
     */
    si?: pulumi.Input<number>;
    /**
     * The state of the Lighthouse report.
     * Available values: "RUNNING", "COMPLETE", "FAILED".
     */
    state?: pulumi.Input<string>;
    /**
     * Total Blocking Time.
     */
    tbt?: pulumi.Input<number>;
    /**
     * Time To First Byte.
     */
    ttfb?: pulumi.Input<number>;
    /**
     * Time To Interactive.
     */
    tti?: pulumi.Input<number>;
}
export interface ObservatoryScheduledTestTestMobileReportError {
    /**
     * The error code of the Lighthouse result.
     * Available values: "NOT*REACHABLE", "DNS*FAILURE", "NOT*HTML", "LIGHTHOUSE*TIMEOUT", "UNKNOWN".
     */
    code?: pulumi.Input<string>;
    /**
     * Detailed error message.
     */
    detail?: pulumi.Input<string>;
    /**
     * The final URL displayed to the user.
     */
    finalDisplayedUrl?: pulumi.Input<string>;
}
export interface ObservatoryScheduledTestTestRegion {
    label?: pulumi.Input<string>;
    /**
     * A test region.
     * Available values: "asia-east1", "asia-northeast1", "asia-northeast2", "asia-south1", "asia-southeast1", "australia-southeast1", "europe-north1", "europe-southwest1", "europe-west1", "europe-west2", "europe-west3", "europe-west4", "europe-west8", "europe-west9", "me-west1", "southamerica-east1", "us-central1", "us-east1", "us-east4", "us-south1", "us-west1".
     */
    value?: pulumi.Input<string>;
}
export interface OrganizationMeta {
    /**
     * Enable features for Organizations.
     */
    flags?: pulumi.Input<inputs.OrganizationMetaFlags>;
    managedBy?: pulumi.Input<string>;
}
export interface OrganizationMetaFlags {
    accountCreation?: pulumi.Input<string>;
    accountDeletion?: pulumi.Input<string>;
    accountMigration?: pulumi.Input<string>;
    accountMobility?: pulumi.Input<string>;
    subOrgCreation?: pulumi.Input<string>;
}
export interface OrganizationParent {
    id: pulumi.Input<string>;
    name?: pulumi.Input<string>;
}
export interface OrganizationProfile {
    businessAddress: pulumi.Input<string>;
    businessEmail: pulumi.Input<string>;
    businessName: pulumi.Input<string>;
    businessPhone: pulumi.Input<string>;
    externalMetadata: pulumi.Input<string>;
}
export interface PageRuleActions {
    alwaysUseHttps?: pulumi.Input<boolean>;
    automaticHttpsRewrites?: pulumi.Input<string>;
    browserCacheTtl?: pulumi.Input<number>;
    browserCheck?: pulumi.Input<string>;
    bypassCacheOnCookie?: pulumi.Input<string>;
    cacheByDeviceType?: pulumi.Input<string>;
    cacheDeceptionArmor?: pulumi.Input<string>;
    cacheKeyFields?: pulumi.Input<inputs.PageRuleActionsCacheKeyFields>;
    cacheLevel?: pulumi.Input<string>;
    cacheOnCookie?: pulumi.Input<string>;
    cacheTtlByStatus?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    disableApps?: pulumi.Input<boolean>;
    disablePerformance?: pulumi.Input<boolean>;
    disableSecurity?: pulumi.Input<boolean>;
    disableZaraz?: pulumi.Input<boolean>;
    edgeCacheTtl?: pulumi.Input<number>;
    emailObfuscation?: pulumi.Input<string>;
    explicitCacheControl?: pulumi.Input<string>;
    forwardingUrl?: pulumi.Input<inputs.PageRuleActionsForwardingUrl>;
    hostHeaderOverride?: pulumi.Input<string>;
    ipGeolocation?: pulumi.Input<string>;
    mirage?: pulumi.Input<string>;
    opportunisticEncryption?: pulumi.Input<string>;
    originErrorPagePassThru?: pulumi.Input<string>;
    polish?: pulumi.Input<string>;
    resolveOverride?: pulumi.Input<string>;
    respectStrongEtag?: pulumi.Input<string>;
    responseBuffering?: pulumi.Input<string>;
    rocketLoader?: pulumi.Input<string>;
    securityLevel?: pulumi.Input<string>;
    sortQueryStringForCache?: pulumi.Input<string>;
    ssl?: pulumi.Input<string>;
    trueClientIpHeader?: pulumi.Input<string>;
    waf?: pulumi.Input<string>;
}
export interface PageRuleActionsCacheKeyFields {
    cookie?: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsCookie>;
    header?: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsHeader>;
    host?: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsHost>;
    queryString?: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsQueryString>;
    user?: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsUser>;
}
export interface PageRuleActionsCacheKeyFieldsCookie {
    checkPresences?: pulumi.Input<pulumi.Input<string>[]>;
    includes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface PageRuleActionsCacheKeyFieldsHeader {
    checkPresences?: pulumi.Input<pulumi.Input<string>[]>;
    excludes?: pulumi.Input<pulumi.Input<string>[]>;
    includes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface PageRuleActionsCacheKeyFieldsHost {
    resolved?: pulumi.Input<boolean>;
}
export interface PageRuleActionsCacheKeyFieldsQueryString {
    excludes?: pulumi.Input<pulumi.Input<string>[]>;
    includes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface PageRuleActionsCacheKeyFieldsUser {
    deviceType?: pulumi.Input<boolean>;
    geo?: pulumi.Input<boolean>;
    lang?: pulumi.Input<boolean>;
}
export interface PageRuleActionsForwardingUrl {
    statusCode: pulumi.Input<number>;
    url: pulumi.Input<string>;
}
export interface PagesDomainValidationData {
    errorMessage?: pulumi.Input<string>;
    /**
     * Available values: "http", "txt".
     */
    method?: pulumi.Input<string>;
    /**
     * Available values: "initializing", "pending", "active", "deactivated", "error".
     */
    status?: pulumi.Input<string>;
    txtName?: pulumi.Input<string>;
    txtValue?: pulumi.Input<string>;
}
export interface PagesDomainVerificationData {
    errorMessage?: pulumi.Input<string>;
    /**
     * Available values: "pending", "active", "deactivated", "blocked", "error".
     */
    status?: pulumi.Input<string>;
}
export interface PagesProjectBuildConfig {
    /**
     * Enable build caching for the project.
     */
    buildCaching?: pulumi.Input<boolean>;
    /**
     * Command used to build project.
     */
    buildCommand?: pulumi.Input<string>;
    /**
     * Output directory of the build.
     */
    destinationDir?: pulumi.Input<string>;
    /**
     * Directory to run the command.
     */
    rootDir?: pulumi.Input<string>;
    /**
     * The classifying tag for analytics.
     */
    webAnalyticsTag?: pulumi.Input<string>;
    /**
     * The auth token for analytics.
     */
    webAnalyticsToken?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeployment {
    /**
     * A list of alias URLs pointing to this deployment.
     */
    aliases?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Configs for the project build process.
     */
    buildConfig?: pulumi.Input<inputs.PagesProjectCanonicalDeploymentBuildConfig>;
    /**
     * When the deployment was created.
     */
    createdOn?: pulumi.Input<string>;
    /**
     * Info about what caused the deployment.
     */
    deploymentTrigger?: pulumi.Input<inputs.PagesProjectCanonicalDeploymentDeploymentTrigger>;
    /**
     * Environment variables used for builds and Pages Functions.
     */
    envVars?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectCanonicalDeploymentEnvVars>;
    }>;
    /**
     * Type of deploy.
     * Available values: "preview", "production".
     */
    environment?: pulumi.Input<string>;
    /**
     * Id of the deployment.
     */
    id?: pulumi.Input<string>;
    /**
     * If the deployment has been skipped.
     */
    isSkipped?: pulumi.Input<boolean>;
    /**
     * The status of the deployment.
     */
    latestStage?: pulumi.Input<inputs.PagesProjectCanonicalDeploymentLatestStage>;
    /**
     * When the deployment was last modified.
     */
    modifiedOn?: pulumi.Input<string>;
    /**
     * Id of the project.
     */
    projectId?: pulumi.Input<string>;
    /**
     * Name of the project.
     */
    projectName?: pulumi.Input<string>;
    /**
     * Short Id (8 character) of the deployment.
     */
    shortId?: pulumi.Input<string>;
    /**
     * Configs for the project source control.
     */
    source?: pulumi.Input<inputs.PagesProjectCanonicalDeploymentSource>;
    /**
     * List of past stages.
     */
    stages?: pulumi.Input<pulumi.Input<inputs.PagesProjectCanonicalDeploymentStage>[]>;
    /**
     * The live URL to view this deployment.
     */
    url?: pulumi.Input<string>;
    /**
     * Whether the deployment uses functions.
     */
    usesFunctions?: pulumi.Input<boolean>;
}
export interface PagesProjectCanonicalDeploymentBuildConfig {
    /**
     * Enable build caching for the project.
     */
    buildCaching?: pulumi.Input<boolean>;
    /**
     * Command used to build project.
     */
    buildCommand?: pulumi.Input<string>;
    /**
     * Assets output directory of the build.
     */
    destinationDir?: pulumi.Input<string>;
    /**
     * Directory to run the command.
     */
    rootDir?: pulumi.Input<string>;
    /**
     * The classifying tag for analytics.
     */
    webAnalyticsTag?: pulumi.Input<string>;
    /**
     * The auth token for analytics.
     */
    webAnalyticsToken?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentDeploymentTrigger {
    /**
     * Additional info about the trigger.
     */
    metadata?: pulumi.Input<inputs.PagesProjectCanonicalDeploymentDeploymentTriggerMetadata>;
    /**
     * What caused the deployment.
     * Available values: "github:push", "ad*hoc", "deploy*hook".
     */
    type?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentDeploymentTriggerMetadata {
    /**
     * Where the trigger happened.
     */
    branch?: pulumi.Input<string>;
    /**
     * Whether the deployment trigger commit was dirty.
     */
    commitDirty?: pulumi.Input<boolean>;
    /**
     * Hash of the deployment trigger commit.
     */
    commitHash?: pulumi.Input<string>;
    /**
     * Message of the deployment trigger commit.
     */
    commitMessage?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentEnvVars {
    /**
     * Available values: "plain*text", "secret*text".
     */
    type?: pulumi.Input<string>;
    /**
     * Environment variable value.
     */
    value?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentLatestStage {
    /**
     * When the stage ended.
     */
    endedOn?: pulumi.Input<string>;
    /**
     * The current build stage.
     * Available values: "queued", "initialize", "cloneRepo", "build", "deploy".
     */
    name?: pulumi.Input<string>;
    /**
     * When the stage started.
     */
    startedOn?: pulumi.Input<string>;
    /**
     * State of the current stage.
     * Available values: "success", "idle", "active", "failure", "canceled".
     */
    status?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentSource {
    config?: pulumi.Input<inputs.PagesProjectCanonicalDeploymentSourceConfig>;
    /**
     * The source control management provider.
     * Available values: "github", "gitlab".
     */
    type?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentSourceConfig {
    /**
     * Whether to enable automatic deployments when pushing to the source repository.
     * When disabled, no deployments (production or preview) will be triggered automatically.
     *
     * @deprecated Use `productionDeploymentsEnabled` and `previewDeploymentSetting` for more granular control.
     */
    deploymentsEnabled?: pulumi.Input<boolean>;
    /**
     * The owner of the repository.
     */
    owner?: pulumi.Input<string>;
    /**
     * The owner ID of the repository.
     */
    ownerId?: pulumi.Input<string>;
    /**
     * A list of paths that should be excluded from triggering a preview deployment. Wildcard syntax (`*`) is supported.
     */
    pathExcludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of paths that should be watched to trigger a preview deployment. Wildcard syntax (`*`) is supported.
     */
    pathIncludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Whether to enable PR comments.
     */
    prCommentsEnabled?: pulumi.Input<boolean>;
    /**
     * A list of branches that should not trigger a preview deployment. Wildcard syntax (`*`) is supported. Must be used with `previewDeploymentSetting` set to `custom`.
     */
    previewBranchExcludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of branches that should trigger a preview deployment. Wildcard syntax (`*`) is supported. Must be used with `previewDeploymentSetting` set to `custom`.
     */
    previewBranchIncludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Controls whether commits to preview branches trigger a preview deployment.
     * Available values: "all", "none", "custom".
     */
    previewDeploymentSetting?: pulumi.Input<string>;
    /**
     * The production branch of the repository.
     */
    productionBranch?: pulumi.Input<string>;
    /**
     * Whether to trigger a production deployment on commits to the production branch.
     */
    productionDeploymentsEnabled?: pulumi.Input<boolean>;
    /**
     * The ID of the repository.
     */
    repoId?: pulumi.Input<string>;
    /**
     * The name of the repository.
     */
    repoName?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentStage {
    /**
     * When the stage ended.
     */
    endedOn?: pulumi.Input<string>;
    /**
     * The current build stage.
     * Available values: "queued", "initialize", "cloneRepo", "build", "deploy".
     */
    name?: pulumi.Input<string>;
    /**
     * When the stage started.
     */
    startedOn?: pulumi.Input<string>;
    /**
     * State of the current stage.
     * Available values: "success", "idle", "active", "failure", "canceled".
     */
    status?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigs {
    /**
     * Configs for preview deploys.
     */
    preview?: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreview>;
    /**
     * Configs for production deploys.
     */
    production?: pulumi.Input<inputs.PagesProjectDeploymentConfigsProduction>;
}
export interface PagesProjectDeploymentConfigsPreview {
    /**
     * Constellation bindings used for Pages Functions.
     */
    aiBindings?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewAiBindings>;
    }>;
    /**
     * Whether to always use the latest compatibility date for Pages Functions.
     */
    alwaysUseLatestCompatibilityDate?: pulumi.Input<boolean>;
    /**
     * Analytics Engine bindings used for Pages Functions.
     */
    analyticsEngineDatasets?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewAnalyticsEngineDatasets>;
    }>;
    /**
     * Browser bindings used for Pages Functions.
     */
    browsers?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewBrowsers>;
    }>;
    /**
     * The major version of the build image to use for Pages Functions.
     */
    buildImageMajorVersion?: pulumi.Input<number>;
    /**
     * Compatibility date used for Pages Functions.
     */
    compatibilityDate?: pulumi.Input<string>;
    /**
     * Compatibility flags used for Pages Functions.
     */
    compatibilityFlags?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * D1 databases used for Pages Functions.
     */
    d1Databases?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewD1Databases>;
    }>;
    /**
     * Durable Object namespaces used for Pages Functions.
     */
    durableObjectNamespaces?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewDurableObjectNamespaces>;
    }>;
    /**
     * Environment variables used for builds and Pages Functions.
     */
    envVars?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewEnvVars>;
    }>;
    /**
     * Whether to fail open when the deployment config cannot be applied.
     */
    failOpen?: pulumi.Input<boolean>;
    /**
     * Hyperdrive bindings used for Pages Functions.
     */
    hyperdriveBindings?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewHyperdriveBindings>;
    }>;
    /**
     * KV namespaces used for Pages Functions.
     */
    kvNamespaces?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewKvNamespaces>;
    }>;
    /**
     * Limits for Pages Functions.
     */
    limits?: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewLimits>;
    /**
     * mTLS bindings used for Pages Functions.
     */
    mtlsCertificates?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewMtlsCertificates>;
    }>;
    /**
     * Placement setting used for Pages Functions.
     */
    placement?: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewPlacement>;
    /**
     * Queue Producer bindings used for Pages Functions.
     */
    queueProducers?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewQueueProducers>;
    }>;
    /**
     * R2 buckets used for Pages Functions.
     */
    r2Buckets?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewR2Buckets>;
    }>;
    /**
     * Services used for Pages Functions.
     */
    services?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewServices>;
    }>;
    /**
     * The usage model for Pages Functions.
     * Available values: "standard", "bundled", "unbound".
     *
     * @deprecated All new projects now use the Standard usage model.
     */
    usageModel?: pulumi.Input<string>;
    /**
     * Vectorize bindings used for Pages Functions.
     */
    vectorizeBindings?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewVectorizeBindings>;
    }>;
    /**
     * Hash of the Wrangler configuration used for the deployment.
     */
    wranglerConfigHash?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewAiBindings {
    projectId: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewAnalyticsEngineDatasets {
    /**
     * Name of the dataset.
     */
    dataset: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewBrowsers {
}
export interface PagesProjectDeploymentConfigsPreviewD1Databases {
    /**
     * UUID of the D1 database.
     */
    id: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewDurableObjectNamespaces {
    /**
     * ID of the Durable Object namespace.
     */
    namespaceId: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewEnvVars {
    /**
     * Available values: "plain*text", "secret*text".
     */
    type: pulumi.Input<string>;
    /**
     * Environment variable value.
     */
    value: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewHyperdriveBindings {
    id: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewKvNamespaces {
    /**
     * ID of the KV namespace.
     */
    namespaceId: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewLimits {
    /**
     * CPU time limit in milliseconds.
     */
    cpuMs: pulumi.Input<number>;
}
export interface PagesProjectDeploymentConfigsPreviewMtlsCertificates {
    certificateId: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewPlacement {
    /**
     * Placement mode.
     */
    mode?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewQueueProducers {
    /**
     * Name of the Queue.
     */
    name: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewR2Buckets {
    /**
     * Jurisdiction of the R2 bucket.
     */
    jurisdiction?: pulumi.Input<string>;
    /**
     * Name of the R2 bucket.
     */
    name: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewServices {
    /**
     * The entrypoint to bind to.
     */
    entrypoint?: pulumi.Input<string>;
    /**
     * The Service environment.
     */
    environment?: pulumi.Input<string>;
    /**
     * The Service name.
     */
    service: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewVectorizeBindings {
    indexName: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProduction {
    /**
     * Constellation bindings used for Pages Functions.
     */
    aiBindings?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionAiBindings>;
    }>;
    /**
     * Whether to always use the latest compatibility date for Pages Functions.
     */
    alwaysUseLatestCompatibilityDate?: pulumi.Input<boolean>;
    /**
     * Analytics Engine bindings used for Pages Functions.
     */
    analyticsEngineDatasets?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionAnalyticsEngineDatasets>;
    }>;
    /**
     * Browser bindings used for Pages Functions.
     */
    browsers?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionBrowsers>;
    }>;
    /**
     * The major version of the build image to use for Pages Functions.
     */
    buildImageMajorVersion?: pulumi.Input<number>;
    /**
     * Compatibility date used for Pages Functions.
     */
    compatibilityDate?: pulumi.Input<string>;
    /**
     * Compatibility flags used for Pages Functions.
     */
    compatibilityFlags?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * D1 databases used for Pages Functions.
     */
    d1Databases?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionD1Databases>;
    }>;
    /**
     * Durable Object namespaces used for Pages Functions.
     */
    durableObjectNamespaces?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionDurableObjectNamespaces>;
    }>;
    /**
     * Environment variables used for builds and Pages Functions.
     */
    envVars?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionEnvVars>;
    }>;
    /**
     * Whether to fail open when the deployment config cannot be applied.
     */
    failOpen?: pulumi.Input<boolean>;
    /**
     * Hyperdrive bindings used for Pages Functions.
     */
    hyperdriveBindings?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionHyperdriveBindings>;
    }>;
    /**
     * KV namespaces used for Pages Functions.
     */
    kvNamespaces?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionKvNamespaces>;
    }>;
    /**
     * Limits for Pages Functions.
     */
    limits?: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionLimits>;
    /**
     * mTLS bindings used for Pages Functions.
     */
    mtlsCertificates?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionMtlsCertificates>;
    }>;
    /**
     * Placement setting used for Pages Functions.
     */
    placement?: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionPlacement>;
    /**
     * Queue Producer bindings used for Pages Functions.
     */
    queueProducers?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionQueueProducers>;
    }>;
    /**
     * R2 buckets used for Pages Functions.
     */
    r2Buckets?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionR2Buckets>;
    }>;
    /**
     * Services used for Pages Functions.
     */
    services?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionServices>;
    }>;
    /**
     * The usage model for Pages Functions.
     * Available values: "standard", "bundled", "unbound".
     *
     * @deprecated All new projects now use the Standard usage model.
     */
    usageModel?: pulumi.Input<string>;
    /**
     * Vectorize bindings used for Pages Functions.
     */
    vectorizeBindings?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionVectorizeBindings>;
    }>;
    /**
     * Hash of the Wrangler configuration used for the deployment.
     */
    wranglerConfigHash?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionAiBindings {
    projectId: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionAnalyticsEngineDatasets {
    /**
     * Name of the dataset.
     */
    dataset: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionBrowsers {
}
export interface PagesProjectDeploymentConfigsProductionD1Databases {
    /**
     * UUID of the D1 database.
     */
    id: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionDurableObjectNamespaces {
    /**
     * ID of the Durable Object namespace.
     */
    namespaceId: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionEnvVars {
    /**
     * Available values: "plain*text", "secret*text".
     */
    type: pulumi.Input<string>;
    /**
     * Environment variable value.
     */
    value: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionHyperdriveBindings {
    id: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionKvNamespaces {
    /**
     * ID of the KV namespace.
     */
    namespaceId: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionLimits {
    /**
     * CPU time limit in milliseconds.
     */
    cpuMs: pulumi.Input<number>;
}
export interface PagesProjectDeploymentConfigsProductionMtlsCertificates {
    certificateId: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionPlacement {
    /**
     * Placement mode.
     */
    mode?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionQueueProducers {
    /**
     * Name of the Queue.
     */
    name: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionR2Buckets {
    /**
     * Jurisdiction of the R2 bucket.
     */
    jurisdiction?: pulumi.Input<string>;
    /**
     * Name of the R2 bucket.
     */
    name: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionServices {
    /**
     * The entrypoint to bind to.
     */
    entrypoint?: pulumi.Input<string>;
    /**
     * The Service environment.
     */
    environment?: pulumi.Input<string>;
    /**
     * The Service name.
     */
    service: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionVectorizeBindings {
    indexName: pulumi.Input<string>;
}
export interface PagesProjectLatestDeployment {
    /**
     * A list of alias URLs pointing to this deployment.
     */
    aliases?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Configs for the project build process.
     */
    buildConfig?: pulumi.Input<inputs.PagesProjectLatestDeploymentBuildConfig>;
    /**
     * When the deployment was created.
     */
    createdOn?: pulumi.Input<string>;
    /**
     * Info about what caused the deployment.
     */
    deploymentTrigger?: pulumi.Input<inputs.PagesProjectLatestDeploymentDeploymentTrigger>;
    /**
     * Environment variables used for builds and Pages Functions.
     */
    envVars?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectLatestDeploymentEnvVars>;
    }>;
    /**
     * Type of deploy.
     * Available values: "preview", "production".
     */
    environment?: pulumi.Input<string>;
    /**
     * Id of the deployment.
     */
    id?: pulumi.Input<string>;
    /**
     * If the deployment has been skipped.
     */
    isSkipped?: pulumi.Input<boolean>;
    /**
     * The status of the deployment.
     */
    latestStage?: pulumi.Input<inputs.PagesProjectLatestDeploymentLatestStage>;
    /**
     * When the deployment was last modified.
     */
    modifiedOn?: pulumi.Input<string>;
    /**
     * Id of the project.
     */
    projectId?: pulumi.Input<string>;
    /**
     * Name of the project.
     */
    projectName?: pulumi.Input<string>;
    /**
     * Short Id (8 character) of the deployment.
     */
    shortId?: pulumi.Input<string>;
    /**
     * Configs for the project source control.
     */
    source?: pulumi.Input<inputs.PagesProjectLatestDeploymentSource>;
    /**
     * List of past stages.
     */
    stages?: pulumi.Input<pulumi.Input<inputs.PagesProjectLatestDeploymentStage>[]>;
    /**
     * The live URL to view this deployment.
     */
    url?: pulumi.Input<string>;
    /**
     * Whether the deployment uses functions.
     */
    usesFunctions?: pulumi.Input<boolean>;
}
export interface PagesProjectLatestDeploymentBuildConfig {
    /**
     * Enable build caching for the project.
     */
    buildCaching?: pulumi.Input<boolean>;
    /**
     * Command used to build project.
     */
    buildCommand?: pulumi.Input<string>;
    /**
     * Assets output directory of the build.
     */
    destinationDir?: pulumi.Input<string>;
    /**
     * Directory to run the command.
     */
    rootDir?: pulumi.Input<string>;
    /**
     * The classifying tag for analytics.
     */
    webAnalyticsTag?: pulumi.Input<string>;
    /**
     * The auth token for analytics.
     */
    webAnalyticsToken?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentDeploymentTrigger {
    /**
     * Additional info about the trigger.
     */
    metadata?: pulumi.Input<inputs.PagesProjectLatestDeploymentDeploymentTriggerMetadata>;
    /**
     * What caused the deployment.
     * Available values: "github:push", "ad*hoc", "deploy*hook".
     */
    type?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentDeploymentTriggerMetadata {
    /**
     * Where the trigger happened.
     */
    branch?: pulumi.Input<string>;
    /**
     * Whether the deployment trigger commit was dirty.
     */
    commitDirty?: pulumi.Input<boolean>;
    /**
     * Hash of the deployment trigger commit.
     */
    commitHash?: pulumi.Input<string>;
    /**
     * Message of the deployment trigger commit.
     */
    commitMessage?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentEnvVars {
    /**
     * Available values: "plain*text", "secret*text".
     */
    type?: pulumi.Input<string>;
    /**
     * Environment variable value.
     */
    value?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentLatestStage {
    /**
     * When the stage ended.
     */
    endedOn?: pulumi.Input<string>;
    /**
     * The current build stage.
     * Available values: "queued", "initialize", "cloneRepo", "build", "deploy".
     */
    name?: pulumi.Input<string>;
    /**
     * When the stage started.
     */
    startedOn?: pulumi.Input<string>;
    /**
     * State of the current stage.
     * Available values: "success", "idle", "active", "failure", "canceled".
     */
    status?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentSource {
    config?: pulumi.Input<inputs.PagesProjectLatestDeploymentSourceConfig>;
    /**
     * The source control management provider.
     * Available values: "github", "gitlab".
     */
    type?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentSourceConfig {
    /**
     * Whether to enable automatic deployments when pushing to the source repository.
     * When disabled, no deployments (production or preview) will be triggered automatically.
     *
     * @deprecated Use `productionDeploymentsEnabled` and `previewDeploymentSetting` for more granular control.
     */
    deploymentsEnabled?: pulumi.Input<boolean>;
    /**
     * The owner of the repository.
     */
    owner?: pulumi.Input<string>;
    /**
     * The owner ID of the repository.
     */
    ownerId?: pulumi.Input<string>;
    /**
     * A list of paths that should be excluded from triggering a preview deployment. Wildcard syntax (`*`) is supported.
     */
    pathExcludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of paths that should be watched to trigger a preview deployment. Wildcard syntax (`*`) is supported.
     */
    pathIncludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Whether to enable PR comments.
     */
    prCommentsEnabled?: pulumi.Input<boolean>;
    /**
     * A list of branches that should not trigger a preview deployment. Wildcard syntax (`*`) is supported. Must be used with `previewDeploymentSetting` set to `custom`.
     */
    previewBranchExcludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of branches that should trigger a preview deployment. Wildcard syntax (`*`) is supported. Must be used with `previewDeploymentSetting` set to `custom`.
     */
    previewBranchIncludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Controls whether commits to preview branches trigger a preview deployment.
     * Available values: "all", "none", "custom".
     */
    previewDeploymentSetting?: pulumi.Input<string>;
    /**
     * The production branch of the repository.
     */
    productionBranch?: pulumi.Input<string>;
    /**
     * Whether to trigger a production deployment on commits to the production branch.
     */
    productionDeploymentsEnabled?: pulumi.Input<boolean>;
    /**
     * The ID of the repository.
     */
    repoId?: pulumi.Input<string>;
    /**
     * The name of the repository.
     */
    repoName?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentStage {
    /**
     * When the stage ended.
     */
    endedOn?: pulumi.Input<string>;
    /**
     * The current build stage.
     * Available values: "queued", "initialize", "cloneRepo", "build", "deploy".
     */
    name?: pulumi.Input<string>;
    /**
     * When the stage started.
     */
    startedOn?: pulumi.Input<string>;
    /**
     * State of the current stage.
     * Available values: "success", "idle", "active", "failure", "canceled".
     */
    status?: pulumi.Input<string>;
}
export interface PagesProjectSource {
    config: pulumi.Input<inputs.PagesProjectSourceConfig>;
    /**
     * The source control management provider.
     * Available values: "github", "gitlab".
     */
    type: pulumi.Input<string>;
}
export interface PagesProjectSourceConfig {
    /**
     * Whether to enable automatic deployments when pushing to the source repository.
     * When disabled, no deployments (production or preview) will be triggered automatically.
     *
     * @deprecated Use `productionDeploymentsEnabled` and `previewDeploymentSetting` for more granular control.
     */
    deploymentsEnabled?: pulumi.Input<boolean>;
    /**
     * The owner of the repository.
     */
    owner?: pulumi.Input<string>;
    /**
     * The owner ID of the repository.
     */
    ownerId?: pulumi.Input<string>;
    /**
     * A list of paths that should be excluded from triggering a preview deployment. Wildcard syntax (`*`) is supported.
     */
    pathExcludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of paths that should be watched to trigger a preview deployment. Wildcard syntax (`*`) is supported.
     */
    pathIncludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Whether to enable PR comments.
     */
    prCommentsEnabled?: pulumi.Input<boolean>;
    /**
     * A list of branches that should not trigger a preview deployment. Wildcard syntax (`*`) is supported. Must be used with `previewDeploymentSetting` set to `custom`.
     */
    previewBranchExcludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of branches that should trigger a preview deployment. Wildcard syntax (`*`) is supported. Must be used with `previewDeploymentSetting` set to `custom`.
     */
    previewBranchIncludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Controls whether commits to preview branches trigger a preview deployment.
     * Available values: "all", "none", "custom".
     */
    previewDeploymentSetting?: pulumi.Input<string>;
    /**
     * The production branch of the repository.
     */
    productionBranch?: pulumi.Input<string>;
    /**
     * Whether to trigger a production deployment on commits to the production branch.
     */
    productionDeploymentsEnabled?: pulumi.Input<boolean>;
    /**
     * The ID of the repository.
     */
    repoId?: pulumi.Input<string>;
    /**
     * The name of the repository.
     */
    repoName?: pulumi.Input<string>;
}
export interface QueueConsumer {
    /**
     * A Resource identifier.
     */
    consumerId?: pulumi.Input<string>;
    createdOn?: pulumi.Input<string>;
    /**
     * Name of the dead letter queue, or empty string if not configured
     */
    deadLetterQueue?: pulumi.Input<string>;
    queueName?: pulumi.Input<string>;
    /**
     * Name of a Worker
     */
    scriptName?: pulumi.Input<string>;
    settings?: pulumi.Input<inputs.QueueConsumerSettings>;
    /**
     * Available values: "worker", "httpPull".
     */
    type?: pulumi.Input<string>;
}
export interface QueueConsumerSettings {
    /**
     * The maximum number of messages to include in a batch.
     */
    batchSize?: pulumi.Input<number>;
    /**
     * Maximum number of concurrent consumers that may consume from this Queue. Set to `null` to automatically opt in to the platform's maximum (recommended).
     */
    maxConcurrency?: pulumi.Input<number>;
    /**
     * The maximum number of retries
     */
    maxRetries?: pulumi.Input<number>;
    /**
     * The number of milliseconds to wait for a batch to fill up before attempting to deliver it
     */
    maxWaitTimeMs?: pulumi.Input<number>;
    /**
     * The number of seconds to delay before making the message available for another attempt.
     */
    retryDelay?: pulumi.Input<number>;
    /**
     * The number of milliseconds that a message is exclusively leased. After the timeout, the message becomes available for another attempt.
     */
    visibilityTimeoutMs?: pulumi.Input<number>;
}
export interface QueueProducer {
    bucketName?: pulumi.Input<string>;
    script?: pulumi.Input<string>;
    /**
     * Available values: "worker", "r2Bucket".
     */
    type?: pulumi.Input<string>;
}
export interface QueueSettings {
    /**
     * Number of seconds to delay delivery of all messages to consumers.
     */
    deliveryDelay?: pulumi.Input<number>;
    /**
     * Indicates if message delivery to consumers is currently paused.
     */
    deliveryPaused?: pulumi.Input<boolean>;
    /**
     * Number of seconds after which an unconsumed message will be delayed.
     */
    messageRetentionPeriod?: pulumi.Input<number>;
}
export interface R2BucketCorsRule {
    /**
     * Object specifying allowed origins, methods and headers for this CORS rule.
     */
    allowed: pulumi.Input<inputs.R2BucketCorsRuleAllowed>;
    /**
     * Specifies the headers that can be exposed back, and accessed by, the JavaScript making the cross-origin request. If you need to access headers beyond the safelisted response headers, such as Content-Encoding or cf-cache-status, you must specify it here.
     */
    exposeHeaders?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Identifier for this rule.
     */
    id?: pulumi.Input<string>;
    /**
     * Specifies the amount of time (in seconds) browsers are allowed to cache CORS preflight responses. Browsers may limit this to 2 hours or less, even if the maximum value (86400) is specified.
     */
    maxAgeSeconds?: pulumi.Input<number>;
}
export interface R2BucketCorsRuleAllowed {
    /**
     * Specifies the value for the Access-Control-Allow-Headers header R2 sets when requesting objects in this bucket from a browser. Cross-origin requests that include custom headers (e.g. x-user-id) should specify these headers as AllowedHeaders.
     */
    headers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Specifies the value for the Access-Control-Allow-Methods header R2 sets when requesting objects in a bucket from a browser.
     */
    methods: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Specifies the value for the Access-Control-Allow-Origin header R2 sets when requesting objects in a bucket from a browser.
     */
    origins: pulumi.Input<pulumi.Input<string>[]>;
}
export interface R2BucketEventNotificationRule {
    /**
     * Array of R2 object actions that will trigger notifications.
     */
    actions: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A description that can be used to identify the event notification rule after creation.
     */
    description?: pulumi.Input<string>;
    /**
     * Notifications will be sent only for objects with this prefix.
     */
    prefix?: pulumi.Input<string>;
    /**
     * Notifications will be sent only for objects with this suffix.
     */
    suffix?: pulumi.Input<string>;
}
export interface R2BucketLifecycleRule {
    /**
     * Transition to abort ongoing multipart uploads.
     */
    abortMultipartUploadsTransition?: pulumi.Input<inputs.R2BucketLifecycleRuleAbortMultipartUploadsTransition>;
    /**
     * Conditions that apply to all transitions of this rule.
     */
    conditions: pulumi.Input<inputs.R2BucketLifecycleRuleConditions>;
    /**
     * Transition to delete objects.
     */
    deleteObjectsTransition?: pulumi.Input<inputs.R2BucketLifecycleRuleDeleteObjectsTransition>;
    /**
     * Whether or not this rule is in effect.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * Unique identifier for this rule.
     */
    id: pulumi.Input<string>;
    /**
     * Transitions to change the storage class of objects.
     */
    storageClassTransitions?: pulumi.Input<pulumi.Input<inputs.R2BucketLifecycleRuleStorageClassTransition>[]>;
}
export interface R2BucketLifecycleRuleAbortMultipartUploadsTransition {
    /**
     * Condition for lifecycle transitions to apply after an object reaches an age in seconds.
     */
    condition?: pulumi.Input<inputs.R2BucketLifecycleRuleAbortMultipartUploadsTransitionCondition>;
}
export interface R2BucketLifecycleRuleAbortMultipartUploadsTransitionCondition {
    maxAge: pulumi.Input<number>;
    /**
     * Available values: "Age".
     */
    type: pulumi.Input<string>;
}
export interface R2BucketLifecycleRuleConditions {
    /**
     * Transitions will only apply to objects/uploads in the bucket that start with the given prefix, an empty prefix can be provided to scope rule to all objects/uploads.
     */
    prefix: pulumi.Input<string>;
}
export interface R2BucketLifecycleRuleDeleteObjectsTransition {
    /**
     * Condition for lifecycle transitions to apply after an object reaches an age in seconds.
     */
    condition?: pulumi.Input<inputs.R2BucketLifecycleRuleDeleteObjectsTransitionCondition>;
}
export interface R2BucketLifecycleRuleDeleteObjectsTransitionCondition {
    date?: pulumi.Input<string>;
    maxAge?: pulumi.Input<number>;
    /**
     * Available values: "Age", "Date".
     */
    type: pulumi.Input<string>;
}
export interface R2BucketLifecycleRuleStorageClassTransition {
    /**
     * Condition for lifecycle transitions to apply after an object reaches an age in seconds.
     */
    condition: pulumi.Input<inputs.R2BucketLifecycleRuleStorageClassTransitionCondition>;
    /**
     * Available values: "InfrequentAccess".
     */
    storageClass: pulumi.Input<string>;
}
export interface R2BucketLifecycleRuleStorageClassTransitionCondition {
    date?: pulumi.Input<string>;
    maxAge?: pulumi.Input<number>;
    /**
     * Available values: "Age", "Date".
     */
    type: pulumi.Input<string>;
}
export interface R2BucketLockRule {
    /**
     * Condition to apply a lock rule to an object for how long in seconds.
     */
    condition: pulumi.Input<inputs.R2BucketLockRuleCondition>;
    /**
     * Whether or not this rule is in effect.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * Unique identifier for this rule.
     */
    id: pulumi.Input<string>;
    /**
     * Rule will only apply to objects/uploads in the bucket that start with the given prefix, an empty prefix can be provided to scope rule to all objects/uploads.
     */
    prefix?: pulumi.Input<string>;
}
export interface R2BucketLockRuleCondition {
    date?: pulumi.Input<string>;
    maxAgeSeconds?: pulumi.Input<number>;
    /**
     * Available values: "Age", "Date", "Indefinite".
     */
    type: pulumi.Input<string>;
}
export interface R2BucketSippyDestination {
    /**
     * ID of a Cloudflare API token.
     * This is the value labelled "Access Key ID" when creating an API.
     * token from the [R2 dashboard](https://dash.cloudflare.com/?to=/:account/r2/api-tokens).
     */
    accessKeyId?: pulumi.Input<string>;
    /**
     * Available values: "r2".
     */
    cloudProvider?: pulumi.Input<string>;
    /**
     * Value of a Cloudflare API token.
     * This is the value labelled "Secret Access Key" when creating an API.
     * token from the [R2 dashboard](https://dash.cloudflare.com/?to=/:account/r2/api-tokens).
     *
     * Sippy will use this token when writing objects to R2, so it is
     * best to scope this token to the bucket you're enabling Sippy for.
     */
    secretAccessKey?: pulumi.Input<string>;
}
export interface R2BucketSippySource {
    /**
     * Access Key ID of an IAM credential (ideally scoped to a single S3 bucket).
     */
    accessKeyId?: pulumi.Input<string>;
    /**
     * Name of the AWS S3 bucket.
     */
    bucket?: pulumi.Input<string>;
    /**
     * URL to the S3-compatible API of the bucket.
     */
    bucketUrl?: pulumi.Input<string>;
    /**
     * Client email of an IAM credential (ideally scoped to a single GCS bucket).
     */
    clientEmail?: pulumi.Input<string>;
    /**
     * Available values: "aws", "gcs", "s3".
     */
    cloudProvider?: pulumi.Input<string>;
    /**
     * Private Key of an IAM credential (ideally scoped to a single GCS bucket).
     */
    privateKey?: pulumi.Input<string>;
    /**
     * Name of the AWS availability zone.
     */
    region?: pulumi.Input<string>;
    /**
     * Secret Access Key of an IAM credential (ideally scoped to a single S3 bucket).
     */
    secretAccessKey?: pulumi.Input<string>;
}
export interface R2CustomDomainStatus {
    /**
     * Ownership status of the domain.
     * Available values: "pending", "active", "deactivated", "blocked", "error", "unknown".
     */
    ownership?: pulumi.Input<string>;
    /**
     * SSL certificate status.
     * Available values: "initializing", "pending", "active", "deactivated", "error", "unknown".
     */
    ssl?: pulumi.Input<string>;
}
export interface RateLimitAction {
    /**
     * The action to perform.
     * Available values: "simulate", "ban", "challenge", "js*challenge", "managed*challenge".
     */
    mode?: pulumi.Input<string>;
    /**
     * A custom content type and reponse to return when the threshold is exceeded. The custom response configured in this object will override the custom error for the zone. This object is optional.
     * Notes: If you omit this object, Cloudflare will use the default HTML error page. If "mode" is "challenge", "managed*challenge", or "js*challenge", Cloudflare will use the zone challenge pages and you should not provide the "response" object.
     */
    response?: pulumi.Input<inputs.RateLimitActionResponse>;
    /**
     * The time in seconds during which Cloudflare will perform the mitigation action. Must be an integer value greater than or equal to the period.
     * Notes: If "mode" is "challenge", "managed*challenge", or "js*challenge", Cloudflare will use the zone's Challenge Passage time and you should not provide this value.
     */
    timeout?: pulumi.Input<number>;
}
export interface RateLimitActionResponse {
    /**
     * The response body to return. The value must conform to the configured content type.
     */
    body?: pulumi.Input<string>;
    /**
     * The content type of the body. Must be one of the following: `text/plain`, `text/xml`, or `application/json`.
     */
    contentType?: pulumi.Input<string>;
}
export interface RateLimitBypass {
    /**
     * Available values: "url".
     */
    name?: pulumi.Input<string>;
    /**
     * The URL to bypass.
     */
    value?: pulumi.Input<string>;
}
export interface RateLimitMatch {
    headers?: pulumi.Input<pulumi.Input<inputs.RateLimitMatchHeader>[]>;
    request?: pulumi.Input<inputs.RateLimitMatchRequest>;
    response?: pulumi.Input<inputs.RateLimitMatchResponse>;
}
export interface RateLimitMatchHeader {
    /**
     * The name of the response header to match.
     */
    name?: pulumi.Input<string>;
    /**
     * The operator used when matching: `eq` means "equal" and `ne` means "not equal".
     * Available values: "eq", "ne".
     */
    op?: pulumi.Input<string>;
    /**
     * The value of the response header, which must match exactly.
     */
    value?: pulumi.Input<string>;
}
export interface RateLimitMatchRequest {
    /**
     * The HTTP methods to match. You can specify a subset (for example, `['POST','PUT']`) or all methods (`['_ALL_']`). This field is optional when creating a rate limit.
     */
    methods?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The HTTP schemes to match. You can specify one scheme (`['HTTPS']`), both schemes (`['HTTP','HTTPS']`), or all schemes (`['_ALL_']`). This field is optional.
     */
    schemes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The URL pattern to match, composed of a host and a path such as `example.org/path*`. Normalization is applied before the pattern is matched. `*` wildcards are expanded to match applicable traffic. Query strings are not matched. Set the value to `*` to match all traffic to your zone.
     */
    url?: pulumi.Input<string>;
}
export interface RateLimitMatchResponse {
    /**
     * When true, only the uncached traffic served from your origin servers will count towards rate limiting. In this case, any cached traffic served by Cloudflare will not count towards rate limiting. This field is optional.
     * Notes: This field is deprecated. Instead, use response headers and set "origin*traffic" to "false" to avoid legacy behaviour interacting with the "response*headers" property.
     */
    originTraffic?: pulumi.Input<boolean>;
}
export interface RecordData {
    /**
     * Algorithm.
     */
    algorithm?: pulumi.Input<number>;
    /**
     * Altitude of location in meters.
     */
    altitude?: pulumi.Input<number>;
    /**
     * Certificate.
     */
    certificate?: pulumi.Input<string>;
    /**
     * Digest.
     */
    digest?: pulumi.Input<string>;
    /**
     * Digest Type.
     */
    digestType?: pulumi.Input<number>;
    /**
     * Fingerprint.
     */
    fingerprint?: pulumi.Input<string>;
    /**
     * Flags for the CAA record.
     */
    flags?: any;
    /**
     * Key Tag.
     */
    keyTag?: pulumi.Input<number>;
    /**
     * Degrees of latitude.
     */
    latDegrees?: pulumi.Input<number>;
    /**
     * Latitude direction.
     * Available values: "N", "S".
     */
    latDirection?: pulumi.Input<string>;
    /**
     * Minutes of latitude.
     */
    latMinutes?: pulumi.Input<number>;
    /**
     * Seconds of latitude.
     */
    latSeconds?: pulumi.Input<number>;
    /**
     * Degrees of longitude.
     */
    longDegrees?: pulumi.Input<number>;
    /**
     * Longitude direction.
     * Available values: "E", "W".
     */
    longDirection?: pulumi.Input<string>;
    /**
     * Minutes of longitude.
     */
    longMinutes?: pulumi.Input<number>;
    /**
     * Seconds of longitude.
     */
    longSeconds?: pulumi.Input<number>;
    /**
     * Matching Type.
     */
    matchingType?: pulumi.Input<number>;
    /**
     * Order.
     */
    order?: pulumi.Input<number>;
    /**
     * The port of the service.
     */
    port?: pulumi.Input<number>;
    /**
     * Horizontal precision of location.
     */
    precisionHorz?: pulumi.Input<number>;
    /**
     * Vertical precision of location.
     */
    precisionVert?: pulumi.Input<number>;
    /**
     * Preference.
     */
    preference?: pulumi.Input<number>;
    /**
     * Priority.
     */
    priority?: pulumi.Input<number>;
    /**
     * Protocol.
     */
    protocol?: pulumi.Input<number>;
    /**
     * Public Key.
     */
    publicKey?: pulumi.Input<string>;
    /**
     * Regex.
     */
    regex?: pulumi.Input<string>;
    /**
     * Replacement.
     */
    replacement?: pulumi.Input<string>;
    /**
     * Selector.
     */
    selector?: pulumi.Input<number>;
    /**
     * Service.
     */
    service?: pulumi.Input<string>;
    /**
     * Size of location in meters.
     */
    size?: pulumi.Input<number>;
    /**
     * Name of the property controlled by this record (e.g.: issue, issuewild, iodef).
     */
    tag?: pulumi.Input<string>;
    /**
     * Target.
     */
    target?: pulumi.Input<string>;
    /**
     * Type.
     */
    type?: pulumi.Input<number>;
    /**
     * Usage.
     */
    usage?: pulumi.Input<number>;
    /**
     * Value of the record. This field's semantics depend on the chosen tag.
     */
    value?: pulumi.Input<string>;
    /**
     * The record weight.
     */
    weight?: pulumi.Input<number>;
}
export interface RecordSettings {
    /**
     * If enabled, causes the CNAME record to be resolved externally and the resulting address records (e.g., A and AAAA) to be returned instead of the CNAME record itself. This setting is unavailable for proxied records, since they are always flattened.
     */
    flattenCname?: pulumi.Input<boolean>;
    /**
     * When enabled, only A records will be generated, and AAAA records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
     */
    ipv4Only?: pulumi.Input<boolean>;
    /**
     * When enabled, only AAAA records will be generated, and A records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
     */
    ipv6Only?: pulumi.Input<boolean>;
}
export interface RiskBehaviorBehaviors {
    enabled: pulumi.Input<boolean>;
    /**
     * Available values: "low", "medium", "high".
     */
    riskLevel: pulumi.Input<string>;
}
export interface RulesetRule {
    /**
     * The action to perform when the rule matches.
     * Available values: "block", "challenge", "compress*response", "ddos*dynamic", "execute", "force*connection*close", "js*challenge", "log", "log*custom*field", "managed*challenge", "redirect", "rewrite", "route", "score", "serve*error", "set*cache*control", "set*cache*settings", "set*cache*tags", "set*config", "skip".
     */
    action: pulumi.Input<string>;
    /**
     * The parameters configuring the rule's action.
     */
    actionParameters?: pulumi.Input<inputs.RulesetRuleActionParameters>;
    /**
     * An informative description of the rule.
     */
    description?: pulumi.Input<string>;
    /**
     * Whether the rule should be executed.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Configuration for exposed credential checking.
     */
    exposedCredentialCheck?: pulumi.Input<inputs.RulesetRuleExposedCredentialCheck>;
    /**
     * The expression defining which traffic will match the rule.
     */
    expression: pulumi.Input<string>;
    /**
     * The unique ID of the rule.
     */
    id?: pulumi.Input<string>;
    /**
     * An object configuring the rule's logging behavior.
     */
    logging?: pulumi.Input<inputs.RulesetRuleLogging>;
    /**
     * An object configuring the rule's rate limit behavior.
     */
    ratelimit?: pulumi.Input<inputs.RulesetRuleRatelimit>;
    /**
     * The reference of the rule (the rule's ID by default).
     */
    ref?: pulumi.Input<string>;
}
export interface RulesetRuleActionParameters {
    /**
     * A list of additional ports that caching should be enabled on.
     */
    additionalCacheablePorts?: pulumi.Input<pulumi.Input<number>[]>;
    /**
     * Custom order for compression algorithms.
     */
    algorithms?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersAlgorithm>[]>;
    /**
     * The name of a custom asset to serve as the response.
     */
    assetName?: pulumi.Input<string>;
    /**
     * Whether to enable Automatic HTTPS Rewrites.
     */
    automaticHttpsRewrites?: pulumi.Input<boolean>;
    /**
     * Which file extensions to minify automatically.
     */
    autominify?: pulumi.Input<inputs.RulesetRuleActionParametersAutominify>;
    /**
     * Whether to enable Browser Integrity Check (BIC).
     */
    bic?: pulumi.Input<boolean>;
    /**
     * How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
     */
    browserTtl?: pulumi.Input<inputs.RulesetRuleActionParametersBrowserTtl>;
    /**
     * Whether the request's response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
     */
    cache?: pulumi.Input<boolean>;
    /**
     * Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
     */
    cacheKey?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKey>;
    /**
     * Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
     */
    cacheReserve?: pulumi.Input<inputs.RulesetRuleActionParametersCacheReserve>;
    /**
     * The response content.
     */
    content?: pulumi.Input<string>;
    /**
     * The content type header to set with the error response.
     * Available values: "application/json", "text/html", "text/plain", "text/xml".
     */
    contentType?: pulumi.Input<string>;
    /**
     * The cookie fields to log.
     */
    cookieFields?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersCookieField>[]>;
    /**
     * Whether to disable Cloudflare Apps.
     */
    disableApps?: pulumi.Input<boolean>;
    /**
     * Whether to disable Real User Monitoring (RUM).
     */
    disableRum?: pulumi.Input<boolean>;
    /**
     * Whether to disable Zaraz.
     */
    disableZaraz?: pulumi.Input<boolean>;
    /**
     * How long the Cloudflare edge network should cache the response.
     */
    edgeTtl?: pulumi.Input<inputs.RulesetRuleActionParametersEdgeTtl>;
    /**
     * Whether to enable Email Obfuscation.
     */
    emailObfuscation?: pulumi.Input<boolean>;
    /**
     * An expression to generate cache tags for set*cache*tags action.
     */
    expression?: pulumi.Input<string>;
    /**
     * Whether to enable Cloudflare Fonts.
     */
    fonts?: pulumi.Input<boolean>;
    /**
     * A redirect based on a bulk list lookup.
     */
    fromList?: pulumi.Input<inputs.RulesetRuleActionParametersFromList>;
    /**
     * A redirect based on the request properties.
     */
    fromValue?: pulumi.Input<inputs.RulesetRuleActionParametersFromValue>;
    /**
     * A map of headers to rewrite.
     */
    headers?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.RulesetRuleActionParametersHeaders>;
    }>;
    /**
     * A value to rewrite the HTTP host header to.
     */
    hostHeader?: pulumi.Input<string>;
    /**
     * Whether to enable Hotlink Protection.
     */
    hotlinkProtection?: pulumi.Input<boolean>;
    /**
     * The ID of the ruleset to execute.
     */
    id?: pulumi.Input<string>;
    /**
     * Set the immutable cache control directive.
     */
    immutable?: pulumi.Input<inputs.RulesetRuleActionParametersImmutable>;
    /**
     * A delta to change the score by, which can be either positive or negative.
     */
    increment?: pulumi.Input<number>;
    /**
     * The configuration to use for matched data logging.
     */
    matchedData?: pulumi.Input<inputs.RulesetRuleActionParametersMatchedData>;
    /**
     * Set the max-age cache control directive.
     */
    maxAge?: pulumi.Input<inputs.RulesetRuleActionParametersMaxAge>;
    /**
     * Whether to enable Mirage.
     */
    mirage?: pulumi.Input<boolean>;
    /**
     * Set the must-revalidate cache control directive.
     */
    mustRevalidate?: pulumi.Input<inputs.RulesetRuleActionParametersMustRevalidate>;
    /**
     * Set the must-understand cache control directive.
     */
    mustUnderstand?: pulumi.Input<inputs.RulesetRuleActionParametersMustUnderstand>;
    /**
     * Set the no-cache cache control directive.
     */
    noCache?: pulumi.Input<inputs.RulesetRuleActionParametersNoCache>;
    /**
     * Set the no-store cache control directive.
     */
    noStore?: pulumi.Input<inputs.RulesetRuleActionParametersNoStore>;
    /**
     * Set the no-transform cache control directive.
     */
    noTransform?: pulumi.Input<inputs.RulesetRuleActionParametersNoTransform>;
    /**
     * The operation to perform for set*cache*tags action.
     * Available values: "set", "add", "remove".
     */
    operation?: pulumi.Input<string>;
    /**
     * Whether to enable Opportunistic Encryption.
     */
    opportunisticEncryption?: pulumi.Input<boolean>;
    /**
     * An origin to route to.
     */
    origin?: pulumi.Input<inputs.RulesetRuleActionParametersOrigin>;
    /**
     * Whether Cloudflare will aim to strictly adhere to RFC 7234.
     */
    originCacheControl?: pulumi.Input<boolean>;
    /**
     * Whether to generate Cloudflare error pages for issues from the origin server.
     */
    originErrorPagePassthru?: pulumi.Input<boolean>;
    /**
     * A set of overrides to apply to the target ruleset.
     */
    overrides?: pulumi.Input<inputs.RulesetRuleActionParametersOverrides>;
    /**
     * A list of phases to skip the execution of. This option is incompatible with the rulesets option.
     * Available values: "ddos*l4", "ddos*l7", "http*config*settings", "http*custom*errors", "http*log*custom*fields", "http*ratelimit", "http*request*cache*settings", "http*request*dynamic*redirect", "http*request*firewall*custom", "http*request*firewall*managed", "http*request*late*transform", "http*request*origin", "http*request*redirect", "http*request*sanitize", "http*request*sbfm", "http*request*transform", "http*response*cache*settings", "http*response*compression", "http*response*firewall*managed", "http*response*headers*transform", "magic*transit", "magic*transit*ids*managed", "magic*transit*managed", "magic*transit*ratelimit".
     */
    phases?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The Polish level to configure.
     * Available values: "off", "lossless", "lossy", "webp".
     */
    polish?: pulumi.Input<string>;
    /**
     * Set the private cache control directive.
     */
    private?: pulumi.Input<inputs.RulesetRuleActionParametersPrivate>;
    /**
     * A list of legacy security products to skip the execution of.
     * Available values: "bic", "hot", "rateLimit", "securityLevel", "uaBlock", "waf", "zoneLockdown".
     */
    products?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Set the proxy-revalidate cache control directive.
     */
    proxyRevalidate?: pulumi.Input<inputs.RulesetRuleActionParametersProxyRevalidate>;
    /**
     * Set the public cache control directive.
     */
    public?: pulumi.Input<inputs.RulesetRuleActionParametersPublic>;
    /**
     * The raw response fields to log.
     */
    rawResponseFields?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersRawResponseField>[]>;
    /**
     * A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
     */
    readTimeout?: pulumi.Input<number>;
    /**
     * The request body buffering mode to configure.
     * Available values: "none", "standard", "full".
     */
    requestBodyBuffering?: pulumi.Input<string>;
    /**
     * The raw request fields to log.
     */
    requestFields?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersRequestField>[]>;
    /**
     * Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
     */
    respectStrongEtags?: pulumi.Input<boolean>;
    /**
     * The response to show when the block is applied.
     */
    response?: pulumi.Input<inputs.RulesetRuleActionParametersResponse>;
    /**
     * The response body buffering mode to configure.
     * Available values: "none", "standard".
     */
    responseBodyBuffering?: pulumi.Input<string>;
    /**
     * The transformed response fields to log.
     */
    responseFields?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersResponseField>[]>;
    /**
     * Whether to enable Rocket Loader.
     */
    rocketLoader?: pulumi.Input<boolean>;
    /**
     * A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
     */
    rules?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * A ruleset to skip the execution of. This option is incompatible with the rulesets option.
     * Available values: "current".
     */
    ruleset?: pulumi.Input<string>;
    /**
     * A list of ruleset IDs to skip the execution of. This option is incompatible with the ruleset and phases options.
     */
    rulesets?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Set the s-maxage cache control directive.
     */
    sMaxage?: pulumi.Input<inputs.RulesetRuleActionParametersSMaxage>;
    /**
     * The Security Level to configure.
     * Available values: "off", "essentially*off", "low", "medium", "high", "under*attack".
     */
    securityLevel?: pulumi.Input<string>;
    /**
     * When to serve stale content from cache.
     */
    serveStale?: pulumi.Input<inputs.RulesetRuleActionParametersServeStale>;
    /**
     * Whether to enable Server-Side Excludes.
     */
    serverSideExcludes?: pulumi.Input<boolean>;
    /**
     * A Server Name Indication (SNI) override.
     */
    sni?: pulumi.Input<inputs.RulesetRuleActionParametersSni>;
    /**
     * The SSL level to configure.
     * Available values: "off", "flexible", "full", "strict", "originPull".
     */
    ssl?: pulumi.Input<string>;
    /**
     * Set the stale-if-error cache control directive.
     */
    staleIfError?: pulumi.Input<inputs.RulesetRuleActionParametersStaleIfError>;
    /**
     * Set the stale-while-revalidate cache control directive.
     */
    staleWhileRevalidate?: pulumi.Input<inputs.RulesetRuleActionParametersStaleWhileRevalidate>;
    /**
     * The status code to use for the error.
     */
    statusCode?: pulumi.Input<number>;
    /**
     * Whether to strip the ETag header from the response.
     */
    stripEtags?: pulumi.Input<boolean>;
    /**
     * Whether to strip the Last-Modified header from the response.
     */
    stripLastModified?: pulumi.Input<boolean>;
    /**
     * Whether to strip the Set-Cookie header from the response.
     */
    stripSetCookie?: pulumi.Input<boolean>;
    /**
     * Whether to enable Signed Exchanges (SXG).
     */
    sxg?: pulumi.Input<boolean>;
    /**
     * The transformed request fields to log.
     */
    transformedRequestFields?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersTransformedRequestField>[]>;
    /**
     * A URI rewrite.
     */
    uri?: pulumi.Input<inputs.RulesetRuleActionParametersUri>;
    /**
     * The cache tag values for set*cache*tags action.
     */
    values?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface RulesetRuleActionParametersAlgorithm {
    /**
     * Name of the compression algorithm to enable.
     * Available values: "none", "auto", "default", "gzip", "brotli", "zstd".
     */
    name?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersAutominify {
    /**
     * Whether to minify CSS files.
     */
    css?: pulumi.Input<boolean>;
    /**
     * Whether to minify HTML files.
     */
    html?: pulumi.Input<boolean>;
    /**
     * Whether to minify JavaScript files.
     */
    js?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersBrowserTtl {
    /**
     * The browser TTL (in seconds) if you choose the "overrideOrigin" mode.
     */
    default?: pulumi.Input<number>;
    /**
     * The browser TTL mode.
     * Available values: "respect*origin", "bypass*by*default", "override*origin", "bypass".
     */
    mode: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersCacheKey {
    /**
     * Whether to separate cached content based on the visitor's device type.
     */
    cacheByDeviceType?: pulumi.Input<boolean>;
    /**
     * Whether to protect from web cache deception attacks, while allowing static assets to be cached.
     */
    cacheDeceptionArmor?: pulumi.Input<boolean>;
    /**
     * Which components of the request are included or excluded from the cache key.
     */
    customKey?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKey>;
    /**
     * Whether to treat requests with the same query parameters the same, regardless of the order those query parameters are in.
     */
    ignoreQueryStringsOrder?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKey {
    /**
     * Which cookies to include in the cache key.
     */
    cookie?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKeyCookie>;
    /**
     * Which headers to include in the cache key.
     */
    header?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKeyHeader>;
    /**
     * How to use the host in the cache key.
     */
    host?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKeyHost>;
    /**
     * Which query string parameters to include in or exclude from the cache key.
     */
    queryString?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKeyQueryString>;
    /**
     * How to use characteristics of the request user agent in the cache key.
     */
    user?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKeyUser>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKeyCookie {
    /**
     * A list of cookies to check for the presence of. The presence of these cookies is included in the cache key.
     */
    checkPresences?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of cookies to include in the cache key.
     */
    includes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKeyHeader {
    /**
     * A list of headers to check for the presence of. The presence of these headers is included in the cache key.
     */
    checkPresences?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A mapping of header names to a list of values. If a header is present in the request and contains any of the values provided, its value is included in the cache key.
     */
    contains?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * Whether to exclude the origin header in the cache key.
     */
    excludeOrigin?: pulumi.Input<boolean>;
    /**
     * A list of headers to include in the cache key.
     */
    includes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKeyHost {
    /**
     * Whether to use the resolved host in the cache key.
     */
    resolved?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKeyQueryString {
    /**
     * Which query string parameters to exclude from the cache key.
     */
    exclude?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKeyQueryStringExclude>;
    /**
     * Which query string parameters to include in the cache key.
     */
    include?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKeyQueryStringInclude>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKeyQueryStringExclude {
    /**
     * Whether to exclude all query string parameters from the cache key.
     */
    all?: pulumi.Input<boolean>;
    /**
     * A list of query string parameters to exclude from the cache key.
     */
    lists?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKeyQueryStringInclude {
    /**
     * Whether to include all query string parameters in the cache key.
     */
    all?: pulumi.Input<boolean>;
    /**
     * A list of query string parameters to include in the cache key.
     */
    lists?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKeyUser {
    /**
     * Whether to use the user agent's device type in the cache key.
     */
    deviceType?: pulumi.Input<boolean>;
    /**
     * Whether to use the user agents's country in the cache key.
     */
    geo?: pulumi.Input<boolean>;
    /**
     * Whether to use the user agent's language in the cache key.
     */
    lang?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersCacheReserve {
    /**
     * Whether Cache Reserve is enabled. If this is true and a request meets eligibility criteria, Cloudflare will write the resource to Cache Reserve.
     */
    eligible: pulumi.Input<boolean>;
    /**
     * The minimum file size eligible for storage in Cache Reserve.
     */
    minimumFileSize?: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersCookieField {
    /**
     * The name of the cookie.
     */
    name: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersEdgeTtl {
    /**
     * The edge TTL (in seconds) if you choose the "overrideOrigin" mode.
     */
    default?: pulumi.Input<number>;
    /**
     * The edge TTL mode.
     * Available values: "respect*origin", "bypass*by*default", "override*origin".
     */
    mode: pulumi.Input<string>;
    /**
     * A list of TTLs to apply to specific status codes or status code ranges.
     */
    statusCodeTtls?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersEdgeTtlStatusCodeTtl>[]>;
}
export interface RulesetRuleActionParametersEdgeTtlStatusCodeTtl {
    /**
     * A single status code to apply the TTL to.
     */
    statusCode?: pulumi.Input<number>;
    /**
     * A range of status codes to apply the TTL to.
     */
    statusCodeRange?: pulumi.Input<inputs.RulesetRuleActionParametersEdgeTtlStatusCodeTtlStatusCodeRange>;
    /**
     * The time to cache the response for (in seconds). A value of 0 is equivalent to setting the cache control header with the value "no-cache". A value of -1 is equivalent to setting the cache control header with the value of "no-store".
     */
    value: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersEdgeTtlStatusCodeTtlStatusCodeRange {
    /**
     * The lower bound of the range.
     */
    from?: pulumi.Input<number>;
    /**
     * The upper bound of the range.
     */
    to?: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersFromList {
    /**
     * An expression that evaluates to the list lookup key.
     */
    key: pulumi.Input<string>;
    /**
     * The name of the list to match against.
     */
    name: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersFromValue {
    /**
     * Whether to keep the query string of the original request.
     */
    preserveQueryString?: pulumi.Input<boolean>;
    /**
     * The status code to use for the redirect.
     */
    statusCode?: pulumi.Input<number>;
    /**
     * A URL to redirect the request to.
     */
    targetUrl: pulumi.Input<inputs.RulesetRuleActionParametersFromValueTargetUrl>;
}
export interface RulesetRuleActionParametersFromValueTargetUrl {
    /**
     * An expression that evaluates to a URL to redirect the request to.
     */
    expression?: pulumi.Input<string>;
    /**
     * A URL to redirect the request to.
     */
    value?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersHeaders {
    /**
     * An expression that evaluates to a value for the header.
     */
    expression?: pulumi.Input<string>;
    /**
     * The operation to perform on the header.
     * Available values: "add", "set", "remove".
     */
    operation: pulumi.Input<string>;
    /**
     * A static value for the header.
     */
    value?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersImmutable {
    /**
     * Whether to apply the directive only to Cloudflare's cache.
     */
    cloudflareOnly?: pulumi.Input<boolean>;
    /**
     * The operation to perform.
     * Available values: "set", "remove".
     */
    operation: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersMatchedData {
    /**
     * The public key to encrypt matched data logs with.
     */
    publicKey: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersMaxAge {
    /**
     * Whether to apply the directive only to Cloudflare's cache.
     */
    cloudflareOnly?: pulumi.Input<boolean>;
    /**
     * The operation to perform.
     * Available values: "set", "remove".
     */
    operation: pulumi.Input<string>;
    /**
     * The value for the directive in seconds.
     */
    value?: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersMustRevalidate {
    /**
     * Whether to apply the directive only to Cloudflare's cache.
     */
    cloudflareOnly?: pulumi.Input<boolean>;
    /**
     * The operation to perform.
     * Available values: "set", "remove".
     */
    operation: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersMustUnderstand {
    /**
     * Whether to apply the directive only to Cloudflare's cache.
     */
    cloudflareOnly?: pulumi.Input<boolean>;
    /**
     * The operation to perform.
     * Available values: "set", "remove".
     */
    operation: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersNoCache {
    /**
     * Whether to apply the directive only to Cloudflare's cache.
     */
    cloudflareOnly?: pulumi.Input<boolean>;
    /**
     * The operation to perform.
     * Available values: "set", "remove".
     */
    operation: pulumi.Input<string>;
    /**
     * The qualifiers for the directive.
     */
    qualifiers?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface RulesetRuleActionParametersNoStore {
    /**
     * Whether to apply the directive only to Cloudflare's cache.
     */
    cloudflareOnly?: pulumi.Input<boolean>;
    /**
     * The operation to perform.
     * Available values: "set", "remove".
     */
    operation: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersNoTransform {
    /**
     * Whether to apply the directive only to Cloudflare's cache.
     */
    cloudflareOnly?: pulumi.Input<boolean>;
    /**
     * The operation to perform.
     * Available values: "set", "remove".
     */
    operation: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersOrigin {
    /**
     * A resolved host to route to.
     */
    host?: pulumi.Input<string>;
    /**
     * A destination port to route to.
     */
    port?: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersOverrides {
    /**
     * An action to override all rules with. This option has lower precedence than rule and category overrides.
     */
    action?: pulumi.Input<string>;
    /**
     * A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
     */
    categories?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersOverridesCategory>[]>;
    /**
     * Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * A list of rule-level overrides. This option has the highest precedence.
     */
    rules?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersOverridesRule>[]>;
    /**
     * A sensitivity level to set for all rules. This option has lower precedence than rule and category overrides and is only applicable for DDoS phases.
     * Available values: "default", "medium", "low", "eoff".
     */
    sensitivityLevel?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersOverridesCategory {
    /**
     * The action to override rules in the category with.
     */
    action?: pulumi.Input<string>;
    /**
     * The name of the category to override.
     */
    category: pulumi.Input<string>;
    /**
     * Whether to enable execution of rules in the category.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The sensitivity level to use for rules in the category. This option is only applicable for DDoS phases.
     * Available values: "default", "medium", "low", "eoff".
     */
    sensitivityLevel?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersOverridesRule {
    /**
     * The action to override the rule with.
     */
    action?: pulumi.Input<string>;
    /**
     * Whether to enable execution of the rule.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The ID of the rule to override.
     */
    id: pulumi.Input<string>;
    /**
     * The score threshold to use for the rule.
     */
    scoreThreshold?: pulumi.Input<number>;
    /**
     * The sensitivity level to use for the rule. This option is only applicable for DDoS phases.
     * Available values: "default", "medium", "low", "eoff".
     */
    sensitivityLevel?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersPrivate {
    /**
     * Whether to apply the directive only to Cloudflare's cache.
     */
    cloudflareOnly?: pulumi.Input<boolean>;
    /**
     * The operation to perform.
     * Available values: "set", "remove".
     */
    operation: pulumi.Input<string>;
    /**
     * The qualifiers for the directive.
     */
    qualifiers?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface RulesetRuleActionParametersProxyRevalidate {
    /**
     * Whether to apply the directive only to Cloudflare's cache.
     */
    cloudflareOnly?: pulumi.Input<boolean>;
    /**
     * The operation to perform.
     * Available values: "set", "remove".
     */
    operation: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersPublic {
    /**
     * Whether to apply the directive only to Cloudflare's cache.
     */
    cloudflareOnly?: pulumi.Input<boolean>;
    /**
     * The operation to perform.
     * Available values: "set", "remove".
     */
    operation: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersRawResponseField {
    /**
     * The name of the response header.
     */
    name: pulumi.Input<string>;
    /**
     * Whether to log duplicate values of the same header.
     */
    preserveDuplicates?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersRequestField {
    /**
     * The name of the header.
     */
    name: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersResponse {
    /**
     * The content to return.
     */
    content: pulumi.Input<string>;
    /**
     * The type of the content to return.
     */
    contentType: pulumi.Input<string>;
    /**
     * The status code to return.
     */
    statusCode: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersResponseField {
    /**
     * The name of the response header.
     */
    name: pulumi.Input<string>;
    /**
     * Whether to log duplicate values of the same header.
     */
    preserveDuplicates?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersSMaxage {
    /**
     * Whether to apply the directive only to Cloudflare's cache.
     */
    cloudflareOnly?: pulumi.Input<boolean>;
    /**
     * The operation to perform.
     * Available values: "set", "remove".
     */
    operation: pulumi.Input<string>;
    /**
     * The value for the directive in seconds.
     */
    value?: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersServeStale {
    /**
     * Whether Cloudflare should disable serving stale content while getting the latest content from the origin.
     */
    disableStaleWhileUpdating?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersSni {
    /**
     * A value to override the SNI to.
     */
    value: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersStaleIfError {
    /**
     * Whether to apply the directive only to Cloudflare's cache.
     */
    cloudflareOnly?: pulumi.Input<boolean>;
    /**
     * The operation to perform.
     * Available values: "set", "remove".
     */
    operation: pulumi.Input<string>;
    /**
     * The value for the directive in seconds.
     */
    value?: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersStaleWhileRevalidate {
    /**
     * Whether to apply the directive only to Cloudflare's cache.
     */
    cloudflareOnly?: pulumi.Input<boolean>;
    /**
     * The operation to perform.
     * Available values: "set", "remove".
     */
    operation: pulumi.Input<string>;
    /**
     * The value for the directive in seconds.
     */
    value?: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersTransformedRequestField {
    /**
     * The name of the header.
     */
    name: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersUri {
    /**
     * A URI path rewrite.
     */
    path?: pulumi.Input<inputs.RulesetRuleActionParametersUriPath>;
    /**
     * A URI query rewrite.
     */
    query?: pulumi.Input<inputs.RulesetRuleActionParametersUriQuery>;
}
export interface RulesetRuleActionParametersUriPath {
    /**
     * An expression that evaluates to a value to rewrite the URI path to.
     */
    expression?: pulumi.Input<string>;
    /**
     * A value to rewrite the URI path to.
     */
    value?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersUriQuery {
    /**
     * An expression that evaluates to a value to rewrite the URI query to.
     */
    expression?: pulumi.Input<string>;
    /**
     * A value to rewrite the URI query to.
     */
    value?: pulumi.Input<string>;
}
export interface RulesetRuleExposedCredentialCheck {
    /**
     * An expression that selects the password used in the credentials check.
     */
    passwordExpression: pulumi.Input<string>;
    /**
     * An expression that selects the user ID used in the credentials check.
     */
    usernameExpression: pulumi.Input<string>;
}
export interface RulesetRuleLogging {
    /**
     * Whether to generate a log when the rule matches.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface RulesetRuleRatelimit {
    /**
     * Characteristics of the request on which the rate limit counter will be incremented.
     */
    characteristics: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
     */
    countingExpression?: pulumi.Input<string>;
    /**
     * Period of time in seconds after which the action will be disabled following its first execution.
     */
    mitigationTimeout?: pulumi.Input<number>;
    /**
     * Period in seconds over which the counter is being incremented.
     */
    period: pulumi.Input<number>;
    /**
     * The threshold of requests per period after which the action will be executed for the first time.
     */
    requestsPerPeriod?: pulumi.Input<number>;
    /**
     * Whether counting is only performed when an origin is reached.
     */
    requestsToOrigin?: pulumi.Input<boolean>;
    /**
     * The score threshold per period for which the action will be executed the first time.
     */
    scorePerPeriod?: pulumi.Input<number>;
    /**
     * A response header name provided by the origin, which contains the score to increment rate limit counter with.
     */
    scoreResponseHeaderName?: pulumi.Input<string>;
}
export interface SnippetFile {
    content: pulumi.Input<string>;
    name: pulumi.Input<string>;
}
export interface SnippetMetadata {
    /**
     * Specify the name of the file that contains the main module of the snippet.
     */
    mainModule: pulumi.Input<string>;
}
export interface SnippetRulesRule {
    /**
     * Provide an informative description of the rule.
     */
    description?: pulumi.Input<string>;
    /**
     * Indicate whether to execute the rule.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Define the expression that determines which traffic matches the rule.
     */
    expression: pulumi.Input<string>;
    /**
     * Specify the unique ID of the rule.
     */
    id?: pulumi.Input<string>;
    /**
     * Specify the timestamp of when the rule was last modified.
     */
    lastUpdated?: pulumi.Input<string>;
    /**
     * Identify the snippet.
     */
    snippetName: pulumi.Input<string>;
}
export interface SnippetsMetadata {
    /**
     * Name of the file that contains the main module of the snippet.
     */
    mainModule: pulumi.Input<string>;
}
export interface SpectrumApplicationDns {
    /**
     * The name of the DNS record associated with the application.
     */
    name?: pulumi.Input<string>;
    /**
     * The type of DNS record associated with the application.
     * Available values: "CNAME", "ADDRESS".
     */
    type?: pulumi.Input<string>;
}
export interface SpectrumApplicationEdgeIps {
    /**
     * The IP versions supported for inbound connections on Spectrum anycast IPs.
     * Available values: "all", "ipv4", "ipv6".
     */
    connectivity?: pulumi.Input<string>;
    /**
     * The array of customer owned IPs we broadcast via anycast for this hostname and application.
     */
    ips?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The type of edge IP configuration specified. Dynamically allocated edge IPs use Spectrum anycast IPs in accordance with the connectivity you specify. Only valid with CNAME DNS names.
     * Available values: "dynamic", "static".
     */
    type?: pulumi.Input<string>;
}
export interface SpectrumApplicationOriginDns {
    /**
     * The name of the DNS record associated with the origin.
     */
    name?: pulumi.Input<string>;
    /**
     * The TTL of our resolution of your DNS record in seconds.
     */
    ttl?: pulumi.Input<number>;
    /**
     * The type of DNS record associated with the origin. "" is used to specify a combination of A/AAAA records.
     * Available values: "", "A", "AAAA", "SRV".
     */
    type?: pulumi.Input<string>;
}
export interface SsoConnectorVerification {
    /**
     * DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership.
     */
    code?: pulumi.Input<string>;
    /**
     * The status of the verification code from the verification process.
     * Available values: "awaiting", "pending", "failed", "verified".
     */
    status?: pulumi.Input<string>;
}
export interface StaticRouteScope {
    /**
     * List of colo names for the ECMP scope.
     */
    coloNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of colo regions for the ECMP scope.
     */
    coloRegions?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface StreamInput {
    /**
     * The video height in pixels. A value of `-1` means the height is unknown. The value becomes available after the upload and before the video is ready.
     */
    height?: pulumi.Input<number>;
    /**
     * The video width in pixels. A value of `-1` means the width is unknown. The value becomes available after the upload and before the video is ready.
     */
    width?: pulumi.Input<number>;
}
export interface StreamLiveInputRecording {
    /**
     * Lists the origins allowed to display videos created with this input. Enter allowed origin domains in an array and use `*` for wildcard subdomains. An empty array allows videos to be viewed on any origin.
     */
    allowedOrigins?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Disables reporting the number of live viewers when this property is set to `true`.
     */
    hideLiveViewerCount?: pulumi.Input<boolean>;
    /**
     * Specifies the recording behavior for the live input. Set this value to `off` to prevent a recording. Set the value to `automatic` to begin a recording and transition to on-demand after Stream Live stops receiving input.
     * Available values: "off", "automatic".
     */
    mode?: pulumi.Input<string>;
    /**
     * Indicates if a video using the live input has the `requireSignedURLs` property set. Also enforces access controls on any video recording of the livestream with the live input.
     */
    requireSignedUrls?: pulumi.Input<boolean>;
    /**
     * Determines the amount of time a live input configured in `automatic` mode should wait before a recording transitions from live to on-demand. `0` is recommended for most use cases and indicates the platform default should be used.
     */
    timeoutSeconds?: pulumi.Input<number>;
}
export interface StreamLiveInputRtmps {
    /**
     * The secret key to use when streaming via RTMPS to a live input.
     */
    streamKey?: pulumi.Input<string>;
    /**
     * The RTMPS URL you provide to the broadcaster, which they stream live video to.
     */
    url?: pulumi.Input<string>;
}
export interface StreamLiveInputRtmpsPlayback {
    /**
     * The secret key to use for playback via RTMPS.
     */
    streamKey?: pulumi.Input<string>;
    /**
     * The URL used to play live video over RTMPS.
     */
    url?: pulumi.Input<string>;
}
export interface StreamLiveInputSrt {
    /**
     * The secret key to use when streaming via SRT to a live input.
     */
    passphrase?: pulumi.Input<string>;
    /**
     * The identifier of the live input to use when streaming via SRT.
     */
    streamId?: pulumi.Input<string>;
    /**
     * The SRT URL you provide to the broadcaster, which they stream live video to.
     */
    url?: pulumi.Input<string>;
}
export interface StreamLiveInputSrtPlayback {
    /**
     * The secret key to use for playback via SRT.
     */
    passphrase?: pulumi.Input<string>;
    /**
     * The identifier of the live input to use for playback via SRT.
     */
    streamId?: pulumi.Input<string>;
    /**
     * The URL used to play live video over SRT.
     */
    url?: pulumi.Input<string>;
}
export interface StreamLiveInputWebRtc {
    /**
     * The WebRTC URL you provide to the broadcaster, which they stream live video to.
     */
    url?: pulumi.Input<string>;
}
export interface StreamLiveInputWebRtcPlayback {
    /**
     * The URL used to play live video over WebRTC.
     */
    url?: pulumi.Input<string>;
}
export interface StreamPlayback {
    /**
     * DASH Media Presentation Description for the video.
     */
    dash?: pulumi.Input<string>;
    /**
     * The HLS manifest for the video.
     */
    hls?: pulumi.Input<string>;
}
export interface StreamStatus {
    /**
     * Specifies why the video failed to encode. This field is empty if the video is not in an `error` state. Preferred for programmatic use.
     */
    errorReasonCode?: pulumi.Input<string>;
    /**
     * Specifies why the video failed to encode using a human readable error message in English. This field is empty if the video is not in an `error` state.
     */
    errorReasonText?: pulumi.Input<string>;
    /**
     * Indicates the size of the entire upload in bytes. The value must be a non-negative integer.
     */
    pctComplete?: pulumi.Input<string>;
    /**
     * Specifies the processing status for all quality levels for a video.
     * Available values: "pendingupload", "downloading", "queued", "inprogress", "ready", "error", "live-inprogress".
     */
    state?: pulumi.Input<string>;
}
export interface StreamWatermark {
    /**
     * The date and a time a watermark profile was created.
     */
    created?: pulumi.Input<string>;
    /**
     * The source URL for a downloaded image. If the watermark profile was created via direct upload, this field is null.
     */
    downloadedFrom?: pulumi.Input<string>;
    /**
     * The height of the image in pixels.
     */
    height?: pulumi.Input<number>;
    /**
     * A short description of the watermark profile.
     */
    name?: pulumi.Input<string>;
    /**
     * The translucency of the image. A value of `0.0` makes the image completely transparent, and `1.0` makes the image completely opaque. Note that if the image is already semi-transparent, setting this to `1.0` will not make the image completely opaque.
     */
    opacity?: pulumi.Input<number>;
    /**
     * The whitespace between the adjacent edges (determined by position) of the video and the image. `0.0` indicates no padding, and `1.0` indicates a fully padded video width or length, as determined by the algorithm.
     */
    padding?: pulumi.Input<number>;
    /**
     * The location of the image. Valid positions are: `upperRight`, `upperLeft`, `lowerLeft`, `lowerRight`, and `center`. Note that `center` ignores the `padding` parameter.
     */
    position?: pulumi.Input<string>;
    /**
     * The size of the image relative to the overall size of the video. This parameter will adapt to horizontal and vertical videos automatically. `0.0` indicates no scaling (use the size of the image as-is), and `1.0`fills the entire video.
     */
    scale?: pulumi.Input<number>;
    /**
     * The size of the image in bytes.
     */
    size?: pulumi.Input<number>;
    /**
     * The unique identifier for a watermark profile.
     */
    uid?: pulumi.Input<string>;
    /**
     * The width of the image in pixels.
     */
    width?: pulumi.Input<number>;
}
export interface TeamsAccountSettings {
    /**
     * Specify activity log settings.
     */
    activityLog?: pulumi.Input<inputs.TeamsAccountSettingsActivityLog>;
    /**
     * Specify anti-virus settings.
     */
    antivirus?: pulumi.Input<inputs.TeamsAccountSettingsAntivirus>;
    /**
     * Specify block page layout settings.
     */
    blockPage?: pulumi.Input<inputs.TeamsAccountSettingsBlockPage>;
    /**
     * Specify the DLP inspection mode.
     */
    bodyScanning?: pulumi.Input<inputs.TeamsAccountSettingsBodyScanning>;
    /**
     * Specify Clientless Browser Isolation settings.
     */
    browserIsolation?: pulumi.Input<inputs.TeamsAccountSettingsBrowserIsolation>;
    /**
     * Specify certificate settings for Gateway TLS interception. If unset, the Cloudflare Root CA handles interception.
     */
    certificate?: pulumi.Input<inputs.TeamsAccountSettingsCertificate>;
    /**
     * Specify custom certificate settings for BYO-PKI. This field is deprecated; use `certificate` instead.
     *
     * @deprecated This attribute is deprecated.
     */
    customCertificate?: pulumi.Input<inputs.TeamsAccountSettingsCustomCertificate>;
    /**
     * Configures user email settings for firewall policies. When you enable this, the system standardizes email addresses in the identity portion of the rule to match extended email variants in firewall policies. When you disable this setting, the system matches email addresses exactly as you provide them. Enable this setting if your email uses `.` or `+` modifiers.
     */
    extendedEmailMatching?: pulumi.Input<inputs.TeamsAccountSettingsExtendedEmailMatching>;
    /**
     * Specify FIPS settings.
     */
    fips?: pulumi.Input<inputs.TeamsAccountSettingsFips>;
    /**
     * Enable host selection in egress policies.
     */
    hostSelector?: pulumi.Input<inputs.TeamsAccountSettingsHostSelector>;
    /**
     * Define the proxy inspection mode.
     */
    inspection?: pulumi.Input<inputs.TeamsAccountSettingsInspection>;
    /**
     * Specify whether to detect protocols from the initial bytes of client traffic.
     */
    protocolDetection?: pulumi.Input<inputs.TeamsAccountSettingsProtocolDetection>;
    /**
     * Specify whether to enable the sandbox.
     */
    sandbox?: pulumi.Input<inputs.TeamsAccountSettingsSandbox>;
    /**
     * Specify whether to inspect encrypted HTTP traffic.
     */
    tlsDecrypt?: pulumi.Input<inputs.TeamsAccountSettingsTlsDecrypt>;
}
export interface TeamsAccountSettingsActivityLog {
    /**
     * Specify whether to log activity.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface TeamsAccountSettingsAntivirus {
    /**
     * Specify whether to enable anti-virus scanning on downloads.
     */
    enabledDownloadPhase?: pulumi.Input<boolean>;
    /**
     * Specify whether to enable anti-virus scanning on uploads.
     */
    enabledUploadPhase?: pulumi.Input<boolean>;
    /**
     * Specify whether to block requests for unscannable files.
     */
    failClosed?: pulumi.Input<boolean>;
    /**
     * Configure the message the user's device shows during an antivirus scan.
     */
    notificationSettings?: pulumi.Input<inputs.TeamsAccountSettingsAntivirusNotificationSettings>;
}
export interface TeamsAccountSettingsAntivirusNotificationSettings {
    /**
     * Specify whether to enable notifications.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Specify whether to include context information as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * Specify the message to show in the notification.
     */
    msg?: pulumi.Input<string>;
    /**
     * Specify a URL that directs users to more information. If unset, the notification opens a block page.
     */
    supportUrl?: pulumi.Input<string>;
}
export interface TeamsAccountSettingsBlockPage {
    /**
     * Specify the block page background color in `#rrggbb` format when the mode is customized*block*page.
     */
    backgroundColor?: pulumi.Input<string>;
    /**
     * Specify whether to enable the custom block page.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Specify the block page footer text when the mode is customized*block*page.
     */
    footerText?: pulumi.Input<string>;
    /**
     * Specify the block page header text when the mode is customized*block*page.
     */
    headerText?: pulumi.Input<string>;
    /**
     * Specify whether to append context to target*uri as query parameters. This applies only when the mode is redirect*uri.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * Specify the full URL to the logo file when the mode is customized*block*page.
     */
    logoPath?: pulumi.Input<string>;
    /**
     * Specify the admin email for users to contact when the mode is customized*block*page.
     */
    mailtoAddress?: pulumi.Input<string>;
    /**
     * Specify the subject line for emails created from the block page when the mode is customized*block*page.
     */
    mailtoSubject?: pulumi.Input<string>;
    /**
     * Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.
     * Available values: "", "customized*block*page", "redirectUri".
     */
    mode?: pulumi.Input<string>;
    /**
     * Specify the block page title when the mode is customized*block*page.
     */
    name?: pulumi.Input<string>;
    /**
     * Indicate that this setting was shared via the Orgs API and read only for the current account.
     */
    readOnly?: pulumi.Input<boolean>;
    /**
     * Indicate the account tag of the account that shared this setting.
     */
    sourceAccount?: pulumi.Input<string>;
    /**
     * Specify whether to suppress detailed information at the bottom of the block page when the mode is customized*block*page.
     */
    suppressFooter?: pulumi.Input<boolean>;
    /**
     * Specify the URI to redirect users to when the mode is redirect_uri.
     */
    targetUri?: pulumi.Input<string>;
    /**
     * Indicate the version number of the setting.
     */
    version?: pulumi.Input<number>;
}
export interface TeamsAccountSettingsBodyScanning {
    /**
     * Specify the inspection mode as either `deep` or `shallow`.
     * Available values: "deep", "shallow".
     */
    inspectionMode?: pulumi.Input<string>;
}
export interface TeamsAccountSettingsBrowserIsolation {
    /**
     * Specify whether to enable non-identity onramp support for Browser Isolation.
     */
    nonIdentityEnabled?: pulumi.Input<boolean>;
    /**
     * Specify whether to enable Clientless Browser Isolation.
     */
    urlBrowserIsolationEnabled?: pulumi.Input<boolean>;
}
export interface TeamsAccountSettingsCertificate {
    /**
     * Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.
     */
    id: pulumi.Input<string>;
}
export interface TeamsAccountSettingsCustomCertificate {
    /**
     * Indicate the internal certificate status.
     */
    bindingStatus?: pulumi.Input<string>;
    /**
     * Specify whether to enable a custom certificate authority for signing Gateway traffic.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * Specify the UUID of the certificate (ID from MTLS certificate store).
     */
    id?: pulumi.Input<string>;
    updatedAt?: pulumi.Input<string>;
}
export interface TeamsAccountSettingsExtendedEmailMatching {
    /**
     * Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Indicate that this setting was shared via the Orgs API and read only for the current account.
     */
    readOnly?: pulumi.Input<boolean>;
    /**
     * Indicate the account tag of the account that shared this setting.
     */
    sourceAccount?: pulumi.Input<string>;
    /**
     * Indicate the version number of the setting.
     */
    version?: pulumi.Input<number>;
}
export interface TeamsAccountSettingsFips {
    /**
     * Enforce cipher suites and TLS versions compliant with FIPS 140-2.
     */
    tls?: pulumi.Input<boolean>;
}
export interface TeamsAccountSettingsHostSelector {
    /**
     * Specify whether to enable filtering via hosts for egress policies.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface TeamsAccountSettingsInspection {
    /**
     * Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.
     * Available values: "static", "dynamic".
     */
    mode?: pulumi.Input<string>;
}
export interface TeamsAccountSettingsProtocolDetection {
    /**
     * Specify whether to detect protocols from the initial bytes of client traffic.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface TeamsAccountSettingsSandbox {
    /**
     * Specify whether to enable the sandbox.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Specify the action to take when the system cannot scan the file.
     * Available values: "allow", "block".
     */
    fallbackAction?: pulumi.Input<string>;
}
export interface TeamsAccountSettingsTlsDecrypt {
    /**
     * Specify whether to inspect encrypted HTTP traffic.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface TeamsListItem {
    /**
     * Provide the list item description (optional).
     */
    description?: pulumi.Input<string>;
    /**
     * Specify the item value.
     */
    value?: pulumi.Input<string>;
}
export interface TeamsLocationEndpoints {
    doh: pulumi.Input<inputs.TeamsLocationEndpointsDoh>;
    dot: pulumi.Input<inputs.TeamsLocationEndpointsDot>;
    ipv4: pulumi.Input<inputs.TeamsLocationEndpointsIpv4>;
    ipv6: pulumi.Input<inputs.TeamsLocationEndpointsIpv6>;
}
export interface TeamsLocationEndpointsDoh {
    /**
     * Indicate whether the DOH endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Specify the list of allowed source IP network ranges for this endpoint. When the list is empty, the endpoint allows all source IPs. The list takes effect only if the endpoint is enabled for this location.
     */
    networks?: pulumi.Input<pulumi.Input<inputs.TeamsLocationEndpointsDohNetwork>[]>;
    /**
     * Specify whether the DOH endpoint requires user identity authentication.
     */
    requireToken?: pulumi.Input<boolean>;
}
export interface TeamsLocationEndpointsDohNetwork {
    /**
     * Specify the IP address or IP CIDR.
     */
    network: pulumi.Input<string>;
}
export interface TeamsLocationEndpointsDot {
    /**
     * Indicate whether the DOT endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Specify the list of allowed source IP network ranges for this endpoint. When the list is empty, the endpoint allows all source IPs. The list takes effect only if the endpoint is enabled for this location.
     */
    networks?: pulumi.Input<pulumi.Input<inputs.TeamsLocationEndpointsDotNetwork>[]>;
}
export interface TeamsLocationEndpointsDotNetwork {
    /**
     * Specify the IP address or IP CIDR.
     */
    network: pulumi.Input<string>;
}
export interface TeamsLocationEndpointsIpv4 {
    /**
     * Indicate whether the IPv4 endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface TeamsLocationEndpointsIpv6 {
    /**
     * Indicate whether the IPV6 endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Specify the list of allowed source IPv6 network ranges for this endpoint. When the list is empty, the endpoint allows all source IPs. The list takes effect only if the endpoint is enabled for this location.
     */
    networks?: pulumi.Input<pulumi.Input<inputs.TeamsLocationEndpointsIpv6Network>[]>;
}
export interface TeamsLocationEndpointsIpv6Network {
    /**
     * Specify the IPv6 address or IPv6 CIDR.
     */
    network: pulumi.Input<string>;
}
export interface TeamsLocationNetwork {
    /**
     * Specify the IPv4 address or IPv4 CIDR. Limit IPv4 CIDRs to a maximum of /24.
     */
    network: pulumi.Input<string>;
}
export interface TeamsRuleExpiration {
    /**
     * Defines the default duration a policy active in minutes. Must set in order to use the `resetExpiration` endpoint on this rule.
     */
    duration?: pulumi.Input<number>;
    /**
     * Indicates whether the policy is expired.
     */
    expired?: pulumi.Input<boolean>;
    /**
     * Show the timestamp when the policy expires and stops applying.  The value must follow RFC 3339 and include a UTC offset.  The system accepts non-zero offsets but converts them to the equivalent UTC+00:00  value and returns timestamps with a trailing Z. Expiration policies ignore client  timezones and expire globally at the specified expiresAt time.
     */
    expiresAt: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettings {
    /**
     * Add custom headers to allowed requests as key-value pairs. Use header names as keys that map to arrays of header values. Settable only for `http` rules with the action set to `allow`.
     */
    addHeaders?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.
     */
    allowChildBypass?: pulumi.Input<boolean>;
    /**
     * Define the settings for the Audit SSH action. Settable only for `l4` rules with `auditSsh` action.
     */
    auditSsh?: pulumi.Input<inputs.TeamsRuleRuleSettingsAuditSsh>;
    /**
     * Configure browser isolation behavior. Settable only for `http` rules with the action set to `isolate`.
     */
    bisoAdminControls?: pulumi.Input<inputs.TeamsRuleRuleSettingsBisoAdminControls>;
    /**
     * Configure custom block page settings. If missing or null, use the account settings. Settable only for `http` rules with the action set to `block`.
     */
    blockPage?: pulumi.Input<inputs.TeamsRuleRuleSettingsBlockPage>;
    /**
     * Enable the custom block page. Settable only for `dns` rules with action `block`.
     */
    blockPageEnabled?: pulumi.Input<boolean>;
    /**
     * Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`.
     */
    blockReason?: pulumi.Input<string>;
    /**
     * Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.
     */
    bypassParentRule?: pulumi.Input<boolean>;
    /**
     * Configure session check behavior. Settable only for `l4` and `http` rules with the action set to `allow`.
     */
    checkSession?: pulumi.Input<inputs.TeamsRuleRuleSettingsCheckSession>;
    /**
     * Configure custom resolvers to route queries that match the resolver policy. Unused with 'resolve*dns*through*cloudflare' or 'resolve*dns*internally' settings. DNS queries get routed to the address closest to their origin. Only valid when a rule's action set to 'resolve'. Settable only for `dnsResolver` rules.
     */
    dnsResolvers?: pulumi.Input<inputs.TeamsRuleRuleSettingsDnsResolvers>;
    /**
     * Configure how Gateway Proxy traffic egresses. You can enable this setting for rules with Egress actions and filters, or omit it to indicate local egress via WARP IPs. Settable only for `egress` rules.
     */
    egress?: pulumi.Input<inputs.TeamsRuleRuleSettingsEgress>;
    /**
     * Configure whether a copy of the HTTP request will be sent to storage when the rule matches.
     */
    forensicCopy?: pulumi.Input<inputs.TeamsRuleRuleSettingsForensicCopy>;
    /**
     * Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dnsResolver` rules.
     */
    ignoreCnameCategoryMatches?: pulumi.Input<boolean>;
    /**
     * Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules.
     */
    insecureDisableDnssecValidation?: pulumi.Input<boolean>;
    /**
     * Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dnsResolver` rules.
     */
    ipCategories?: pulumi.Input<boolean>;
    /**
     * Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dnsResolver` rules.
     */
    ipIndicatorFeeds?: pulumi.Input<boolean>;
    /**
     * Send matching traffic to the supplied destination IP address and port. Settable only for `l4` rules with the action set to `l4Override`.
     */
    l4override?: pulumi.Input<inputs.TeamsRuleRuleSettingsL4override>;
    /**
     * Configure a notification to display on the user's device when this rule matched. Settable for all types of rules with the action set to `block`.
     */
    notificationSettings?: pulumi.Input<inputs.TeamsRuleRuleSettingsNotificationSettings>;
    /**
     * Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`.
     */
    overrideHost?: pulumi.Input<string>;
    /**
     * Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`.
     */
    overrideIps?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Configure DLP payload logging. Settable only for `http` rules.
     */
    payloadLog?: pulumi.Input<inputs.TeamsRuleRuleSettingsPayloadLog>;
    /**
     * Configure settings that apply to quarantine rules. Settable only for `http` rules.
     */
    quarantine?: pulumi.Input<inputs.TeamsRuleRuleSettingsQuarantine>;
    /**
     * Apply settings to redirect rules. Settable only for `http` rules with the action set to `redirect`.
     */
    redirect?: pulumi.Input<inputs.TeamsRuleRuleSettingsRedirect>;
    /**
     * Configure to forward the query to the internal DNS service, passing the specified 'view*id' as input. Not used when 'dns*resolvers' is specified or 'resolve*dns*through*cloudflare' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dnsResolver` rules.
     */
    resolveDnsInternally?: pulumi.Input<inputs.TeamsRuleRuleSettingsResolveDnsInternally>;
    /**
     * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns*resolvers' specified or 'resolve*dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dnsResolver` rules.
     */
    resolveDnsThroughCloudflare?: pulumi.Input<boolean>;
    /**
     * Configure behavior when an upstream certificate is invalid or an SSL error occurs. Settable only for `http` rules with the action set to `allow`.
     */
    untrustedCert?: pulumi.Input<inputs.TeamsRuleRuleSettingsUntrustedCert>;
}
export interface TeamsRuleRuleSettingsAuditSsh {
    /**
     * Enable SSH command logging.
     */
    commandLogging?: pulumi.Input<boolean>;
}
export interface TeamsRuleRuleSettingsBisoAdminControls {
    /**
     * Configure copy behavior. If set to remote*only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".
     * Available values: "enabled", "disabled", "remote*only".
     */
    copy?: pulumi.Input<string>;
    /**
     * Set to false to enable copy-pasting. Only applies when `version == "v1"`.
     */
    dcp?: pulumi.Input<boolean>;
    /**
     * Set to false to enable downloading. Only applies when `version == "v1"`.
     */
    dd?: pulumi.Input<boolean>;
    /**
     * Set to false to enable keyboard usage. Only applies when `version == "v1"`.
     */
    dk?: pulumi.Input<boolean>;
    /**
     * Configure download behavior. When set to remote*only, users can view downloads but cannot save them. Applies only when version == "v2".
     * Available values: "enabled", "disabled", "remote*only".
     */
    download?: pulumi.Input<string>;
    /**
     * Set to false to enable printing. Only applies when `version == "v1"`.
     */
    dp?: pulumi.Input<boolean>;
    /**
     * Set to false to enable uploading. Only applies when `version == "v1"`.
     */
    du?: pulumi.Input<boolean>;
    /**
     * Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".
     * Available values: "enabled", "disabled".
     */
    keyboard?: pulumi.Input<string>;
    /**
     * Configure paste behavior. If set to remote*only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".
     * Available values: "enabled", "disabled", "remote*only".
     */
    paste?: pulumi.Input<string>;
    /**
     * Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".
     * Available values: "enabled", "disabled".
     */
    printing?: pulumi.Input<string>;
    /**
     * Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".
     * Available values: "enabled", "disabled".
     */
    upload?: pulumi.Input<string>;
    /**
     * Indicate which version of the browser isolation controls should apply.
     * Available values: "v1", "v2".
     */
    version?: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsBlockPage {
    /**
     * Specify whether to pass the context information as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * Specify the URI to which the user is redirected.
     */
    targetUri: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsCheckSession {
    /**
     * Sets the required session freshness threshold. The API returns a normalized version of this value.
     */
    duration?: pulumi.Input<string>;
    /**
     * Enable session enforcement.
     */
    enforce?: pulumi.Input<boolean>;
}
export interface TeamsRuleRuleSettingsDnsResolvers {
    ipv4s?: pulumi.Input<pulumi.Input<inputs.TeamsRuleRuleSettingsDnsResolversIpv4>[]>;
    ipv6s?: pulumi.Input<pulumi.Input<inputs.TeamsRuleRuleSettingsDnsResolversIpv6>[]>;
}
export interface TeamsRuleRuleSettingsDnsResolversIpv4 {
    /**
     * Specify the IPv4 address of the upstream resolver.
     */
    ip: pulumi.Input<string>;
    /**
     * Specify a port number to use for the upstream resolver. Defaults to 53 if unspecified.
     */
    port?: pulumi.Input<number>;
    /**
     * Indicate whether to connect to this resolver over a private network. Must set when vnetId set.
     */
    routeThroughPrivateNetwork?: pulumi.Input<boolean>;
    /**
     * Specify an optional virtual network for this resolver. Uses default virtual network id if omitted.
     */
    vnetId?: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsDnsResolversIpv6 {
    /**
     * Specify the IPv6 address of the upstream resolver.
     */
    ip: pulumi.Input<string>;
    /**
     * Specify a port number to use for the upstream resolver. Defaults to 53 if unspecified.
     */
    port?: pulumi.Input<number>;
    /**
     * Indicate whether to connect to this resolver over a private network. Must set when vnetId set.
     */
    routeThroughPrivateNetwork?: pulumi.Input<boolean>;
    /**
     * Specify an optional virtual network for this resolver. Uses default virtual network id if omitted.
     */
    vnetId?: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsEgress {
    /**
     * Specify the IPv4 address to use for egress.
     */
    ipv4?: pulumi.Input<string>;
    /**
     * Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.
     */
    ipv4Fallback?: pulumi.Input<string>;
    /**
     * Specify the IPv6 range to use for egress.
     */
    ipv6?: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsForensicCopy {
    /**
     * Enable sending the copy to storage.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface TeamsRuleRuleSettingsL4override {
    /**
     * Defines the IPv4 or IPv6 address.
     */
    ip?: pulumi.Input<string>;
    /**
     * Defines a port number to use for TCP/UDP overrides.
     */
    port?: pulumi.Input<number>;
}
export interface TeamsRuleRuleSettingsNotificationSettings {
    /**
     * Enable notification.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Indicates whether to pass the context information as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * Customize the message shown in the notification.
     */
    msg?: pulumi.Input<string>;
    /**
     * Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.
     */
    supportUrl?: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsPayloadLog {
    /**
     * Enable DLP payload logging for this rule.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface TeamsRuleRuleSettingsQuarantine {
    /**
     * Specify the types of files to sandbox.
     */
    fileTypes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface TeamsRuleRuleSettingsRedirect {
    /**
     * Specify whether to pass the context information as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * Specify whether to append the path and query parameters from the original request to target_uri.
     */
    preservePathAndQuery?: pulumi.Input<boolean>;
    /**
     * Specify the URI to which the user is redirected.
     */
    targetUri: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsResolveDnsInternally {
    /**
     * Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.
     * Available values: "none", "publicDns".
     */
    fallback?: pulumi.Input<string>;
    /**
     * Specify the internal DNS view identifier to pass to the internal DNS service.
     */
    viewId?: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsUntrustedCert {
    /**
     * Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.
     * Available values: "passThrough", "block", "error".
     */
    action?: pulumi.Input<string>;
}
export interface TeamsRuleSchedule {
    /**
     * Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.
     */
    fri?: pulumi.Input<string>;
    /**
     * Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.
     */
    mon?: pulumi.Input<string>;
    /**
     * Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.
     */
    sat?: pulumi.Input<string>;
    /**
     * Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.
     */
    sun?: pulumi.Input<string>;
    /**
     * Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.
     */
    thu?: pulumi.Input<string>;
    /**
     * Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.
     */
    timeZone?: pulumi.Input<string>;
    /**
     * Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.
     */
    tue?: pulumi.Input<string>;
    /**
     * Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.
     */
    wed?: pulumi.Input<string>;
}
export interface TokenValidationConfigCredentials {
    keys: pulumi.Input<pulumi.Input<inputs.TokenValidationConfigCredentialsKey>[]>;
}
export interface TokenValidationConfigCredentialsKey {
    /**
     * Algorithm
     * Available values: "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384".
     */
    alg: pulumi.Input<string>;
    /**
     * Curve
     * Available values: "P-256", "P-384".
     */
    crv?: pulumi.Input<string>;
    /**
     * RSA exponent
     */
    e?: pulumi.Input<string>;
    /**
     * Key ID
     */
    kid: pulumi.Input<string>;
    /**
     * Key Type
     * Available values: "RSA", "EC".
     */
    kty: pulumi.Input<string>;
    /**
     * RSA modulus
     */
    n?: pulumi.Input<string>;
    /**
     * X EC coordinate
     */
    x?: pulumi.Input<string>;
    /**
     * Y EC coordinate
     */
    y?: pulumi.Input<string>;
}
export interface TokenValidationRulesPosition {
    /**
     * Move rule to after rule with this ID.
     */
    after?: pulumi.Input<string>;
    /**
     * Move rule to before rule with this ID.
     */
    before?: pulumi.Input<string>;
    /**
     * Move rule to this position
     */
    index?: pulumi.Input<number>;
}
export interface TokenValidationRulesSelector {
    /**
     * Ignore operations that were otherwise included by `include`.
     */
    excludes?: pulumi.Input<pulumi.Input<inputs.TokenValidationRulesSelectorExclude>[]>;
    /**
     * Select all matching operations.
     */
    includes?: pulumi.Input<pulumi.Input<inputs.TokenValidationRulesSelectorInclude>[]>;
}
export interface TokenValidationRulesSelectorExclude {
    /**
     * Excluded operation IDs.
     */
    operationIds?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface TokenValidationRulesSelectorInclude {
    /**
     * Included hostnames.
     */
    hosts?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface TunnelConfigConfig {
    /**
     * List of public hostname definitions. At least one ingress rule needs to be defined for the tunnel.
     */
    ingresses?: pulumi.Input<pulumi.Input<inputs.TunnelConfigConfigIngress>[]>;
    /**
     * Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.
     */
    originRequest?: pulumi.Input<inputs.TunnelConfigConfigOriginRequest>;
}
export interface TunnelConfigConfigIngress {
    /**
     * Public hostname for this service.
     */
    hostname?: pulumi.Input<string>;
    /**
     * Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.
     */
    originRequest?: pulumi.Input<inputs.TunnelConfigConfigIngressOriginRequest>;
    /**
     * Requests with this path route to this public hostname.
     */
    path?: pulumi.Input<string>;
    /**
     * Protocol and address of destination server. Supported protocols: http://, https://, unix://, tcp://, ssh://, rdp://, unix+tls://, smb://. Alternatively can return a HTTP status code http*status:[code] e.g. 'http*status:404'.
     */
    service: pulumi.Input<string>;
}
export interface TunnelConfigConfigIngressOriginRequest {
    /**
     * For all L7 requests to this hostname, cloudflared will validate each request's Cf-Access-Jwt-Assertion request header.
     */
    access?: pulumi.Input<inputs.TunnelConfigConfigIngressOriginRequestAccess>;
    /**
     * Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
     */
    caPool?: pulumi.Input<string>;
    /**
     * Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.
     */
    connectTimeout?: pulumi.Input<number>;
    /**
     * Disables chunked transfer encoding. Useful if you are running a WSGI server.
     */
    disableChunkedEncoding?: pulumi.Input<boolean>;
    /**
     * Attempt to connect to origin using HTTP2. Origin must be configured as https.
     */
    http2Origin?: pulumi.Input<boolean>;
    /**
     * Sets the HTTP Host header on requests sent to the local service.
     */
    httpHostHeader?: pulumi.Input<string>;
    /**
     * Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
     */
    keepAliveConnections?: pulumi.Input<number>;
    /**
     * Timeout after which an idle keepalive connection can be discarded.
     */
    keepAliveTimeout?: pulumi.Input<number>;
    /**
     * Auto configure the Hostname on the origin server certificate.
     */
    matchSnItoHost?: pulumi.Input<boolean>;
    /**
     * Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
     */
    noHappyEyeballs?: pulumi.Input<boolean>;
    /**
     * Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
     */
    noTlsVerify?: pulumi.Input<boolean>;
    /**
     * Hostname that cloudflared should expect from your origin server certificate.
     */
    originServerName?: pulumi.Input<string>;
    /**
     * cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
     */
    proxyType?: pulumi.Input<string>;
    /**
     * The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
     */
    tcpKeepAlive?: pulumi.Input<number>;
    /**
     * Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
     */
    tlsTimeout?: pulumi.Input<number>;
}
export interface TunnelConfigConfigIngressOriginRequestAccess {
    /**
     * Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.
     */
    audTags: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Deny traffic that has not fulfilled Access authorization.
     */
    required?: pulumi.Input<boolean>;
    teamName: pulumi.Input<string>;
}
export interface TunnelConfigConfigOriginRequest {
    /**
     * For all L7 requests to this hostname, cloudflared will validate each request's Cf-Access-Jwt-Assertion request header.
     */
    access?: pulumi.Input<inputs.TunnelConfigConfigOriginRequestAccess>;
    /**
     * Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
     */
    caPool?: pulumi.Input<string>;
    /**
     * Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.
     */
    connectTimeout?: pulumi.Input<number>;
    /**
     * Disables chunked transfer encoding. Useful if you are running a WSGI server.
     */
    disableChunkedEncoding?: pulumi.Input<boolean>;
    /**
     * Attempt to connect to origin using HTTP2. Origin must be configured as https.
     */
    http2Origin?: pulumi.Input<boolean>;
    /**
     * Sets the HTTP Host header on requests sent to the local service.
     */
    httpHostHeader?: pulumi.Input<string>;
    /**
     * Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
     */
    keepAliveConnections?: pulumi.Input<number>;
    /**
     * Timeout after which an idle keepalive connection can be discarded.
     */
    keepAliveTimeout?: pulumi.Input<number>;
    /**
     * Auto configure the Hostname on the origin server certificate.
     */
    matchSnItoHost?: pulumi.Input<boolean>;
    /**
     * Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
     */
    noHappyEyeballs?: pulumi.Input<boolean>;
    /**
     * Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
     */
    noTlsVerify?: pulumi.Input<boolean>;
    /**
     * Hostname that cloudflared should expect from your origin server certificate.
     */
    originServerName?: pulumi.Input<string>;
    /**
     * cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
     */
    proxyType?: pulumi.Input<string>;
    /**
     * The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
     */
    tcpKeepAlive?: pulumi.Input<number>;
    /**
     * Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
     */
    tlsTimeout?: pulumi.Input<number>;
}
export interface TunnelConfigConfigOriginRequestAccess {
    /**
     * Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.
     */
    audTags: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Deny traffic that has not fulfilled Access authorization.
     */
    required?: pulumi.Input<boolean>;
    teamName: pulumi.Input<string>;
}
export interface TunnelConnection {
    /**
     * UUID of the Cloudflare Tunnel connector.
     */
    clientId?: pulumi.Input<string>;
    /**
     * The cloudflared version used to establish this connection.
     */
    clientVersion?: pulumi.Input<string>;
    /**
     * The Cloudflare data center used for this connection.
     */
    coloName?: pulumi.Input<string>;
    /**
     * UUID of the Cloudflare Tunnel connection.
     */
    id?: pulumi.Input<string>;
    /**
     * Cloudflare continues to track connections for several minutes after they disconnect. This is an optimization to improve latency and reliability of reconnecting.  If `true`, the connection has disconnected but is still being tracked. If `false`, the connection is actively serving traffic.
     */
    isPendingReconnect?: pulumi.Input<boolean>;
    /**
     * Timestamp of when the connection was established.
     */
    openedAt?: pulumi.Input<string>;
    /**
     * The public IP address of the host running cloudflared.
     */
    originIp?: pulumi.Input<string>;
    /**
     * UUID of the Cloudflare Tunnel connection.
     */
    uuid?: pulumi.Input<string>;
}
export interface UserAgentBlockingRuleConfiguration {
    /**
     * The configuration target. You must set the target to `ua` when specifying a user agent in the rule.
     * Available values: "ua".
     */
    target?: pulumi.Input<string>;
    /**
     * the user agent to exactly match
     */
    value?: pulumi.Input<string>;
}
export interface UserOrganization {
    /**
     * Identifier
     */
    id?: pulumi.Input<string>;
    /**
     * Organization name.
     */
    name?: pulumi.Input<string>;
    /**
     * Access permissions for this User.
     */
    permissions?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of roles that a user has within an organization.
     */
    roles?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Whether the user is a member of the organization or has an invitation pending.
     * Available values: "member", "invited".
     */
    status?: pulumi.Input<string>;
}
export interface WaitingRoomAdditionalRoute {
    /**
     * The hostname to which this waiting room will be applied (no wildcards). The hostname must be the primary domain, subdomain, or custom hostname (if using SSL for SaaS) of this zone. Please do not include the scheme (http:// or https://).
     */
    host?: pulumi.Input<string>;
    /**
     * Sets the path within the host to enable the waiting room on. The waiting room will be enabled for all subpaths as well. If there are two waiting rooms on the same subpath, the waiting room for the most specific path will be chosen. Wildcards and query parameters are not supported.
     */
    path?: pulumi.Input<string>;
}
export interface WaitingRoomCookieAttributes {
    /**
     * Configures the SameSite attribute on the waiting room cookie. Value `auto` will be translated to `lax` or `none` depending if **Always Use HTTPS** is enabled. Note that when using value `none`, the secure attribute cannot be set to `never`.
     * Available values: "auto", "lax", "none", "strict".
     */
    samesite?: pulumi.Input<string>;
    /**
     * Configures the Secure attribute on the waiting room cookie. Value `always` indicates that the Secure attribute will be set in the Set-Cookie header, `never` indicates that the Secure attribute will not be set, and `auto` will set the Secure attribute depending if **Always Use HTTPS** is enabled.
     * Available values: "auto", "always", "never".
     */
    secure?: pulumi.Input<string>;
}
export interface WaitingRoomRulesRule {
    /**
     * The action to take when the expression matches.
     * Available values: "bypass*waiting*room".
     */
    action: pulumi.Input<string>;
    /**
     * The description of the rule.
     */
    description?: pulumi.Input<string>;
    /**
     * When set to true, the rule is enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Criteria defining when there is a match for the current rule.
     */
    expression: pulumi.Input<string>;
}
export interface WebAnalyticsSiteRule {
    created?: pulumi.Input<string>;
    /**
     * The hostname the rule will be applied to.
     */
    host?: pulumi.Input<string>;
    /**
     * The Web Analytics rule identifier.
     */
    id?: pulumi.Input<string>;
    /**
     * Whether the rule includes or excludes traffic from being measured.
     */
    inclusive?: pulumi.Input<boolean>;
    /**
     * Whether the rule is paused or not.
     */
    isPaused?: pulumi.Input<boolean>;
    /**
     * The paths the rule will be applied to.
     */
    paths?: pulumi.Input<pulumi.Input<string>[]>;
    priority?: pulumi.Input<number>;
}
export interface WebAnalyticsSiteRuleset {
    /**
     * Whether the ruleset is enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The Web Analytics ruleset identifier.
     */
    id?: pulumi.Input<string>;
    zoneName?: pulumi.Input<string>;
    /**
     * The zone identifier.
     */
    zoneTag?: pulumi.Input<string>;
}
export interface WorkerCronTriggerSchedule {
    createdOn?: pulumi.Input<string>;
    cron: pulumi.Input<string>;
    modifiedOn?: pulumi.Input<string>;
}
export interface WorkerObservability {
    /**
     * Whether observability is enabled for the Worker.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The sampling rate for observability. From 0 to 1 (1 = 100%, 0.1 = 10%).
     */
    headSamplingRate?: pulumi.Input<number>;
    /**
     * Log settings for the Worker.
     */
    logs?: pulumi.Input<inputs.WorkerObservabilityLogs>;
}
export interface WorkerObservabilityLogs {
    /**
     * Whether logs are enabled for the Worker.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The sampling rate for logs. From 0 to 1 (1 = 100%, 0.1 = 10%).
     */
    headSamplingRate?: pulumi.Input<number>;
    /**
     * Whether [invocation logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/#invocation-logs) are enabled for the Worker.
     */
    invocationLogs?: pulumi.Input<boolean>;
}
export interface WorkerReferences {
    /**
     * Other Workers that reference the Worker as an outbound for a dispatch namespace.
     */
    dispatchNamespaceOutbounds?: pulumi.Input<pulumi.Input<inputs.WorkerReferencesDispatchNamespaceOutbound>[]>;
    /**
     * Custom domains connected to the Worker.
     */
    domains?: pulumi.Input<pulumi.Input<inputs.WorkerReferencesDomain>[]>;
    /**
     * Other Workers that reference Durable Object classes implemented by the Worker.
     */
    durableObjects?: pulumi.Input<pulumi.Input<inputs.WorkerReferencesDurableObject>[]>;
    /**
     * Queues that send messages to the Worker.
     */
    queues?: pulumi.Input<pulumi.Input<inputs.WorkerReferencesQueue>[]>;
    /**
     * Other Workers that reference the Worker using [service bindings](https://developers.cloudflare.com/workers/runtime-apis/bindings/service-bindings/).
     */
    workers?: pulumi.Input<pulumi.Input<inputs.WorkerReferencesWorker>[]>;
}
export interface WorkerReferencesDispatchNamespaceOutbound {
    /**
     * ID of the dispatch namespace.
     */
    namespaceId?: pulumi.Input<string>;
    /**
     * Name of the dispatch namespace.
     */
    namespaceName?: pulumi.Input<string>;
    /**
     * ID of the Worker using the dispatch namespace.
     */
    workerId?: pulumi.Input<string>;
    /**
     * Name of the Worker using the dispatch namespace.
     */
    workerName?: pulumi.Input<string>;
}
export interface WorkerReferencesDomain {
    /**
     * ID of the TLS certificate issued for the custom domain.
     */
    certificateId?: pulumi.Input<string>;
    /**
     * Full hostname of the custom domain, including the zone name.
     */
    hostname?: pulumi.Input<string>;
    /**
     * ID of the custom domain.
     */
    id?: pulumi.Input<string>;
    /**
     * ID of the zone.
     */
    zoneId?: pulumi.Input<string>;
    /**
     * Name of the zone.
     */
    zoneName?: pulumi.Input<string>;
}
export interface WorkerReferencesDurableObject {
    /**
     * ID of the Durable Object namespace being used.
     */
    namespaceId?: pulumi.Input<string>;
    /**
     * Name of the Durable Object namespace being used.
     */
    namespaceName?: pulumi.Input<string>;
    /**
     * ID of the Worker using the Durable Object implementation.
     */
    workerId?: pulumi.Input<string>;
    /**
     * Name of the Worker using the Durable Object implementation.
     */
    workerName?: pulumi.Input<string>;
}
export interface WorkerReferencesQueue {
    /**
     * ID of the queue consumer configuration.
     */
    queueConsumerId?: pulumi.Input<string>;
    /**
     * ID of the queue.
     */
    queueId?: pulumi.Input<string>;
    /**
     * Name of the queue.
     */
    queueName?: pulumi.Input<string>;
}
export interface WorkerReferencesWorker {
    /**
     * ID of the referencing Worker.
     */
    id?: pulumi.Input<string>;
    /**
     * Name of the referencing Worker.
     */
    name?: pulumi.Input<string>;
}
export interface WorkerScriptAssets {
    /**
     * The SHA-256 hash of the asset manifest of files to upload.
     */
    assetManifestSha256?: pulumi.Input<string>;
    /**
     * Configuration for assets within a Worker.
     */
    config?: pulumi.Input<inputs.WorkerScriptAssetsConfig>;
    /**
     * Path to the directory containing asset files to upload.
     */
    directory?: pulumi.Input<string>;
    /**
     * Token provided upon successful upload of all files from a registered manifest.
     */
    jwt?: pulumi.Input<string>;
}
export interface WorkerScriptAssetsConfig {
    /**
     * The contents of a _headers file (used to attach custom headers on asset responses).
     */
    headers?: pulumi.Input<string>;
    /**
     * Determines the redirects and rewrites of requests for HTML content.
     * Available values: "auto-trailing-slash", "force-trailing-slash", "drop-trailing-slash", "none".
     */
    htmlHandling?: pulumi.Input<string>;
    /**
     * Determines the response when a request does not match a static asset, and there is no Worker script.
     * Available values: "none", "404-page", "single-page-application".
     */
    notFoundHandling?: pulumi.Input<string>;
    /**
     * The contents of a _redirects file (used to apply redirects or proxy paths ahead of asset serving).
     */
    redirects?: pulumi.Input<string>;
    /**
     * When a boolean true, requests will always invoke the Worker script. Otherwise, attempt to serve an asset matching the request, falling back to the Worker script. When a list of strings, contains path rules to control routing to either the Worker or assets. Glob (*) and negative (!) rules are supported. Rules must start with either '/' or '!/'. At least one non-negative rule must be provided, and negative rules have higher precedence than non-negative rules.
     */
    runWorkerFirst?: any;
    /**
     * When true and the incoming request matches an asset, that will be served instead of invoking the Worker script. When false, requests will always invoke the Worker script.
     *
     * @deprecated This attribute is deprecated.
     */
    serveDirectly?: pulumi.Input<boolean>;
}
export interface WorkerScriptBinding {
    /**
     * Algorithm-specific key parameters. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#algorithm).
     */
    algorithm?: pulumi.Input<string>;
    /**
     * List of allowed destination addresses.
     */
    allowedDestinationAddresses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of allowed sender addresses.
     */
    allowedSenderAddresses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * R2 bucket to bind to.
     */
    bucketName?: pulumi.Input<string>;
    /**
     * Identifier of the certificate to bind to.
     */
    certificateId?: pulumi.Input<string>;
    /**
     * The exported class name of the Durable Object.
     */
    className?: pulumi.Input<string>;
    /**
     * The name of the dataset to bind to.
     */
    dataset?: pulumi.Input<string>;
    /**
     * Destination address for the email.
     */
    destinationAddress?: pulumi.Input<string>;
    /**
     * The environment of the scriptName to bind to.
     */
    environment?: pulumi.Input<string>;
    /**
     * Data format of the key. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#format).
     * Available values: "raw", "pkcs8", "spki", "jwk".
     */
    format?: pulumi.Input<string>;
    /**
     * Identifier of the D1 database to bind to.
     */
    id?: pulumi.Input<string>;
    /**
     * Name of the Vectorize index to bind to.
     */
    indexName?: pulumi.Input<string>;
    /**
     * JSON data to use.
     */
    json?: pulumi.Input<string>;
    /**
     * The [jurisdiction](https://developers.cloudflare.com/r2/reference/data-location/#jurisdictional-restrictions) of the R2 bucket.
     * Available values: "eu", "fedramp".
     */
    jurisdiction?: pulumi.Input<string>;
    /**
     * Base64-encoded key data. Required if `format` is "raw", "pkcs8", or "spki".
     */
    keyBase64?: pulumi.Input<string>;
    /**
     * Key data in [JSON Web Key](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#json_web_key) format. Required if `format` is "jwk".
     */
    keyJwk?: pulumi.Input<string>;
    /**
     * A JavaScript variable name for the binding.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the dispatch namespace.
     */
    namespace?: pulumi.Input<string>;
    /**
     * Namespace identifier tag.
     */
    namespaceId?: pulumi.Input<string>;
    /**
     * The old name of the inherited binding. If set, the binding will be renamed from `oldName` to `name` in the new version. If not set, the binding will keep the same name between versions.
     */
    oldName?: pulumi.Input<string>;
    /**
     * Outbound worker.
     */
    outbound?: pulumi.Input<inputs.WorkerScriptBindingOutbound>;
    /**
     * The name of the file containing the data content. Only accepted for `service worker syntax` Workers.
     */
    part?: pulumi.Input<string>;
    /**
     * Name of the Pipeline to bind to.
     */
    pipeline?: pulumi.Input<string>;
    /**
     * Name of the Queue to bind to.
     */
    queueName?: pulumi.Input<string>;
    /**
     * The script where the Durable Object is defined, if it is external to this Worker.
     */
    scriptName?: pulumi.Input<string>;
    /**
     * Name of the secret in the store.
     */
    secretName?: pulumi.Input<string>;
    /**
     * Name of Worker to bind to.
     */
    service?: pulumi.Input<string>;
    /**
     * A simple rate limit.
     */
    simple?: pulumi.Input<inputs.WorkerScriptBindingSimple>;
    /**
     * ID of the store containing the secret.
     */
    storeId?: pulumi.Input<string>;
    /**
     * The text value to use.
     */
    text?: pulumi.Input<string>;
    /**
     * The kind of resource that the binding provides.
     * Available values: "ai", "analytics*engine", "assets", "browser", "d1", "data*blob", "dispatch*namespace", "durable*object*namespace", "hyperdrive", "inherit", "images", "json", "kv*namespace", "mtls*certificate", "plain*text", "pipelines", "queue", "r2*bucket", "secret*text", "send*email", "service", "tail*consumer", "text*blob", "vectorize", "version*metadata", "secrets*store*secret", "secret*key", "workflow", "wasm*module".
     */
    type: pulumi.Input<string>;
    /**
     * Allowed operations with the key. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#keyUsages).
     */
    usages?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Identifier for the version to inherit the binding from, which can be the version ID or the literal "latest" to inherit from the latest version. Defaults to inheriting the binding from the latest version.
     */
    versionId?: pulumi.Input<string>;
    /**
     * Name of the Workflow to bind to.
     */
    workflowName?: pulumi.Input<string>;
}
export interface WorkerScriptBindingOutbound {
    /**
     * Pass information from the Dispatch Worker to the Outbound Worker through the parameters.
     */
    params?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Outbound worker.
     */
    worker?: pulumi.Input<inputs.WorkerScriptBindingOutboundWorker>;
}
export interface WorkerScriptBindingOutboundWorker {
    /**
     * Environment of the outbound worker.
     */
    environment?: pulumi.Input<string>;
    /**
     * Name of the outbound worker.
     */
    service?: pulumi.Input<string>;
}
export interface WorkerScriptBindingSimple {
    /**
     * The rate limit value.
     */
    limit: pulumi.Input<number>;
    /**
     * The rate limit period in seconds.
     */
    period: pulumi.Input<number>;
}
export interface WorkerScriptLimits {
    /**
     * The amount of CPU time this Worker can use in milliseconds.
     */
    cpuMs?: pulumi.Input<number>;
}
export interface WorkerScriptMigrations {
    /**
     * A list of classes to delete Durable Object namespaces from.
     */
    deletedClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces from.
     */
    newClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces with SQLite from.
     */
    newSqliteClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Tag to set as the latest migration tag.
     */
    newTag?: pulumi.Input<string>;
    /**
     * Tag used to verify against the latest migration tag for this Worker. If they don't match, the upload is rejected.
     */
    oldTag?: pulumi.Input<string>;
    /**
     * A list of classes with Durable Object namespaces that were renamed.
     */
    renamedClasses?: pulumi.Input<pulumi.Input<inputs.WorkerScriptMigrationsRenamedClass>[]>;
    /**
     * Migrations to apply in order.
     */
    steps?: pulumi.Input<pulumi.Input<inputs.WorkerScriptMigrationsStep>[]>;
    /**
     * A list of transfers for Durable Object namespaces from a different Worker and class to a class defined in this Worker.
     */
    transferredClasses?: pulumi.Input<pulumi.Input<inputs.WorkerScriptMigrationsTransferredClass>[]>;
}
export interface WorkerScriptMigrationsRenamedClass {
    from?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkerScriptMigrationsStep {
    /**
     * A list of classes to delete Durable Object namespaces from.
     */
    deletedClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces from.
     */
    newClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces with SQLite from.
     */
    newSqliteClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes with Durable Object namespaces that were renamed.
     */
    renamedClasses?: pulumi.Input<pulumi.Input<inputs.WorkerScriptMigrationsStepRenamedClass>[]>;
    /**
     * A list of transfers for Durable Object namespaces from a different Worker and class to a class defined in this Worker.
     */
    transferredClasses?: pulumi.Input<pulumi.Input<inputs.WorkerScriptMigrationsStepTransferredClass>[]>;
}
export interface WorkerScriptMigrationsStepRenamedClass {
    from?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkerScriptMigrationsStepTransferredClass {
    from?: pulumi.Input<string>;
    fromScript?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkerScriptMigrationsTransferredClass {
    from?: pulumi.Input<string>;
    fromScript?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkerScriptNamedHandler {
    /**
     * The names of handlers exported as part of the named export.
     */
    handlers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The name of the export.
     */
    name?: pulumi.Input<string>;
}
export interface WorkerScriptObservability {
    /**
     * Whether observability is enabled for the Worker.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The sampling rate for incoming requests. From 0 to 1 (1 = 100%, 0.1 = 10%). Default is 1.
     */
    headSamplingRate?: pulumi.Input<number>;
    /**
     * Log settings for the Worker.
     */
    logs?: pulumi.Input<inputs.WorkerScriptObservabilityLogs>;
}
export interface WorkerScriptObservabilityLogs {
    /**
     * A list of destinations where logs will be exported to.
     */
    destinations?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Whether logs are enabled for the Worker.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The sampling rate for logs. From 0 to 1 (1 = 100%, 0.1 = 10%). Default is 1.
     */
    headSamplingRate?: pulumi.Input<number>;
    /**
     * Whether [invocation logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/#invocation-logs) are enabled for the Worker.
     */
    invocationLogs: pulumi.Input<boolean>;
    /**
     * Whether log persistence is enabled for the Worker.
     */
    persist?: pulumi.Input<boolean>;
}
export interface WorkerScriptPlacement {
    /**
     * TCP host and port for targeted placement.
     */
    host?: pulumi.Input<string>;
    /**
     * HTTP hostname for targeted placement.
     */
    hostname?: pulumi.Input<string>;
    /**
     * The last time the script was analyzed for [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement).
     */
    lastAnalyzedAt?: pulumi.Input<string>;
    /**
     * Enables [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement).
     * Available values: "smart", "targeted".
     */
    mode?: pulumi.Input<string>;
    /**
     * Cloud region for targeted placement in format 'provider:region'.
     */
    region?: pulumi.Input<string>;
    /**
     * Status of [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement).
     * Available values: "SUCCESS", "UNSUPPORTED*APPLICATION", "INSUFFICIENT*INVOCATIONS".
     */
    status?: pulumi.Input<string>;
    /**
     * Array of placement targets (currently limited to single target).
     */
    targets?: pulumi.Input<pulumi.Input<inputs.WorkerScriptPlacementTarget>[]>;
}
export interface WorkerScriptPlacementTarget {
    /**
     * TCP host:port for targeted placement.
     */
    host?: pulumi.Input<string>;
    /**
     * HTTP hostname for targeted placement.
     */
    hostname?: pulumi.Input<string>;
    /**
     * Cloud region in format 'provider:region'.
     */
    region?: pulumi.Input<string>;
}
export interface WorkerScriptTailConsumer {
    /**
     * Optional environment if the Worker utilizes one.
     */
    environment?: pulumi.Input<string>;
    /**
     * Optional dispatch namespace the script belongs to.
     */
    namespace?: pulumi.Input<string>;
    /**
     * Name of Worker that is to be the consumer.
     */
    service: pulumi.Input<string>;
}
export interface WorkerSubdomain {
    /**
     * Whether the *.workers.dev subdomain is enabled for the Worker.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Whether [preview URLs](https://developers.cloudflare.com/workers/configuration/previews/) are enabled for the Worker.
     */
    previewsEnabled?: pulumi.Input<boolean>;
}
export interface WorkerTailConsumer {
    /**
     * Name of the consumer Worker.
     */
    name: pulumi.Input<string>;
}
export interface WorkerVersionAnnotations {
    /**
     * Human-readable message about the version.
     */
    workersMessage?: pulumi.Input<string>;
    /**
     * User-provided identifier for the version.
     */
    workersTag?: pulumi.Input<string>;
    /**
     * Operation that triggered the creation of the version.
     */
    workersTriggeredBy?: pulumi.Input<string>;
}
export interface WorkerVersionAssets {
    /**
     * The SHA-256 hash of the asset manifest of files to upload.
     */
    assetManifestSha256?: pulumi.Input<string>;
    /**
     * Configuration for assets within a Worker.
     */
    config?: pulumi.Input<inputs.WorkerVersionAssetsConfig>;
    /**
     * Path to the directory containing asset files to upload.
     */
    directory?: pulumi.Input<string>;
    /**
     * Token provided upon successful upload of all files from a registered manifest.
     */
    jwt?: pulumi.Input<string>;
}
export interface WorkerVersionAssetsConfig {
    /**
     * Determines the redirects and rewrites of requests for HTML content.
     * Available values: "auto-trailing-slash", "force-trailing-slash", "drop-trailing-slash", "none".
     */
    htmlHandling?: pulumi.Input<string>;
    /**
     * Determines the response when a request does not match a static asset, and there is no Worker script.
     * Available values: "none", "404-page", "single-page-application".
     */
    notFoundHandling?: pulumi.Input<string>;
    /**
     * When a boolean true, requests will always invoke the Worker script. Otherwise, attempt to serve an asset matching the request, falling back to the Worker script. When a list of strings, contains path rules to control routing to either the Worker or assets. Glob (*) and negative (!) rules are supported. Rules must start with either '/' or '!/'. At least one non-negative rule must be provided, and negative rules have higher precedence than non-negative rules.
     */
    runWorkerFirst?: any;
}
export interface WorkerVersionBinding {
    /**
     * Algorithm-specific key parameters. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#algorithm).
     */
    algorithm?: pulumi.Input<string>;
    /**
     * List of allowed destination addresses.
     */
    allowedDestinationAddresses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of allowed sender addresses.
     */
    allowedSenderAddresses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * R2 bucket to bind to.
     */
    bucketName?: pulumi.Input<string>;
    /**
     * Identifier of the certificate to bind to.
     */
    certificateId?: pulumi.Input<string>;
    /**
     * The exported class name of the Durable Object.
     */
    className?: pulumi.Input<string>;
    /**
     * The name of the dataset to bind to.
     */
    dataset?: pulumi.Input<string>;
    /**
     * Destination address for the email.
     */
    destinationAddress?: pulumi.Input<string>;
    /**
     * The environment of the scriptName to bind to.
     */
    environment?: pulumi.Input<string>;
    /**
     * Data format of the key. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#format).
     * Available values: "raw", "pkcs8", "spki", "jwk".
     */
    format?: pulumi.Input<string>;
    /**
     * Identifier of the D1 database to bind to.
     */
    id?: pulumi.Input<string>;
    /**
     * Name of the Vectorize index to bind to.
     */
    indexName?: pulumi.Input<string>;
    /**
     * JSON data to use.
     */
    json?: pulumi.Input<string>;
    /**
     * The [jurisdiction](https://developers.cloudflare.com/r2/reference/data-location/#jurisdictional-restrictions) of the R2 bucket.
     * Available values: "eu", "fedramp".
     */
    jurisdiction?: pulumi.Input<string>;
    /**
     * Base64-encoded key data. Required if `format` is "raw", "pkcs8", or "spki".
     */
    keyBase64?: pulumi.Input<string>;
    /**
     * Key data in [JSON Web Key](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#json_web_key) format. Required if `format` is "jwk".
     */
    keyJwk?: pulumi.Input<string>;
    /**
     * A JavaScript variable name for the binding.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the dispatch namespace.
     */
    namespace?: pulumi.Input<string>;
    /**
     * Namespace identifier tag.
     */
    namespaceId?: pulumi.Input<string>;
    /**
     * The old name of the inherited binding. If set, the binding will be renamed from `oldName` to `name` in the new version. If not set, the binding will keep the same name between versions.
     */
    oldName?: pulumi.Input<string>;
    /**
     * Outbound worker.
     */
    outbound?: pulumi.Input<inputs.WorkerVersionBindingOutbound>;
    /**
     * The name of the file containing the data content. Only accepted for `service worker syntax` Workers.
     */
    part?: pulumi.Input<string>;
    /**
     * Name of the Pipeline to bind to.
     */
    pipeline?: pulumi.Input<string>;
    /**
     * Name of the Queue to bind to.
     */
    queueName?: pulumi.Input<string>;
    /**
     * The script where the Durable Object is defined, if it is external to this Worker.
     */
    scriptName?: pulumi.Input<string>;
    /**
     * Name of the secret in the store.
     */
    secretName?: pulumi.Input<string>;
    /**
     * Name of Worker to bind to.
     */
    service?: pulumi.Input<string>;
    /**
     * The rate limit configuration.
     */
    simple?: pulumi.Input<inputs.WorkerVersionBindingSimple>;
    /**
     * ID of the store containing the secret.
     */
    storeId?: pulumi.Input<string>;
    /**
     * The text value to use.
     */
    text?: pulumi.Input<string>;
    /**
     * The kind of resource that the binding provides.
     * Available values: "ai", "analytics*engine", "assets", "browser", "d1", "data*blob", "dispatch*namespace", "durable*object*namespace", "hyperdrive", "inherit", "images", "json", "kv*namespace", "mtls*certificate", "plain*text", "pipelines", "queue", "ratelimit", "r2*bucket", "secret*text", "send*email", "service", "text*blob", "vectorize", "version*metadata", "secrets*store*secret", "secret*key", "workflow", "wasmModule".
     */
    type: pulumi.Input<string>;
    /**
     * Allowed operations with the key. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#keyUsages).
     */
    usages?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Identifier for the version to inherit the binding from, which can be the version ID or the literal "latest" to inherit from the latest version. Defaults to inheriting the binding from the latest version.
     */
    versionId?: pulumi.Input<string>;
    /**
     * Name of the Workflow to bind to.
     */
    workflowName?: pulumi.Input<string>;
}
export interface WorkerVersionBindingOutbound {
    /**
     * Pass information from the Dispatch Worker to the Outbound Worker through the parameters.
     */
    params?: pulumi.Input<pulumi.Input<inputs.WorkerVersionBindingOutboundParam>[]>;
    /**
     * Outbound worker.
     */
    worker?: pulumi.Input<inputs.WorkerVersionBindingOutboundWorker>;
}
export interface WorkerVersionBindingOutboundParam {
    /**
     * Name of the parameter.
     */
    name: pulumi.Input<string>;
}
export interface WorkerVersionBindingOutboundWorker {
    /**
     * Entrypoint to invoke on the outbound worker.
     */
    entrypoint?: pulumi.Input<string>;
    /**
     * Environment of the outbound worker.
     */
    environment?: pulumi.Input<string>;
    /**
     * Name of the outbound worker.
     */
    service?: pulumi.Input<string>;
}
export interface WorkerVersionBindingSimple {
    /**
     * The limit (requests per period).
     */
    limit: pulumi.Input<number>;
    /**
     * The period in seconds.
     */
    period: pulumi.Input<number>;
}
export interface WorkerVersionLimits {
    /**
     * CPU time limit in milliseconds.
     */
    cpuMs: pulumi.Input<number>;
}
export interface WorkerVersionMigrations {
    /**
     * A list of classes to delete Durable Object namespaces from.
     */
    deletedClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces from.
     */
    newClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces with SQLite from.
     */
    newSqliteClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Tag to set as the latest migration tag.
     */
    newTag?: pulumi.Input<string>;
    /**
     * Tag used to verify against the latest migration tag for this Worker. If they don't match, the upload is rejected.
     */
    oldTag?: pulumi.Input<string>;
    /**
     * A list of classes with Durable Object namespaces that were renamed.
     */
    renamedClasses?: pulumi.Input<pulumi.Input<inputs.WorkerVersionMigrationsRenamedClass>[]>;
    /**
     * Migrations to apply in order.
     */
    steps?: pulumi.Input<pulumi.Input<inputs.WorkerVersionMigrationsStep>[]>;
    /**
     * A list of transfers for Durable Object namespaces from a different Worker and class to a class defined in this Worker.
     */
    transferredClasses?: pulumi.Input<pulumi.Input<inputs.WorkerVersionMigrationsTransferredClass>[]>;
}
export interface WorkerVersionMigrationsRenamedClass {
    from?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkerVersionMigrationsStep {
    /**
     * A list of classes to delete Durable Object namespaces from.
     */
    deletedClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces from.
     */
    newClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces with SQLite from.
     */
    newSqliteClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes with Durable Object namespaces that were renamed.
     */
    renamedClasses?: pulumi.Input<pulumi.Input<inputs.WorkerVersionMigrationsStepRenamedClass>[]>;
    /**
     * A list of transfers for Durable Object namespaces from a different Worker and class to a class defined in this Worker.
     */
    transferredClasses?: pulumi.Input<pulumi.Input<inputs.WorkerVersionMigrationsStepTransferredClass>[]>;
}
export interface WorkerVersionMigrationsStepRenamedClass {
    from?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkerVersionMigrationsStepTransferredClass {
    from?: pulumi.Input<string>;
    fromScript?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkerVersionMigrationsTransferredClass {
    from?: pulumi.Input<string>;
    fromScript?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkerVersionModule {
    /**
     * The base64-encoded module content.
     */
    contentBase64?: pulumi.Input<string>;
    /**
     * The file path of the module content.
     */
    contentFile?: pulumi.Input<string>;
    /**
     * The SHA-256 hash of the module content.
     */
    contentSha256?: pulumi.Input<string>;
    /**
     * The content type of the module.
     */
    contentType: pulumi.Input<string>;
    /**
     * The name of the module.
     */
    name: pulumi.Input<string>;
}
export interface WorkerVersionPlacement {
    /**
     * TCP host and port for targeted placement.
     */
    host?: pulumi.Input<string>;
    /**
     * HTTP hostname for targeted placement.
     */
    hostname?: pulumi.Input<string>;
    /**
     * Enables [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement).
     * Available values: "smart", "targeted".
     */
    mode?: pulumi.Input<string>;
    /**
     * Cloud region for targeted placement in format 'provider:region'.
     */
    region?: pulumi.Input<string>;
    /**
     * Array of placement targets (currently limited to single target).
     */
    targets?: pulumi.Input<pulumi.Input<inputs.WorkerVersionPlacementTarget>[]>;
}
export interface WorkerVersionPlacementTarget {
    /**
     * TCP host:port for targeted placement.
     */
    host?: pulumi.Input<string>;
    /**
     * HTTP hostname for targeted placement.
     */
    hostname?: pulumi.Input<string>;
    /**
     * Cloud region in format 'provider:region'.
     */
    region?: pulumi.Input<string>;
}
export interface WorkersCronTriggerSchedule {
    createdOn?: pulumi.Input<string>;
    cron: pulumi.Input<string>;
    modifiedOn?: pulumi.Input<string>;
}
export interface WorkersDeploymentAnnotations {
    /**
     * Human-readable message about the deployment. Truncated to 100 bytes.
     */
    workersMessage?: pulumi.Input<string>;
    /**
     * Operation that triggered the creation of the deployment.
     */
    workersTriggeredBy?: pulumi.Input<string>;
}
export interface WorkersDeploymentVersion {
    percentage: pulumi.Input<number>;
    versionId: pulumi.Input<string>;
}
export interface WorkersScriptAssets {
    /**
     * The SHA-256 hash of the asset manifest of files to upload.
     */
    assetManifestSha256?: pulumi.Input<string>;
    /**
     * Configuration for assets within a Worker.
     */
    config?: pulumi.Input<inputs.WorkersScriptAssetsConfig>;
    /**
     * Path to the directory containing asset files to upload.
     */
    directory?: pulumi.Input<string>;
    /**
     * Token provided upon successful upload of all files from a registered manifest.
     */
    jwt?: pulumi.Input<string>;
}
export interface WorkersScriptAssetsConfig {
    /**
     * The contents of a _headers file (used to attach custom headers on asset responses).
     */
    headers?: pulumi.Input<string>;
    /**
     * Determines the redirects and rewrites of requests for HTML content.
     * Available values: "auto-trailing-slash", "force-trailing-slash", "drop-trailing-slash", "none".
     */
    htmlHandling?: pulumi.Input<string>;
    /**
     * Determines the response when a request does not match a static asset, and there is no Worker script.
     * Available values: "none", "404-page", "single-page-application".
     */
    notFoundHandling?: pulumi.Input<string>;
    /**
     * The contents of a _redirects file (used to apply redirects or proxy paths ahead of asset serving).
     */
    redirects?: pulumi.Input<string>;
    /**
     * When a boolean true, requests will always invoke the Worker script. Otherwise, attempt to serve an asset matching the request, falling back to the Worker script. When a list of strings, contains path rules to control routing to either the Worker or assets. Glob (*) and negative (!) rules are supported. Rules must start with either '/' or '!/'. At least one non-negative rule must be provided, and negative rules have higher precedence than non-negative rules.
     */
    runWorkerFirst?: any;
    /**
     * When true and the incoming request matches an asset, that will be served instead of invoking the Worker script. When false, requests will always invoke the Worker script.
     *
     * @deprecated This attribute is deprecated.
     */
    serveDirectly?: pulumi.Input<boolean>;
}
export interface WorkersScriptBinding {
    /**
     * Algorithm-specific key parameters. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#algorithm).
     */
    algorithm?: pulumi.Input<string>;
    /**
     * List of allowed destination addresses.
     */
    allowedDestinationAddresses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of allowed sender addresses.
     */
    allowedSenderAddresses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * R2 bucket to bind to.
     */
    bucketName?: pulumi.Input<string>;
    /**
     * Identifier of the certificate to bind to.
     */
    certificateId?: pulumi.Input<string>;
    /**
     * The exported class name of the Durable Object.
     */
    className?: pulumi.Input<string>;
    /**
     * The name of the dataset to bind to.
     */
    dataset?: pulumi.Input<string>;
    /**
     * Destination address for the email.
     */
    destinationAddress?: pulumi.Input<string>;
    /**
     * The environment of the scriptName to bind to.
     */
    environment?: pulumi.Input<string>;
    /**
     * Data format of the key. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#format).
     * Available values: "raw", "pkcs8", "spki", "jwk".
     */
    format?: pulumi.Input<string>;
    /**
     * Identifier of the D1 database to bind to.
     */
    id?: pulumi.Input<string>;
    /**
     * Name of the Vectorize index to bind to.
     */
    indexName?: pulumi.Input<string>;
    /**
     * JSON data to use.
     */
    json?: pulumi.Input<string>;
    /**
     * The [jurisdiction](https://developers.cloudflare.com/r2/reference/data-location/#jurisdictional-restrictions) of the R2 bucket.
     * Available values: "eu", "fedramp".
     */
    jurisdiction?: pulumi.Input<string>;
    /**
     * Base64-encoded key data. Required if `format` is "raw", "pkcs8", or "spki".
     */
    keyBase64?: pulumi.Input<string>;
    /**
     * Key data in [JSON Web Key](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#json_web_key) format. Required if `format` is "jwk".
     */
    keyJwk?: pulumi.Input<string>;
    /**
     * A JavaScript variable name for the binding.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the dispatch namespace.
     */
    namespace?: pulumi.Input<string>;
    /**
     * Namespace identifier tag.
     */
    namespaceId?: pulumi.Input<string>;
    /**
     * The old name of the inherited binding. If set, the binding will be renamed from `oldName` to `name` in the new version. If not set, the binding will keep the same name between versions.
     */
    oldName?: pulumi.Input<string>;
    /**
     * Outbound worker.
     */
    outbound?: pulumi.Input<inputs.WorkersScriptBindingOutbound>;
    /**
     * The name of the file containing the data content. Only accepted for `service worker syntax` Workers.
     */
    part?: pulumi.Input<string>;
    /**
     * Name of the Pipeline to bind to.
     */
    pipeline?: pulumi.Input<string>;
    /**
     * Name of the Queue to bind to.
     */
    queueName?: pulumi.Input<string>;
    /**
     * The script where the Durable Object is defined, if it is external to this Worker.
     */
    scriptName?: pulumi.Input<string>;
    /**
     * Name of the secret in the store.
     */
    secretName?: pulumi.Input<string>;
    /**
     * Name of Worker to bind to.
     */
    service?: pulumi.Input<string>;
    /**
     * A simple rate limit.
     */
    simple?: pulumi.Input<inputs.WorkersScriptBindingSimple>;
    /**
     * ID of the store containing the secret.
     */
    storeId?: pulumi.Input<string>;
    /**
     * The text value to use.
     */
    text?: pulumi.Input<string>;
    /**
     * The kind of resource that the binding provides.
     * Available values: "ai", "analytics*engine", "assets", "browser", "d1", "data*blob", "dispatch*namespace", "durable*object*namespace", "hyperdrive", "inherit", "images", "json", "kv*namespace", "mtls*certificate", "plain*text", "pipelines", "queue", "r2*bucket", "secret*text", "send*email", "service", "tail*consumer", "text*blob", "vectorize", "version*metadata", "secrets*store*secret", "secret*key", "workflow", "wasm*module".
     */
    type: pulumi.Input<string>;
    /**
     * Allowed operations with the key. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#keyUsages).
     */
    usages?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Identifier for the version to inherit the binding from, which can be the version ID or the literal "latest" to inherit from the latest version. Defaults to inheriting the binding from the latest version.
     */
    versionId?: pulumi.Input<string>;
    /**
     * Name of the Workflow to bind to.
     */
    workflowName?: pulumi.Input<string>;
}
export interface WorkersScriptBindingOutbound {
    /**
     * Pass information from the Dispatch Worker to the Outbound Worker through the parameters.
     */
    params?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Outbound worker.
     */
    worker?: pulumi.Input<inputs.WorkersScriptBindingOutboundWorker>;
}
export interface WorkersScriptBindingOutboundWorker {
    /**
     * Environment of the outbound worker.
     */
    environment?: pulumi.Input<string>;
    /**
     * Name of the outbound worker.
     */
    service?: pulumi.Input<string>;
}
export interface WorkersScriptBindingSimple {
    /**
     * The rate limit value.
     */
    limit: pulumi.Input<number>;
    /**
     * The rate limit period in seconds.
     */
    period: pulumi.Input<number>;
}
export interface WorkersScriptLimits {
    /**
     * The amount of CPU time this Worker can use in milliseconds.
     */
    cpuMs?: pulumi.Input<number>;
}
export interface WorkersScriptMigrations {
    /**
     * A list of classes to delete Durable Object namespaces from.
     */
    deletedClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces from.
     */
    newClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces with SQLite from.
     */
    newSqliteClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Tag to set as the latest migration tag.
     */
    newTag?: pulumi.Input<string>;
    /**
     * Tag used to verify against the latest migration tag for this Worker. If they don't match, the upload is rejected.
     */
    oldTag?: pulumi.Input<string>;
    /**
     * A list of classes with Durable Object namespaces that were renamed.
     */
    renamedClasses?: pulumi.Input<pulumi.Input<inputs.WorkersScriptMigrationsRenamedClass>[]>;
    /**
     * Migrations to apply in order.
     */
    steps?: pulumi.Input<pulumi.Input<inputs.WorkersScriptMigrationsStep>[]>;
    /**
     * A list of transfers for Durable Object namespaces from a different Worker and class to a class defined in this Worker.
     */
    transferredClasses?: pulumi.Input<pulumi.Input<inputs.WorkersScriptMigrationsTransferredClass>[]>;
}
export interface WorkersScriptMigrationsRenamedClass {
    from?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkersScriptMigrationsStep {
    /**
     * A list of classes to delete Durable Object namespaces from.
     */
    deletedClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces from.
     */
    newClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces with SQLite from.
     */
    newSqliteClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes with Durable Object namespaces that were renamed.
     */
    renamedClasses?: pulumi.Input<pulumi.Input<inputs.WorkersScriptMigrationsStepRenamedClass>[]>;
    /**
     * A list of transfers for Durable Object namespaces from a different Worker and class to a class defined in this Worker.
     */
    transferredClasses?: pulumi.Input<pulumi.Input<inputs.WorkersScriptMigrationsStepTransferredClass>[]>;
}
export interface WorkersScriptMigrationsStepRenamedClass {
    from?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkersScriptMigrationsStepTransferredClass {
    from?: pulumi.Input<string>;
    fromScript?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkersScriptMigrationsTransferredClass {
    from?: pulumi.Input<string>;
    fromScript?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkersScriptNamedHandler {
    /**
     * The names of handlers exported as part of the named export.
     */
    handlers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The name of the export.
     */
    name?: pulumi.Input<string>;
}
export interface WorkersScriptObservability {
    /**
     * Whether observability is enabled for the Worker.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The sampling rate for incoming requests. From 0 to 1 (1 = 100%, 0.1 = 10%). Default is 1.
     */
    headSamplingRate?: pulumi.Input<number>;
    /**
     * Log settings for the Worker.
     */
    logs?: pulumi.Input<inputs.WorkersScriptObservabilityLogs>;
}
export interface WorkersScriptObservabilityLogs {
    /**
     * A list of destinations where logs will be exported to.
     */
    destinations?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Whether logs are enabled for the Worker.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The sampling rate for logs. From 0 to 1 (1 = 100%, 0.1 = 10%). Default is 1.
     */
    headSamplingRate?: pulumi.Input<number>;
    /**
     * Whether [invocation logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/#invocation-logs) are enabled for the Worker.
     */
    invocationLogs: pulumi.Input<boolean>;
    /**
     * Whether log persistence is enabled for the Worker.
     */
    persist?: pulumi.Input<boolean>;
}
export interface WorkersScriptPlacement {
    /**
     * TCP host and port for targeted placement.
     */
    host?: pulumi.Input<string>;
    /**
     * HTTP hostname for targeted placement.
     */
    hostname?: pulumi.Input<string>;
    /**
     * The last time the script was analyzed for [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement).
     */
    lastAnalyzedAt?: pulumi.Input<string>;
    /**
     * Enables [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement).
     * Available values: "smart", "targeted".
     */
    mode?: pulumi.Input<string>;
    /**
     * Cloud region for targeted placement in format 'provider:region'.
     */
    region?: pulumi.Input<string>;
    /**
     * Status of [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement).
     * Available values: "SUCCESS", "UNSUPPORTED*APPLICATION", "INSUFFICIENT*INVOCATIONS".
     */
    status?: pulumi.Input<string>;
    /**
     * Array of placement targets (currently limited to single target).
     */
    targets?: pulumi.Input<pulumi.Input<inputs.WorkersScriptPlacementTarget>[]>;
}
export interface WorkersScriptPlacementTarget {
    /**
     * TCP host:port for targeted placement.
     */
    host?: pulumi.Input<string>;
    /**
     * HTTP hostname for targeted placement.
     */
    hostname?: pulumi.Input<string>;
    /**
     * Cloud region in format 'provider:region'.
     */
    region?: pulumi.Input<string>;
}
export interface WorkersScriptTailConsumer {
    /**
     * Optional environment if the Worker utilizes one.
     */
    environment?: pulumi.Input<string>;
    /**
     * Optional dispatch namespace the script belongs to.
     */
    namespace?: pulumi.Input<string>;
    /**
     * Name of Worker that is to be the consumer.
     */
    service: pulumi.Input<string>;
}
export interface WorkflowInstances {
    complete?: pulumi.Input<number>;
    errored?: pulumi.Input<number>;
    paused?: pulumi.Input<number>;
    queued?: pulumi.Input<number>;
    running?: pulumi.Input<number>;
    terminated?: pulumi.Input<number>;
    waiting?: pulumi.Input<number>;
    waitingForPause?: pulumi.Input<number>;
}
export interface ZeroTrustAccessAiControlsMcpPortalServer {
    defaultDisabled?: pulumi.Input<boolean>;
    onBehalf?: pulumi.Input<boolean>;
    /**
     * server id
     */
    serverId: pulumi.Input<string>;
    updatedPrompts?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessAiControlsMcpPortalServerUpdatedPrompt>[]>;
    updatedTools?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessAiControlsMcpPortalServerUpdatedTool>[]>;
}
export interface ZeroTrustAccessAiControlsMcpPortalServerUpdatedPrompt {
    description?: pulumi.Input<string>;
    enabled?: pulumi.Input<boolean>;
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessAiControlsMcpPortalServerUpdatedTool {
    description?: pulumi.Input<string>;
    enabled?: pulumi.Input<boolean>;
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationCorsHeaders {
    /**
     * Allows all HTTP request headers.
     */
    allowAllHeaders?: pulumi.Input<boolean>;
    /**
     * Allows all HTTP request methods.
     */
    allowAllMethods?: pulumi.Input<boolean>;
    /**
     * Allows all origins.
     */
    allowAllOrigins?: pulumi.Input<boolean>;
    /**
     * When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.
     */
    allowCredentials?: pulumi.Input<boolean>;
    /**
     * Allowed HTTP request headers.
     */
    allowedHeaders?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Allowed HTTP request methods.
     */
    allowedMethods?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Allowed origins.
     */
    allowedOrigins?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The maximum number of seconds the results of a preflight request can be cached.
     */
    maxAge?: pulumi.Input<number>;
}
export interface ZeroTrustAccessApplicationDestination {
    /**
     * The CIDR range of the destination. Single IPs will be computed as /32.
     */
    cidr?: pulumi.Input<string>;
    /**
     * The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
     */
    hostname?: pulumi.Input<string>;
    /**
     * The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.
     * Available values: "tcp", "udp".
     */
    l4Protocol?: pulumi.Input<string>;
    /**
     * A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.
     */
    mcpServerId?: pulumi.Input<string>;
    /**
     * The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.
     */
    portRange?: pulumi.Input<string>;
    /**
     * Available values: "public", "private".
     */
    type?: pulumi.Input<string>;
    /**
     * The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
     */
    uri?: pulumi.Input<string>;
    /**
     * The VNET ID to match the destination. When omitted, all VNETs will match.
     */
    vnetId?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationFooterLink {
    /**
     * The hypertext in the footer link.
     */
    name: pulumi.Input<string>;
    /**
     * the hyperlink in the footer link.
     */
    url: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationLandingPageDesign {
    /**
     * The background color of the log in button on the landing page.
     */
    buttonColor?: pulumi.Input<string>;
    /**
     * The color of the text in the log in button on the landing page.
     */
    buttonTextColor?: pulumi.Input<string>;
    /**
     * The URL of the image shown on the landing page.
     */
    imageUrl?: pulumi.Input<string>;
    /**
     * The message shown on the landing page.
     */
    message?: pulumi.Input<string>;
    /**
     * The title shown on the landing page.
     */
    title?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicy {
    /**
     * The rules that define how users may connect to the targets secured by your application.
     */
    connectionRules?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyConnectionRules>;
    /**
     * The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
     * Available values: "allow", "deny", "nonIdentity", "bypass".
     */
    decision?: pulumi.Input<string>;
    /**
     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
     */
    excludes?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExclude>[]>;
    /**
     * The UUID of the policy
     */
    id?: pulumi.Input<string>;
    /**
     * Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
     */
    includes?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyInclude>[]>;
    /**
     * The name of the Access policy.
     */
    name?: pulumi.Input<string>;
    /**
     * The order of execution for this policy. Must be unique for each policy within an app.
     */
    precedence?: pulumi.Input<number>;
    /**
     * Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
     */
    requires?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequire>[]>;
}
export interface ZeroTrustAccessApplicationPolicyConnectionRules {
    /**
     * The RDP-specific rules that define clipboard behavior for RDP connections.
     */
    rdp?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyConnectionRulesRdp>;
    /**
     * The SSH-specific rules that define how users may connect to the targets secured by your application.
     */
    ssh?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyConnectionRulesSsh>;
}
export interface ZeroTrustAccessApplicationPolicyConnectionRulesRdp {
    /**
     * Clipboard formats allowed when copying from local machine to remote RDP session.
     */
    allowedClipboardLocalToRemoteFormats?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Clipboard formats allowed when copying from remote RDP session to local machine.
     */
    allowedClipboardRemoteToLocalFormats?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ZeroTrustAccessApplicationPolicyConnectionRulesSsh {
    /**
     * Enables using Identity Provider email alias as SSH username.
     */
    allowEmailAlias?: pulumi.Input<boolean>;
    /**
     * Contains the Unix usernames that may be used when connecting over SSH.
     */
    usernames: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ZeroTrustAccessApplicationPolicyExclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeServiceToken>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeAnyValidServiceToken {
}
export interface ZeroTrustAccessApplicationPolicyExcludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeCertificate {
}
export interface ZeroTrustAccessApplicationPolicyExcludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeEveryone {
}
export interface ZeroTrustAccessApplicationPolicyExcludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyInclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeServiceToken>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeAnyValidServiceToken {
}
export interface ZeroTrustAccessApplicationPolicyIncludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeCertificate {
}
export interface ZeroTrustAccessApplicationPolicyIncludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeEveryone {
}
export interface ZeroTrustAccessApplicationPolicyIncludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequire {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireServiceToken>;
}
export interface ZeroTrustAccessApplicationPolicyRequireAnyValidServiceToken {
}
export interface ZeroTrustAccessApplicationPolicyRequireAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireCertificate {
}
export interface ZeroTrustAccessApplicationPolicyRequireCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireEveryone {
}
export interface ZeroTrustAccessApplicationPolicyRequireExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationSaasApp {
    /**
     * The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.
     */
    accessTokenLifetime?: pulumi.Input<string>;
    /**
     * If client secret should be required on the token endpoint when authorization*code*with_pkce grant is used.
     */
    allowPkceWithoutClientSecret?: pulumi.Input<boolean>;
    /**
     * The URL where this applications tile redirects users
     */
    appLauncherUrl?: pulumi.Input<string>;
    /**
     * Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"
     * Available values: "saml", "oidc".
     */
    authType?: pulumi.Input<string>;
    /**
     * The application client id
     */
    clientId?: pulumi.Input<string>;
    /**
     * The application client secret, only returned on POST request.
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.
     */
    consumerServiceUrl?: pulumi.Input<string>;
    customAttributes?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessApplicationSaasAppCustomAttribute>[]>;
    customClaims?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessApplicationSaasAppCustomClaim>[]>;
    /**
     * The URL that the user will be redirected to after a successful login for IDP initiated logins.
     */
    defaultRelayState?: pulumi.Input<string>;
    /**
     * The OIDC flows supported by this application
     */
    grantTypes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
     */
    groupFilterRegex?: pulumi.Input<string>;
    hybridAndImplicitOptions?: pulumi.Input<inputs.ZeroTrustAccessApplicationSaasAppHybridAndImplicitOptions>;
    /**
     * The unique identifier for your SaaS application.
     */
    idpEntityId?: pulumi.Input<string>;
    /**
     * The format of the name identifier sent to the SaaS application.
     * Available values: "id", "email".
     */
    nameIdFormat?: pulumi.Input<string>;
    /**
     * A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `nameIdFormat` setting.
     */
    nameIdTransformJsonata?: pulumi.Input<string>;
    /**
     * The Access public certificate that will be used to verify your identity.
     */
    publicKey?: pulumi.Input<string>;
    /**
     * The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens
     */
    redirectUris?: pulumi.Input<pulumi.Input<string>[]>;
    refreshTokenOptions?: pulumi.Input<inputs.ZeroTrustAccessApplicationSaasAppRefreshTokenOptions>;
    /**
     * A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml*attributes or oidc*fields of the identity provider used to authenticate. The output of this expression must be a JSON object.
     */
    samlAttributeTransformJsonata?: pulumi.Input<string>;
    /**
     * Define the user information shared with access, "offlineAccess" scope will be automatically enabled if refresh tokens are enabled
     */
    scopes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A globally unique name for an identity or service provider.
     */
    spEntityId?: pulumi.Input<string>;
    /**
     * The endpoint where your SaaS application will send login requests.
     */
    ssoEndpoint?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationSaasAppCustomAttribute {
    /**
     * The SAML FriendlyName of the attribute.
     */
    friendlyName?: pulumi.Input<string>;
    /**
     * The name of the attribute.
     */
    name?: pulumi.Input<string>;
    /**
     * A globally unique name for an identity or service provider.
     * Available values: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified", "urn:oasis:names:tc:SAML:2.0:attrname-format:basic", "urn:oasis:names:tc:SAML:2.0:attrname-format:uri".
     */
    nameFormat?: pulumi.Input<string>;
    /**
     * If the attribute is required when building a SAML assertion.
     */
    required?: pulumi.Input<boolean>;
    source?: pulumi.Input<inputs.ZeroTrustAccessApplicationSaasAppCustomAttributeSource>;
}
export interface ZeroTrustAccessApplicationSaasAppCustomAttributeSource {
    /**
     * The name of the IdP attribute.
     */
    name?: pulumi.Input<string>;
    /**
     * A mapping from IdP ID to attribute name.
     */
    nameByIdps?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessApplicationSaasAppCustomAttributeSourceNameByIdp>[]>;
}
export interface ZeroTrustAccessApplicationSaasAppCustomAttributeSourceNameByIdp {
    /**
     * The UID of the IdP.
     */
    idpId?: pulumi.Input<string>;
    /**
     * The name of the IdP provided attribute.
     */
    sourceName?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationSaasAppCustomClaim {
    /**
     * The name of the claim.
     */
    name?: pulumi.Input<string>;
    /**
     * If the claim is required when building an OIDC token.
     */
    required?: pulumi.Input<boolean>;
    /**
     * The scope of the claim.
     * Available values: "groups", "profile", "email", "openid".
     */
    scope?: pulumi.Input<string>;
    source?: pulumi.Input<inputs.ZeroTrustAccessApplicationSaasAppCustomClaimSource>;
}
export interface ZeroTrustAccessApplicationSaasAppCustomClaimSource {
    /**
     * The name of the IdP claim.
     */
    name?: pulumi.Input<string>;
    /**
     * A mapping from IdP ID to claim name.
     */
    nameByIdp?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
}
export interface ZeroTrustAccessApplicationSaasAppHybridAndImplicitOptions {
    /**
     * If an Access Token should be returned from the OIDC Authorization endpoint
     */
    returnAccessTokenFromAuthorizationEndpoint?: pulumi.Input<boolean>;
    /**
     * If an ID Token should be returned from the OIDC Authorization endpoint
     */
    returnIdTokenFromAuthorizationEndpoint?: pulumi.Input<boolean>;
}
export interface ZeroTrustAccessApplicationSaasAppRefreshTokenOptions {
    /**
     * How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.
     */
    lifetime?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationScimConfig {
    /**
     * Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
     */
    authentication?: pulumi.Input<inputs.ZeroTrustAccessApplicationScimConfigAuthentication>;
    /**
     * If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.
     */
    deactivateOnDelete?: pulumi.Input<boolean>;
    /**
     * Whether SCIM provisioning is turned on for this application.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The UID of the IdP to use as the source for SCIM resources to provision to this application.
     */
    idpUid: pulumi.Input<string>;
    /**
     * A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
     */
    mappings?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessApplicationScimConfigMapping>[]>;
    /**
     * The base URI for the application's SCIM-compatible API.
     */
    remoteUri: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationScimConfigAuthentication {
    /**
     * URL used to generate the auth code used during token generation.
     */
    authorizationUrl?: pulumi.Input<string>;
    /**
     * Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.
     */
    clientId?: pulumi.Input<string>;
    /**
     * Secret used to authenticate when generating a token for authenticating with the remove SCIM service.
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * Password used to authenticate with the remote SCIM service.
     */
    password?: pulumi.Input<string>;
    /**
     * The authentication scheme to use when making SCIM requests to this application.
     * Available values: "httpbasic", "oauthbearertoken", "oauth2", "access*service*token".
     */
    scheme: pulumi.Input<string>;
    /**
     * The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.
     */
    scopes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Token used to authenticate with the remote SCIM service.
     */
    token?: pulumi.Input<string>;
    /**
     * URL used to generate the token used to authenticate with the remote SCIM service.
     */
    tokenUrl?: pulumi.Input<string>;
    /**
     * User name used to authenticate with the remote SCIM service.
     */
    user?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationScimConfigMapping {
    /**
     * Whether or not this mapping is enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.
     */
    filter?: pulumi.Input<string>;
    /**
     * Whether or not this mapping applies to creates, updates, or deletes.
     */
    operations?: pulumi.Input<inputs.ZeroTrustAccessApplicationScimConfigMappingOperations>;
    /**
     * Which SCIM resource type this mapping applies to.
     */
    schema: pulumi.Input<string>;
    /**
     * The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
     * Available values: "strict", "passthrough".
     */
    strictness?: pulumi.Input<string>;
    /**
     * A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.
     */
    transformJsonata?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationScimConfigMappingOperations {
    /**
     * Whether or not this mapping applies to create (POST) operations.
     */
    create?: pulumi.Input<boolean>;
    /**
     * Whether or not this mapping applies to DELETE operations.
     */
    delete?: pulumi.Input<boolean>;
    /**
     * Whether or not this mapping applies to update (PATCH/PUT) operations.
     */
    update?: pulumi.Input<boolean>;
}
export interface ZeroTrustAccessApplicationTargetCriteria {
    /**
     * The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.
     */
    port: pulumi.Input<number>;
    /**
     * The communication protocol your application secures.
     * Available values: "SSH", "RDP".
     */
    protocol: pulumi.Input<string>;
    /**
     * Contains a map of target attribute keys to target attribute values.
     */
    targetAttributes: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
}
export interface ZeroTrustAccessGroupExclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeServiceToken>;
}
export interface ZeroTrustAccessGroupExcludeAnyValidServiceToken {
}
export interface ZeroTrustAccessGroupExcludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeCertificate {
}
export interface ZeroTrustAccessGroupExcludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeEveryone {
}
export interface ZeroTrustAccessGroupExcludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupInclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeServiceToken>;
}
export interface ZeroTrustAccessGroupIncludeAnyValidServiceToken {
}
export interface ZeroTrustAccessGroupIncludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeCertificate {
}
export interface ZeroTrustAccessGroupIncludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeEveryone {
}
export interface ZeroTrustAccessGroupIncludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequire {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireServiceToken>;
}
export interface ZeroTrustAccessGroupRequireAnyValidServiceToken {
}
export interface ZeroTrustAccessGroupRequireAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireCertificate {
}
export interface ZeroTrustAccessGroupRequireCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireEveryone {
}
export interface ZeroTrustAccessGroupRequireExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessIdentityProviderConfig {
    /**
     * Your companies TLD
     */
    appsDomain?: pulumi.Input<string>;
    /**
     * A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
     */
    attributes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The authorizationEndpoint URL of your IdP
     */
    authUrl?: pulumi.Input<string>;
    /**
     * Your okta authorization server id
     */
    authorizationServerId?: pulumi.Input<string>;
    /**
     * Your centrify account url
     */
    centrifyAccount?: pulumi.Input<string>;
    /**
     * Your centrify app id
     */
    centrifyAppId?: pulumi.Input<string>;
    /**
     * The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens
     */
    certsUrl?: pulumi.Input<string>;
    /**
     * Custom claims
     */
    claims?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Your OAuth Client ID
     */
    clientId?: pulumi.Input<string>;
    /**
     * Your OAuth Client Secret
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * Should Cloudflare try to load authentication contexts from your account
     */
    conditionalAccessEnabled?: pulumi.Input<boolean>;
    /**
     * Your Azure directory uuid
     */
    directoryId?: pulumi.Input<string>;
    /**
     * The attribute name for email in the SAML response.
     */
    emailAttributeName?: pulumi.Input<string>;
    /**
     * The claim name for email in the idToken response.
     */
    emailClaimName?: pulumi.Input<string>;
    /**
     * Add a list of attribute names that will be returned in the response header from the Access callback.
     */
    headerAttributes?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessIdentityProviderConfigHeaderAttribute>[]>;
    /**
     * X509 certificate to verify the signature in the SAML authentication response
     */
    idpPublicCerts?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * IdP Entity ID or Issuer URL
     */
    issuerUrl?: pulumi.Input<string>;
    /**
     * Your okta account url
     */
    oktaAccount?: pulumi.Input<string>;
    /**
     * Your OneLogin account url
     */
    oneloginAccount?: pulumi.Input<string>;
    /**
     * Your PingOne environment identifier
     */
    pingEnvId?: pulumi.Input<string>;
    /**
     * Enable Proof Key for Code Exchange (PKCE)
     */
    pkceEnabled?: pulumi.Input<boolean>;
    /**
     * Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interaction*required error. prompt=select*account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
     * Available values: "login", "selectAccount", "none".
     */
    prompt?: pulumi.Input<string>;
    redirectUrl?: pulumi.Input<string>;
    /**
     * OAuth scopes
     */
    scopes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
     */
    signRequest?: pulumi.Input<boolean>;
    /**
     * URL to send the SAML authentication requests to
     */
    ssoTargetUrl?: pulumi.Input<string>;
    /**
     * Should Cloudflare try to load groups from your account
     */
    supportGroups?: pulumi.Input<boolean>;
    /**
     * The tokenEndpoint URL of your IdP
     */
    tokenUrl?: pulumi.Input<string>;
}
export interface ZeroTrustAccessIdentityProviderConfigHeaderAttribute {
    /**
     * attribute name from the IDP
     */
    attributeName?: pulumi.Input<string>;
    /**
     * header that will be added on the request to the origin
     */
    headerName?: pulumi.Input<string>;
}
export interface ZeroTrustAccessIdentityProviderScimConfig {
    /**
     * A flag to enable or disable SCIM for the identity provider.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no*action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.
     * Available values: "automatic", "reauth", "no*action".
     */
    identityUpdateBehavior?: pulumi.Input<string>;
    /**
     * The base URL of Cloudflare's SCIM V2.0 API endpoint.
     */
    scimBaseUrl?: pulumi.Input<string>;
    /**
     * A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider.  This cannot be enabled unless userDeprovision is also enabled.
     */
    seatDeprovision?: pulumi.Input<boolean>;
    /**
     * A read-only token generated when the SCIM integration is enabled for the first time.  It is redacted on subsequent requests.  If you lose this you will need to refresh it at /access/identity*providers/:idpID/refresh*scim_secret.
     */
    secret?: pulumi.Input<string>;
    /**
     * A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
     */
    userDeprovision?: pulumi.Input<boolean>;
}
export interface ZeroTrustAccessInfrastructureTargetIp {
    /**
     * The target's IPv4 address
     */
    ipv4?: pulumi.Input<inputs.ZeroTrustAccessInfrastructureTargetIpIpv4>;
    /**
     * The target's IPv6 address
     */
    ipv6?: pulumi.Input<inputs.ZeroTrustAccessInfrastructureTargetIpIpv6>;
}
export interface ZeroTrustAccessInfrastructureTargetIpIpv4 {
    /**
     * IP address of the target
     */
    ipAddr?: pulumi.Input<string>;
    /**
     * (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.
     */
    virtualNetworkId?: pulumi.Input<string>;
}
export interface ZeroTrustAccessInfrastructureTargetIpIpv6 {
    /**
     * IP address of the target
     */
    ipAddr?: pulumi.Input<string>;
    /**
     * (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.
     */
    virtualNetworkId?: pulumi.Input<string>;
}
export interface ZeroTrustAccessMtlsHostnameSettingsSetting {
    /**
     * Request client certificates for this hostname in China. Can only be set to true if this zone is china network enabled.
     */
    chinaNetwork: pulumi.Input<boolean>;
    /**
     * Client Certificate Forwarding is a feature that takes the client cert provided by the eyeball to the edge, and forwards it to the origin as a HTTP header to allow logging on the origin.
     */
    clientCertificateForwarding: pulumi.Input<boolean>;
    /**
     * The hostname that these settings apply to.
     */
    hostname: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyApprovalGroup {
    /**
     * The number of approvals needed to obtain access.
     */
    approvalsNeeded: pulumi.Input<number>;
    /**
     * A list of emails that can approve the access request.
     */
    emailAddresses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The UUID of an re-usable email list.
     */
    emailListUuid?: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyConnectionRules {
    /**
     * The RDP-specific rules that define clipboard behavior for RDP connections.
     */
    rdp?: pulumi.Input<inputs.ZeroTrustAccessPolicyConnectionRulesRdp>;
}
export interface ZeroTrustAccessPolicyConnectionRulesRdp {
    /**
     * Clipboard formats allowed when copying from local machine to remote RDP session.
     */
    allowedClipboardLocalToRemoteFormats?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Clipboard formats allowed when copying from remote RDP session to local machine.
     */
    allowedClipboardRemoteToLocalFormats?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ZeroTrustAccessPolicyExclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeServiceToken>;
}
export interface ZeroTrustAccessPolicyExcludeAnyValidServiceToken {
}
export interface ZeroTrustAccessPolicyExcludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeCertificate {
}
export interface ZeroTrustAccessPolicyExcludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeEveryone {
}
export interface ZeroTrustAccessPolicyExcludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyInclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeServiceToken>;
}
export interface ZeroTrustAccessPolicyIncludeAnyValidServiceToken {
}
export interface ZeroTrustAccessPolicyIncludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeCertificate {
}
export interface ZeroTrustAccessPolicyIncludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeEveryone {
}
export interface ZeroTrustAccessPolicyIncludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyMfaConfig {
    /**
     * Lists the MFA methods that users can authenticate with.
     */
    allowedAuthenticators?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Indicates whether to bypass MFA for this resource. This option is available at the application and policy level.
     */
    mfaBypass?: pulumi.Input<boolean>;
    /**
     * Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
     */
    sessionDuration?: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequire {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireServiceToken>;
}
export interface ZeroTrustAccessPolicyRequireAnyValidServiceToken {
}
export interface ZeroTrustAccessPolicyRequireAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireCertificate {
}
export interface ZeroTrustAccessPolicyRequireCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireEveryone {
}
export interface ZeroTrustAccessPolicyRequireExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustDeviceCustomProfileExclude {
    /**
     * The address in CIDR format to exclude from the tunnel. If `address` is present, `host` must not be present.
     */
    address?: pulumi.Input<string>;
    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * The domain name to exclude from the tunnel. If `host` is present, `address` must not be present.
     */
    host?: pulumi.Input<string>;
}
export interface ZeroTrustDeviceCustomProfileFallbackDomain {
    /**
     * A description of the fallback domain, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * A list of IP addresses to handle domain resolution.
     */
    dnsServers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The domain suffix to match when resolving locally.
     */
    suffix?: pulumi.Input<string>;
}
export interface ZeroTrustDeviceCustomProfileInclude {
    /**
     * The address in CIDR format to include in the tunnel. If `address` is present, `host` must not be present.
     */
    address?: pulumi.Input<string>;
    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * The domain name to include in the tunnel. If `host` is present, `address` must not be present.
     */
    host?: pulumi.Input<string>;
}
export interface ZeroTrustDeviceCustomProfileLocalDomainFallbackDomain {
    /**
     * A description of the fallback domain, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * A list of IP addresses to handle domain resolution.
     */
    dnsServers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The domain suffix to match when resolving locally.
     */
    suffix: pulumi.Input<string>;
}
export interface ZeroTrustDeviceCustomProfileServiceModeV2 {
    /**
     * The mode to run the WARP client under.
     */
    mode?: pulumi.Input<string>;
    /**
     * The port number when used with proxy mode.
     */
    port?: pulumi.Input<number>;
}
export interface ZeroTrustDeviceCustomProfileTargetTest {
    /**
     * The id of the DEX test targeting this policy.
     */
    id?: pulumi.Input<string>;
    /**
     * The name of the DEX test targeting this policy.
     */
    name?: pulumi.Input<string>;
}
export interface ZeroTrustDeviceDefaultProfileExclude {
    /**
     * The address in CIDR format to exclude from the tunnel. If `address` is present, `host` must not be present.
     */
    address?: pulumi.Input<string>;
    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * The domain name to exclude from the tunnel. If `host` is present, `address` must not be present.
     */
    host?: pulumi.Input<string>;
}
export interface ZeroTrustDeviceDefaultProfileFallbackDomain {
    /**
     * A description of the fallback domain, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * A list of IP addresses to handle domain resolution.
     */
    dnsServers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The domain suffix to match when resolving locally.
     */
    suffix?: pulumi.Input<string>;
}
export interface ZeroTrustDeviceDefaultProfileInclude {
    /**
     * The address in CIDR format to include in the tunnel. If `address` is present, `host` must not be present.
     */
    address?: pulumi.Input<string>;
    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * The domain name to include in the tunnel. If `host` is present, `address` must not be present.
     */
    host?: pulumi.Input<string>;
}
export interface ZeroTrustDeviceDefaultProfileLocalDomainFallbackDomain {
    /**
     * A description of the fallback domain, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * A list of IP addresses to handle domain resolution.
     */
    dnsServers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The domain suffix to match when resolving locally.
     */
    suffix: pulumi.Input<string>;
}
export interface ZeroTrustDeviceDefaultProfileServiceModeV2 {
    /**
     * The mode to run the WARP client under.
     */
    mode?: pulumi.Input<string>;
    /**
     * The port number when used with proxy mode.
     */
    port?: pulumi.Input<number>;
}
export interface ZeroTrustDeviceManagedNetworksConfig {
    /**
     * The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.
     */
    sha256?: pulumi.Input<string>;
    /**
     * A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.
     */
    tlsSockaddr: pulumi.Input<string>;
}
export interface ZeroTrustDevicePostureIntegrationConfig {
    /**
     * If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `apiUrl`.
     */
    accessClientId?: pulumi.Input<string>;
    /**
     * If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `apiUrl`.
     */
    accessClientSecret?: pulumi.Input<string>;
    /**
     * The Workspace One API URL provided in the Workspace One Admin Dashboard.
     */
    apiUrl?: pulumi.Input<string>;
    /**
     * The Workspace One Authorization URL depending on your region.
     */
    authUrl?: pulumi.Input<string>;
    /**
     * The Workspace One client ID provided in the Workspace One Admin Dashboard.
     */
    clientId?: pulumi.Input<string>;
    /**
     * The Uptycs client secret.
     */
    clientKey?: pulumi.Input<string>;
    /**
     * The Workspace One client secret provided in the Workspace One Admin Dashboard.
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * The Crowdstrike customer ID.
     */
    customerId?: pulumi.Input<string>;
}
export interface ZeroTrustDevicePostureRuleInput {
    /**
     * The Number of active threats.
     */
    activeThreats?: pulumi.Input<number>;
    /**
     * UUID of Cloudflare managed certificate.
     */
    certificateId?: pulumi.Input<string>;
    /**
     * List of volume names to be checked for encryption.
     */
    checkDisks?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.
     */
    checkPrivateKey?: pulumi.Input<boolean>;
    /**
     * Common Name that is protected by the certificate.
     */
    cn?: pulumi.Input<string>;
    /**
     * Compliance Status.
     * Available values: "compliant", "noncompliant", "unknown", "notapplicable", "ingraceperiod", "error".
     */
    complianceStatus?: pulumi.Input<string>;
    /**
     * Posture Integration ID.
     */
    connectionId?: pulumi.Input<string>;
    /**
     * Count Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    countOperator?: pulumi.Input<string>;
    /**
     * Domain.
     */
    domain?: pulumi.Input<string>;
    /**
     * For more details on eid last seen, refer to the Tanium documentation.
     */
    eidLastSeen?: pulumi.Input<string>;
    /**
     * Enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Whether or not file exists.
     */
    exists?: pulumi.Input<boolean>;
    /**
     * List of values indicating purposes for which the certificate public key can be used.
     */
    extendedKeyUsages?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List ID.
     */
    id?: pulumi.Input<string>;
    /**
     * Whether device is infected.
     */
    infected?: pulumi.Input<boolean>;
    /**
     * Whether device is active.
     */
    isActive?: pulumi.Input<boolean>;
    /**
     * The Number of Issues.
     */
    issueCount?: pulumi.Input<string>;
    /**
     * For more details on last seen, please refer to the Crowdstrike documentation.
     */
    lastSeen?: pulumi.Input<string>;
    locations?: pulumi.Input<inputs.ZeroTrustDevicePostureRuleInputLocations>;
    /**
     * Network status of device.
     * Available values: "connected", "disconnected", "disconnecting", "connecting".
     */
    networkStatus?: pulumi.Input<string>;
    /**
     * Operating system.
     * Available values: "windows", "linux", "mac", "android", "ios", "chromeos".
     */
    operatingSystem?: pulumi.Input<string>;
    /**
     * Agent operational state.
     * Available values: "na", "partially*disabled", "auto*fully*disabled", "fully*disabled", "auto*partially*disabled", "disabled*error", "db*corruption".
     */
    operationalState?: pulumi.Input<string>;
    /**
     * Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    operator?: pulumi.Input<string>;
    /**
     * Os Version.
     */
    os?: pulumi.Input<string>;
    /**
     * Operating System Distribution Name (linux only).
     */
    osDistroName?: pulumi.Input<string>;
    /**
     * Version of OS Distribution (linux only).
     */
    osDistroRevision?: pulumi.Input<string>;
    /**
     * Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
     */
    osVersionExtra?: pulumi.Input<string>;
    /**
     * Overall.
     */
    overall?: pulumi.Input<string>;
    /**
     * File path.
     */
    path?: pulumi.Input<string>;
    /**
     * Whether to check all disks for encryption.
     */
    requireAll?: pulumi.Input<boolean>;
    /**
     * For more details on risk level, refer to the Tanium documentation.
     * Available values: "low", "medium", "high", "critical".
     */
    riskLevel?: pulumi.Input<string>;
    /**
     * A value between 0-100 assigned to devices set by the 3rd party posture provider.
     */
    score?: pulumi.Input<number>;
    /**
     * Score Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    scoreOperator?: pulumi.Input<string>;
    /**
     * SensorConfig.
     */
    sensorConfig?: pulumi.Input<string>;
    /**
     * SHA-256.
     */
    sha256?: pulumi.Input<string>;
    /**
     * For more details on state, please refer to the Crowdstrike documentation.
     * Available values: "online", "offline", "unknown".
     */
    state?: pulumi.Input<string>;
    /**
     * List of certificate Subject Alternative Names.
     */
    subjectAlternativeNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Signing certificate thumbprint.
     */
    thumbprint?: pulumi.Input<string>;
    /**
     * For more details on total score, refer to the Tanium documentation.
     */
    totalScore?: pulumi.Input<number>;
    /**
     * Number of days that the antivirus should be updated within.
     */
    updateWindowDays?: pulumi.Input<number>;
    /**
     * Version of OS.
     */
    version?: pulumi.Input<string>;
    /**
     * Version Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    versionOperator?: pulumi.Input<string>;
}
export interface ZeroTrustDevicePostureRuleInputLocations {
    /**
     * List of paths to check for client certificate on linux.
     */
    paths?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of trust stores to check for client certificate.
     */
    trustStores?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ZeroTrustDevicePostureRuleMatch {
    /**
     * Available values: "windows", "mac", "linux", "android", "ios", "chromeos".
     */
    platform?: pulumi.Input<string>;
}
export interface ZeroTrustDexRuleTargetedTest {
    /**
     * The configuration object which contains the details for the WARP client to conduct the test.
     */
    data?: pulumi.Input<inputs.ZeroTrustDexRuleTargetedTestData>;
    enabled?: pulumi.Input<boolean>;
    name?: pulumi.Input<string>;
    testId?: pulumi.Input<string>;
}
export interface ZeroTrustDexRuleTargetedTestData {
    /**
     * The desired endpoint to test.
     */
    host?: pulumi.Input<string>;
    /**
     * The type of test.
     * Available values: "http", "traceroute".
     */
    kind?: pulumi.Input<string>;
    /**
     * The HTTP request method type.
     * Available values: "GET".
     */
    method?: pulumi.Input<string>;
}
export interface ZeroTrustDexTestData {
    /**
     * The desired endpoint to test.
     */
    host?: pulumi.Input<string>;
    /**
     * The type of test.
     */
    kind?: pulumi.Input<string>;
    /**
     * The HTTP request method type.
     */
    method?: pulumi.Input<string>;
}
export interface ZeroTrustDexTestTargetPolicy {
    /**
     * Whether the DEX rule is the account default
     */
    default?: pulumi.Input<boolean>;
    /**
     * The id of the DEX rule
     */
    id: pulumi.Input<string>;
    /**
     * The name of the DEX rule
     */
    name?: pulumi.Input<string>;
}
export interface ZeroTrustDlpCustomEntryConfidence {
    /**
     * Indicates whether this entry has AI remote service validation.
     */
    aiContextAvailable?: pulumi.Input<boolean>;
    /**
     * Indicates whether this entry has any form of validation that is not an AI remote service.
     */
    available?: pulumi.Input<boolean>;
}
export interface ZeroTrustDlpCustomEntryPattern {
    regex: pulumi.Input<string>;
    /**
     * Available values: "luhn".
     *
     * @deprecated This attribute is deprecated.
     */
    validation?: pulumi.Input<string>;
}
export interface ZeroTrustDlpCustomEntryProfile {
    id?: pulumi.Input<string>;
    name?: pulumi.Input<string>;
}
export interface ZeroTrustDlpCustomEntryVariant {
    description?: pulumi.Input<string>;
    /**
     * Available values: "Intent", "Content".
     */
    topicType?: pulumi.Input<string>;
    /**
     * Available values: "PromptTopic".
     */
    type?: pulumi.Input<string>;
}
export interface ZeroTrustDlpCustomProfileContextAwareness {
    /**
     * If true, scan the context of predefined entries to only return matches surrounded by keywords.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Content types to exclude from context analysis and return all matches.
     */
    skip?: pulumi.Input<inputs.ZeroTrustDlpCustomProfileContextAwarenessSkip>;
}
export interface ZeroTrustDlpCustomProfileContextAwarenessSkip {
    /**
     * If the content type is a file, skip context analysis and return all matches.
     */
    files?: pulumi.Input<boolean>;
}
export interface ZeroTrustDlpCustomProfileEntry {
    description?: pulumi.Input<string>;
    enabled: pulumi.Input<boolean>;
    entryId?: pulumi.Input<string>;
    name: pulumi.Input<string>;
    pattern: pulumi.Input<inputs.ZeroTrustDlpCustomProfileEntryPattern>;
}
export interface ZeroTrustDlpCustomProfileEntryPattern {
    regex: pulumi.Input<string>;
    /**
     * Available values: "luhn".
     *
     * @deprecated This attribute is deprecated.
     */
    validation?: pulumi.Input<string>;
}
export interface ZeroTrustDlpCustomProfileSharedEntry {
    enabled: pulumi.Input<boolean>;
    entryId: pulumi.Input<string>;
    /**
     * Available values: "custom", "predefined", "integration", "exact*data", "document*fingerprint".
     */
    entryType: pulumi.Input<string>;
}
export interface ZeroTrustDlpDatasetColumn {
    entryId?: pulumi.Input<string>;
    headerName?: pulumi.Input<string>;
    numCells?: pulumi.Input<number>;
    /**
     * Available values: "empty", "uploading", "pending", "processing", "failed", "complete".
     */
    uploadStatus?: pulumi.Input<string>;
}
export interface ZeroTrustDlpDatasetDataset {
    caseSensitive?: pulumi.Input<boolean>;
    columns?: pulumi.Input<pulumi.Input<inputs.ZeroTrustDlpDatasetDatasetColumn>[]>;
    createdAt?: pulumi.Input<string>;
    /**
     * The description of the dataset.
     */
    description?: pulumi.Input<string>;
    encodingVersion?: pulumi.Input<number>;
    id?: pulumi.Input<string>;
    name?: pulumi.Input<string>;
    numCells?: pulumi.Input<number>;
    secret?: pulumi.Input<boolean>;
    /**
     * Available values: "empty", "uploading", "pending", "processing", "failed", "complete".
     */
    status?: pulumi.Input<string>;
    /**
     * Stores when the dataset was last updated.
     */
    updatedAt?: pulumi.Input<string>;
    uploads?: pulumi.Input<pulumi.Input<inputs.ZeroTrustDlpDatasetDatasetUpload>[]>;
}
export interface ZeroTrustDlpDatasetDatasetColumn {
    entryId?: pulumi.Input<string>;
    headerName?: pulumi.Input<string>;
    numCells?: pulumi.Input<number>;
    /**
     * Available values: "empty", "uploading", "pending", "processing", "failed", "complete".
     */
    uploadStatus?: pulumi.Input<string>;
}
export interface ZeroTrustDlpDatasetDatasetUpload {
    numCells?: pulumi.Input<number>;
    /**
     * Available values: "empty", "uploading", "pending", "processing", "failed", "complete".
     */
    status?: pulumi.Input<string>;
    version?: pulumi.Input<number>;
}
export interface ZeroTrustDlpDatasetUpload {
    numCells?: pulumi.Input<number>;
    /**
     * Available values: "empty", "uploading", "pending", "processing", "failed", "complete".
     */
    status?: pulumi.Input<string>;
    version?: pulumi.Input<number>;
}
export interface ZeroTrustDlpEntryConfidence {
    /**
     * Indicates whether this entry has AI remote service validation.
     */
    aiContextAvailable?: pulumi.Input<boolean>;
    /**
     * Indicates whether this entry has any form of validation that is not an AI remote service.
     */
    available?: pulumi.Input<boolean>;
}
export interface ZeroTrustDlpEntryPattern {
    regex: pulumi.Input<string>;
    /**
     * Available values: "luhn".
     *
     * @deprecated This attribute is deprecated.
     */
    validation?: pulumi.Input<string>;
}
export interface ZeroTrustDlpEntryProfile {
    id?: pulumi.Input<string>;
    name?: pulumi.Input<string>;
}
export interface ZeroTrustDlpEntryVariant {
    description?: pulumi.Input<string>;
    /**
     * Available values: "Intent", "Content".
     */
    topicType?: pulumi.Input<string>;
    /**
     * Available values: "PromptTopic".
     */
    type?: pulumi.Input<string>;
}
export interface ZeroTrustDlpIntegrationEntryConfidence {
    /**
     * Indicates whether this entry has AI remote service validation.
     */
    aiContextAvailable?: pulumi.Input<boolean>;
    /**
     * Indicates whether this entry has any form of validation that is not an AI remote service.
     */
    available?: pulumi.Input<boolean>;
}
export interface ZeroTrustDlpIntegrationEntryPattern {
    regex?: pulumi.Input<string>;
    /**
     * Available values: "luhn".
     *
     * @deprecated This attribute is deprecated.
     */
    validation?: pulumi.Input<string>;
}
export interface ZeroTrustDlpIntegrationEntryProfile {
    id?: pulumi.Input<string>;
    name?: pulumi.Input<string>;
}
export interface ZeroTrustDlpIntegrationEntryVariant {
    description?: pulumi.Input<string>;
    /**
     * Available values: "Intent", "Content".
     */
    topicType?: pulumi.Input<string>;
    /**
     * Available values: "PromptTopic".
     */
    type?: pulumi.Input<string>;
}
export interface ZeroTrustDlpPredefinedEntryConfidence {
    /**
     * Indicates whether this entry has AI remote service validation.
     */
    aiContextAvailable?: pulumi.Input<boolean>;
    /**
     * Indicates whether this entry has any form of validation that is not an AI remote service.
     */
    available?: pulumi.Input<boolean>;
}
export interface ZeroTrustDlpPredefinedEntryPattern {
    regex?: pulumi.Input<string>;
    /**
     * Available values: "luhn".
     *
     * @deprecated This attribute is deprecated.
     */
    validation?: pulumi.Input<string>;
}
export interface ZeroTrustDlpPredefinedEntryProfile {
    id?: pulumi.Input<string>;
    name?: pulumi.Input<string>;
}
export interface ZeroTrustDlpPredefinedEntryVariant {
    description?: pulumi.Input<string>;
    /**
     * Available values: "Intent", "Content".
     */
    topicType?: pulumi.Input<string>;
    /**
     * Available values: "PromptTopic".
     */
    type?: pulumi.Input<string>;
}
export interface ZeroTrustDlpPredefinedProfileEntry {
    enabled: pulumi.Input<boolean>;
    id: pulumi.Input<string>;
}
export interface ZeroTrustDnsLocationEndpoints {
    doh: pulumi.Input<inputs.ZeroTrustDnsLocationEndpointsDoh>;
    dot: pulumi.Input<inputs.ZeroTrustDnsLocationEndpointsDot>;
    ipv4: pulumi.Input<inputs.ZeroTrustDnsLocationEndpointsIpv4>;
    ipv6: pulumi.Input<inputs.ZeroTrustDnsLocationEndpointsIpv6>;
}
export interface ZeroTrustDnsLocationEndpointsDoh {
    /**
     * Indicate whether the DOH endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Specify the list of allowed source IP network ranges for this endpoint. When the list is empty, the endpoint allows all source IPs. The list takes effect only if the endpoint is enabled for this location.
     */
    networks?: pulumi.Input<pulumi.Input<inputs.ZeroTrustDnsLocationEndpointsDohNetwork>[]>;
    /**
     * Specify whether the DOH endpoint requires user identity authentication.
     */
    requireToken?: pulumi.Input<boolean>;
}
export interface ZeroTrustDnsLocationEndpointsDohNetwork {
    /**
     * Specify the IP address or IP CIDR.
     */
    network: pulumi.Input<string>;
}
export interface ZeroTrustDnsLocationEndpointsDot {
    /**
     * Indicate whether the DOT endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Specify the list of allowed source IP network ranges for this endpoint. When the list is empty, the endpoint allows all source IPs. The list takes effect only if the endpoint is enabled for this location.
     */
    networks?: pulumi.Input<pulumi.Input<inputs.ZeroTrustDnsLocationEndpointsDotNetwork>[]>;
}
export interface ZeroTrustDnsLocationEndpointsDotNetwork {
    /**
     * Specify the IP address or IP CIDR.
     */
    network: pulumi.Input<string>;
}
export interface ZeroTrustDnsLocationEndpointsIpv4 {
    /**
     * Indicate whether the IPv4 endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustDnsLocationEndpointsIpv6 {
    /**
     * Indicate whether the IPV6 endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Specify the list of allowed source IPv6 network ranges for this endpoint. When the list is empty, the endpoint allows all source IPs. The list takes effect only if the endpoint is enabled for this location.
     */
    networks?: pulumi.Input<pulumi.Input<inputs.ZeroTrustDnsLocationEndpointsIpv6Network>[]>;
}
export interface ZeroTrustDnsLocationEndpointsIpv6Network {
    /**
     * Specify the IPv6 address or IPv6 CIDR.
     */
    network: pulumi.Input<string>;
}
export interface ZeroTrustDnsLocationNetwork {
    /**
     * Specify the IPv4 address or IPv4 CIDR. Limit IPv4 CIDRs to a maximum of /24.
     */
    network: pulumi.Input<string>;
}
export interface ZeroTrustGatewayLoggingSettingsByRuleType {
    /**
     * Configure logging settings for DNS firewall.
     */
    dns?: pulumi.Input<inputs.ZeroTrustGatewayLoggingSettingsByRuleTypeDns>;
    /**
     * Configure logging settings for HTTP/HTTPS firewall.
     */
    http?: pulumi.Input<inputs.ZeroTrustGatewayLoggingSettingsByRuleTypeHttp>;
    /**
     * Configure logging settings for Network firewall.
     */
    l4?: pulumi.Input<inputs.ZeroTrustGatewayLoggingSettingsByRuleTypeL4>;
}
export interface ZeroTrustGatewayLoggingSettingsByRuleTypeDns {
    /**
     * Specify whether to log all requests to this service.
     */
    logAll?: pulumi.Input<boolean>;
    /**
     * Specify whether to log only blocking requests to this service.
     */
    logBlocks?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewayLoggingSettingsByRuleTypeHttp {
    /**
     * Specify whether to log all requests to this service.
     */
    logAll?: pulumi.Input<boolean>;
    /**
     * Specify whether to log only blocking requests to this service.
     */
    logBlocks?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewayLoggingSettingsByRuleTypeL4 {
    /**
     * Specify whether to log all requests to this service.
     */
    logAll?: pulumi.Input<boolean>;
    /**
     * Specify whether to log only blocking requests to this service.
     */
    logBlocks?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewayPolicyExpiration {
    /**
     * Defines the default duration a policy active in minutes. Must set in order to use the `resetExpiration` endpoint on this rule.
     */
    duration?: pulumi.Input<number>;
    /**
     * Indicates whether the policy is expired.
     */
    expired?: pulumi.Input<boolean>;
    /**
     * Show the timestamp when the policy expires and stops applying.  The value must follow RFC 3339 and include a UTC offset.  The system accepts non-zero offsets but converts them to the equivalent UTC+00:00  value and returns timestamps with a trailing Z. Expiration policies ignore client  timezones and expire globally at the specified expiresAt time.
     */
    expiresAt: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettings {
    /**
     * Add custom headers to allowed requests as key-value pairs. Use header names as keys that map to arrays of header values. Settable only for `http` rules with the action set to `allow`.
     */
    addHeaders?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.
     */
    allowChildBypass?: pulumi.Input<boolean>;
    /**
     * Define the settings for the Audit SSH action. Settable only for `l4` rules with `auditSsh` action.
     */
    auditSsh?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsAuditSsh>;
    /**
     * Configure browser isolation behavior. Settable only for `http` rules with the action set to `isolate`.
     */
    bisoAdminControls?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsBisoAdminControls>;
    /**
     * Configure custom block page settings. If missing or null, use the account settings. Settable only for `http` rules with the action set to `block`.
     */
    blockPage?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsBlockPage>;
    /**
     * Enable the custom block page. Settable only for `dns` rules with action `block`.
     */
    blockPageEnabled?: pulumi.Input<boolean>;
    /**
     * Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`.
     */
    blockReason?: pulumi.Input<string>;
    /**
     * Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.
     */
    bypassParentRule?: pulumi.Input<boolean>;
    /**
     * Configure session check behavior. Settable only for `l4` and `http` rules with the action set to `allow`.
     */
    checkSession?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsCheckSession>;
    /**
     * Configure custom resolvers to route queries that match the resolver policy. Unused with 'resolve*dns*through*cloudflare' or 'resolve*dns*internally' settings. DNS queries get routed to the address closest to their origin. Only valid when a rule's action set to 'resolve'. Settable only for `dnsResolver` rules.
     */
    dnsResolvers?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsDnsResolvers>;
    /**
     * Configure how Gateway Proxy traffic egresses. You can enable this setting for rules with Egress actions and filters, or omit it to indicate local egress via WARP IPs. Settable only for `egress` rules.
     */
    egress?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsEgress>;
    /**
     * Configure whether a copy of the HTTP request will be sent to storage when the rule matches.
     */
    forensicCopy?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsForensicCopy>;
    /**
     * Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dnsResolver` rules.
     */
    ignoreCnameCategoryMatches?: pulumi.Input<boolean>;
    /**
     * Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules.
     */
    insecureDisableDnssecValidation?: pulumi.Input<boolean>;
    /**
     * Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dnsResolver` rules.
     */
    ipCategories?: pulumi.Input<boolean>;
    /**
     * Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dnsResolver` rules.
     */
    ipIndicatorFeeds?: pulumi.Input<boolean>;
    /**
     * Send matching traffic to the supplied destination IP address and port. Settable only for `l4` rules with the action set to `l4Override`.
     */
    l4override?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsL4override>;
    /**
     * Configure a notification to display on the user's device when this rule matched. Settable for all types of rules with the action set to `block`.
     */
    notificationSettings?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsNotificationSettings>;
    /**
     * Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`.
     */
    overrideHost?: pulumi.Input<string>;
    /**
     * Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`.
     */
    overrideIps?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Configure DLP payload logging. Settable only for `http` rules.
     */
    payloadLog?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsPayloadLog>;
    /**
     * Configure settings that apply to quarantine rules. Settable only for `http` rules.
     */
    quarantine?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsQuarantine>;
    /**
     * Apply settings to redirect rules. Settable only for `http` rules with the action set to `redirect`.
     */
    redirect?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsRedirect>;
    /**
     * Configure to forward the query to the internal DNS service, passing the specified 'view*id' as input. Not used when 'dns*resolvers' is specified or 'resolve*dns*through*cloudflare' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dnsResolver` rules.
     */
    resolveDnsInternally?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsResolveDnsInternally>;
    /**
     * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns*resolvers' specified or 'resolve*dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dnsResolver` rules.
     */
    resolveDnsThroughCloudflare?: pulumi.Input<boolean>;
    /**
     * Configure behavior when an upstream certificate is invalid or an SSL error occurs. Settable only for `http` rules with the action set to `allow`.
     */
    untrustedCert?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsUntrustedCert>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsAuditSsh {
    /**
     * Enable SSH command logging.
     */
    commandLogging?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsBisoAdminControls {
    /**
     * Configure copy behavior. If set to remote*only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".
     * Available values: "enabled", "disabled", "remote*only".
     */
    copy?: pulumi.Input<string>;
    /**
     * Set to false to enable copy-pasting. Only applies when `version == "v1"`.
     */
    dcp?: pulumi.Input<boolean>;
    /**
     * Set to false to enable downloading. Only applies when `version == "v1"`.
     */
    dd?: pulumi.Input<boolean>;
    /**
     * Set to false to enable keyboard usage. Only applies when `version == "v1"`.
     */
    dk?: pulumi.Input<boolean>;
    /**
     * Configure download behavior. When set to remote*only, users can view downloads but cannot save them. Applies only when version == "v2".
     * Available values: "enabled", "disabled", "remote*only".
     */
    download?: pulumi.Input<string>;
    /**
     * Set to false to enable printing. Only applies when `version == "v1"`.
     */
    dp?: pulumi.Input<boolean>;
    /**
     * Set to false to enable uploading. Only applies when `version == "v1"`.
     */
    du?: pulumi.Input<boolean>;
    /**
     * Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".
     * Available values: "enabled", "disabled".
     */
    keyboard?: pulumi.Input<string>;
    /**
     * Configure paste behavior. If set to remote*only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".
     * Available values: "enabled", "disabled", "remote*only".
     */
    paste?: pulumi.Input<string>;
    /**
     * Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".
     * Available values: "enabled", "disabled".
     */
    printing?: pulumi.Input<string>;
    /**
     * Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".
     * Available values: "enabled", "disabled".
     */
    upload?: pulumi.Input<string>;
    /**
     * Indicate which version of the browser isolation controls should apply.
     * Available values: "v1", "v2".
     */
    version?: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsBlockPage {
    /**
     * Specify whether to pass the context information as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * Specify the URI to which the user is redirected.
     */
    targetUri: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsCheckSession {
    /**
     * Sets the required session freshness threshold. The API returns a normalized version of this value.
     */
    duration?: pulumi.Input<string>;
    /**
     * Enable session enforcement.
     */
    enforce?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsDnsResolvers {
    ipv4s?: pulumi.Input<pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv4>[]>;
    ipv6s?: pulumi.Input<pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv6>[]>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv4 {
    /**
     * Specify the IPv4 address of the upstream resolver.
     */
    ip: pulumi.Input<string>;
    /**
     * Specify a port number to use for the upstream resolver. Defaults to 53 if unspecified.
     */
    port?: pulumi.Input<number>;
    /**
     * Indicate whether to connect to this resolver over a private network. Must set when vnetId set.
     */
    routeThroughPrivateNetwork?: pulumi.Input<boolean>;
    /**
     * Specify an optional virtual network for this resolver. Uses default virtual network id if omitted.
     */
    vnetId?: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv6 {
    /**
     * Specify the IPv6 address of the upstream resolver.
     */
    ip: pulumi.Input<string>;
    /**
     * Specify a port number to use for the upstream resolver. Defaults to 53 if unspecified.
     */
    port?: pulumi.Input<number>;
    /**
     * Indicate whether to connect to this resolver over a private network. Must set when vnetId set.
     */
    routeThroughPrivateNetwork?: pulumi.Input<boolean>;
    /**
     * Specify an optional virtual network for this resolver. Uses default virtual network id if omitted.
     */
    vnetId?: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsEgress {
    /**
     * Specify the IPv4 address to use for egress.
     */
    ipv4?: pulumi.Input<string>;
    /**
     * Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.
     */
    ipv4Fallback?: pulumi.Input<string>;
    /**
     * Specify the IPv6 range to use for egress.
     */
    ipv6?: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsForensicCopy {
    /**
     * Enable sending the copy to storage.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsL4override {
    /**
     * Defines the IPv4 or IPv6 address.
     */
    ip?: pulumi.Input<string>;
    /**
     * Defines a port number to use for TCP/UDP overrides.
     */
    port?: pulumi.Input<number>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsNotificationSettings {
    /**
     * Enable notification.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Indicates whether to pass the context information as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * Customize the message shown in the notification.
     */
    msg?: pulumi.Input<string>;
    /**
     * Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.
     */
    supportUrl?: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsPayloadLog {
    /**
     * Enable DLP payload logging for this rule.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsQuarantine {
    /**
     * Specify the types of files to sandbox.
     */
    fileTypes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsRedirect {
    /**
     * Specify whether to pass the context information as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * Specify whether to append the path and query parameters from the original request to target_uri.
     */
    preservePathAndQuery?: pulumi.Input<boolean>;
    /**
     * Specify the URI to which the user is redirected.
     */
    targetUri: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsResolveDnsInternally {
    /**
     * Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.
     * Available values: "none", "publicDns".
     */
    fallback?: pulumi.Input<string>;
    /**
     * Specify the internal DNS view identifier to pass to the internal DNS service.
     */
    viewId?: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsUntrustedCert {
    /**
     * Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.
     * Available values: "passThrough", "block", "error".
     */
    action?: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicySchedule {
    /**
     * Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.
     */
    fri?: pulumi.Input<string>;
    /**
     * Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.
     */
    mon?: pulumi.Input<string>;
    /**
     * Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.
     */
    sat?: pulumi.Input<string>;
    /**
     * Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.
     */
    sun?: pulumi.Input<string>;
    /**
     * Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.
     */
    thu?: pulumi.Input<string>;
    /**
     * Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.
     */
    timeZone?: pulumi.Input<string>;
    /**
     * Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.
     */
    tue?: pulumi.Input<string>;
    /**
     * Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.
     */
    wed?: pulumi.Input<string>;
}
export interface ZeroTrustGatewaySettingsSettings {
    /**
     * Specify activity log settings.
     */
    activityLog?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsActivityLog>;
    /**
     * Specify anti-virus settings.
     */
    antivirus?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsAntivirus>;
    /**
     * Specify block page layout settings.
     */
    blockPage?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsBlockPage>;
    /**
     * Specify the DLP inspection mode.
     */
    bodyScanning?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsBodyScanning>;
    /**
     * Specify Clientless Browser Isolation settings.
     */
    browserIsolation?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsBrowserIsolation>;
    /**
     * Specify certificate settings for Gateway TLS interception. If unset, the Cloudflare Root CA handles interception.
     */
    certificate?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsCertificate>;
    /**
     * Specify custom certificate settings for BYO-PKI. This field is deprecated; use `certificate` instead.
     *
     * @deprecated This attribute is deprecated.
     */
    customCertificate?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsCustomCertificate>;
    /**
     * Configures user email settings for firewall policies. When you enable this, the system standardizes email addresses in the identity portion of the rule to match extended email variants in firewall policies. When you disable this setting, the system matches email addresses exactly as you provide them. Enable this setting if your email uses `.` or `+` modifiers.
     */
    extendedEmailMatching?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsExtendedEmailMatching>;
    /**
     * Specify FIPS settings.
     */
    fips?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsFips>;
    /**
     * Enable host selection in egress policies.
     */
    hostSelector?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsHostSelector>;
    /**
     * Define the proxy inspection mode.
     */
    inspection?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsInspection>;
    /**
     * Specify whether to detect protocols from the initial bytes of client traffic.
     */
    protocolDetection?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsProtocolDetection>;
    /**
     * Specify whether to enable the sandbox.
     */
    sandbox?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsSandbox>;
    /**
     * Specify whether to inspect encrypted HTTP traffic.
     */
    tlsDecrypt?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsTlsDecrypt>;
}
export interface ZeroTrustGatewaySettingsSettingsActivityLog {
    /**
     * Specify whether to log activity.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewaySettingsSettingsAntivirus {
    /**
     * Specify whether to enable anti-virus scanning on downloads.
     */
    enabledDownloadPhase?: pulumi.Input<boolean>;
    /**
     * Specify whether to enable anti-virus scanning on uploads.
     */
    enabledUploadPhase?: pulumi.Input<boolean>;
    /**
     * Specify whether to block requests for unscannable files.
     */
    failClosed?: pulumi.Input<boolean>;
    /**
     * Configure the message the user's device shows during an antivirus scan.
     */
    notificationSettings?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsAntivirusNotificationSettings>;
}
export interface ZeroTrustGatewaySettingsSettingsAntivirusNotificationSettings {
    /**
     * Specify whether to enable notifications.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Specify whether to include context information as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * Specify the message to show in the notification.
     */
    msg?: pulumi.Input<string>;
    /**
     * Specify a URL that directs users to more information. If unset, the notification opens a block page.
     */
    supportUrl?: pulumi.Input<string>;
}
export interface ZeroTrustGatewaySettingsSettingsBlockPage {
    /**
     * Specify the block page background color in `#rrggbb` format when the mode is customized*block*page.
     */
    backgroundColor?: pulumi.Input<string>;
    /**
     * Specify whether to enable the custom block page.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Specify the block page footer text when the mode is customized*block*page.
     */
    footerText?: pulumi.Input<string>;
    /**
     * Specify the block page header text when the mode is customized*block*page.
     */
    headerText?: pulumi.Input<string>;
    /**
     * Specify whether to append context to target*uri as query parameters. This applies only when the mode is redirect*uri.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * Specify the full URL to the logo file when the mode is customized*block*page.
     */
    logoPath?: pulumi.Input<string>;
    /**
     * Specify the admin email for users to contact when the mode is customized*block*page.
     */
    mailtoAddress?: pulumi.Input<string>;
    /**
     * Specify the subject line for emails created from the block page when the mode is customized*block*page.
     */
    mailtoSubject?: pulumi.Input<string>;
    /**
     * Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.
     * Available values: "", "customized*block*page", "redirectUri".
     */
    mode?: pulumi.Input<string>;
    /**
     * Specify the block page title when the mode is customized*block*page.
     */
    name?: pulumi.Input<string>;
    /**
     * Indicate that this setting was shared via the Orgs API and read only for the current account.
     */
    readOnly?: pulumi.Input<boolean>;
    /**
     * Indicate the account tag of the account that shared this setting.
     */
    sourceAccount?: pulumi.Input<string>;
    /**
     * Specify whether to suppress detailed information at the bottom of the block page when the mode is customized*block*page.
     */
    suppressFooter?: pulumi.Input<boolean>;
    /**
     * Specify the URI to redirect users to when the mode is redirect_uri.
     */
    targetUri?: pulumi.Input<string>;
    /**
     * Indicate the version number of the setting.
     */
    version?: pulumi.Input<number>;
}
export interface ZeroTrustGatewaySettingsSettingsBodyScanning {
    /**
     * Specify the inspection mode as either `deep` or `shallow`.
     * Available values: "deep", "shallow".
     */
    inspectionMode?: pulumi.Input<string>;
}
export interface ZeroTrustGatewaySettingsSettingsBrowserIsolation {
    /**
     * Specify whether to enable non-identity onramp support for Browser Isolation.
     */
    nonIdentityEnabled?: pulumi.Input<boolean>;
    /**
     * Specify whether to enable Clientless Browser Isolation.
     */
    urlBrowserIsolationEnabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewaySettingsSettingsCertificate {
    /**
     * Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustGatewaySettingsSettingsCustomCertificate {
    /**
     * Indicate the internal certificate status.
     */
    bindingStatus?: pulumi.Input<string>;
    /**
     * Specify whether to enable a custom certificate authority for signing Gateway traffic.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * Specify the UUID of the certificate (ID from MTLS certificate store).
     */
    id?: pulumi.Input<string>;
    updatedAt?: pulumi.Input<string>;
}
export interface ZeroTrustGatewaySettingsSettingsExtendedEmailMatching {
    /**
     * Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Indicate that this setting was shared via the Orgs API and read only for the current account.
     */
    readOnly?: pulumi.Input<boolean>;
    /**
     * Indicate the account tag of the account that shared this setting.
     */
    sourceAccount?: pulumi.Input<string>;
    /**
     * Indicate the version number of the setting.
     */
    version?: pulumi.Input<number>;
}
export interface ZeroTrustGatewaySettingsSettingsFips {
    /**
     * Enforce cipher suites and TLS versions compliant with FIPS 140-2.
     */
    tls?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewaySettingsSettingsHostSelector {
    /**
     * Specify whether to enable filtering via hosts for egress policies.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewaySettingsSettingsInspection {
    /**
     * Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.
     * Available values: "static", "dynamic".
     */
    mode?: pulumi.Input<string>;
}
export interface ZeroTrustGatewaySettingsSettingsProtocolDetection {
    /**
     * Specify whether to detect protocols from the initial bytes of client traffic.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewaySettingsSettingsSandbox {
    /**
     * Specify whether to enable the sandbox.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Specify the action to take when the system cannot scan the file.
     * Available values: "allow", "block".
     */
    fallbackAction?: pulumi.Input<string>;
}
export interface ZeroTrustGatewaySettingsSettingsTlsDecrypt {
    /**
     * Specify whether to inspect encrypted HTTP traffic.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustListItem {
    /**
     * Provide the list item description (optional).
     */
    description?: pulumi.Input<string>;
    /**
     * Specify the item value.
     */
    value?: pulumi.Input<string>;
}
export interface ZeroTrustLocalFallbackDomainDomain {
    /**
     * A description of the fallback domain, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * A list of IP addresses to handle domain resolution.
     */
    dnsServers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The domain suffix to match when resolving locally.
     */
    suffix: pulumi.Input<string>;
}
export interface ZeroTrustOrganizationCustomPages {
    /**
     * The uid of the custom page to use when a user is denied access after failing a non-identity rule.
     */
    forbidden?: pulumi.Input<string>;
    /**
     * The uid of the custom page to use when a user is denied access.
     */
    identityDenied?: pulumi.Input<string>;
}
export interface ZeroTrustOrganizationLoginDesign {
    /**
     * The background color on your login page.
     */
    backgroundColor?: pulumi.Input<string>;
    /**
     * The text at the bottom of your login page.
     */
    footerText?: pulumi.Input<string>;
    /**
     * The text at the top of your login page.
     */
    headerText?: pulumi.Input<string>;
    /**
     * The URL of the logo on your login page.
     */
    logoPath?: pulumi.Input<string>;
    /**
     * The text color on your login page.
     */
    textColor?: pulumi.Input<string>;
}
export interface ZeroTrustOrganizationMfaConfig {
    /**
     * Lists the MFA methods that users can authenticate with.
     */
    allowedAuthenticators?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
     */
    sessionDuration?: pulumi.Input<string>;
}
export interface ZeroTrustRiskBehaviorBehaviors {
    enabled: pulumi.Input<boolean>;
    /**
     * Available values: "low", "medium", "high".
     */
    riskLevel: pulumi.Input<string>;
}
export interface ZeroTrustTunnelCloudflaredConfigConfig {
    /**
     * List of public hostname definitions. At least one ingress rule needs to be defined for the tunnel.
     */
    ingresses?: pulumi.Input<pulumi.Input<inputs.ZeroTrustTunnelCloudflaredConfigConfigIngress>[]>;
    /**
     * Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.
     */
    originRequest?: pulumi.Input<inputs.ZeroTrustTunnelCloudflaredConfigConfigOriginRequest>;
}
export interface ZeroTrustTunnelCloudflaredConfigConfigIngress {
    /**
     * Public hostname for this service.
     */
    hostname?: pulumi.Input<string>;
    /**
     * Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.
     */
    originRequest?: pulumi.Input<inputs.ZeroTrustTunnelCloudflaredConfigConfigIngressOriginRequest>;
    /**
     * Requests with this path route to this public hostname.
     */
    path?: pulumi.Input<string>;
    /**
     * Protocol and address of destination server. Supported protocols: http://, https://, unix://, tcp://, ssh://, rdp://, unix+tls://, smb://. Alternatively can return a HTTP status code http*status:[code] e.g. 'http*status:404'.
     */
    service: pulumi.Input<string>;
}
export interface ZeroTrustTunnelCloudflaredConfigConfigIngressOriginRequest {
    /**
     * For all L7 requests to this hostname, cloudflared will validate each request's Cf-Access-Jwt-Assertion request header.
     */
    access?: pulumi.Input<inputs.ZeroTrustTunnelCloudflaredConfigConfigIngressOriginRequestAccess>;
    /**
     * Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
     */
    caPool?: pulumi.Input<string>;
    /**
     * Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.
     */
    connectTimeout?: pulumi.Input<number>;
    /**
     * Disables chunked transfer encoding. Useful if you are running a WSGI server.
     */
    disableChunkedEncoding?: pulumi.Input<boolean>;
    /**
     * Attempt to connect to origin using HTTP2. Origin must be configured as https.
     */
    http2Origin?: pulumi.Input<boolean>;
    /**
     * Sets the HTTP Host header on requests sent to the local service.
     */
    httpHostHeader?: pulumi.Input<string>;
    /**
     * Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
     */
    keepAliveConnections?: pulumi.Input<number>;
    /**
     * Timeout after which an idle keepalive connection can be discarded.
     */
    keepAliveTimeout?: pulumi.Input<number>;
    /**
     * Auto configure the Hostname on the origin server certificate.
     */
    matchSnItoHost?: pulumi.Input<boolean>;
    /**
     * Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
     */
    noHappyEyeballs?: pulumi.Input<boolean>;
    /**
     * Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
     */
    noTlsVerify?: pulumi.Input<boolean>;
    /**
     * Hostname that cloudflared should expect from your origin server certificate.
     */
    originServerName?: pulumi.Input<string>;
    /**
     * cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
     */
    proxyType?: pulumi.Input<string>;
    /**
     * The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
     */
    tcpKeepAlive?: pulumi.Input<number>;
    /**
     * Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
     */
    tlsTimeout?: pulumi.Input<number>;
}
export interface ZeroTrustTunnelCloudflaredConfigConfigIngressOriginRequestAccess {
    /**
     * Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.
     */
    audTags: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Deny traffic that has not fulfilled Access authorization.
     */
    required?: pulumi.Input<boolean>;
    teamName: pulumi.Input<string>;
}
export interface ZeroTrustTunnelCloudflaredConfigConfigOriginRequest {
    /**
     * For all L7 requests to this hostname, cloudflared will validate each request's Cf-Access-Jwt-Assertion request header.
     */
    access?: pulumi.Input<inputs.ZeroTrustTunnelCloudflaredConfigConfigOriginRequestAccess>;
    /**
     * Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
     */
    caPool?: pulumi.Input<string>;
    /**
     * Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.
     */
    connectTimeout?: pulumi.Input<number>;
    /**
     * Disables chunked transfer encoding. Useful if you are running a WSGI server.
     */
    disableChunkedEncoding?: pulumi.Input<boolean>;
    /**
     * Attempt to connect to origin using HTTP2. Origin must be configured as https.
     */
    http2Origin?: pulumi.Input<boolean>;
    /**
     * Sets the HTTP Host header on requests sent to the local service.
     */
    httpHostHeader?: pulumi.Input<string>;
    /**
     * Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
     */
    keepAliveConnections?: pulumi.Input<number>;
    /**
     * Timeout after which an idle keepalive connection can be discarded.
     */
    keepAliveTimeout?: pulumi.Input<number>;
    /**
     * Auto configure the Hostname on the origin server certificate.
     */
    matchSnItoHost?: pulumi.Input<boolean>;
    /**
     * Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
     */
    noHappyEyeballs?: pulumi.Input<boolean>;
    /**
     * Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
     */
    noTlsVerify?: pulumi.Input<boolean>;
    /**
     * Hostname that cloudflared should expect from your origin server certificate.
     */
    originServerName?: pulumi.Input<string>;
    /**
     * cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
     */
    proxyType?: pulumi.Input<string>;
    /**
     * The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
     */
    tcpKeepAlive?: pulumi.Input<number>;
    /**
     * Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
     */
    tlsTimeout?: pulumi.Input<number>;
}
export interface ZeroTrustTunnelCloudflaredConfigConfigOriginRequestAccess {
    /**
     * Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.
     */
    audTags: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Deny traffic that has not fulfilled Access authorization.
     */
    required?: pulumi.Input<boolean>;
    teamName: pulumi.Input<string>;
}
export interface ZeroTrustTunnelCloudflaredConnection {
    /**
     * UUID of the Cloudflare Tunnel connector.
     */
    clientId?: pulumi.Input<string>;
    /**
     * The cloudflared version used to establish this connection.
     */
    clientVersion?: pulumi.Input<string>;
    /**
     * The Cloudflare data center used for this connection.
     */
    coloName?: pulumi.Input<string>;
    /**
     * UUID of the Cloudflare Tunnel connection.
     */
    id?: pulumi.Input<string>;
    /**
     * Cloudflare continues to track connections for several minutes after they disconnect. This is an optimization to improve latency and reliability of reconnecting.  If `true`, the connection has disconnected but is still being tracked. If `false`, the connection is actively serving traffic.
     */
    isPendingReconnect?: pulumi.Input<boolean>;
    /**
     * Timestamp of when the connection was established.
     */
    openedAt?: pulumi.Input<string>;
    /**
     * The public IP address of the host running cloudflared.
     */
    originIp?: pulumi.Input<string>;
    /**
     * UUID of the Cloudflare Tunnel connection.
     */
    uuid?: pulumi.Input<string>;
}
export interface ZeroTrustTunnelWarpConnectorConnection {
    /**
     * UUID of the Cloudflare Tunnel connector.
     */
    clientId?: pulumi.Input<string>;
    /**
     * The cloudflared version used to establish this connection.
     */
    clientVersion?: pulumi.Input<string>;
    /**
     * The Cloudflare data center used for this connection.
     */
    coloName?: pulumi.Input<string>;
    /**
     * UUID of the Cloudflare Tunnel connection.
     */
    id?: pulumi.Input<string>;
    /**
     * Cloudflare continues to track connections for several minutes after they disconnect. This is an optimization to improve latency and reliability of reconnecting.  If `true`, the connection has disconnected but is still being tracked. If `false`, the connection is actively serving traffic.
     */
    isPendingReconnect?: pulumi.Input<boolean>;
    /**
     * Timestamp of when the connection was established.
     */
    openedAt?: pulumi.Input<string>;
    /**
     * The public IP address of the host running cloudflared.
     */
    originIp?: pulumi.Input<string>;
    /**
     * UUID of the Cloudflare Tunnel connection.
     */
    uuid?: pulumi.Input<string>;
}
export interface ZoneAccount {
    /**
     * Identifier
     */
    id?: pulumi.Input<string>;
}
export interface ZoneCacheVariantsValue {
    /**
     * List of strings with the MIME types of all the variants that should be served for avif.
     */
    avifs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for bmp.
     */
    bmps?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for gif.
     */
    gifs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for jp2.
     */
    jp2s?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for jpeg.
     */
    jpegs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for jpg2.
     */
    jpg2s?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for jpg.
     */
    jpgs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for png.
     */
    pngs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for tiff.
     */
    tiffs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for tif.
     */
    tifs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for webp.
     */
    webps?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ZoneDnsSettingsInternalDns {
    /**
     * The ID of the zone to fallback to.
     */
    referenceZoneId?: pulumi.Input<string>;
}
export interface ZoneDnsSettingsNameservers {
    /**
     * Configured nameserver set to be used for this zone
     */
    nsSet?: pulumi.Input<number>;
    /**
     * Nameserver type
     * Available values: "cloudflare.standard", "custom.account", "custom.tenant", "custom.zone".
     */
    type?: pulumi.Input<string>;
}
export interface ZoneDnsSettingsSoa {
    /**
     * Time in seconds of being unable to query the primary server after which secondary servers should stop serving the zone.
     */
    expire?: pulumi.Input<number>;
    /**
     * The time to live (TTL) for negative caching of records within the zone.
     */
    minTtl?: pulumi.Input<number>;
    /**
     * The primary nameserver, which may be used for outbound zone transfers. If null, a Cloudflare-assigned value will be used.
     */
    mname?: pulumi.Input<string>;
    /**
     * Time in seconds after which secondary servers should re-check the SOA record to see if the zone has been updated.
     */
    refresh?: pulumi.Input<number>;
    /**
     * Time in seconds after which secondary servers should retry queries after the primary server was unresponsive.
     */
    retry?: pulumi.Input<number>;
    /**
     * The email address of the zone administrator, with the first label representing the local part of the email address.
     */
    rname?: pulumi.Input<string>;
    /**
     * The time to live (TTL) of the SOA record itself.
     */
    ttl?: pulumi.Input<number>;
}
export interface ZoneLockdownConfiguration {
    /**
     * The configuration target. You must set the target to `ip` when specifying an IP address in the Zone Lockdown rule.
     * Available values: "ip", "ipRange".
     */
    target?: pulumi.Input<string>;
    /**
     * The IP address to match. This address will be compared to the IP address of incoming requests.
     */
    value?: pulumi.Input<string>;
}
export interface ZoneMeta {
    /**
     * The zone is only configured for CDN.
     */
    cdnOnly?: pulumi.Input<boolean>;
    /**
     * Number of Custom Certificates the zone can have.
     */
    customCertificateQuota?: pulumi.Input<number>;
    /**
     * The zone is only configured for DNS.
     */
    dnsOnly?: pulumi.Input<boolean>;
    /**
     * The zone is setup with Foundation DNS.
     */
    foundationDns?: pulumi.Input<boolean>;
    /**
     * Number of Page Rules a zone can have.
     */
    pageRuleQuota?: pulumi.Input<number>;
    /**
     * The zone has been flagged for phishing.
     */
    phishingDetected?: pulumi.Input<boolean>;
    step?: pulumi.Input<number>;
}
export interface ZoneOwner {
    /**
     * Identifier
     */
    id?: pulumi.Input<string>;
    /**
     * Name of the owner.
     */
    name?: pulumi.Input<string>;
    /**
     * The type of owner.
     */
    type?: pulumi.Input<string>;
}
export interface ZonePlan {
    /**
     * States if the subscription can be activated.
     */
    canSubscribe?: pulumi.Input<boolean>;
    /**
     * The denomination of the customer.
     */
    currency?: pulumi.Input<string>;
    /**
     * If this Zone is managed by another company.
     */
    externallyManaged?: pulumi.Input<boolean>;
    /**
     * How often the customer is billed.
     */
    frequency?: pulumi.Input<string>;
    /**
     * Identifier
     */
    id?: pulumi.Input<string>;
    /**
     * States if the subscription active.
     */
    isSubscribed?: pulumi.Input<boolean>;
    /**
     * If the legacy discount applies to this Zone.
     */
    legacyDiscount?: pulumi.Input<boolean>;
    /**
     * The legacy name of the plan.
     */
    legacyId?: pulumi.Input<string>;
    /**
     * Name of the owner.
     */
    name?: pulumi.Input<string>;
    /**
     * How much the customer is paying.
     */
    price?: pulumi.Input<number>;
}
export interface ZoneSubscriptionRatePlan {
    /**
     * The currency applied to the rate plan subscription.
     */
    currency?: pulumi.Input<string>;
    /**
     * Whether this rate plan is managed externally from Cloudflare.
     */
    externallyManaged?: pulumi.Input<boolean>;
    /**
     * The ID of the rate plan.
     * Available values: "free", "lite", "pro", "pro*plus", "business", "enterprise", "partners*free", "partners*pro", "partners*business", "partners*enterprise", "partners*ent".
     */
    id?: pulumi.Input<string>;
    /**
     * Whether a rate plan is enterprise-based (or newly adopted term contract).
     */
    isContract?: pulumi.Input<boolean>;
    /**
     * The full name of the rate plan.
     */
    publicName?: pulumi.Input<string>;
    /**
     * The scope that this rate plan applies to.
     */
    scope?: pulumi.Input<string>;
    /**
     * The list of sets this rate plan applies to. Returns array of strings.
     */
    sets?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ZoneTenant {
    /**
     * Identifier
     */
    id?: pulumi.Input<string>;
    /**
     * The name of the Tenant account.
     */
    name?: pulumi.Input<string>;
}
export interface ZoneTenantUnit {
    /**
     * Identifier
     */
    id?: pulumi.Input<string>;
}