import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
export interface AccessApplicationCorsHeaders {
    /**
     * Allows all HTTP request headers.
     */
    allowAllHeaders?: pulumi.Input<boolean>;
    /**
     * Allows all HTTP request methods.
     */
    allowAllMethods?: pulumi.Input<boolean>;
    /**
     * Allows all origins.
     */
    allowAllOrigins?: pulumi.Input<boolean>;
    /**
     * When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.
     */
    allowCredentials?: pulumi.Input<boolean>;
    /**
     * Allowed HTTP request headers.
     */
    allowedHeaders?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Allowed HTTP request methods.
     */
    allowedMethods?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Allowed origins.
     */
    allowedOrigins?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The maximum number of seconds the results of a preflight request can be cached.
     */
    maxAge?: pulumi.Input<number>;
}
export interface AccessApplicationDestination {
    /**
     * The CIDR range of the destination. Single IPs will be computed as /32.
     */
    cidr?: pulumi.Input<string>;
    /**
     * The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
     */
    hostname?: pulumi.Input<string>;
    /**
     * The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.
     * Available values: "tcp", "udp".
     */
    l4Protocol?: pulumi.Input<string>;
    /**
     * The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.
     */
    portRange?: pulumi.Input<string>;
    /**
     * Available values: "public", "private".
     */
    type?: pulumi.Input<string>;
    /**
     * The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
     */
    uri?: pulumi.Input<string>;
    /**
     * The VNET ID to match the destination. When omitted, all VNETs will match.
     */
    vnetId?: pulumi.Input<string>;
}
export interface AccessApplicationFooterLink {
    /**
     * The hypertext in the footer link.
     */
    name: pulumi.Input<string>;
    /**
     * the hyperlink in the footer link.
     */
    url: pulumi.Input<string>;
}
export interface AccessApplicationLandingPageDesign {
    /**
     * The background color of the log in button on the landing page.
     */
    buttonColor?: pulumi.Input<string>;
    /**
     * The color of the text in the log in button on the landing page.
     */
    buttonTextColor?: pulumi.Input<string>;
    /**
     * The URL of the image shown on the landing page.
     */
    imageUrl?: pulumi.Input<string>;
    /**
     * The message shown on the landing page.
     */
    message?: pulumi.Input<string>;
    /**
     * The title shown on the landing page.
     */
    title?: pulumi.Input<string>;
}
export interface AccessApplicationPolicy {
    /**
     * The rules that define how users may connect to the targets secured by your application.
     */
    connectionRules?: pulumi.Input<inputs.AccessApplicationPolicyConnectionRules>;
    /**
     * The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
     * Available values: "allow", "deny", "nonIdentity", "bypass".
     */
    decision?: pulumi.Input<string>;
    /**
     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
     */
    excludes?: pulumi.Input<pulumi.Input<inputs.AccessApplicationPolicyExclude>[]>;
    /**
     * The UUID of the policy
     */
    id?: pulumi.Input<string>;
    /**
     * Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
     */
    includes?: pulumi.Input<pulumi.Input<inputs.AccessApplicationPolicyInclude>[]>;
    /**
     * The name of the Access policy.
     */
    name?: pulumi.Input<string>;
    /**
     * The order of execution for this policy. Must be unique for each policy within an app.
     */
    precedence?: pulumi.Input<number>;
    /**
     * Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
     */
    requires?: pulumi.Input<pulumi.Input<inputs.AccessApplicationPolicyRequire>[]>;
}
export interface AccessApplicationPolicyConnectionRules {
    /**
     * The SSH-specific rules that define how users may connect to the targets secured by your application.
     */
    ssh?: pulumi.Input<inputs.AccessApplicationPolicyConnectionRulesSsh>;
}
export interface AccessApplicationPolicyConnectionRulesSsh {
    /**
     * Enables using Identity Provider email alias as SSH username.
     */
    allowEmailAlias?: pulumi.Input<boolean>;
    /**
     * Contains the Unix usernames that may be used when connecting over SSH.
     */
    usernames: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccessApplicationPolicyExclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessApplicationPolicyExcludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessApplicationPolicyExcludeAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessApplicationPolicyExcludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessApplicationPolicyExcludeAzureAd>;
    certificate?: pulumi.Input<inputs.AccessApplicationPolicyExcludeCertificate>;
    commonName?: pulumi.Input<inputs.AccessApplicationPolicyExcludeCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessApplicationPolicyExcludeDevicePosture>;
    email?: pulumi.Input<inputs.AccessApplicationPolicyExcludeEmail>;
    emailDomain?: pulumi.Input<inputs.AccessApplicationPolicyExcludeEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessApplicationPolicyExcludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessApplicationPolicyExcludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessApplicationPolicyExcludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessApplicationPolicyExcludeGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessApplicationPolicyExcludeGithubOrganization>;
    group?: pulumi.Input<inputs.AccessApplicationPolicyExcludeGroup>;
    gsuite?: pulumi.Input<inputs.AccessApplicationPolicyExcludeGsuite>;
    ip?: pulumi.Input<inputs.AccessApplicationPolicyExcludeIp>;
    ipList?: pulumi.Input<inputs.AccessApplicationPolicyExcludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessApplicationPolicyExcludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessApplicationPolicyExcludeLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessApplicationPolicyExcludeOidc>;
    okta?: pulumi.Input<inputs.AccessApplicationPolicyExcludeOkta>;
    saml?: pulumi.Input<inputs.AccessApplicationPolicyExcludeSaml>;
    serviceToken?: pulumi.Input<inputs.AccessApplicationPolicyExcludeServiceToken>;
}
export interface AccessApplicationPolicyExcludeAnyValidServiceToken {
}
export interface AccessApplicationPolicyExcludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeCertificate {
}
export interface AccessApplicationPolicyExcludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeEveryone {
}
export interface AccessApplicationPolicyExcludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyExcludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyInclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessApplicationPolicyIncludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessApplicationPolicyIncludeAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessApplicationPolicyIncludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessApplicationPolicyIncludeAzureAd>;
    certificate?: pulumi.Input<inputs.AccessApplicationPolicyIncludeCertificate>;
    commonName?: pulumi.Input<inputs.AccessApplicationPolicyIncludeCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessApplicationPolicyIncludeDevicePosture>;
    email?: pulumi.Input<inputs.AccessApplicationPolicyIncludeEmail>;
    emailDomain?: pulumi.Input<inputs.AccessApplicationPolicyIncludeEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessApplicationPolicyIncludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessApplicationPolicyIncludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessApplicationPolicyIncludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessApplicationPolicyIncludeGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessApplicationPolicyIncludeGithubOrganization>;
    group?: pulumi.Input<inputs.AccessApplicationPolicyIncludeGroup>;
    gsuite?: pulumi.Input<inputs.AccessApplicationPolicyIncludeGsuite>;
    ip?: pulumi.Input<inputs.AccessApplicationPolicyIncludeIp>;
    ipList?: pulumi.Input<inputs.AccessApplicationPolicyIncludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessApplicationPolicyIncludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessApplicationPolicyIncludeLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessApplicationPolicyIncludeOidc>;
    okta?: pulumi.Input<inputs.AccessApplicationPolicyIncludeOkta>;
    saml?: pulumi.Input<inputs.AccessApplicationPolicyIncludeSaml>;
    serviceToken?: pulumi.Input<inputs.AccessApplicationPolicyIncludeServiceToken>;
}
export interface AccessApplicationPolicyIncludeAnyValidServiceToken {
}
export interface AccessApplicationPolicyIncludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeCertificate {
}
export interface AccessApplicationPolicyIncludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeEveryone {
}
export interface AccessApplicationPolicyIncludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyIncludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequire {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessApplicationPolicyRequireAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessApplicationPolicyRequireAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessApplicationPolicyRequireAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessApplicationPolicyRequireAzureAd>;
    certificate?: pulumi.Input<inputs.AccessApplicationPolicyRequireCertificate>;
    commonName?: pulumi.Input<inputs.AccessApplicationPolicyRequireCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessApplicationPolicyRequireDevicePosture>;
    email?: pulumi.Input<inputs.AccessApplicationPolicyRequireEmail>;
    emailDomain?: pulumi.Input<inputs.AccessApplicationPolicyRequireEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessApplicationPolicyRequireEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessApplicationPolicyRequireEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessApplicationPolicyRequireExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessApplicationPolicyRequireGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessApplicationPolicyRequireGithubOrganization>;
    group?: pulumi.Input<inputs.AccessApplicationPolicyRequireGroup>;
    gsuite?: pulumi.Input<inputs.AccessApplicationPolicyRequireGsuite>;
    ip?: pulumi.Input<inputs.AccessApplicationPolicyRequireIp>;
    ipList?: pulumi.Input<inputs.AccessApplicationPolicyRequireIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessApplicationPolicyRequireLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessApplicationPolicyRequireLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessApplicationPolicyRequireOidc>;
    okta?: pulumi.Input<inputs.AccessApplicationPolicyRequireOkta>;
    saml?: pulumi.Input<inputs.AccessApplicationPolicyRequireSaml>;
    serviceToken?: pulumi.Input<inputs.AccessApplicationPolicyRequireServiceToken>;
}
export interface AccessApplicationPolicyRequireAnyValidServiceToken {
}
export interface AccessApplicationPolicyRequireAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireCertificate {
}
export interface AccessApplicationPolicyRequireCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireEveryone {
}
export interface AccessApplicationPolicyRequireExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessApplicationPolicyRequireServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessApplicationSaasApp {
    /**
     * The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.
     */
    accessTokenLifetime?: pulumi.Input<string>;
    /**
     * If client secret should be required on the token endpoint when authorization*code*with_pkce grant is used.
     */
    allowPkceWithoutClientSecret?: pulumi.Input<boolean>;
    /**
     * The URL where this applications tile redirects users
     */
    appLauncherUrl?: pulumi.Input<string>;
    /**
     * Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"
     * Available values: "saml", "oidc".
     */
    authType?: pulumi.Input<string>;
    /**
     * The application client id
     */
    clientId?: pulumi.Input<string>;
    /**
     * The application client secret, only returned on POST request.
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.
     */
    consumerServiceUrl?: pulumi.Input<string>;
    createdAt?: pulumi.Input<string>;
    customAttributes?: pulumi.Input<pulumi.Input<inputs.AccessApplicationSaasAppCustomAttribute>[]>;
    customClaims?: pulumi.Input<pulumi.Input<inputs.AccessApplicationSaasAppCustomClaim>[]>;
    /**
     * The URL that the user will be redirected to after a successful login for IDP initiated logins.
     */
    defaultRelayState?: pulumi.Input<string>;
    /**
     * The OIDC flows supported by this application
     */
    grantTypes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
     */
    groupFilterRegex?: pulumi.Input<string>;
    hybridAndImplicitOptions?: pulumi.Input<inputs.AccessApplicationSaasAppHybridAndImplicitOptions>;
    /**
     * The unique identifier for your SaaS application.
     */
    idpEntityId?: pulumi.Input<string>;
    /**
     * The format of the name identifier sent to the SaaS application.
     * Available values: "id", "email".
     */
    nameIdFormat?: pulumi.Input<string>;
    /**
     * A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `nameIdFormat` setting.
     */
    nameIdTransformJsonata?: pulumi.Input<string>;
    /**
     * The Access public certificate that will be used to verify your identity.
     */
    publicKey?: pulumi.Input<string>;
    /**
     * The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens
     */
    redirectUris?: pulumi.Input<pulumi.Input<string>[]>;
    refreshTokenOptions?: pulumi.Input<inputs.AccessApplicationSaasAppRefreshTokenOptions>;
    /**
     * A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml*attributes or oidc*fields of the identity provider used to authenticate. The output of this expression must be a JSON object.
     */
    samlAttributeTransformJsonata?: pulumi.Input<string>;
    /**
     * Define the user information shared with access, "offlineAccess" scope will be automatically enabled if refresh tokens are enabled
     */
    scopes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A globally unique name for an identity or service provider.
     */
    spEntityId?: pulumi.Input<string>;
    /**
     * The endpoint where your SaaS application will send login requests.
     */
    ssoEndpoint?: pulumi.Input<string>;
    updatedAt?: pulumi.Input<string>;
}
export interface AccessApplicationSaasAppCustomAttribute {
    /**
     * The SAML FriendlyName of the attribute.
     */
    friendlyName?: pulumi.Input<string>;
    /**
     * The name of the attribute.
     */
    name?: pulumi.Input<string>;
    /**
     * A globally unique name for an identity or service provider.
     * Available values: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified", "urn:oasis:names:tc:SAML:2.0:attrname-format:basic", "urn:oasis:names:tc:SAML:2.0:attrname-format:uri".
     */
    nameFormat?: pulumi.Input<string>;
    /**
     * If the attribute is required when building a SAML assertion.
     */
    required?: pulumi.Input<boolean>;
    source?: pulumi.Input<inputs.AccessApplicationSaasAppCustomAttributeSource>;
}
export interface AccessApplicationSaasAppCustomAttributeSource {
    /**
     * The name of the IdP attribute.
     */
    name?: pulumi.Input<string>;
    /**
     * A mapping from IdP ID to attribute name.
     */
    nameByIdps?: pulumi.Input<pulumi.Input<inputs.AccessApplicationSaasAppCustomAttributeSourceNameByIdp>[]>;
}
export interface AccessApplicationSaasAppCustomAttributeSourceNameByIdp {
    /**
     * The UID of the IdP.
     */
    idpId?: pulumi.Input<string>;
    /**
     * The name of the IdP provided attribute.
     */
    sourceName?: pulumi.Input<string>;
}
export interface AccessApplicationSaasAppCustomClaim {
    /**
     * The name of the claim.
     */
    name?: pulumi.Input<string>;
    /**
     * If the claim is required when building an OIDC token.
     */
    required?: pulumi.Input<boolean>;
    /**
     * The scope of the claim.
     * Available values: "groups", "profile", "email", "openid".
     */
    scope?: pulumi.Input<string>;
    source?: pulumi.Input<inputs.AccessApplicationSaasAppCustomClaimSource>;
}
export interface AccessApplicationSaasAppCustomClaimSource {
    /**
     * The name of the IdP claim.
     */
    name?: pulumi.Input<string>;
    /**
     * A mapping from IdP ID to claim name.
     */
    nameByIdp?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
}
export interface AccessApplicationSaasAppHybridAndImplicitOptions {
    /**
     * If an Access Token should be returned from the OIDC Authorization endpoint
     */
    returnAccessTokenFromAuthorizationEndpoint?: pulumi.Input<boolean>;
    /**
     * If an ID Token should be returned from the OIDC Authorization endpoint
     */
    returnIdTokenFromAuthorizationEndpoint?: pulumi.Input<boolean>;
}
export interface AccessApplicationSaasAppRefreshTokenOptions {
    /**
     * How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.
     */
    lifetime?: pulumi.Input<string>;
}
export interface AccessApplicationScimConfig {
    /**
     * Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
     */
    authentication?: pulumi.Input<inputs.AccessApplicationScimConfigAuthentication>;
    /**
     * If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.
     */
    deactivateOnDelete?: pulumi.Input<boolean>;
    /**
     * Whether SCIM provisioning is turned on for this application.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The UID of the IdP to use as the source for SCIM resources to provision to this application.
     */
    idpUid: pulumi.Input<string>;
    /**
     * A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
     */
    mappings?: pulumi.Input<pulumi.Input<inputs.AccessApplicationScimConfigMapping>[]>;
    /**
     * The base URI for the application's SCIM-compatible API.
     */
    remoteUri: pulumi.Input<string>;
}
export interface AccessApplicationScimConfigAuthentication {
    /**
     * URL used to generate the auth code used during token generation.
     */
    authorizationUrl?: pulumi.Input<string>;
    /**
     * Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.
     */
    clientId?: pulumi.Input<string>;
    /**
     * Secret used to authenticate when generating a token for authenticating with the remove SCIM service.
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * Password used to authenticate with the remote SCIM service.
     */
    password?: pulumi.Input<string>;
    /**
     * The authentication scheme to use when making SCIM requests to this application.
     * Available values: "httpbasic", "oauthbearertoken", "oauth2", "access*service*token".
     */
    scheme: pulumi.Input<string>;
    /**
     * The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.
     */
    scopes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Token used to authenticate with the remote SCIM service.
     */
    token?: pulumi.Input<string>;
    /**
     * URL used to generate the token used to authenticate with the remote SCIM service.
     */
    tokenUrl?: pulumi.Input<string>;
    /**
     * User name used to authenticate with the remote SCIM service.
     */
    user?: pulumi.Input<string>;
}
export interface AccessApplicationScimConfigMapping {
    /**
     * Whether or not this mapping is enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.
     */
    filter?: pulumi.Input<string>;
    /**
     * Whether or not this mapping applies to creates, updates, or deletes.
     */
    operations?: pulumi.Input<inputs.AccessApplicationScimConfigMappingOperations>;
    /**
     * Which SCIM resource type this mapping applies to.
     */
    schema: pulumi.Input<string>;
    /**
     * The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
     * Available values: "strict", "passthrough".
     */
    strictness?: pulumi.Input<string>;
    /**
     * A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.
     */
    transformJsonata?: pulumi.Input<string>;
}
export interface AccessApplicationScimConfigMappingOperations {
    /**
     * Whether or not this mapping applies to create (POST) operations.
     */
    create?: pulumi.Input<boolean>;
    /**
     * Whether or not this mapping applies to DELETE operations.
     */
    delete?: pulumi.Input<boolean>;
    /**
     * Whether or not this mapping applies to update (PATCH/PUT) operations.
     */
    update?: pulumi.Input<boolean>;
}
export interface AccessApplicationTargetCriteria {
    /**
     * The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.
     */
    port: pulumi.Input<number>;
    /**
     * The communication protocol your application secures.
     * Available values: "SSH", "RDP".
     */
    protocol: pulumi.Input<string>;
    /**
     * Contains a map of target attribute keys to target attribute values.
     */
    targetAttributes: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
}
export interface AccessGroupExclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessGroupExcludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessGroupExcludeAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessGroupExcludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessGroupExcludeAzureAd>;
    certificate?: pulumi.Input<inputs.AccessGroupExcludeCertificate>;
    commonName?: pulumi.Input<inputs.AccessGroupExcludeCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessGroupExcludeDevicePosture>;
    email?: pulumi.Input<inputs.AccessGroupExcludeEmail>;
    emailDomain?: pulumi.Input<inputs.AccessGroupExcludeEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessGroupExcludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessGroupExcludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessGroupExcludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessGroupExcludeGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessGroupExcludeGithubOrganization>;
    group?: pulumi.Input<inputs.AccessGroupExcludeGroup>;
    gsuite?: pulumi.Input<inputs.AccessGroupExcludeGsuite>;
    ip?: pulumi.Input<inputs.AccessGroupExcludeIp>;
    ipList?: pulumi.Input<inputs.AccessGroupExcludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessGroupExcludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessGroupExcludeLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessGroupExcludeOidc>;
    okta?: pulumi.Input<inputs.AccessGroupExcludeOkta>;
    saml?: pulumi.Input<inputs.AccessGroupExcludeSaml>;
    serviceToken?: pulumi.Input<inputs.AccessGroupExcludeServiceToken>;
}
export interface AccessGroupExcludeAnyValidServiceToken {
}
export interface AccessGroupExcludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupExcludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessGroupExcludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupExcludeCertificate {
}
export interface AccessGroupExcludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessGroupExcludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessGroupExcludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessGroupExcludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessGroupExcludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupExcludeEveryone {
}
export interface AccessGroupExcludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessGroupExcludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessGroupExcludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessGroupExcludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupExcludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupExcludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessGroupExcludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupExcludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessGroupExcludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupExcludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupExcludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessGroupExcludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupExcludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessGroupInclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessGroupIncludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessGroupIncludeAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessGroupIncludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessGroupIncludeAzureAd>;
    certificate?: pulumi.Input<inputs.AccessGroupIncludeCertificate>;
    commonName?: pulumi.Input<inputs.AccessGroupIncludeCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessGroupIncludeDevicePosture>;
    email?: pulumi.Input<inputs.AccessGroupIncludeEmail>;
    emailDomain?: pulumi.Input<inputs.AccessGroupIncludeEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessGroupIncludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessGroupIncludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessGroupIncludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessGroupIncludeGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessGroupIncludeGithubOrganization>;
    group?: pulumi.Input<inputs.AccessGroupIncludeGroup>;
    gsuite?: pulumi.Input<inputs.AccessGroupIncludeGsuite>;
    ip?: pulumi.Input<inputs.AccessGroupIncludeIp>;
    ipList?: pulumi.Input<inputs.AccessGroupIncludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessGroupIncludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessGroupIncludeLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessGroupIncludeOidc>;
    okta?: pulumi.Input<inputs.AccessGroupIncludeOkta>;
    saml?: pulumi.Input<inputs.AccessGroupIncludeSaml>;
    serviceToken?: pulumi.Input<inputs.AccessGroupIncludeServiceToken>;
}
export interface AccessGroupIncludeAnyValidServiceToken {
}
export interface AccessGroupIncludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupIncludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessGroupIncludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupIncludeCertificate {
}
export interface AccessGroupIncludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessGroupIncludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessGroupIncludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessGroupIncludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessGroupIncludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupIncludeEveryone {
}
export interface AccessGroupIncludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessGroupIncludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessGroupIncludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessGroupIncludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupIncludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupIncludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessGroupIncludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupIncludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessGroupIncludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupIncludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupIncludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessGroupIncludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupIncludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessGroupRequire {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessGroupRequireAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessGroupRequireAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessGroupRequireAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessGroupRequireAzureAd>;
    certificate?: pulumi.Input<inputs.AccessGroupRequireCertificate>;
    commonName?: pulumi.Input<inputs.AccessGroupRequireCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessGroupRequireDevicePosture>;
    email?: pulumi.Input<inputs.AccessGroupRequireEmail>;
    emailDomain?: pulumi.Input<inputs.AccessGroupRequireEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessGroupRequireEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessGroupRequireEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessGroupRequireExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessGroupRequireGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessGroupRequireGithubOrganization>;
    group?: pulumi.Input<inputs.AccessGroupRequireGroup>;
    gsuite?: pulumi.Input<inputs.AccessGroupRequireGsuite>;
    ip?: pulumi.Input<inputs.AccessGroupRequireIp>;
    ipList?: pulumi.Input<inputs.AccessGroupRequireIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessGroupRequireLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessGroupRequireLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessGroupRequireOidc>;
    okta?: pulumi.Input<inputs.AccessGroupRequireOkta>;
    saml?: pulumi.Input<inputs.AccessGroupRequireSaml>;
    serviceToken?: pulumi.Input<inputs.AccessGroupRequireServiceToken>;
}
export interface AccessGroupRequireAnyValidServiceToken {
}
export interface AccessGroupRequireAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupRequireAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessGroupRequireAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupRequireCertificate {
}
export interface AccessGroupRequireCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessGroupRequireDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessGroupRequireEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessGroupRequireEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessGroupRequireEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupRequireEveryone {
}
export interface AccessGroupRequireExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessGroupRequireGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessGroupRequireGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessGroupRequireGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupRequireGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupRequireIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessGroupRequireIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupRequireLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessGroupRequireLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessGroupRequireOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupRequireOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessGroupRequireSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessGroupRequireServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessIdentityProviderConfig {
    /**
     * Your companies TLD
     */
    appsDomain?: pulumi.Input<string>;
    /**
     * A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
     */
    attributes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The authorizationEndpoint URL of your IdP
     */
    authUrl?: pulumi.Input<string>;
    /**
     * Your okta authorization server id
     */
    authorizationServerId?: pulumi.Input<string>;
    /**
     * Your centrify account url
     */
    centrifyAccount?: pulumi.Input<string>;
    /**
     * Your centrify app id
     */
    centrifyAppId?: pulumi.Input<string>;
    /**
     * The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens
     */
    certsUrl?: pulumi.Input<string>;
    /**
     * Custom claims
     */
    claims?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Your OAuth Client ID
     */
    clientId?: pulumi.Input<string>;
    /**
     * Your OAuth Client Secret
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * Should Cloudflare try to load authentication contexts from your account
     */
    conditionalAccessEnabled?: pulumi.Input<boolean>;
    /**
     * Your Azure directory uuid
     */
    directoryId?: pulumi.Input<string>;
    /**
     * The attribute name for email in the SAML response.
     */
    emailAttributeName?: pulumi.Input<string>;
    /**
     * The claim name for email in the idToken response.
     */
    emailClaimName?: pulumi.Input<string>;
    /**
     * Add a list of attribute names that will be returned in the response header from the Access callback.
     */
    headerAttributes?: pulumi.Input<pulumi.Input<inputs.AccessIdentityProviderConfigHeaderAttribute>[]>;
    /**
     * X509 certificate to verify the signature in the SAML authentication response
     */
    idpPublicCerts?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * IdP Entity ID or Issuer URL
     */
    issuerUrl?: pulumi.Input<string>;
    /**
     * Your okta account url
     */
    oktaAccount?: pulumi.Input<string>;
    /**
     * Your OneLogin account url
     */
    oneloginAccount?: pulumi.Input<string>;
    /**
     * Your PingOne environment identifier
     */
    pingEnvId?: pulumi.Input<string>;
    /**
     * Enable Proof Key for Code Exchange (PKCE)
     */
    pkceEnabled?: pulumi.Input<boolean>;
    /**
     * Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interaction*required error. prompt=select*account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
     * Available values: "login", "selectAccount", "none".
     */
    prompt?: pulumi.Input<string>;
    redirectUrl?: pulumi.Input<string>;
    /**
     * OAuth scopes
     */
    scopes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
     */
    signRequest?: pulumi.Input<boolean>;
    /**
     * URL to send the SAML authentication requests to
     */
    ssoTargetUrl?: pulumi.Input<string>;
    /**
     * Should Cloudflare try to load groups from your account
     */
    supportGroups?: pulumi.Input<boolean>;
    /**
     * The tokenEndpoint URL of your IdP
     */
    tokenUrl?: pulumi.Input<string>;
}
export interface AccessIdentityProviderConfigHeaderAttribute {
    /**
     * attribute name from the IDP
     */
    attributeName?: pulumi.Input<string>;
    /**
     * header that will be added on the request to the origin
     */
    headerName?: pulumi.Input<string>;
}
export interface AccessIdentityProviderScimConfig {
    /**
     * A flag to enable or disable SCIM for the identity provider.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no*action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.
     * Available values: "automatic", "reauth", "no*action".
     */
    identityUpdateBehavior?: pulumi.Input<string>;
    /**
     * The base URL of Cloudflare's SCIM V2.0 API endpoint.
     */
    scimBaseUrl?: pulumi.Input<string>;
    /**
     * A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider.  This cannot be enabled unless userDeprovision is also enabled.
     */
    seatDeprovision?: pulumi.Input<boolean>;
    /**
     * A read-only token generated when the SCIM integration is enabled for the first time.  It is redacted on subsequent requests.  If you lose this you will need to refresh it at /access/identity*providers/:idpID/refresh*scim_secret.
     */
    secret?: pulumi.Input<string>;
    /**
     * A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
     */
    userDeprovision?: pulumi.Input<boolean>;
}
export interface AccessMutualTlsHostnameSettingsSetting {
    /**
     * Request client certificates for this hostname in China. Can only be set to true if this zone is china network enabled.
     */
    chinaNetwork: pulumi.Input<boolean>;
    /**
     * Client Certificate Forwarding is a feature that takes the client cert provided by the eyeball to the edge, and forwards it to the origin as a HTTP header to allow logging on the origin.
     */
    clientCertificateForwarding: pulumi.Input<boolean>;
    /**
     * The hostname that these settings apply to.
     */
    hostname: pulumi.Input<string>;
}
export interface AccessOrganizationCustomPages {
    /**
     * The uid of the custom page to use when a user is denied access after failing a non-identity rule.
     */
    forbidden?: pulumi.Input<string>;
    /**
     * The uid of the custom page to use when a user is denied access.
     */
    identityDenied?: pulumi.Input<string>;
}
export interface AccessOrganizationLoginDesign {
    /**
     * The background color on your login page.
     */
    backgroundColor?: pulumi.Input<string>;
    /**
     * The text at the bottom of your login page.
     */
    footerText?: pulumi.Input<string>;
    /**
     * The text at the top of your login page.
     */
    headerText?: pulumi.Input<string>;
    /**
     * The URL of the logo on your login page.
     */
    logoPath?: pulumi.Input<string>;
    /**
     * The text color on your login page.
     */
    textColor?: pulumi.Input<string>;
}
export interface AccessPolicyApprovalGroup {
    /**
     * The number of approvals needed to obtain access.
     */
    approvalsNeeded: pulumi.Input<number>;
    /**
     * A list of emails that can approve the access request.
     */
    emailAddresses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The UUID of an re-usable email list.
     */
    emailListUuid?: pulumi.Input<string>;
}
export interface AccessPolicyExclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessPolicyExcludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessPolicyExcludeAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessPolicyExcludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessPolicyExcludeAzureAd>;
    certificate?: pulumi.Input<inputs.AccessPolicyExcludeCertificate>;
    commonName?: pulumi.Input<inputs.AccessPolicyExcludeCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessPolicyExcludeDevicePosture>;
    email?: pulumi.Input<inputs.AccessPolicyExcludeEmail>;
    emailDomain?: pulumi.Input<inputs.AccessPolicyExcludeEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessPolicyExcludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessPolicyExcludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessPolicyExcludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessPolicyExcludeGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessPolicyExcludeGithubOrganization>;
    group?: pulumi.Input<inputs.AccessPolicyExcludeGroup>;
    gsuite?: pulumi.Input<inputs.AccessPolicyExcludeGsuite>;
    ip?: pulumi.Input<inputs.AccessPolicyExcludeIp>;
    ipList?: pulumi.Input<inputs.AccessPolicyExcludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessPolicyExcludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessPolicyExcludeLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessPolicyExcludeOidc>;
    okta?: pulumi.Input<inputs.AccessPolicyExcludeOkta>;
    saml?: pulumi.Input<inputs.AccessPolicyExcludeSaml>;
    serviceToken?: pulumi.Input<inputs.AccessPolicyExcludeServiceToken>;
}
export interface AccessPolicyExcludeAnyValidServiceToken {
}
export interface AccessPolicyExcludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyExcludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessPolicyExcludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyExcludeCertificate {
}
export interface AccessPolicyExcludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessPolicyExcludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessPolicyExcludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessPolicyExcludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessPolicyExcludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyExcludeEveryone {
}
export interface AccessPolicyExcludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessPolicyExcludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessPolicyExcludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessPolicyExcludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyExcludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyExcludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessPolicyExcludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyExcludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessPolicyExcludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyExcludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyExcludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessPolicyExcludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyExcludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessPolicyInclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessPolicyIncludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessPolicyIncludeAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessPolicyIncludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessPolicyIncludeAzureAd>;
    certificate?: pulumi.Input<inputs.AccessPolicyIncludeCertificate>;
    commonName?: pulumi.Input<inputs.AccessPolicyIncludeCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessPolicyIncludeDevicePosture>;
    email?: pulumi.Input<inputs.AccessPolicyIncludeEmail>;
    emailDomain?: pulumi.Input<inputs.AccessPolicyIncludeEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessPolicyIncludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessPolicyIncludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessPolicyIncludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessPolicyIncludeGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessPolicyIncludeGithubOrganization>;
    group?: pulumi.Input<inputs.AccessPolicyIncludeGroup>;
    gsuite?: pulumi.Input<inputs.AccessPolicyIncludeGsuite>;
    ip?: pulumi.Input<inputs.AccessPolicyIncludeIp>;
    ipList?: pulumi.Input<inputs.AccessPolicyIncludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessPolicyIncludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessPolicyIncludeLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessPolicyIncludeOidc>;
    okta?: pulumi.Input<inputs.AccessPolicyIncludeOkta>;
    saml?: pulumi.Input<inputs.AccessPolicyIncludeSaml>;
    serviceToken?: pulumi.Input<inputs.AccessPolicyIncludeServiceToken>;
}
export interface AccessPolicyIncludeAnyValidServiceToken {
}
export interface AccessPolicyIncludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyIncludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessPolicyIncludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyIncludeCertificate {
}
export interface AccessPolicyIncludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessPolicyIncludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessPolicyIncludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessPolicyIncludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessPolicyIncludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyIncludeEveryone {
}
export interface AccessPolicyIncludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessPolicyIncludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessPolicyIncludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessPolicyIncludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyIncludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyIncludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessPolicyIncludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyIncludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessPolicyIncludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyIncludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyIncludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessPolicyIncludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyIncludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessPolicyRequire {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.AccessPolicyRequireAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.AccessPolicyRequireAuthContext>;
    authMethod?: pulumi.Input<inputs.AccessPolicyRequireAuthMethod>;
    azureAd?: pulumi.Input<inputs.AccessPolicyRequireAzureAd>;
    certificate?: pulumi.Input<inputs.AccessPolicyRequireCertificate>;
    commonName?: pulumi.Input<inputs.AccessPolicyRequireCommonName>;
    devicePosture?: pulumi.Input<inputs.AccessPolicyRequireDevicePosture>;
    email?: pulumi.Input<inputs.AccessPolicyRequireEmail>;
    emailDomain?: pulumi.Input<inputs.AccessPolicyRequireEmailDomain>;
    emailList?: pulumi.Input<inputs.AccessPolicyRequireEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.AccessPolicyRequireEveryone>;
    externalEvaluation?: pulumi.Input<inputs.AccessPolicyRequireExternalEvaluation>;
    geo?: pulumi.Input<inputs.AccessPolicyRequireGeo>;
    githubOrganization?: pulumi.Input<inputs.AccessPolicyRequireGithubOrganization>;
    group?: pulumi.Input<inputs.AccessPolicyRequireGroup>;
    gsuite?: pulumi.Input<inputs.AccessPolicyRequireGsuite>;
    ip?: pulumi.Input<inputs.AccessPolicyRequireIp>;
    ipList?: pulumi.Input<inputs.AccessPolicyRequireIpList>;
    linkedAppToken?: pulumi.Input<inputs.AccessPolicyRequireLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.AccessPolicyRequireLoginMethod>;
    oidc?: pulumi.Input<inputs.AccessPolicyRequireOidc>;
    okta?: pulumi.Input<inputs.AccessPolicyRequireOkta>;
    saml?: pulumi.Input<inputs.AccessPolicyRequireSaml>;
    serviceToken?: pulumi.Input<inputs.AccessPolicyRequireServiceToken>;
}
export interface AccessPolicyRequireAnyValidServiceToken {
}
export interface AccessPolicyRequireAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyRequireAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface AccessPolicyRequireAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyRequireCertificate {
}
export interface AccessPolicyRequireCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface AccessPolicyRequireDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface AccessPolicyRequireEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface AccessPolicyRequireEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface AccessPolicyRequireEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyRequireEveryone {
}
export interface AccessPolicyRequireExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface AccessPolicyRequireGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface AccessPolicyRequireGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface AccessPolicyRequireGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyRequireGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyRequireIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface AccessPolicyRequireIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyRequireLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface AccessPolicyRequireLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface AccessPolicyRequireOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyRequireOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface AccessPolicyRequireSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface AccessPolicyRequireServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface AccessRuleConfiguration {
    /**
     * The configuration target. You must set the target to `ip` when specifying an IP address in the rule.
     * Available values: "ip", "ip6", "ipRange", "asn", "country".
     */
    target?: pulumi.Input<string>;
    /**
     * The IP address to match. This address will be compared to the IP address of incoming requests.
     */
    value?: pulumi.Input<string>;
}
export interface AccessRuleScope {
    /**
     * The contact email address of the user.
     */
    email?: pulumi.Input<string>;
    /**
     * Defines an identifier.
     */
    id?: pulumi.Input<string>;
    /**
     * Defines the scope of the rule.
     * Available values: "user", "organization".
     */
    type?: pulumi.Input<string>;
}
export interface AccountDnsSettingsZoneDefaults {
    /**
     * Whether to flatten all CNAME records in the zone. Note that, due to DNS limitations, a CNAME record at the zone apex will always be flattened.
     */
    flattenAllCnames?: pulumi.Input<boolean>;
    /**
     * Whether to enable Foundation DNS Advanced Nameservers on the zone.
     */
    foundationDns?: pulumi.Input<boolean>;
    /**
     * Settings for this internal zone.
     */
    internalDns?: pulumi.Input<inputs.AccountDnsSettingsZoneDefaultsInternalDns>;
    /**
     * Whether to enable multi-provider DNS, which causes Cloudflare to activate the zone even when non-Cloudflare NS records exist, and to respect NS records at the zone apex during outbound zone transfers.
     */
    multiProvider?: pulumi.Input<boolean>;
    /**
     * Settings determining the nameservers through which the zone should be available.
     */
    nameservers?: pulumi.Input<inputs.AccountDnsSettingsZoneDefaultsNameservers>;
    /**
     * The time to live (TTL) of the zone's nameserver (NS) records.
     */
    nsTtl?: pulumi.Input<number>;
    /**
     * Allows a Secondary DNS zone to use (proxied) override records and CNAME flattening at the zone apex.
     */
    secondaryOverrides?: pulumi.Input<boolean>;
    /**
     * Components of the zone's SOA record.
     */
    soa?: pulumi.Input<inputs.AccountDnsSettingsZoneDefaultsSoa>;
    /**
     * Whether the zone mode is a regular or CDN/DNS only zone.
     * Available values: "standard", "cdn*only", "dns*only".
     */
    zoneMode?: pulumi.Input<string>;
}
export interface AccountDnsSettingsZoneDefaultsInternalDns {
    /**
     * The ID of the zone to fallback to.
     */
    referenceZoneId?: pulumi.Input<string>;
}
export interface AccountDnsSettingsZoneDefaultsNameservers {
    /**
     * Nameserver type
     * Available values: "cloudflare.standard", "cloudflare.standard.random", "custom.account", "custom.tenant".
     */
    type: pulumi.Input<string>;
}
export interface AccountDnsSettingsZoneDefaultsSoa {
    /**
     * Time in seconds of being unable to query the primary server after which secondary servers should stop serving the zone.
     */
    expire: pulumi.Input<number>;
    /**
     * The time to live (TTL) for negative caching of records within the zone.
     */
    minTtl: pulumi.Input<number>;
    /**
     * The primary nameserver, which may be used for outbound zone transfers.
     */
    mname: pulumi.Input<string>;
    /**
     * Time in seconds after which secondary servers should re-check the SOA record to see if the zone has been updated.
     */
    refresh: pulumi.Input<number>;
    /**
     * Time in seconds after which secondary servers should retry queries after the primary server was unresponsive.
     */
    retry: pulumi.Input<number>;
    /**
     * The email address of the zone administrator, with the first label representing the local part of the email address.
     */
    rname: pulumi.Input<string>;
    /**
     * The time to live (TTL) of the SOA record itself.
     */
    ttl: pulumi.Input<number>;
}
export interface AccountMemberPolicy {
    /**
     * Allow or deny operations against the resources.
     * Available values: "allow", "deny".
     */
    access: pulumi.Input<string>;
    /**
     * Policy identifier.
     */
    id?: pulumi.Input<string>;
    /**
     * A set of permission groups that are specified to the policy.
     */
    permissionGroups: pulumi.Input<pulumi.Input<inputs.AccountMemberPolicyPermissionGroup>[]>;
    /**
     * A list of resource groups that the policy applies to.
     */
    resourceGroups: pulumi.Input<pulumi.Input<inputs.AccountMemberPolicyResourceGroup>[]>;
}
export interface AccountMemberPolicyPermissionGroup {
    /**
     * Identifier of the group.
     */
    id: pulumi.Input<string>;
}
export interface AccountMemberPolicyResourceGroup {
    /**
     * Identifier of the group.
     */
    id: pulumi.Input<string>;
}
export interface AccountMemberUser {
    /**
     * The contact email address of the user.
     */
    email?: pulumi.Input<string>;
    /**
     * User's first name
     */
    firstName?: pulumi.Input<string>;
    /**
     * Identifier
     */
    id?: pulumi.Input<string>;
    /**
     * User's last name
     */
    lastName?: pulumi.Input<string>;
    /**
     * Indicates whether two-factor authentication is enabled for the user account. Does not apply to API authentication.
     */
    twoFactorAuthenticationEnabled?: pulumi.Input<boolean>;
}
export interface AccountSettings {
    /**
     * Sets an abuse contact email to notify for abuse reports.
     */
    abuseContactEmail?: pulumi.Input<string>;
    /**
     * Indicates whether membership in this account requires that
     * Two-Factor Authentication is enabled
     */
    enforceTwofactor?: pulumi.Input<boolean>;
}
export interface AccountSubscriptionRatePlan {
    /**
     * The currency applied to the rate plan subscription.
     */
    currency?: pulumi.Input<string>;
    /**
     * Whether this rate plan is managed externally from Cloudflare.
     */
    externallyManaged?: pulumi.Input<boolean>;
    /**
     * The ID of the rate plan.
     * Available values: "free", "lite", "pro", "pro*plus", "business", "enterprise", "partners*free", "partners*pro", "partners*business", "partnersEnterprise".
     */
    id?: pulumi.Input<string>;
    /**
     * Whether a rate plan is enterprise-based (or newly adopted term contract).
     */
    isContract?: pulumi.Input<boolean>;
    /**
     * The full name of the rate plan.
     */
    publicName?: pulumi.Input<string>;
    /**
     * The scope that this rate plan applies to.
     */
    scope?: pulumi.Input<string>;
    /**
     * The list of sets this rate plan applies to.
     */
    sets?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccountTokenCondition {
    /**
     * Client IP restrictions.
     */
    requestIp?: pulumi.Input<inputs.AccountTokenConditionRequestIp>;
}
export interface AccountTokenConditionRequestIp {
    /**
     * List of IPv4/IPv6 CIDR addresses.
     */
    ins?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of IPv4/IPv6 CIDR addresses.
     */
    notIns?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface AccountTokenPolicy {
    /**
     * Allow or deny operations against the resources.
     * Available values: "allow", "deny".
     */
    effect: pulumi.Input<string>;
    /**
     * Policy identifier.
     */
    id?: pulumi.Input<string>;
    /**
     * A set of permission groups that are specified to the policy.
     */
    permissionGroups: pulumi.Input<pulumi.Input<inputs.AccountTokenPolicyPermissionGroup>[]>;
    /**
     * A list of resource names that the policy applies to.
     */
    resources: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
}
export interface AccountTokenPolicyPermissionGroup {
    /**
     * Identifier of the permission group.
     */
    id: pulumi.Input<string>;
    /**
     * Attributes associated to the permission group.
     */
    meta?: pulumi.Input<inputs.AccountTokenPolicyPermissionGroupMeta>;
    /**
     * Name of the permission group.
     */
    name?: pulumi.Input<string>;
}
export interface AccountTokenPolicyPermissionGroupMeta {
    key?: pulumi.Input<string>;
    value?: pulumi.Input<string>;
}
export interface AccountUnit {
    /**
     * Tenant unit ID
     */
    id?: pulumi.Input<string>;
}
export interface AddressMapMembership {
    /**
     * Controls whether the membership can be deleted via the API or not.
     */
    canDelete?: pulumi.Input<boolean>;
    createdAt?: pulumi.Input<string>;
    /**
     * The identifier for the membership (eg. a zone or account tag).
     */
    identifier?: pulumi.Input<string>;
    /**
     * The type of the membership.
     * Available values: "zone", "account".
     */
    kind?: pulumi.Input<string>;
}
export interface ApiShieldAuthIdCharacteristic {
    /**
     * The name of the characteristic field, i.e., the header or cookie name.
     */
    name: pulumi.Input<string>;
    /**
     * The type of characteristic.
     * Available values: "header", "cookie", "jwt".
     */
    type: pulumi.Input<string>;
}
export interface ApiShieldError {
    code?: pulumi.Input<number>;
    documentationUrl?: pulumi.Input<string>;
    message?: pulumi.Input<string>;
    source?: pulumi.Input<inputs.ApiShieldErrorSource>;
}
export interface ApiShieldErrorSource {
    pointer?: pulumi.Input<string>;
}
export interface ApiShieldMessage {
    code?: pulumi.Input<number>;
    documentationUrl?: pulumi.Input<string>;
    message?: pulumi.Input<string>;
    source?: pulumi.Input<inputs.ApiShieldMessageSource>;
}
export interface ApiShieldMessageSource {
    pointer?: pulumi.Input<string>;
}
export interface ApiShieldOperationFeatures {
    /**
     * API Routing settings on endpoint.
     */
    apiRouting?: pulumi.Input<inputs.ApiShieldOperationFeaturesApiRouting>;
    confidenceIntervals?: pulumi.Input<inputs.ApiShieldOperationFeaturesConfidenceIntervals>;
    parameterSchemas?: pulumi.Input<inputs.ApiShieldOperationFeaturesParameterSchemas>;
    schemaInfo?: pulumi.Input<inputs.ApiShieldOperationFeaturesSchemaInfo>;
    thresholds?: pulumi.Input<inputs.ApiShieldOperationFeaturesThresholds>;
}
export interface ApiShieldOperationFeaturesApiRouting {
    lastUpdated?: pulumi.Input<string>;
    /**
     * Target route.
     */
    route?: pulumi.Input<string>;
}
export interface ApiShieldOperationFeaturesConfidenceIntervals {
    lastUpdated?: pulumi.Input<string>;
    suggestedThreshold?: pulumi.Input<inputs.ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThreshold>;
}
export interface ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThreshold {
    confidenceIntervals?: pulumi.Input<inputs.ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervals>;
    /**
     * Suggested threshold.
     */
    mean?: pulumi.Input<number>;
}
export interface ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervals {
    /**
     * Upper and lower bound for percentile estimate
     */
    p90?: pulumi.Input<inputs.ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervalsP90>;
    /**
     * Upper and lower bound for percentile estimate
     */
    p95?: pulumi.Input<inputs.ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervalsP95>;
    /**
     * Upper and lower bound for percentile estimate
     */
    p99?: pulumi.Input<inputs.ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervalsP99>;
}
export interface ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervalsP90 {
    /**
     * Lower bound for percentile estimate
     */
    lower?: pulumi.Input<number>;
    /**
     * Upper bound for percentile estimate
     */
    upper?: pulumi.Input<number>;
}
export interface ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervalsP95 {
    /**
     * Lower bound for percentile estimate
     */
    lower?: pulumi.Input<number>;
    /**
     * Upper bound for percentile estimate
     */
    upper?: pulumi.Input<number>;
}
export interface ApiShieldOperationFeaturesConfidenceIntervalsSuggestedThresholdConfidenceIntervalsP99 {
    /**
     * Lower bound for percentile estimate
     */
    lower?: pulumi.Input<number>;
    /**
     * Upper bound for percentile estimate
     */
    upper?: pulumi.Input<number>;
}
export interface ApiShieldOperationFeaturesParameterSchemas {
    lastUpdated?: pulumi.Input<string>;
    /**
     * An operation schema object containing a response.
     */
    parameterSchemas?: pulumi.Input<inputs.ApiShieldOperationFeaturesParameterSchemasParameterSchemas>;
}
export interface ApiShieldOperationFeaturesParameterSchemasParameterSchemas {
    /**
     * An array containing the learned parameter schemas.
     */
    parameters?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * An empty response object. This field is required to yield a valid operation schema.
     */
    responses?: pulumi.Input<string>;
}
export interface ApiShieldOperationFeaturesSchemaInfo {
    /**
     * Schema active on endpoint.
     */
    activeSchema?: pulumi.Input<inputs.ApiShieldOperationFeaturesSchemaInfoActiveSchema>;
    /**
     * True if a Cloudflare-provided learned schema is available for this endpoint.
     */
    learnedAvailable?: pulumi.Input<boolean>;
    /**
     * Action taken on requests failing validation.
     * Available values: "none", "log", "block".
     */
    mitigationAction?: pulumi.Input<string>;
}
export interface ApiShieldOperationFeaturesSchemaInfoActiveSchema {
    createdAt?: pulumi.Input<string>;
    /**
     * UUID.
     */
    id?: pulumi.Input<string>;
    /**
     * True if schema is Cloudflare-provided.
     */
    isLearned?: pulumi.Input<boolean>;
    /**
     * Schema file name.
     */
    name?: pulumi.Input<string>;
}
export interface ApiShieldOperationFeaturesThresholds {
    /**
     * The total number of auth-ids seen across this calculation.
     */
    authIdTokens?: pulumi.Input<number>;
    /**
     * The number of data points used for the threshold suggestion calculation.
     */
    dataPoints?: pulumi.Input<number>;
    lastUpdated?: pulumi.Input<string>;
    /**
     * The p50 quantile of requests (in period_seconds).
     */
    p50?: pulumi.Input<number>;
    /**
     * The p90 quantile of requests (in period_seconds).
     */
    p90?: pulumi.Input<number>;
    /**
     * The p99 quantile of requests (in period_seconds).
     */
    p99?: pulumi.Input<number>;
    /**
     * The period over which this threshold is suggested.
     */
    periodSeconds?: pulumi.Input<number>;
    /**
     * The estimated number of requests covered by these calculations.
     */
    requests?: pulumi.Input<number>;
    /**
     * The suggested threshold in requests done by the same auth*id or period*seconds.
     */
    suggestedThreshold?: pulumi.Input<number>;
}
export interface ApiShieldSchemaSchema {
    createdAt?: pulumi.Input<string>;
    /**
     * Kind of schema
     * Available values: "openapiV3".
     */
    kind?: pulumi.Input<string>;
    /**
     * Name of the schema
     */
    name?: pulumi.Input<string>;
    /**
     * UUID.
     */
    schemaId?: pulumi.Input<string>;
    /**
     * Source of the schema
     */
    source?: pulumi.Input<string>;
    /**
     * Flag whether schema is enabled for validation.
     */
    validationEnabled?: pulumi.Input<boolean>;
}
export interface ApiShieldSchemaUploadDetails {
    /**
     * Diagnostic warning events that occurred during processing. These events are non-critical errors found within the schema.
     */
    warnings?: pulumi.Input<pulumi.Input<inputs.ApiShieldSchemaUploadDetailsWarning>[]>;
}
export interface ApiShieldSchemaUploadDetailsWarning {
    /**
     * Code that identifies the event that occurred.
     */
    code?: pulumi.Input<number>;
    /**
     * JSONPath location(s) in the schema where these events were encountered.  See [https://goessner.net/articles/JsonPath/](https://goessner.net/articles/JsonPath/) for JSONPath specification.
     */
    locations?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Diagnostic message that describes the event.
     */
    message?: pulumi.Input<string>;
}
export interface ApiTokenCondition {
    /**
     * Client IP restrictions.
     */
    requestIp?: pulumi.Input<inputs.ApiTokenConditionRequestIp>;
}
export interface ApiTokenConditionRequestIp {
    /**
     * List of IPv4/IPv6 CIDR addresses.
     */
    ins?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of IPv4/IPv6 CIDR addresses.
     */
    notIns?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ApiTokenPolicy {
    /**
     * Allow or deny operations against the resources.
     * Available values: "allow", "deny".
     */
    effect: pulumi.Input<string>;
    /**
     * Policy identifier.
     */
    id?: pulumi.Input<string>;
    /**
     * A set of permission groups that are specified to the policy.
     */
    permissionGroups: pulumi.Input<pulumi.Input<inputs.ApiTokenPolicyPermissionGroup>[]>;
    /**
     * A list of resource names that the policy applies to.
     */
    resources: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
}
export interface ApiTokenPolicyPermissionGroup {
    /**
     * Identifier of the permission group.
     */
    id: pulumi.Input<string>;
    /**
     * Attributes associated to the permission group.
     */
    meta?: pulumi.Input<inputs.ApiTokenPolicyPermissionGroupMeta>;
    /**
     * Name of the permission group.
     */
    name?: pulumi.Input<string>;
}
export interface ApiTokenPolicyPermissionGroupMeta {
    key?: pulumi.Input<string>;
    value?: pulumi.Input<string>;
}
export interface AuthenticatedOriginPullsConfig {
    /**
     * Certificate identifier tag.
     */
    certId?: pulumi.Input<string>;
    /**
     * Indicates whether hostname-level authenticated origin pulls is enabled. A null value voids the association.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The hostname on the origin for which the client certificate uploaded will be used.
     */
    hostname?: pulumi.Input<string>;
}
export interface BotManagementStaleZoneConfiguration {
    /**
     * Indicates that the zone's Bot Fight Mode is turned on.
     */
    fightMode?: pulumi.Input<boolean>;
    /**
     * Indicates that the zone's wordpress optimization for SBFM is turned on.
     */
    optimizeWordpress?: pulumi.Input<boolean>;
    /**
     * Indicates that the zone's definitely automated requests are being blocked or challenged.
     */
    sbfmDefinitelyAutomated?: pulumi.Input<string>;
    /**
     * Indicates that the zone's likely automated requests are being blocked or challenged.
     */
    sbfmLikelyAutomated?: pulumi.Input<string>;
    /**
     * Indicates that the zone's static resource protection is turned on.
     */
    sbfmStaticResourceProtection?: pulumi.Input<string>;
    /**
     * Indicates that the zone's verified bot requests are being blocked.
     */
    sbfmVerifiedBots?: pulumi.Input<string>;
    /**
     * Indicates that the zone's session score tracking is disabled.
     */
    suppressSessionScore?: pulumi.Input<boolean>;
}
export interface CertificatePackValidationError {
    /**
     * A domain validation error.
     */
    message?: pulumi.Input<string>;
}
export interface CertificatePackValidationRecord {
    /**
     * The set of email addresses that the certificate authority (CA) will use to complete domain validation.
     */
    emails?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The content that the certificate authority (CA) will expect to find at the httpUrl during the domain validation.
     */
    httpBody?: pulumi.Input<string>;
    /**
     * The url that will be checked during domain validation.
     */
    httpUrl?: pulumi.Input<string>;
    /**
     * The hostname that the certificate authority (CA) will check for a TXT record during domain validation .
     */
    txtName?: pulumi.Input<string>;
    /**
     * The TXT record that the certificate authority (CA) will check during domain validation.
     */
    txtValue?: pulumi.Input<string>;
}
export interface CloudConnectorRulesRule {
    description?: pulumi.Input<string>;
    enabled?: pulumi.Input<boolean>;
    expression?: pulumi.Input<string>;
    id?: pulumi.Input<string>;
    /**
     * Parameters of Cloud Connector Rule
     */
    parameters?: pulumi.Input<inputs.CloudConnectorRulesRuleParameters>;
    /**
     * Cloud Provider type
     * Available values: "aws*s3", "cloudflare*r2", "gcp*storage", "azure*storage".
     */
    provider?: pulumi.Input<string>;
}
export interface CloudConnectorRulesRuleParameters {
    /**
     * Host to perform Cloud Connection to
     */
    host?: pulumi.Input<string>;
}
export interface ContentScanningExpressionBody {
    /**
     * Defines the ruleset expression to use in matching content objects.
     */
    payload: pulumi.Input<string>;
}
export interface CustomHostnameOwnershipVerification {
    /**
     * DNS Name for record.
     */
    name?: pulumi.Input<string>;
    /**
     * DNS Record type.
     * Available values: "txt".
     */
    type?: pulumi.Input<string>;
    /**
     * Content for the record.
     */
    value?: pulumi.Input<string>;
}
export interface CustomHostnameOwnershipVerificationHttp {
    /**
     * Token to be served.
     */
    httpBody?: pulumi.Input<string>;
    /**
     * The HTTP URL that will be checked during custom hostname verification and where the customer should host the token.
     */
    httpUrl?: pulumi.Input<string>;
}
export interface CustomHostnameSsl {
    /**
     * A ubiquitous bundle has the highest probability of being verified everywhere, even by clients using outdated or unusual trust stores. An optimal bundle uses the shortest chain and newest intermediates. And the force bundle verifies the chain, but does not otherwise modify it.
     * Available values: "ubiquitous", "optimal", "force".
     */
    bundleMethod?: pulumi.Input<string>;
    /**
     * The Certificate Authority that will issue the certificate
     * Available values: "digicert", "google", "lets*encrypt", "ssl*com".
     */
    certificateAuthority?: pulumi.Input<string>;
    /**
     * Whether or not to add Cloudflare Branding for the order.  This will add a subdomain of sni.cloudflaressl.com as the Common Name if set to true
     */
    cloudflareBranding?: pulumi.Input<boolean>;
    /**
     * Array of custom certificate and key pairs (1 or 2 pairs allowed)
     */
    customCertBundles?: pulumi.Input<pulumi.Input<inputs.CustomHostnameSslCustomCertBundle>[]>;
    /**
     * If a custom uploaded certificate is used.
     */
    customCertificate?: pulumi.Input<string>;
    /**
     * The key for a custom uploaded certificate.
     */
    customKey?: pulumi.Input<string>;
    /**
     * Domain control validation (DCV) method used for this hostname.
     * Available values: "http", "txt", "email".
     */
    method?: pulumi.Input<string>;
    /**
     * SSL specific settings.
     */
    settings?: pulumi.Input<inputs.CustomHostnameSslSettings>;
    /**
     * Level of validation to be used for this hostname. Domain validation (dv) must be used.
     * Available values: "dv".
     */
    type?: pulumi.Input<string>;
    /**
     * Indicates whether the certificate covers a wildcard.
     */
    wildcard?: pulumi.Input<boolean>;
}
export interface CustomHostnameSslCustomCertBundle {
    /**
     * If a custom uploaded certificate is used.
     */
    customCertificate: pulumi.Input<string>;
    /**
     * The key for a custom uploaded certificate.
     */
    customKey: pulumi.Input<string>;
}
export interface CustomHostnameSslSettings {
    /**
     * An allowlist of ciphers for TLS termination. These ciphers must be in the BoringSSL format.
     */
    ciphers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Whether or not Early Hints is enabled.
     * Available values: "on", "off".
     */
    earlyHints?: pulumi.Input<string>;
    /**
     * Whether or not HTTP2 is enabled.
     * Available values: "on", "off".
     */
    http2?: pulumi.Input<string>;
    /**
     * The minimum TLS version supported.
     * Available values: "1.0", "1.1", "1.2", "1.3".
     */
    minTlsVersion?: pulumi.Input<string>;
    /**
     * Whether or not TLS 1.3 is enabled.
     * Available values: "on", "off".
     */
    tls13?: pulumi.Input<string>;
}
export interface CustomSslGeoRestrictions {
    /**
     * Available values: "us", "eu", "highestSecurity".
     */
    label?: pulumi.Input<string>;
}
export interface CustomSslKeylessServer {
    /**
     * When the Keyless SSL was created.
     */
    createdOn?: pulumi.Input<string>;
    /**
     * Whether or not the Keyless SSL is on or off.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The keyless SSL name.
     */
    host?: pulumi.Input<string>;
    /**
     * Keyless certificate identifier tag.
     */
    id?: pulumi.Input<string>;
    /**
     * When the Keyless SSL was last modified.
     */
    modifiedOn?: pulumi.Input<string>;
    /**
     * The keyless SSL name.
     */
    name?: pulumi.Input<string>;
    /**
     * Available permissions for the Keyless SSL for the current user requesting the item.
     */
    permissions?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server.
     */
    port?: pulumi.Input<number>;
    /**
     * Status of the Keyless SSL.
     * Available values: "active", "deleted".
     */
    status?: pulumi.Input<string>;
    /**
     * Configuration for using Keyless SSL through a Cloudflare Tunnel
     */
    tunnel?: pulumi.Input<inputs.CustomSslKeylessServerTunnel>;
}
export interface CustomSslKeylessServerTunnel {
    /**
     * Private IP of the Key Server Host
     */
    privateIp?: pulumi.Input<string>;
    /**
     * Cloudflare Tunnel Virtual Network ID
     */
    vnetId?: pulumi.Input<string>;
}
export interface D1DatabaseReadReplication {
    /**
     * The read replication mode for the database. Use 'auto' to create replicas and allow D1 automatically place them around the world, or 'disabled' to not use any database replicas (it can take a few hours for all replicas to be deleted).
     * Available values: "auto", "disabled".
     */
    mode: pulumi.Input<string>;
}
export interface DeviceManagedNetworksConfig {
    /**
     * The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.
     */
    sha256?: pulumi.Input<string>;
    /**
     * A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.
     */
    tlsSockaddr: pulumi.Input<string>;
}
export interface DevicePostureIntegrationConfig {
    /**
     * If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `apiUrl`.
     */
    accessClientId?: pulumi.Input<string>;
    /**
     * If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `apiUrl`.
     */
    accessClientSecret?: pulumi.Input<string>;
    /**
     * The Workspace One API URL provided in the Workspace One Admin Dashboard.
     */
    apiUrl?: pulumi.Input<string>;
    /**
     * The Workspace One Authorization URL depending on your region.
     */
    authUrl?: pulumi.Input<string>;
    /**
     * The Workspace One client ID provided in the Workspace One Admin Dashboard.
     */
    clientId?: pulumi.Input<string>;
    /**
     * The Uptycs client secret.
     */
    clientKey?: pulumi.Input<string>;
    /**
     * The Workspace One client secret provided in the Workspace One Admin Dashboard.
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * The Crowdstrike customer ID.
     */
    customerId?: pulumi.Input<string>;
}
export interface DevicePostureRuleInput {
    /**
     * The Number of active threats.
     */
    activeThreats?: pulumi.Input<number>;
    /**
     * UUID of Cloudflare managed certificate.
     */
    certificateId?: pulumi.Input<string>;
    /**
     * List of volume names to be checked for encryption.
     */
    checkDisks?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.
     */
    checkPrivateKey?: pulumi.Input<boolean>;
    /**
     * Common Name that is protected by the certificate.
     */
    cn?: pulumi.Input<string>;
    /**
     * Compliance Status.
     * Available values: "compliant", "noncompliant", "unknown", "notapplicable", "ingraceperiod", "error".
     */
    complianceStatus?: pulumi.Input<string>;
    /**
     * Posture Integration ID.
     */
    connectionId?: pulumi.Input<string>;
    /**
     * Count Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    countOperator?: pulumi.Input<string>;
    /**
     * Domain.
     */
    domain?: pulumi.Input<string>;
    /**
     * For more details on eid last seen, refer to the Tanium documentation.
     */
    eidLastSeen?: pulumi.Input<string>;
    /**
     * Enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Whether or not file exists.
     */
    exists?: pulumi.Input<boolean>;
    /**
     * List of values indicating purposes for which the certificate public key can be used.
     */
    extendedKeyUsages?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List ID.
     */
    id?: pulumi.Input<string>;
    /**
     * Whether device is infected.
     */
    infected?: pulumi.Input<boolean>;
    /**
     * Whether device is active.
     */
    isActive?: pulumi.Input<boolean>;
    /**
     * The Number of Issues.
     */
    issueCount?: pulumi.Input<string>;
    /**
     * For more details on last seen, please refer to the Crowdstrike documentation.
     */
    lastSeen?: pulumi.Input<string>;
    locations?: pulumi.Input<inputs.DevicePostureRuleInputLocations>;
    /**
     * Network status of device.
     * Available values: "connected", "disconnected", "disconnecting", "connecting".
     */
    networkStatus?: pulumi.Input<string>;
    /**
     * Operating system.
     * Available values: "windows", "linux", "mac", "android", "ios", "chromeos".
     */
    operatingSystem?: pulumi.Input<string>;
    /**
     * Agent operational state.
     * Available values: "na", "partially*disabled", "auto*fully*disabled", "fully*disabled", "auto*partially*disabled", "disabled*error", "db*corruption".
     */
    operationalState?: pulumi.Input<string>;
    /**
     * Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    operator?: pulumi.Input<string>;
    /**
     * Os Version.
     */
    os?: pulumi.Input<string>;
    /**
     * Operating System Distribution Name (linux only).
     */
    osDistroName?: pulumi.Input<string>;
    /**
     * Version of OS Distribution (linux only).
     */
    osDistroRevision?: pulumi.Input<string>;
    /**
     * Additional version data. For Mac or iOS, the Product Version Extra. For Linux, the kernel release version. (Mac, iOS, and Linux only).
     */
    osVersionExtra?: pulumi.Input<string>;
    /**
     * Overall.
     */
    overall?: pulumi.Input<string>;
    /**
     * File path.
     */
    path?: pulumi.Input<string>;
    /**
     * Whether to check all disks for encryption.
     */
    requireAll?: pulumi.Input<boolean>;
    /**
     * For more details on risk level, refer to the Tanium documentation.
     * Available values: "low", "medium", "high", "critical".
     */
    riskLevel?: pulumi.Input<string>;
    /**
     * A value between 0-100 assigned to devices set by the 3rd party posture provider.
     */
    score?: pulumi.Input<number>;
    /**
     * Score Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    scoreOperator?: pulumi.Input<string>;
    /**
     * SensorConfig.
     */
    sensorConfig?: pulumi.Input<string>;
    /**
     * SHA-256.
     */
    sha256?: pulumi.Input<string>;
    /**
     * For more details on state, please refer to the Crowdstrike documentation.
     * Available values: "online", "offline", "unknown".
     */
    state?: pulumi.Input<string>;
    /**
     * List of certificate Subject Alternative Names.
     */
    subjectAlternativeNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Signing certificate thumbprint.
     */
    thumbprint?: pulumi.Input<string>;
    /**
     * For more details on total score, refer to the Tanium documentation.
     */
    totalScore?: pulumi.Input<number>;
    /**
     * Version of OS.
     */
    version?: pulumi.Input<string>;
    /**
     * Version Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    versionOperator?: pulumi.Input<string>;
}
export interface DevicePostureRuleInputLocations {
    /**
     * List of paths to check for client certificate on linux.
     */
    paths?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of trust stores to check for client certificate.
     */
    trustStores?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface DevicePostureRuleMatch {
    /**
     * Available values: "windows", "mac", "linux", "android", "ios", "chromeos".
     */
    platform?: pulumi.Input<string>;
}
export interface DlpCustomProfileContextAwareness {
    /**
     * If true, scan the context of predefined entries to only return matches surrounded by keywords.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * Content types to exclude from context analysis and return all matches.
     */
    skip: pulumi.Input<inputs.DlpCustomProfileContextAwarenessSkip>;
}
export interface DlpCustomProfileContextAwarenessSkip {
    /**
     * If the content type is a file, skip context analysis and return all matches.
     */
    files: pulumi.Input<boolean>;
}
export interface DlpCustomProfileEntry {
    enabled: pulumi.Input<boolean>;
    entryId?: pulumi.Input<string>;
    name: pulumi.Input<string>;
    pattern: pulumi.Input<inputs.DlpCustomProfileEntryPattern>;
}
export interface DlpCustomProfileEntryPattern {
    regex: pulumi.Input<string>;
    /**
     * Available values: "luhn".
     *
     * @deprecated This attribute is deprecated.
     */
    validation?: pulumi.Input<string>;
}
export interface DlpCustomProfileSharedEntry {
    enabled: pulumi.Input<boolean>;
    entryId: pulumi.Input<string>;
    /**
     * Available values: "custom", "predefined", "integration", "exact*data", "document*fingerprint".
     */
    entryType: pulumi.Input<string>;
}
export interface DlpPredefinedProfileContextAwareness {
    /**
     * If true, scan the context of predefined entries to only return matches surrounded by keywords.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * Content types to exclude from context analysis and return all matches.
     */
    skip: pulumi.Input<inputs.DlpPredefinedProfileContextAwarenessSkip>;
}
export interface DlpPredefinedProfileContextAwarenessSkip {
    /**
     * If the content type is a file, skip context analysis and return all matches.
     */
    files: pulumi.Input<boolean>;
}
export interface DlpPredefinedProfileEntry {
    enabled: pulumi.Input<boolean>;
    id: pulumi.Input<string>;
}
export interface DnsFirewallAttackMitigation {
    /**
     * When enabled, automatically mitigate random-prefix attacks to protect upstream DNS servers
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Only mitigate attacks when upstream servers seem unhealthy
     */
    onlyWhenUpstreamUnhealthy?: pulumi.Input<boolean>;
}
export interface DnsRecordData {
    /**
     * Algorithm.
     */
    algorithm?: pulumi.Input<number>;
    /**
     * Altitude of location in meters.
     */
    altitude?: pulumi.Input<number>;
    /**
     * Certificate.
     */
    certificate?: pulumi.Input<string>;
    /**
     * Digest.
     */
    digest?: pulumi.Input<string>;
    /**
     * Digest Type.
     */
    digestType?: pulumi.Input<number>;
    /**
     * Fingerprint.
     */
    fingerprint?: pulumi.Input<string>;
    /**
     * Flags for the CAA record.
     */
    flags?: any;
    /**
     * Key Tag.
     */
    keyTag?: pulumi.Input<number>;
    /**
     * Degrees of latitude.
     */
    latDegrees?: pulumi.Input<number>;
    /**
     * Latitude direction.
     * Available values: "N", "S".
     */
    latDirection?: pulumi.Input<string>;
    /**
     * Minutes of latitude.
     */
    latMinutes?: pulumi.Input<number>;
    /**
     * Seconds of latitude.
     */
    latSeconds?: pulumi.Input<number>;
    /**
     * Degrees of longitude.
     */
    longDegrees?: pulumi.Input<number>;
    /**
     * Longitude direction.
     * Available values: "E", "W".
     */
    longDirection?: pulumi.Input<string>;
    /**
     * Minutes of longitude.
     */
    longMinutes?: pulumi.Input<number>;
    /**
     * Seconds of longitude.
     */
    longSeconds?: pulumi.Input<number>;
    /**
     * Matching Type.
     */
    matchingType?: pulumi.Input<number>;
    /**
     * Order.
     */
    order?: pulumi.Input<number>;
    /**
     * The port of the service.
     */
    port?: pulumi.Input<number>;
    /**
     * Horizontal precision of location.
     */
    precisionHorz?: pulumi.Input<number>;
    /**
     * Vertical precision of location.
     */
    precisionVert?: pulumi.Input<number>;
    /**
     * Preference.
     */
    preference?: pulumi.Input<number>;
    /**
     * Priority.
     */
    priority?: pulumi.Input<number>;
    /**
     * Protocol.
     */
    protocol?: pulumi.Input<number>;
    /**
     * Public Key.
     */
    publicKey?: pulumi.Input<string>;
    /**
     * Regex.
     */
    regex?: pulumi.Input<string>;
    /**
     * Replacement.
     */
    replacement?: pulumi.Input<string>;
    /**
     * Selector.
     */
    selector?: pulumi.Input<number>;
    /**
     * Service.
     */
    service?: pulumi.Input<string>;
    /**
     * Size of location in meters.
     */
    size?: pulumi.Input<number>;
    /**
     * Name of the property controlled by this record (e.g.: issue, issuewild, iodef).
     */
    tag?: pulumi.Input<string>;
    /**
     * Target.
     */
    target?: pulumi.Input<string>;
    /**
     * Type.
     */
    type?: pulumi.Input<number>;
    /**
     * Usage.
     */
    usage?: pulumi.Input<number>;
    /**
     * Value of the record. This field's semantics depend on the chosen tag.
     */
    value?: pulumi.Input<string>;
    /**
     * The record weight.
     */
    weight?: pulumi.Input<number>;
}
export interface DnsRecordSettings {
    /**
     * If enabled, causes the CNAME record to be resolved externally and the resulting address records (e.g., A and AAAA) to be returned instead of the CNAME record itself. This setting is unavailable for proxied records, since they are always flattened.
     */
    flattenCname?: pulumi.Input<boolean>;
    /**
     * When enabled, only A records will be generated, and AAAA records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
     */
    ipv4Only?: pulumi.Input<boolean>;
    /**
     * When enabled, only AAAA records will be generated, and A records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
     */
    ipv6Only?: pulumi.Input<boolean>;
}
export interface EmailRoutingCatchAllAction {
    /**
     * Type of action for catch-all rule.
     * Available values: "drop", "forward", "worker".
     */
    type: pulumi.Input<string>;
    values?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface EmailRoutingCatchAllMatcher {
    /**
     * Type of matcher. Default is 'all'.
     * Available values: "all".
     */
    type: pulumi.Input<string>;
}
export interface EmailRoutingDnsError {
    code?: pulumi.Input<number>;
    documentationUrl?: pulumi.Input<string>;
    message?: pulumi.Input<string>;
    source?: pulumi.Input<inputs.EmailRoutingDnsErrorSource>;
}
export interface EmailRoutingDnsErrorSource {
    pointer?: pulumi.Input<string>;
}
export interface EmailRoutingDnsMessage {
    code?: pulumi.Input<number>;
    documentationUrl?: pulumi.Input<string>;
    message?: pulumi.Input<string>;
    source?: pulumi.Input<inputs.EmailRoutingDnsMessageSource>;
}
export interface EmailRoutingDnsMessageSource {
    pointer?: pulumi.Input<string>;
}
export interface EmailRoutingDnsResult {
    /**
     * DNS record content.
     */
    content?: pulumi.Input<string>;
    errors?: pulumi.Input<pulumi.Input<inputs.EmailRoutingDnsResultError>[]>;
    /**
     * DNS record name (or @ for the zone apex).
     */
    name?: pulumi.Input<string>;
    /**
     * Required for MX, SRV and URI records. Unused by other record types. Records with lower priorities are preferred.
     */
    priority?: pulumi.Input<number>;
    records?: pulumi.Input<pulumi.Input<inputs.EmailRoutingDnsResultRecord>[]>;
    /**
     * Time to live, in seconds, of the DNS record. Must be between 60 and 86400, or 1 for 'automatic'.
     */
    ttl?: pulumi.Input<number>;
    /**
     * DNS record type.
     * Available values: "A", "AAAA", "CNAME", "HTTPS", "TXT", "SRV", "LOC", "MX", "NS", "CERT", "DNSKEY", "DS", "NAPTR", "SMIMEA", "SSHFP", "SVCB", "TLSA", "URI".
     */
    type?: pulumi.Input<string>;
}
export interface EmailRoutingDnsResultError {
    code?: pulumi.Input<string>;
    /**
     * List of records needed to enable an Email Routing zone.
     */
    missing?: pulumi.Input<inputs.EmailRoutingDnsResultErrorMissing>;
}
export interface EmailRoutingDnsResultErrorMissing {
    /**
     * DNS record content.
     */
    content?: pulumi.Input<string>;
    /**
     * DNS record name (or @ for the zone apex).
     */
    name?: pulumi.Input<string>;
    /**
     * Required for MX, SRV and URI records. Unused by other record types. Records with lower priorities are preferred.
     */
    priority?: pulumi.Input<number>;
    /**
     * Time to live, in seconds, of the DNS record. Must be between 60 and 86400, or 1 for 'automatic'.
     */
    ttl?: pulumi.Input<number>;
    /**
     * DNS record type.
     * Available values: "A", "AAAA", "CNAME", "HTTPS", "TXT", "SRV", "LOC", "MX", "NS", "CERT", "DNSKEY", "DS", "NAPTR", "SMIMEA", "SSHFP", "SVCB", "TLSA", "URI".
     */
    type?: pulumi.Input<string>;
}
export interface EmailRoutingDnsResultInfo {
    /**
     * Total number of results for the requested service.
     */
    count?: pulumi.Input<number>;
    /**
     * Current page within paginated list of results.
     */
    page?: pulumi.Input<number>;
    /**
     * Number of results per page of results.
     */
    perPage?: pulumi.Input<number>;
    /**
     * Total results available without any search parameters.
     */
    totalCount?: pulumi.Input<number>;
}
export interface EmailRoutingDnsResultRecord {
    /**
     * DNS record content.
     */
    content?: pulumi.Input<string>;
    /**
     * DNS record name (or @ for the zone apex).
     */
    name?: pulumi.Input<string>;
    /**
     * Required for MX, SRV and URI records. Unused by other record types. Records with lower priorities are preferred.
     */
    priority?: pulumi.Input<number>;
    /**
     * Time to live, in seconds, of the DNS record. Must be between 60 and 86400, or 1 for 'automatic'.
     */
    ttl?: pulumi.Input<number>;
    /**
     * DNS record type.
     * Available values: "A", "AAAA", "CNAME", "HTTPS", "TXT", "SRV", "LOC", "MX", "NS", "CERT", "DNSKEY", "DS", "NAPTR", "SMIMEA", "SSHFP", "SVCB", "TLSA", "URI".
     */
    type?: pulumi.Input<string>;
}
export interface EmailRoutingRuleAction {
    /**
     * Type of supported action.
     * Available values: "drop", "forward", "worker".
     */
    type: pulumi.Input<string>;
    values?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface EmailRoutingRuleMatcher {
    /**
     * Field for type matcher.
     * Available values: "to".
     */
    field?: pulumi.Input<string>;
    /**
     * Type of matcher.
     * Available values: "all", "literal".
     */
    type: pulumi.Input<string>;
    /**
     * Value for matcher.
     */
    value?: pulumi.Input<string>;
}
export interface EmailSecurityTrustedDomainsBody {
    comments?: pulumi.Input<string>;
    /**
     * Select to prevent recently registered domains from triggering a
     * Suspicious or Malicious disposition.
     */
    isRecent: pulumi.Input<boolean>;
    isRegex: pulumi.Input<boolean>;
    /**
     * Select for partner or other approved domains that have similar
     * spelling to your connected domains. Prevents listed domains from
     * triggering a Spoof disposition.
     */
    isSimilarity: pulumi.Input<boolean>;
    pattern: pulumi.Input<string>;
}
export interface FilterBody {
    /**
     * An informative summary of the filter.
     */
    description?: pulumi.Input<string>;
    /**
     * The filter expression. For more information, refer to [Expressions](https://developers.cloudflare.com/ruleset-engine/rules-language/expressions/).
     */
    expression?: pulumi.Input<string>;
    /**
     * The unique identifier of the filter.
     */
    id?: pulumi.Input<string>;
    /**
     * When true, indicates that the filter is currently paused.
     */
    paused?: pulumi.Input<boolean>;
    /**
     * A short reference tag. Allows you to select related filters.
     */
    ref?: pulumi.Input<string>;
}
export interface FirewallRuleAction {
    /**
     * The action to perform.
     * Available values: "simulate", "ban", "challenge", "js*challenge", "managed*challenge".
     */
    mode?: pulumi.Input<string>;
    /**
     * A custom content type and reponse to return when the threshold is exceeded. The custom response configured in this object will override the custom error for the zone. This object is optional.
     * Notes: If you omit this object, Cloudflare will use the default HTML error page. If "mode" is "challenge", "managed*challenge", or "js*challenge", Cloudflare will use the zone challenge pages and you should not provide the "response" object.
     */
    response?: pulumi.Input<inputs.FirewallRuleActionResponse>;
    /**
     * The time in seconds during which Cloudflare will perform the mitigation action. Must be an integer value greater than or equal to the period.
     * Notes: If "mode" is "challenge", "managed*challenge", or "js*challenge", Cloudflare will use the zone's Challenge Passage time and you should not provide this value.
     */
    timeout?: pulumi.Input<number>;
}
export interface FirewallRuleActionResponse {
    /**
     * The response body to return. The value must conform to the configured content type.
     */
    body?: pulumi.Input<string>;
    /**
     * The content type of the body. Must be one of the following: `text/plain`, `text/xml`, or `application/json`.
     */
    contentType?: pulumi.Input<string>;
}
export interface FirewallRuleFilter {
    /**
     * An informative summary of the filter.
     */
    description?: pulumi.Input<string>;
    /**
     * The filter expression. For more information, refer to [Expressions](https://developers.cloudflare.com/ruleset-engine/rules-language/expressions/).
     */
    expression?: pulumi.Input<string>;
    /**
     * The unique identifier of the filter.
     */
    id?: pulumi.Input<string>;
    /**
     * When true, indicates that the filter is currently paused.
     */
    paused?: pulumi.Input<boolean>;
    /**
     * A short reference tag. Allows you to select related filters.
     */
    ref?: pulumi.Input<string>;
}
export interface GetAccessRuleFilter {
    configuration?: inputs.GetAccessRuleFilterConfiguration;
    /**
     * Defines the direction used to sort returned rules.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Defines the search requirements. When set to `all`, all the search requirements must match. When set to `any`, only one of the search requirements has to match.
     * Available values: "any", "all".
     */
    match?: string;
    /**
     * The action to apply to a matched request.
     * Available values: "block", "challenge", "whitelist", "js*challenge", "managed*challenge".
     */
    mode?: string;
    /**
     * Defines the string to search for in the notes of existing IP Access rules.
     * Notes: For example, the string 'attack' would match IP Access rules with notes 'Attack 26/02' and 'Attack 27/02'. The search is case insensitive.
     */
    notes?: string;
    /**
     * Defines the field used to sort returned rules.
     * Available values: "configuration.target", "configuration.value", "mode".
     */
    order?: string;
}
export interface GetAccessRuleFilterArgs {
    configuration?: pulumi.Input<inputs.GetAccessRuleFilterConfigurationArgs>;
    /**
     * Defines the direction used to sort returned rules.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Defines the search requirements. When set to `all`, all the search requirements must match. When set to `any`, only one of the search requirements has to match.
     * Available values: "any", "all".
     */
    match?: pulumi.Input<string>;
    /**
     * The action to apply to a matched request.
     * Available values: "block", "challenge", "whitelist", "js*challenge", "managed*challenge".
     */
    mode?: pulumi.Input<string>;
    /**
     * Defines the string to search for in the notes of existing IP Access rules.
     * Notes: For example, the string 'attack' would match IP Access rules with notes 'Attack 26/02' and 'Attack 27/02'. The search is case insensitive.
     */
    notes?: pulumi.Input<string>;
    /**
     * Defines the field used to sort returned rules.
     * Available values: "configuration.target", "configuration.value", "mode".
     */
    order?: pulumi.Input<string>;
}
export interface GetAccessRuleFilterConfiguration {
    /**
     * Defines the target to search in existing rules.
     * Available values: "ip", "ipRange", "asn", "country".
     */
    target?: string;
    /**
     * Defines the target value to search for in existing rules: an IP address, an IP address range, or a country code, depending on the provided `configuration.target`.
     * Notes: You can search for a single IPv4 address, an IP address range with a subnet of '/16' or '/24', or a two-letter ISO-3166-1 alpha-2 country code.
     */
    value?: string;
}
export interface GetAccessRuleFilterConfigurationArgs {
    /**
     * Defines the target to search in existing rules.
     * Available values: "ip", "ipRange", "asn", "country".
     */
    target?: pulumi.Input<string>;
    /**
     * Defines the target value to search for in existing rules: an IP address, an IP address range, or a country code, depending on the provided `configuration.target`.
     * Notes: You can search for a single IPv4 address, an IP address range with a subnet of '/16' or '/24', or a two-letter ISO-3166-1 alpha-2 country code.
     */
    value?: pulumi.Input<string>;
}
export interface GetAccessRulesConfiguration {
    /**
     * Defines the target to search in existing rules.
     * Available values: "ip", "ipRange", "asn", "country".
     */
    target?: string;
    /**
     * Defines the target value to search for in existing rules: an IP address, an IP address range, or a country code, depending on the provided `configuration.target`.
     * Notes: You can search for a single IPv4 address, an IP address range with a subnet of '/16' or '/24', or a two-letter ISO-3166-1 alpha-2 country code.
     */
    value?: string;
}
export interface GetAccessRulesConfigurationArgs {
    /**
     * Defines the target to search in existing rules.
     * Available values: "ip", "ipRange", "asn", "country".
     */
    target?: pulumi.Input<string>;
    /**
     * Defines the target value to search for in existing rules: an IP address, an IP address range, or a country code, depending on the provided `configuration.target`.
     * Notes: You can search for a single IPv4 address, an IP address range with a subnet of '/16' or '/24', or a two-letter ISO-3166-1 alpha-2 country code.
     */
    value?: pulumi.Input<string>;
}
export interface GetAccountDnsSettingsInternalViewFilter {
    /**
     * Direction to order DNS views in.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Whether to match all search requirements or at least one (any). If set to `all`, acts like a logical AND between filters. If set to `any`, acts like a logical OR instead.
     * Available values: "any", "all".
     */
    match?: string;
    name?: inputs.GetAccountDnsSettingsInternalViewFilterName;
    /**
     * Field to order DNS views by.
     * Available values: "name", "created*on", "modified*on".
     */
    order?: string;
    /**
     * A zone ID that exists in the zones list for the view.
     */
    zoneId?: string;
    /**
     * A zone name that exists in the zones list for the view.
     */
    zoneName?: string;
}
export interface GetAccountDnsSettingsInternalViewFilterArgs {
    /**
     * Direction to order DNS views in.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Whether to match all search requirements or at least one (any). If set to `all`, acts like a logical AND between filters. If set to `any`, acts like a logical OR instead.
     * Available values: "any", "all".
     */
    match?: pulumi.Input<string>;
    name?: pulumi.Input<inputs.GetAccountDnsSettingsInternalViewFilterNameArgs>;
    /**
     * Field to order DNS views by.
     * Available values: "name", "created*on", "modified*on".
     */
    order?: pulumi.Input<string>;
    /**
     * A zone ID that exists in the zones list for the view.
     */
    zoneId?: pulumi.Input<string>;
    /**
     * A zone name that exists in the zones list for the view.
     */
    zoneName?: pulumi.Input<string>;
}
export interface GetAccountDnsSettingsInternalViewFilterName {
    /**
     * Substring of the DNS view name.
     */
    contains?: string;
    /**
     * Suffix of the DNS view name.
     */
    endswith?: string;
    /**
     * Exact value of the DNS view name.
     */
    exact?: string;
    /**
     * Prefix of the DNS view name.
     */
    startswith?: string;
}
export interface GetAccountDnsSettingsInternalViewFilterNameArgs {
    /**
     * Substring of the DNS view name.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS view name.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS view name.
     */
    exact?: pulumi.Input<string>;
    /**
     * Prefix of the DNS view name.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetAccountDnsSettingsInternalViewsName {
    /**
     * Substring of the DNS view name.
     */
    contains?: string;
    /**
     * Suffix of the DNS view name.
     */
    endswith?: string;
    /**
     * Exact value of the DNS view name.
     */
    exact?: string;
    /**
     * Prefix of the DNS view name.
     */
    startswith?: string;
}
export interface GetAccountDnsSettingsInternalViewsNameArgs {
    /**
     * Substring of the DNS view name.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS view name.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS view name.
     */
    exact?: pulumi.Input<string>;
    /**
     * Prefix of the DNS view name.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetAccountFilter {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Name of the account.
     */
    name?: string;
}
export interface GetAccountFilterArgs {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Name of the account.
     */
    name?: pulumi.Input<string>;
}
export interface GetAccountMemberFilter {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Field to order results by.
     * Available values: "user.first*name", "user.last*name", "user.email", "status".
     */
    order?: string;
    /**
     * A member's status in the account.
     * Available values: "accepted", "pending", "rejected".
     */
    status?: string;
}
export interface GetAccountMemberFilterArgs {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Field to order results by.
     * Available values: "user.first*name", "user.last*name", "user.email", "status".
     */
    order?: pulumi.Input<string>;
    /**
     * A member's status in the account.
     * Available values: "accepted", "pending", "rejected".
     */
    status?: pulumi.Input<string>;
}
export interface GetAccountTokenFilter {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: string;
}
export interface GetAccountTokenFilterArgs {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
}
export interface GetApiShieldOperationFilter {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Filter results to only include endpoints containing this pattern.
     */
    endpoint?: string;
    /**
     * Add feature(s) to the results. The feature name that is given here corresponds to the resulting feature object. Have a look at the top-level object description for more details on the specific meaning.
     */
    features?: string[];
    /**
     * Filter results to only include the specified hosts.
     */
    hosts?: string[];
    /**
     * Filter results to only include the specified HTTP methods.
     */
    methods?: string[];
    /**
     * Field to order by. When requesting a feature, the feature keys are available for ordering as well, e.g., `thresholds.suggested_threshold`.
     * Available values: "method", "host", "endpoint", "thresholds.$key".
     */
    order?: string;
}
export interface GetApiShieldOperationFilterArgs {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Filter results to only include endpoints containing this pattern.
     */
    endpoint?: pulumi.Input<string>;
    /**
     * Add feature(s) to the results. The feature name that is given here corresponds to the resulting feature object. Have a look at the top-level object description for more details on the specific meaning.
     */
    features?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Filter results to only include the specified hosts.
     */
    hosts?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Filter results to only include the specified HTTP methods.
     */
    methods?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Field to order by. When requesting a feature, the feature keys are available for ordering as well, e.g., `thresholds.suggested_threshold`.
     * Available values: "method", "host", "endpoint", "thresholds.$key".
     */
    order?: pulumi.Input<string>;
}
export interface GetApiTokenFilter {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: string;
}
export interface GetApiTokenFilterArgs {
    /**
     * Direction to order results.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
}
export interface GetCloudforceOneRequestFilter {
    /**
     * Retrieve requests completed after this time.
     */
    completedAfter?: string;
    /**
     * Retrieve requests completed before this time.
     */
    completedBefore?: string;
    /**
     * Retrieve requests created after this time.
     */
    createdAfter?: string;
    /**
     * Retrieve requests created before this time.
     */
    createdBefore?: string;
    /**
     * Page number of results.
     */
    page: number;
    /**
     * Number of results per page.
     */
    perPage: number;
    /**
     * Requested information from request.
     */
    requestType?: string;
    /**
     * Field to sort results by.
     */
    sortBy?: string;
    /**
     * Sort order (asc or desc).
     * Available values: "asc", "desc".
     */
    sortOrder?: string;
    /**
     * Request Status.
     * Available values: "open", "accepted", "reported", "approved", "completed", "declined".
     */
    status?: string;
}
export interface GetCloudforceOneRequestFilterArgs {
    /**
     * Retrieve requests completed after this time.
     */
    completedAfter?: pulumi.Input<string>;
    /**
     * Retrieve requests completed before this time.
     */
    completedBefore?: pulumi.Input<string>;
    /**
     * Retrieve requests created after this time.
     */
    createdAfter?: pulumi.Input<string>;
    /**
     * Retrieve requests created before this time.
     */
    createdBefore?: pulumi.Input<string>;
    /**
     * Page number of results.
     */
    page: pulumi.Input<number>;
    /**
     * Number of results per page.
     */
    perPage: pulumi.Input<number>;
    /**
     * Requested information from request.
     */
    requestType?: pulumi.Input<string>;
    /**
     * Field to sort results by.
     */
    sortBy?: pulumi.Input<string>;
    /**
     * Sort order (asc or desc).
     * Available values: "asc", "desc".
     */
    sortOrder?: pulumi.Input<string>;
    /**
     * Request Status.
     * Available values: "open", "accepted", "reported", "approved", "completed", "declined".
     */
    status?: pulumi.Input<string>;
}
export interface GetCustomHostnameFilter {
    /**
     * Direction to order hostnames.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Fully qualified domain name to match against. This parameter cannot be used with the 'id' parameter.
     */
    hostname?: string;
    /**
     * Hostname ID to match against. This ID was generated and returned during the initial customHostname creation. This parameter cannot be used with the 'hostname' parameter.
     */
    id?: string;
    /**
     * Field to order hostnames by.
     * Available values: "ssl", "sslStatus".
     */
    order?: string;
    /**
     * Whether to filter hostnames based on if they have SSL enabled.
     * Available values: 0, 1.
     */
    ssl?: number;
}
export interface GetCustomHostnameFilterArgs {
    /**
     * Direction to order hostnames.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Fully qualified domain name to match against. This parameter cannot be used with the 'id' parameter.
     */
    hostname?: pulumi.Input<string>;
    /**
     * Hostname ID to match against. This ID was generated and returned during the initial customHostname creation. This parameter cannot be used with the 'hostname' parameter.
     */
    id?: pulumi.Input<string>;
    /**
     * Field to order hostnames by.
     * Available values: "ssl", "sslStatus".
     */
    order?: pulumi.Input<string>;
    /**
     * Whether to filter hostnames based on if they have SSL enabled.
     * Available values: 0, 1.
     */
    ssl?: pulumi.Input<number>;
}
export interface GetCustomSslFilter {
    /**
     * Whether to match all search requirements or at least one (any).
     * Available values: "any", "all".
     */
    match?: string;
    /**
     * Status of the zone's custom SSL.
     * Available values: "active", "expired", "deleted", "pending", "initializing".
     */
    status?: string;
}
export interface GetCustomSslFilterArgs {
    /**
     * Whether to match all search requirements or at least one (any).
     * Available values: "any", "all".
     */
    match?: pulumi.Input<string>;
    /**
     * Status of the zone's custom SSL.
     * Available values: "active", "expired", "deleted", "pending", "initializing".
     */
    status?: pulumi.Input<string>;
}
export interface GetD1DatabaseFilter {
    /**
     * a database name to search for.
     */
    name?: string;
}
export interface GetD1DatabaseFilterArgs {
    /**
     * a database name to search for.
     */
    name?: pulumi.Input<string>;
}
export interface GetDnsRecordFilter {
    comment?: inputs.GetDnsRecordFilterComment;
    content?: inputs.GetDnsRecordFilterContent;
    /**
     * Direction to order DNS records in.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Whether to match all search requirements or at least one (any). If set to `all`, acts like a logical AND between filters. If set to `any`, acts like a logical OR instead. Note that the interaction between tag filters is controlled by the `tag-match` parameter instead.
     * Available values: "any", "all".
     */
    match?: string;
    name?: inputs.GetDnsRecordFilterName;
    /**
     * Field to order DNS records by.
     * Available values: "type", "name", "content", "ttl", "proxied".
     */
    order?: string;
    /**
     * Whether the record is receiving the performance and security benefits of Cloudflare.
     */
    proxied?: boolean;
    /**
     * Allows searching in multiple properties of a DNS record simultaneously. This parameter is intended for human users, not automation. Its exact behavior is intentionally left unspecified and is subject to change in the future. This parameter works independently of the `match` setting. For automated searches, please use the other available parameters.
     */
    search?: string;
    tag?: inputs.GetDnsRecordFilterTag;
    /**
     * Whether to match all tag search requirements or at least one (any). If set to `all`, acts like a logical AND between tag filters. If set to `any`, acts like a logical OR instead. Note that the regular `match` parameter is still used to combine the resulting condition with other filters that aren't related to tags.
     * Available values: "any", "all".
     */
    tagMatch?: string;
    /**
     * Record type.
     * Available values: "A", "AAAA", "CAA", "CERT", "CNAME", "DNSKEY", "DS", "HTTPS", "LOC", "MX", "NAPTR", "NS", "OPENPGPKEY", "PTR", "SMIMEA", "SRV", "SSHFP", "SVCB", "TLSA", "TXT", "URI".
     */
    type?: string;
}
export interface GetDnsRecordFilterArgs {
    comment?: pulumi.Input<inputs.GetDnsRecordFilterCommentArgs>;
    content?: pulumi.Input<inputs.GetDnsRecordFilterContentArgs>;
    /**
     * Direction to order DNS records in.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Whether to match all search requirements or at least one (any). If set to `all`, acts like a logical AND between filters. If set to `any`, acts like a logical OR instead. Note that the interaction between tag filters is controlled by the `tag-match` parameter instead.
     * Available values: "any", "all".
     */
    match?: pulumi.Input<string>;
    name?: pulumi.Input<inputs.GetDnsRecordFilterNameArgs>;
    /**
     * Field to order DNS records by.
     * Available values: "type", "name", "content", "ttl", "proxied".
     */
    order?: pulumi.Input<string>;
    /**
     * Whether the record is receiving the performance and security benefits of Cloudflare.
     */
    proxied?: pulumi.Input<boolean>;
    /**
     * Allows searching in multiple properties of a DNS record simultaneously. This parameter is intended for human users, not automation. Its exact behavior is intentionally left unspecified and is subject to change in the future. This parameter works independently of the `match` setting. For automated searches, please use the other available parameters.
     */
    search?: pulumi.Input<string>;
    tag?: pulumi.Input<inputs.GetDnsRecordFilterTagArgs>;
    /**
     * Whether to match all tag search requirements or at least one (any). If set to `all`, acts like a logical AND between tag filters. If set to `any`, acts like a logical OR instead. Note that the regular `match` parameter is still used to combine the resulting condition with other filters that aren't related to tags.
     * Available values: "any", "all".
     */
    tagMatch?: pulumi.Input<string>;
    /**
     * Record type.
     * Available values: "A", "AAAA", "CAA", "CERT", "CNAME", "DNSKEY", "DS", "HTTPS", "LOC", "MX", "NAPTR", "NS", "OPENPGPKEY", "PTR", "SMIMEA", "SRV", "SSHFP", "SVCB", "TLSA", "TXT", "URI".
     */
    type?: pulumi.Input<string>;
}
export interface GetDnsRecordFilterComment {
    /**
     * If this parameter is present, only records *without* a comment are returned.
     */
    absent?: string;
    /**
     * Substring of the DNS record comment. Comment filters are case-insensitive.
     */
    contains?: string;
    /**
     * Suffix of the DNS record comment. Comment filters are case-insensitive.
     */
    endswith?: string;
    /**
     * Exact value of the DNS record comment. Comment filters are case-insensitive.
     */
    exact?: string;
    /**
     * If this parameter is present, only records *with* a comment are returned.
     */
    present?: string;
    /**
     * Prefix of the DNS record comment. Comment filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordFilterCommentArgs {
    /**
     * If this parameter is present, only records *without* a comment are returned.
     */
    absent?: pulumi.Input<string>;
    /**
     * Substring of the DNS record comment. Comment filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS record comment. Comment filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS record comment. Comment filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * If this parameter is present, only records *with* a comment are returned.
     */
    present?: pulumi.Input<string>;
    /**
     * Prefix of the DNS record comment. Comment filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetDnsRecordFilterContent {
    /**
     * Substring of the DNS record content. Content filters are case-insensitive.
     */
    contains?: string;
    /**
     * Suffix of the DNS record content. Content filters are case-insensitive.
     */
    endswith?: string;
    /**
     * Exact value of the DNS record content. Content filters are case-insensitive.
     */
    exact?: string;
    /**
     * Prefix of the DNS record content. Content filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordFilterContentArgs {
    /**
     * Substring of the DNS record content. Content filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS record content. Content filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS record content. Content filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * Prefix of the DNS record content. Content filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetDnsRecordFilterName {
    /**
     * Substring of the DNS record name. Name filters are case-insensitive.
     */
    contains?: string;
    /**
     * Suffix of the DNS record name. Name filters are case-insensitive.
     */
    endswith?: string;
    /**
     * Exact value of the DNS record name. Name filters are case-insensitive.
     */
    exact?: string;
    /**
     * Prefix of the DNS record name. Name filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordFilterNameArgs {
    /**
     * Substring of the DNS record name. Name filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS record name. Name filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS record name. Name filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * Prefix of the DNS record name. Name filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetDnsRecordFilterTag {
    /**
     * Name of a tag which must *not* be present on the DNS record. Tag filters are case-insensitive.
     */
    absent?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value contains `<tag-value>`. Tag filters are case-insensitive.
     */
    contains?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value ends with `<tag-value>`. Tag filters are case-insensitive.
     */
    endswith?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value is `<tag-value>`. Tag filters are case-insensitive.
     */
    exact?: string;
    /**
     * Name of a tag which must be present on the DNS record. Tag filters are case-insensitive.
     */
    present?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value starts with `<tag-value>`. Tag filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordFilterTagArgs {
    /**
     * Name of a tag which must *not* be present on the DNS record. Tag filters are case-insensitive.
     */
    absent?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value contains `<tag-value>`. Tag filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value ends with `<tag-value>`. Tag filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value is `<tag-value>`. Tag filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * Name of a tag which must be present on the DNS record. Tag filters are case-insensitive.
     */
    present?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value starts with `<tag-value>`. Tag filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetDnsRecordsComment {
    /**
     * If this parameter is present, only records *without* a comment are returned.
     */
    absent?: string;
    /**
     * Substring of the DNS record comment. Comment filters are case-insensitive.
     */
    contains?: string;
    /**
     * Suffix of the DNS record comment. Comment filters are case-insensitive.
     */
    endswith?: string;
    /**
     * Exact value of the DNS record comment. Comment filters are case-insensitive.
     */
    exact?: string;
    /**
     * If this parameter is present, only records *with* a comment are returned.
     */
    present?: string;
    /**
     * Prefix of the DNS record comment. Comment filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordsCommentArgs {
    /**
     * If this parameter is present, only records *without* a comment are returned.
     */
    absent?: pulumi.Input<string>;
    /**
     * Substring of the DNS record comment. Comment filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS record comment. Comment filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS record comment. Comment filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * If this parameter is present, only records *with* a comment are returned.
     */
    present?: pulumi.Input<string>;
    /**
     * Prefix of the DNS record comment. Comment filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetDnsRecordsContent {
    /**
     * Substring of the DNS record content. Content filters are case-insensitive.
     */
    contains?: string;
    /**
     * Suffix of the DNS record content. Content filters are case-insensitive.
     */
    endswith?: string;
    /**
     * Exact value of the DNS record content. Content filters are case-insensitive.
     */
    exact?: string;
    /**
     * Prefix of the DNS record content. Content filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordsContentArgs {
    /**
     * Substring of the DNS record content. Content filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS record content. Content filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS record content. Content filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * Prefix of the DNS record content. Content filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetDnsRecordsName {
    /**
     * Substring of the DNS record name. Name filters are case-insensitive.
     */
    contains?: string;
    /**
     * Suffix of the DNS record name. Name filters are case-insensitive.
     */
    endswith?: string;
    /**
     * Exact value of the DNS record name. Name filters are case-insensitive.
     */
    exact?: string;
    /**
     * Prefix of the DNS record name. Name filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordsNameArgs {
    /**
     * Substring of the DNS record name. Name filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * Suffix of the DNS record name. Name filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * Exact value of the DNS record name. Name filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * Prefix of the DNS record name. Name filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetDnsRecordsTag {
    /**
     * Name of a tag which must *not* be present on the DNS record. Tag filters are case-insensitive.
     */
    absent?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value contains `<tag-value>`. Tag filters are case-insensitive.
     */
    contains?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value ends with `<tag-value>`. Tag filters are case-insensitive.
     */
    endswith?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value is `<tag-value>`. Tag filters are case-insensitive.
     */
    exact?: string;
    /**
     * Name of a tag which must be present on the DNS record. Tag filters are case-insensitive.
     */
    present?: string;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value starts with `<tag-value>`. Tag filters are case-insensitive.
     */
    startswith?: string;
}
export interface GetDnsRecordsTagArgs {
    /**
     * Name of a tag which must *not* be present on the DNS record. Tag filters are case-insensitive.
     */
    absent?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value contains `<tag-value>`. Tag filters are case-insensitive.
     */
    contains?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value ends with `<tag-value>`. Tag filters are case-insensitive.
     */
    endswith?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value is `<tag-value>`. Tag filters are case-insensitive.
     */
    exact?: pulumi.Input<string>;
    /**
     * Name of a tag which must be present on the DNS record. Tag filters are case-insensitive.
     */
    present?: pulumi.Input<string>;
    /**
     * A tag and value, of the form `<tag-name>:<tag-value>`. The API will only return DNS records that have a tag named `<tag-name>` whose value starts with `<tag-value>`. Tag filters are case-insensitive.
     */
    startswith?: pulumi.Input<string>;
}
export interface GetEmailRoutingAddressFilter {
    /**
     * Sorts results in an ascending or descending order.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Filter by verified destination addresses.
     */
    verified?: boolean;
}
export interface GetEmailRoutingAddressFilterArgs {
    /**
     * Sorts results in an ascending or descending order.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Filter by verified destination addresses.
     */
    verified?: pulumi.Input<boolean>;
}
export interface GetEmailRoutingRuleFilter {
    /**
     * Filter by enabled routing rules.
     */
    enabled?: boolean;
}
export interface GetEmailRoutingRuleFilterArgs {
    /**
     * Filter by enabled routing rules.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface GetEmailSecurityBlockSenderFilter {
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * The field to sort by.
     * Available values: "pattern", "createdAt".
     */
    order?: string;
    pattern?: string;
    /**
     * Available values: "EMAIL", "DOMAIN", "IP", "UNKNOWN".
     */
    patternType?: string;
    /**
     * Allows searching in multiple properties of a record simultaneously.
     * This parameter is intended for human users, not automation. Its exact
     * behavior is intentionally left unspecified and is subject to change
     * in the future.
     */
    search?: string;
}
export interface GetEmailSecurityBlockSenderFilterArgs {
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * The field to sort by.
     * Available values: "pattern", "createdAt".
     */
    order?: pulumi.Input<string>;
    pattern?: pulumi.Input<string>;
    /**
     * Available values: "EMAIL", "DOMAIN", "IP", "UNKNOWN".
     */
    patternType?: pulumi.Input<string>;
    /**
     * Allows searching in multiple properties of a record simultaneously.
     * This parameter is intended for human users, not automation. Its exact
     * behavior is intentionally left unspecified and is subject to change
     * in the future.
     */
    search?: pulumi.Input<string>;
}
export interface GetEmailSecurityImpersonationRegistryFilter {
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * The field to sort by.
     * Available values: "name", "email", "createdAt".
     */
    order?: string;
    /**
     * Available values: "A1S*INTERNAL", "SNOOPY-CASB*OFFICE*365", "SNOOPY-OFFICE*365", "SNOOPY-GOOGLE_DIRECTORY".
     */
    provenance?: string;
    /**
     * Allows searching in multiple properties of a record simultaneously.
     * This parameter is intended for human users, not automation. Its exact
     * behavior is intentionally left unspecified and is subject to change
     * in the future.
     */
    search?: string;
}
export interface GetEmailSecurityImpersonationRegistryFilterArgs {
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * The field to sort by.
     * Available values: "name", "email", "createdAt".
     */
    order?: pulumi.Input<string>;
    /**
     * Available values: "A1S*INTERNAL", "SNOOPY-CASB*OFFICE*365", "SNOOPY-OFFICE*365", "SNOOPY-GOOGLE_DIRECTORY".
     */
    provenance?: pulumi.Input<string>;
    /**
     * Allows searching in multiple properties of a record simultaneously.
     * This parameter is intended for human users, not automation. Its exact
     * behavior is intentionally left unspecified and is subject to change
     * in the future.
     */
    search?: pulumi.Input<string>;
}
export interface GetEmailSecurityTrustedDomainsFilter {
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: string;
    isRecent?: boolean;
    isSimilarity?: boolean;
    /**
     * The field to sort by.
     * Available values: "pattern", "createdAt".
     */
    order?: string;
    pattern?: string;
    /**
     * Allows searching in multiple properties of a record simultaneously.
     * This parameter is intended for human users, not automation. Its exact
     * behavior is intentionally left unspecified and is subject to change
     * in the future.
     */
    search?: string;
}
export interface GetEmailSecurityTrustedDomainsFilterArgs {
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    isRecent?: pulumi.Input<boolean>;
    isSimilarity?: pulumi.Input<boolean>;
    /**
     * The field to sort by.
     * Available values: "pattern", "createdAt".
     */
    order?: pulumi.Input<string>;
    pattern?: pulumi.Input<string>;
    /**
     * Allows searching in multiple properties of a record simultaneously.
     * This parameter is intended for human users, not automation. Its exact
     * behavior is intentionally left unspecified and is subject to change
     * in the future.
     */
    search?: pulumi.Input<string>;
}
export interface GetFilterFilter {
    /**
     * A case-insensitive string to find in the description.
     */
    description?: string;
    /**
     * A case-insensitive string to find in the expression.
     */
    expression?: string;
    /**
     * The unique identifier of the filter.
     */
    id?: string;
    /**
     * When true, indicates that the filter is currently paused.
     */
    paused?: boolean;
    /**
     * The filter ref (a short reference tag) to search for. Must be an exact match.
     */
    ref?: string;
}
export interface GetFilterFilterArgs {
    /**
     * A case-insensitive string to find in the description.
     */
    description?: pulumi.Input<string>;
    /**
     * A case-insensitive string to find in the expression.
     */
    expression?: pulumi.Input<string>;
    /**
     * The unique identifier of the filter.
     */
    id?: pulumi.Input<string>;
    /**
     * When true, indicates that the filter is currently paused.
     */
    paused?: pulumi.Input<boolean>;
    /**
     * The filter ref (a short reference tag) to search for. Must be an exact match.
     */
    ref?: pulumi.Input<string>;
}
export interface GetLoadBalancerPoolFilter {
    /**
     * The ID of the Monitor to use for checking the health of origins within this pool.
     */
    monitor?: string;
}
export interface GetLoadBalancerPoolFilterArgs {
    /**
     * The ID of the Monitor to use for checking the health of origins within this pool.
     */
    monitor?: pulumi.Input<string>;
}
export interface GetMagicTransitSiteFilter {
    /**
     * Identifier
     */
    connectorid?: string;
}
export interface GetMagicTransitSiteFilterArgs {
    /**
     * Identifier
     */
    connectorid?: pulumi.Input<string>;
}
export interface GetOriginCaCertificateFilter {
    /**
     * Limit to the number of records returned.
     */
    limit?: number;
    /**
     * Offset the results
     */
    offset?: number;
    /**
     * Identifier.
     */
    zoneId: string;
}
export interface GetOriginCaCertificateFilterArgs {
    /**
     * Limit to the number of records returned.
     */
    limit?: pulumi.Input<number>;
    /**
     * Offset the results
     */
    offset?: pulumi.Input<number>;
    /**
     * Identifier.
     */
    zoneId: pulumi.Input<string>;
}
export interface GetSchemaValidationSchemasFilter {
    /**
     * Omit the source-files of schemas and only retrieve their meta-data.
     */
    omitSource?: boolean;
    /**
     * Filter for enabled schemas
     */
    validationEnabled?: boolean;
}
export interface GetSchemaValidationSchemasFilterArgs {
    /**
     * Omit the source-files of schemas and only retrieve their meta-data.
     */
    omitSource?: pulumi.Input<boolean>;
    /**
     * Filter for enabled schemas
     */
    validationEnabled?: pulumi.Input<boolean>;
}
export interface GetTurnstileWidgetFilter {
    /**
     * Direction to order widgets.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Field to order widgets by.
     * Available values: "id", "sitekey", "name", "created*on", "modified*on".
     */
    order?: string;
}
export interface GetTurnstileWidgetFilterArgs {
    /**
     * Direction to order widgets.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Field to order widgets by.
     * Available values: "id", "sitekey", "name", "created*on", "modified*on".
     */
    order?: pulumi.Input<string>;
}
export interface GetUserAgentBlockingRuleFilter {
    /**
     * A string to search for in the description of existing rules.
     */
    description?: string;
    /**
     * When true, indicates that the rule is currently paused.
     */
    paused?: boolean;
    /**
     * A string to search for in the user agent values of existing rules.
     */
    userAgent?: string;
}
export interface GetUserAgentBlockingRuleFilterArgs {
    /**
     * A string to search for in the description of existing rules.
     */
    description?: pulumi.Input<string>;
    /**
     * When true, indicates that the rule is currently paused.
     */
    paused?: pulumi.Input<boolean>;
    /**
     * A string to search for in the user agent values of existing rules.
     */
    userAgent?: pulumi.Input<string>;
}
export interface GetWebAnalyticsSiteFilter {
    /**
     * The property used to sort the list of results.
     * Available values: "host", "created".
     */
    orderBy?: string;
}
export interface GetWebAnalyticsSiteFilterArgs {
    /**
     * The property used to sort the list of results.
     * Available values: "host", "created".
     */
    orderBy?: pulumi.Input<string>;
}
export interface GetWorkersCustomDomainFilter {
    /**
     * Worker environment associated with the zone and hostname.
     */
    environment?: string;
    /**
     * Hostname of the Worker Domain.
     */
    hostname?: string;
    /**
     * Worker service associated with the zone and hostname.
     */
    service?: string;
    /**
     * Identifier of the zone.
     */
    zoneId?: string;
    /**
     * Name of the zone.
     */
    zoneName?: string;
}
export interface GetWorkersCustomDomainFilterArgs {
    /**
     * Worker environment associated with the zone and hostname.
     */
    environment?: pulumi.Input<string>;
    /**
     * Hostname of the Worker Domain.
     */
    hostname?: pulumi.Input<string>;
    /**
     * Worker service associated with the zone and hostname.
     */
    service?: pulumi.Input<string>;
    /**
     * Identifier of the zone.
     */
    zoneId?: pulumi.Input<string>;
    /**
     * Name of the zone.
     */
    zoneName?: pulumi.Input<string>;
}
export interface GetWorkersKvNamespaceFilter {
    /**
     * Direction to order namespaces.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Field to order results by.
     * Available values: "id", "title".
     */
    order?: string;
}
export interface GetWorkersKvNamespaceFilterArgs {
    /**
     * Direction to order namespaces.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Field to order results by.
     * Available values: "id", "title".
     */
    order?: pulumi.Input<string>;
}
export interface GetZeroTrustAccessApplicationFilter {
    /**
     * The aud of the app.
     */
    aud?: string;
    /**
     * The domain of the app.
     */
    domain?: string;
    /**
     * True for only exact string matches against passed name/domain query parameters.
     */
    exact?: boolean;
    /**
     * The name of the app.
     */
    name?: string;
    /**
     * Search for apps by other listed query parameters.
     */
    search?: string;
}
export interface GetZeroTrustAccessApplicationFilterArgs {
    /**
     * The aud of the app.
     */
    aud?: pulumi.Input<string>;
    /**
     * The domain of the app.
     */
    domain?: pulumi.Input<string>;
    /**
     * True for only exact string matches against passed name/domain query parameters.
     */
    exact?: pulumi.Input<boolean>;
    /**
     * The name of the app.
     */
    name?: pulumi.Input<string>;
    /**
     * Search for apps by other listed query parameters.
     */
    search?: pulumi.Input<string>;
}
export interface GetZeroTrustAccessGroupFilter {
    /**
     * The name of the group.
     */
    name?: string;
    /**
     * Search for groups by other listed query parameters.
     */
    search?: string;
}
export interface GetZeroTrustAccessGroupFilterArgs {
    /**
     * The name of the group.
     */
    name?: pulumi.Input<string>;
    /**
     * Search for groups by other listed query parameters.
     */
    search?: pulumi.Input<string>;
}
export interface GetZeroTrustAccessIdentityProviderFilter {
    /**
     * Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
     */
    scimEnabled?: string;
}
export interface GetZeroTrustAccessIdentityProviderFilterArgs {
    /**
     * Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
     */
    scimEnabled?: pulumi.Input<string>;
}
export interface GetZeroTrustAccessInfrastructureTargetFilter {
    /**
     * Date and time at which the target was created after (inclusive)
     */
    createdAfter?: string;
    /**
     * Date and time at which the target was created before (inclusive)
     */
    createdBefore?: string;
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Hostname of a target
     */
    hostname?: string;
    /**
     * Partial match to the hostname of a target
     */
    hostnameContains?: string;
    /**
     * Filters for targets whose IP addresses look like the specified string.
     * Supports `*` as a wildcard character
     */
    ipLike?: string;
    /**
     * IPv4 address of the target
     */
    ipV4?: string;
    /**
     * IPv6 address of the target
     */
    ipV6?: string;
    /**
     * Filters for targets that have any of the following IP addresses. Specify
     * `ips` multiple times in query parameter to build list of candidates.
     */
    ips?: string[];
    /**
     * Defines an IPv4 filter range's ending value (inclusive). Requires
     * `ipv4Start` to be specified as well.
     */
    ipv4End?: string;
    /**
     * Defines an IPv4 filter range's starting value (inclusive). Requires
     * `ipv4End` to be specified as well.
     */
    ipv4Start?: string;
    /**
     * Defines an IPv6 filter range's ending value (inclusive). Requires
     * `ipv6Start` to be specified as well.
     */
    ipv6End?: string;
    /**
     * Defines an IPv6 filter range's starting value (inclusive). Requires
     * `ipv6End` to be specified as well.
     */
    ipv6Start?: string;
    /**
     * Date and time at which the target was modified after (inclusive)
     */
    modifiedAfter?: string;
    /**
     * Date and time at which the target was modified before (inclusive)
     */
    modifiedBefore?: string;
    /**
     * The field to sort by.
     * Available values: "hostname", "createdAt".
     */
    order?: string;
    /**
     * Filters for targets that have any of the following UUIDs. Specify
     * `targetIds` multiple times in query parameter to build list of
     * candidates.
     */
    targetIds?: string[];
    /**
     * Private virtual network identifier of the target
     */
    virtualNetworkId?: string;
}
export interface GetZeroTrustAccessInfrastructureTargetFilterArgs {
    /**
     * Date and time at which the target was created after (inclusive)
     */
    createdAfter?: pulumi.Input<string>;
    /**
     * Date and time at which the target was created before (inclusive)
     */
    createdBefore?: pulumi.Input<string>;
    /**
     * The sorting direction.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Hostname of a target
     */
    hostname?: pulumi.Input<string>;
    /**
     * Partial match to the hostname of a target
     */
    hostnameContains?: pulumi.Input<string>;
    /**
     * Filters for targets whose IP addresses look like the specified string.
     * Supports `*` as a wildcard character
     */
    ipLike?: pulumi.Input<string>;
    /**
     * IPv4 address of the target
     */
    ipV4?: pulumi.Input<string>;
    /**
     * IPv6 address of the target
     */
    ipV6?: pulumi.Input<string>;
    /**
     * Filters for targets that have any of the following IP addresses. Specify
     * `ips` multiple times in query parameter to build list of candidates.
     */
    ips?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Defines an IPv4 filter range's ending value (inclusive). Requires
     * `ipv4Start` to be specified as well.
     */
    ipv4End?: pulumi.Input<string>;
    /**
     * Defines an IPv4 filter range's starting value (inclusive). Requires
     * `ipv4End` to be specified as well.
     */
    ipv4Start?: pulumi.Input<string>;
    /**
     * Defines an IPv6 filter range's ending value (inclusive). Requires
     * `ipv6Start` to be specified as well.
     */
    ipv6End?: pulumi.Input<string>;
    /**
     * Defines an IPv6 filter range's starting value (inclusive). Requires
     * `ipv6End` to be specified as well.
     */
    ipv6Start?: pulumi.Input<string>;
    /**
     * Date and time at which the target was modified after (inclusive)
     */
    modifiedAfter?: pulumi.Input<string>;
    /**
     * Date and time at which the target was modified before (inclusive)
     */
    modifiedBefore?: pulumi.Input<string>;
    /**
     * The field to sort by.
     * Available values: "hostname", "createdAt".
     */
    order?: pulumi.Input<string>;
    /**
     * Filters for targets that have any of the following UUIDs. Specify
     * `targetIds` multiple times in query parameter to build list of
     * candidates.
     */
    targetIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Private virtual network identifier of the target
     */
    virtualNetworkId?: pulumi.Input<string>;
}
export interface GetZeroTrustAccessServiceTokenFilter {
    /**
     * The name of the service token.
     */
    name?: string;
    /**
     * Search for service tokens by other listed query parameters.
     */
    search?: string;
}
export interface GetZeroTrustAccessServiceTokenFilterArgs {
    /**
     * The name of the service token.
     */
    name?: pulumi.Input<string>;
    /**
     * Search for service tokens by other listed query parameters.
     */
    search?: pulumi.Input<string>;
}
export interface GetZeroTrustListFilter {
    /**
     * The type of list.
     * Available values: "SERIAL", "URL", "DOMAIN", "EMAIL", "IP".
     */
    type?: string;
}
export interface GetZeroTrustListFilterArgs {
    /**
     * The type of list.
     * Available values: "SERIAL", "URL", "DOMAIN", "EMAIL", "IP".
     */
    type?: pulumi.Input<string>;
}
export interface GetZeroTrustTunnelCloudflaredFilter {
    excludePrefix?: string;
    /**
     * If provided, include only resources that were created (and not deleted) before this time. URL encoded.
     */
    existedAt?: string;
    includePrefix?: string;
    /**
     * If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included.
     */
    isDeleted?: boolean;
    /**
     * A user-friendly name for a tunnel.
     */
    name?: string;
    /**
     * The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
     * Available values: "inactive", "degraded", "healthy", "down".
     */
    status?: string;
    /**
     * UUID of the tunnel.
     */
    uuid?: string;
    wasActiveAt?: string;
    wasInactiveAt?: string;
}
export interface GetZeroTrustTunnelCloudflaredFilterArgs {
    excludePrefix?: pulumi.Input<string>;
    /**
     * If provided, include only resources that were created (and not deleted) before this time. URL encoded.
     */
    existedAt?: pulumi.Input<string>;
    includePrefix?: pulumi.Input<string>;
    /**
     * If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included.
     */
    isDeleted?: pulumi.Input<boolean>;
    /**
     * A user-friendly name for a tunnel.
     */
    name?: pulumi.Input<string>;
    /**
     * The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
     * Available values: "inactive", "degraded", "healthy", "down".
     */
    status?: pulumi.Input<string>;
    /**
     * UUID of the tunnel.
     */
    uuid?: pulumi.Input<string>;
    wasActiveAt?: pulumi.Input<string>;
    wasInactiveAt?: pulumi.Input<string>;
}
export interface GetZeroTrustTunnelCloudflaredRouteFilter {
    /**
     * Optional remark describing the route.
     */
    comment?: string;
    /**
     * If provided, include only resources that were created (and not deleted) before this time. URL encoded.
     */
    existedAt?: string;
    /**
     * If `true`, only include deleted routes. If `false`, exclude deleted routes. If empty, all routes will be included.
     */
    isDeleted?: boolean;
    /**
     * If set, only list routes that are contained within this IP range.
     */
    networkSubset?: string;
    /**
     * If set, only list routes that contain this IP range.
     */
    networkSuperset?: string;
    /**
     * UUID of the route.
     */
    routeId?: string;
    /**
     * The types of tunnels to filter by, separated by commas.
     */
    tunTypes?: string[];
    /**
     * UUID of the tunnel.
     */
    tunnelId?: string;
    /**
     * UUID of the virtual network.
     */
    virtualNetworkId?: string;
}
export interface GetZeroTrustTunnelCloudflaredRouteFilterArgs {
    /**
     * Optional remark describing the route.
     */
    comment?: pulumi.Input<string>;
    /**
     * If provided, include only resources that were created (and not deleted) before this time. URL encoded.
     */
    existedAt?: pulumi.Input<string>;
    /**
     * If `true`, only include deleted routes. If `false`, exclude deleted routes. If empty, all routes will be included.
     */
    isDeleted?: pulumi.Input<boolean>;
    /**
     * If set, only list routes that are contained within this IP range.
     */
    networkSubset?: pulumi.Input<string>;
    /**
     * If set, only list routes that contain this IP range.
     */
    networkSuperset?: pulumi.Input<string>;
    /**
     * UUID of the route.
     */
    routeId?: pulumi.Input<string>;
    /**
     * The types of tunnels to filter by, separated by commas.
     */
    tunTypes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * UUID of the tunnel.
     */
    tunnelId?: pulumi.Input<string>;
    /**
     * UUID of the virtual network.
     */
    virtualNetworkId?: pulumi.Input<string>;
}
export interface GetZeroTrustTunnelCloudflaredVirtualNetworkFilter {
    /**
     * UUID of the virtual network.
     */
    id?: string;
    /**
     * If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included.
     */
    isDefault?: boolean;
    /**
     * If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included.
     */
    isDefaultNetwork?: boolean;
    /**
     * If `true`, only include deleted virtual networks. If `false`, exclude deleted virtual networks. If empty, all virtual networks will be included.
     */
    isDeleted?: boolean;
    /**
     * A user-friendly name for the virtual network.
     */
    name?: string;
}
export interface GetZeroTrustTunnelCloudflaredVirtualNetworkFilterArgs {
    /**
     * UUID of the virtual network.
     */
    id?: pulumi.Input<string>;
    /**
     * If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included.
     */
    isDefault?: pulumi.Input<boolean>;
    /**
     * If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included.
     */
    isDefaultNetwork?: pulumi.Input<boolean>;
    /**
     * If `true`, only include deleted virtual networks. If `false`, exclude deleted virtual networks. If empty, all virtual networks will be included.
     */
    isDeleted?: pulumi.Input<boolean>;
    /**
     * A user-friendly name for the virtual network.
     */
    name?: pulumi.Input<string>;
}
export interface GetZeroTrustTunnelWarpConnectorFilter {
    excludePrefix?: string;
    /**
     * If provided, include only resources that were created (and not deleted) before this time. URL encoded.
     */
    existedAt?: string;
    includePrefix?: string;
    /**
     * If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included.
     */
    isDeleted?: boolean;
    /**
     * A user-friendly name for the tunnel.
     */
    name?: string;
    /**
     * The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
     * Available values: "inactive", "degraded", "healthy", "down".
     */
    status?: string;
    /**
     * UUID of the tunnel.
     */
    uuid?: string;
    wasActiveAt?: string;
    wasInactiveAt?: string;
}
export interface GetZeroTrustTunnelWarpConnectorFilterArgs {
    excludePrefix?: pulumi.Input<string>;
    /**
     * If provided, include only resources that were created (and not deleted) before this time. URL encoded.
     */
    existedAt?: pulumi.Input<string>;
    includePrefix?: pulumi.Input<string>;
    /**
     * If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included.
     */
    isDeleted?: pulumi.Input<boolean>;
    /**
     * A user-friendly name for the tunnel.
     */
    name?: pulumi.Input<string>;
    /**
     * The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
     * Available values: "inactive", "degraded", "healthy", "down".
     */
    status?: pulumi.Input<string>;
    /**
     * UUID of the tunnel.
     */
    uuid?: pulumi.Input<string>;
    wasActiveAt?: pulumi.Input<string>;
    wasInactiveAt?: pulumi.Input<string>;
}
export interface GetZoneFilter {
    account?: inputs.GetZoneFilterAccount;
    /**
     * Direction to order zones.
     * Available values: "asc", "desc".
     */
    direction?: string;
    /**
     * Whether to match all search requirements or at least one (any).
     * Available values: "any", "all".
     */
    match?: string;
    /**
     * A domain name. Optional filter operators can be provided to extend refine the search:
     *   * `equal` (default)
     *   * `notEqual`
     *   * `startsWith`
     *   * `endsWith`
     *   * `contains`
     *   * `startsWithCaseSensitive`
     *   * `endsWithCaseSensitive`
     *   * `containsCaseSensitive`
     */
    name?: string;
    /**
     * Field to order zones by.
     * Available values: "name", "status", "account.id", "account.name", "plan.id".
     */
    order?: string;
    /**
     * Specify a zone status to filter by.
     * Available values: "initializing", "pending", "active", "moved".
     */
    status?: string;
}
export interface GetZoneFilterArgs {
    account?: pulumi.Input<inputs.GetZoneFilterAccountArgs>;
    /**
     * Direction to order zones.
     * Available values: "asc", "desc".
     */
    direction?: pulumi.Input<string>;
    /**
     * Whether to match all search requirements or at least one (any).
     * Available values: "any", "all".
     */
    match?: pulumi.Input<string>;
    /**
     * A domain name. Optional filter operators can be provided to extend refine the search:
     *   * `equal` (default)
     *   * `notEqual`
     *   * `startsWith`
     *   * `endsWith`
     *   * `contains`
     *   * `startsWithCaseSensitive`
     *   * `endsWithCaseSensitive`
     *   * `containsCaseSensitive`
     */
    name?: pulumi.Input<string>;
    /**
     * Field to order zones by.
     * Available values: "name", "status", "account.id", "account.name", "plan.id".
     */
    order?: pulumi.Input<string>;
    /**
     * Specify a zone status to filter by.
     * Available values: "initializing", "pending", "active", "moved".
     */
    status?: pulumi.Input<string>;
}
export interface GetZoneFilterAccount {
    /**
     * Filter by an account ID.
     */
    id?: string;
    /**
     * An account Name. Optional filter operators can be provided to extend refine the search:
     *   * `equal` (default)
     *   * `notEqual`
     *   * `startsWith`
     *   * `endsWith`
     *   * `contains`
     *   * `startsWithCaseSensitive`
     *   * `endsWithCaseSensitive`
     *   * `containsCaseSensitive`
     */
    name?: string;
}
export interface GetZoneFilterAccountArgs {
    /**
     * Filter by an account ID.
     */
    id?: pulumi.Input<string>;
    /**
     * An account Name. Optional filter operators can be provided to extend refine the search:
     *   * `equal` (default)
     *   * `notEqual`
     *   * `startsWith`
     *   * `endsWith`
     *   * `contains`
     *   * `startsWithCaseSensitive`
     *   * `endsWithCaseSensitive`
     *   * `containsCaseSensitive`
     */
    name?: pulumi.Input<string>;
}
export interface GetZoneLockdownFilter {
    /**
     * The timestamp of when the rule was created.
     */
    createdOn?: string;
    /**
     * A string to search for in the description of existing rules.
     */
    description?: string;
    /**
     * A string to search for in the description of existing rules.
     */
    descriptionSearch?: string;
    /**
     * A single IP address to search for in existing rules.
     */
    ip?: string;
    /**
     * A single IP address range to search for in existing rules.
     */
    ipRangeSearch?: string;
    /**
     * A single IP address to search for in existing rules.
     */
    ipSearch?: string;
    /**
     * The timestamp of when the rule was last modified.
     */
    modifiedOn?: string;
    /**
     * The priority of the rule to control the processing order. A lower number indicates higher priority. If not provided, any rules with a configured priority will be processed before rules without a priority.
     */
    priority?: number;
    /**
     * A single URI to search for in the list of URLs of existing rules.
     */
    uriSearch?: string;
}
export interface GetZoneLockdownFilterArgs {
    /**
     * The timestamp of when the rule was created.
     */
    createdOn?: pulumi.Input<string>;
    /**
     * A string to search for in the description of existing rules.
     */
    description?: pulumi.Input<string>;
    /**
     * A string to search for in the description of existing rules.
     */
    descriptionSearch?: pulumi.Input<string>;
    /**
     * A single IP address to search for in existing rules.
     */
    ip?: pulumi.Input<string>;
    /**
     * A single IP address range to search for in existing rules.
     */
    ipRangeSearch?: pulumi.Input<string>;
    /**
     * A single IP address to search for in existing rules.
     */
    ipSearch?: pulumi.Input<string>;
    /**
     * The timestamp of when the rule was last modified.
     */
    modifiedOn?: pulumi.Input<string>;
    /**
     * The priority of the rule to control the processing order. A lower number indicates higher priority. If not provided, any rules with a configured priority will be processed before rules without a priority.
     */
    priority?: pulumi.Input<number>;
    /**
     * A single URI to search for in the list of URLs of existing rules.
     */
    uriSearch?: pulumi.Input<string>;
}
export interface GetZonesAccount {
    /**
     * Filter by an account ID.
     */
    id?: string;
    /**
     * An account Name. Optional filter operators can be provided to extend refine the search:
     *   * `equal` (default)
     *   * `notEqual`
     *   * `startsWith`
     *   * `endsWith`
     *   * `contains`
     *   * `startsWithCaseSensitive`
     *   * `endsWithCaseSensitive`
     *   * `containsCaseSensitive`
     */
    name?: string;
}
export interface GetZonesAccountArgs {
    /**
     * Filter by an account ID.
     */
    id?: pulumi.Input<string>;
    /**
     * An account Name. Optional filter operators can be provided to extend refine the search:
     *   * `equal` (default)
     *   * `notEqual`
     *   * `startsWith`
     *   * `endsWith`
     *   * `contains`
     *   * `startsWithCaseSensitive`
     *   * `endsWithCaseSensitive`
     *   * `containsCaseSensitive`
     */
    name?: pulumi.Input<string>;
}
export interface HealthcheckHttpConfig {
    /**
     * Do not validate the certificate when the health check uses HTTPS.
     */
    allowInsecure?: pulumi.Input<boolean>;
    /**
     * A case-insensitive sub-string to look for in the response body. If this string is not found, the origin will be marked as unhealthy.
     */
    expectedBody?: pulumi.Input<string>;
    /**
     * The expected HTTP response codes (e.g. "200") or code ranges (e.g. "2xx" for all codes starting with 2) of the health check.
     */
    expectedCodes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Follow redirects if the origin returns a 3xx status code.
     */
    followRedirects?: pulumi.Input<boolean>;
    /**
     * The HTTP request headers to send in the health check. It is recommended you set a Host header by default. The User-Agent header cannot be overridden.
     */
    header?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * The HTTP method to use for the health check.
     * Available values: "GET", "HEAD".
     */
    method?: pulumi.Input<string>;
    /**
     * The endpoint path to health check against.
     */
    path?: pulumi.Input<string>;
    /**
     * Port number to connect to for the health check. Defaults to 80 if type is HTTP or 443 if type is HTTPS.
     */
    port?: pulumi.Input<number>;
}
export interface HealthcheckTcpConfig {
    /**
     * The TCP connection method to use for the health check.
     * Available values: "connectionEstablished".
     */
    method?: pulumi.Input<string>;
    /**
     * Port number to connect to for the health check. Defaults to 80.
     */
    port?: pulumi.Input<number>;
}
export interface HyperdriveConfigCaching {
    /**
     * Set to true to disable caching of SQL responses. Default is false.
     */
    disabled?: pulumi.Input<boolean>;
    /**
     * Specify the maximum duration items should persist in the cache. Not returned if set to the default (60).
     */
    maxAge?: pulumi.Input<number>;
    /**
     * Specify the number of seconds the cache may serve a stale response. Omitted if set to the default (15).
     */
    staleWhileRevalidate?: pulumi.Input<number>;
}
export interface HyperdriveConfigMtls {
    /**
     * Define CA certificate ID obtained after uploading CA cert.
     */
    caCertificateId?: pulumi.Input<string>;
    /**
     * Define mTLS certificate ID obtained after uploading client cert.
     */
    mtlsCertificateId?: pulumi.Input<string>;
    /**
     * Set SSL mode to 'require', 'verify-ca', or 'verify-full' to verify the CA.
     */
    sslmode?: pulumi.Input<string>;
}
export interface HyperdriveConfigOrigin {
    /**
     * Defines the Client ID of the Access token to use when connecting to the origin database.
     */
    accessClientId?: pulumi.Input<string>;
    /**
     * Defines the Client Secret of the Access Token to use when connecting to the origin database. The API never returns this write-only value.
     */
    accessClientSecret?: pulumi.Input<string>;
    /**
     * Set the name of your origin database.
     */
    database: pulumi.Input<string>;
    /**
     * Defines the host (hostname or IP) of your origin database.
     */
    host: pulumi.Input<string>;
    /**
     * Set the password needed to access your origin database. The API never returns this write-only value.
     */
    password: pulumi.Input<string>;
    /**
     * Defines the port (default: 5432 for Postgres) of your origin database.
     */
    port?: pulumi.Input<number>;
    /**
     * Specifies the URL scheme used to connect to your origin database.
     * Available values: "postgres", "postgresql", "mysql".
     */
    scheme: pulumi.Input<string>;
    /**
     * Set the user of your origin database.
     */
    user: pulumi.Input<string>;
}
export interface ImageVariantOptions {
    /**
     * The fit property describes how the width and height dimensions should be interpreted.
     * Available values: "scale-down", "contain", "cover", "crop", "pad".
     */
    fit: pulumi.Input<string>;
    /**
     * Maximum height in image pixels.
     */
    height: pulumi.Input<number>;
    /**
     * What EXIF data should be preserved in the output image.
     * Available values: "keep", "copyright", "none".
     */
    metadata: pulumi.Input<string>;
    /**
     * Maximum width in image pixels.
     */
    width: pulumi.Input<number>;
}
export interface ImageVariantVariant {
    id?: pulumi.Input<string>;
    /**
     * Indicates whether the variant can access an image without a signature, regardless of image access control.
     */
    neverRequireSignedUrls?: pulumi.Input<boolean>;
    /**
     * Allows you to define image resizing sizes for different use cases.
     */
    options?: pulumi.Input<inputs.ImageVariantVariantOptions>;
}
export interface ImageVariantVariantOptions {
    /**
     * The fit property describes how the width and height dimensions should be interpreted.
     * Available values: "scale-down", "contain", "cover", "crop", "pad".
     */
    fit?: pulumi.Input<string>;
    /**
     * Maximum height in image pixels.
     */
    height?: pulumi.Input<number>;
    /**
     * What EXIF data should be preserved in the output image.
     * Available values: "keep", "copyright", "none".
     */
    metadata?: pulumi.Input<string>;
    /**
     * Maximum width in image pixels.
     */
    width?: pulumi.Input<number>;
}
export interface KeylessCertificateTunnel {
    /**
     * Private IP of the Key Server Host
     */
    privateIp: pulumi.Input<string>;
    /**
     * Cloudflare Tunnel Virtual Network ID
     */
    vnetId: pulumi.Input<string>;
}
export interface ListItem {
    /**
     * A non-negative 32 bit integer
     */
    asn?: pulumi.Input<number>;
    /**
     * An informative summary of the list item.
     */
    comment?: pulumi.Input<string>;
    /**
     * Valid characters for hostnames are ASCII(7) letters from a to z, the digits from 0 to 9, wildcards (*), and the hyphen (-).
     */
    hostname?: pulumi.Input<inputs.ListItemHostname>;
    /**
     * An IPv4 address, an IPv4 CIDR, an IPv6 address, or an IPv6 CIDR.
     */
    ip?: pulumi.Input<string>;
    /**
     * The definition of the redirect.
     */
    redirect?: pulumi.Input<inputs.ListItemRedirect>;
}
export interface ListItemHostname {
    /**
     * Only applies to wildcard hostnames (e.g., *.example.com). When true (default), only subdomains are blocked. When false, both the root domain and subdomains are blocked.
     */
    excludeExactHostname?: pulumi.Input<boolean>;
    urlHostname: pulumi.Input<string>;
}
export interface ListItemRedirect {
    includeSubdomains?: pulumi.Input<boolean>;
    preservePathSuffix?: pulumi.Input<boolean>;
    preserveQueryString?: pulumi.Input<boolean>;
    sourceUrl: pulumi.Input<string>;
    /**
     * Available values: 301, 302, 307, 308.
     */
    statusCode?: pulumi.Input<number>;
    subpathMatching?: pulumi.Input<boolean>;
    targetUrl: pulumi.Input<string>;
}
export interface LoadBalancerAdaptiveRouting {
    /**
     * Extends zero-downtime failover of requests to healthy origins from alternate pools, when no healthy alternate exists in the same pool, according to the failover order defined by traffic and origin steering. When set false (the default) zero-downtime failover will only occur between origins within the same pool. See `sessionAffinityAttributes` for control over when sessions are broken or reassigned.
     */
    failoverAcrossPools?: pulumi.Input<boolean>;
}
export interface LoadBalancerLocationStrategy {
    /**
     * Determines the authoritative location when ECS is not preferred, does not exist in the request, or its GeoIP lookup is unsuccessful.
     */
    mode?: pulumi.Input<string>;
    /**
     * Whether the EDNS Client Subnet (ECS) GeoIP should be preferred as the authoritative location.
     */
    preferEcs?: pulumi.Input<string>;
}
export interface LoadBalancerPoolLoadShedding {
    /**
     * The percent of traffic to shed from the pool, according to the default policy. Applies to new sessions and traffic without session affinity.
     */
    defaultPercent?: pulumi.Input<number>;
    /**
     * The default policy to use when load shedding. A random policy randomly sheds a given percent of requests. A hash policy computes a hash over the CF-Connecting-IP address and sheds all requests originating from a percent of IPs.
     * Available values: "random", "hash".
     */
    defaultPolicy?: pulumi.Input<string>;
    /**
     * The percent of existing sessions to shed from the pool, according to the session policy.
     */
    sessionPercent?: pulumi.Input<number>;
    /**
     * Only the hash policy is supported for existing sessions (to avoid exponential decay).
     * Available values: "hash".
     */
    sessionPolicy?: pulumi.Input<string>;
}
export interface LoadBalancerPoolNotificationFilter {
    /**
     * Filter options for a particular resource type (pool or origin). Use null to reset.
     */
    origin?: pulumi.Input<inputs.LoadBalancerPoolNotificationFilterOrigin>;
    /**
     * Filter options for a particular resource type (pool or origin). Use null to reset.
     */
    pool?: pulumi.Input<inputs.LoadBalancerPoolNotificationFilterPool>;
}
export interface LoadBalancerPoolNotificationFilterOrigin {
    /**
     * If set true, disable notifications for this type of resource (pool or origin).
     */
    disable?: pulumi.Input<boolean>;
    /**
     * If present, send notifications only for this health status (e.g. false for only DOWN events). Use null to reset (all events).
     */
    healthy?: pulumi.Input<boolean>;
}
export interface LoadBalancerPoolNotificationFilterPool {
    /**
     * If set true, disable notifications for this type of resource (pool or origin).
     */
    disable?: pulumi.Input<boolean>;
    /**
     * If present, send notifications only for this health status (e.g. false for only DOWN events). Use null to reset (all events).
     */
    healthy?: pulumi.Input<boolean>;
}
export interface LoadBalancerPoolOrigin {
    /**
     * The IP address (IPv4 or IPv6) of the origin, or its publicly addressable hostname. Hostnames entered here should resolve directly to the origin, and not be a hostname proxied by Cloudflare. To set an internal/reserved address, virtual*network*id must also be set.
     */
    address?: pulumi.Input<string>;
    /**
     * This field shows up only if the origin is disabled. This field is set with the time the origin was disabled.
     */
    disabledAt?: pulumi.Input<string>;
    /**
     * Whether to enable (the default) this origin within the pool. Disabled origins will not receive traffic and are excluded from health checks. The origin will only be disabled for the current pool.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The request header is used to pass additional information with an HTTP request. Currently supported header is 'Host'.
     */
    header?: pulumi.Input<inputs.LoadBalancerPoolOriginHeader>;
    /**
     * A human-identifiable name for the origin.
     */
    name?: pulumi.Input<string>;
    /**
     * The port for upstream connections. A value of 0 means the default port for the protocol will be used.
     */
    port?: pulumi.Input<number>;
    /**
     * The virtual network subnet ID the origin belongs in. Virtual network must also belong to the account.
     */
    virtualNetworkId?: pulumi.Input<string>;
    /**
     * The weight of this origin relative to other origins in the pool. Based on the configured weight the total traffic is distributed among origins within the pool.
     */
    weight?: pulumi.Input<number>;
}
export interface LoadBalancerPoolOriginHeader {
    /**
     * The 'Host' header allows to override the hostname set in the HTTP request. Current support is 1 'Host' header override per origin.
     */
    hosts?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface LoadBalancerPoolOriginSteering {
    /**
     * The type of origin steering policy to use.
     */
    policy?: pulumi.Input<string>;
}
export interface LoadBalancerRandomSteering {
    /**
     * The default weight for pools in the load balancer that are not specified in the poolWeights map.
     */
    defaultWeight?: pulumi.Input<number>;
    /**
     * A mapping of pool IDs to custom weights. The weight is relative to other pools in the load balancer.
     */
    poolWeights?: pulumi.Input<{
        [key: string]: pulumi.Input<number>;
    }>;
}
export interface LoadBalancerRule {
    /**
     * The condition expressions to evaluate. If the condition evaluates to true, the overrides or fixedResponse in this rule will be applied. An empty condition is always true. For more details on condition expressions, please see https://developers.cloudflare.com/load-balancing/understand-basics/load-balancing-rules/expressions.
     */
    condition?: pulumi.Input<string>;
    /**
     * Disable this specific rule. It will no longer be evaluated by this load balancer.
     */
    disabled?: pulumi.Input<boolean>;
    /**
     * A collection of fields used to directly respond to the eyeball instead of routing to a pool. If a fixed*response is supplied the rule will be marked as terminates.
     */
    fixedResponse?: pulumi.Input<inputs.LoadBalancerRuleFixedResponse>;
    /**
     * Name of this rule. Only used for human readability.
     */
    name?: pulumi.Input<string>;
    /**
     * A collection of overrides to apply to the load balancer when this rule's condition is true. All fields are optional.
     */
    overrides?: pulumi.Input<inputs.LoadBalancerRuleOverrides>;
    /**
     * The order in which rules should be executed in relation to each other. Lower values are executed first. Values do not need to be sequential. If no value is provided for any rule the array order of the rules field will be used to assign a priority.
     */
    priority?: pulumi.Input<number>;
    /**
     * If this rule's condition is true, this causes rule evaluation to stop after processing this rule.
     */
    terminates?: pulumi.Input<boolean>;
}
export interface LoadBalancerRuleFixedResponse {
    /**
     * The http 'Content-Type' header to include in the response.
     */
    contentType?: pulumi.Input<string>;
    /**
     * The http 'Location' header to include in the response.
     */
    location?: pulumi.Input<string>;
    /**
     * Text to include as the http body.
     */
    messageBody?: pulumi.Input<string>;
    /**
     * The http status code to respond with.
     */
    statusCode?: pulumi.Input<number>;
}
export interface LoadBalancerRuleOverrides {
    /**
     * Controls features that modify the routing of requests to pools and origins in response to dynamic conditions, such as during the interval between active health monitoring requests. For example, zero-downtime failover occurs immediately when an origin becomes unavailable due to HTTP 521, 522, or 523 response codes. If there is another healthy origin in the same pool, the request is retried once against this alternate origin.
     */
    adaptiveRouting?: pulumi.Input<inputs.LoadBalancerRuleOverridesAdaptiveRouting>;
    /**
     * A mapping of country codes to a list of pool IDs (ordered by their failover priority) for the given country. Any country not explicitly defined will fall back to using the corresponding region*pool mapping if it exists else to default*pools.
     */
    countryPools?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * A list of pool IDs ordered by their failover priority. Pools defined here are used by default, or when regionPools are not configured for a given region.
     */
    defaultPools?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The pool ID to use when all other pools are detected as unhealthy.
     */
    fallbackPool?: pulumi.Input<string>;
    /**
     * Controls location-based steering for non-proxied requests. See `steeringPolicy` to learn how steering is affected.
     */
    locationStrategy?: pulumi.Input<inputs.LoadBalancerRuleOverridesLocationStrategy>;
    /**
     * Enterprise only: A mapping of Cloudflare PoP identifiers to a list of pool IDs (ordered by their failover priority) for the PoP (datacenter). Any PoPs not explicitly defined will fall back to using the corresponding country*pool, then region*pool mapping if it exists else to default_pools.
     */
    popPools?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * Configures pool weights.
     */
    randomSteering?: pulumi.Input<inputs.LoadBalancerRuleOverridesRandomSteering>;
    /**
     * A mapping of region codes to a list of pool IDs (ordered by their failover priority) for the given region. Any regions not explicitly defined will fall back to using default_pools.
     */
    regionPools?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * Specifies the type of session affinity the load balancer should use unless specified as `"none"`. The supported types are: - `"cookie"`: On the first request to a proxied load balancer, a cookie is generated, encoding information of which origin the request will be forwarded to. Subsequent requests, by the same client to the same load balancer, will be sent to the origin server the cookie encodes, for the duration of the cookie and as long as the origin server remains healthy. If the cookie has expired or the origin server is unhealthy, then a new origin server is calculated and used. - `"ipCookie"`: Behaves the same as `"cookie"` except the initial origin selection is stable and based on the client's ip address. - `"header"`: On the first request to a proxied load balancer, a session key based on the configured HTTP headers (see `session_affinity_attributes.headers`) is generated, encoding the request headers used for storing in the load balancer session state which origin the request will be forwarded to. Subsequent requests to the load balancer with the same headers will be sent to the same origin server, for the duration of the session and as long as the origin server remains healthy. If the session has been idle for the duration of `sessionAffinityTtl` seconds or the origin server is unhealthy, then a new origin server is calculated and used. See `headers` in `sessionAffinityAttributes` for additional required configuration.
     * Available values: "none", "cookie", "ipCookie", "header".
     */
    sessionAffinity?: pulumi.Input<string>;
    /**
     * Configures attributes for session affinity.
     */
    sessionAffinityAttributes?: pulumi.Input<inputs.LoadBalancerRuleOverridesSessionAffinityAttributes>;
    /**
     * Time, in seconds, until a client's session expires after being created. Once the expiry time has been reached, subsequent requests may get sent to a different origin server. The accepted ranges per `sessionAffinity` policy are: - `"cookie"` / `"ipCookie"`: The current default of 23 hours will be used unless explicitly set. The accepted range of values is between [1800, 604800]. - `"header"`: The current default of 1800 seconds will be used unless explicitly set. The accepted range of values is between [30, 3600]. Note: With session affinity by header, sessions only expire after they haven't been used for the number of seconds specified.
     */
    sessionAffinityTtl?: pulumi.Input<number>;
    /**
     * Steering Policy for this load balancer.
     */
    steeringPolicy?: pulumi.Input<string>;
    /**
     * Time to live (TTL) of the DNS entry for the IP address returned by this load balancer. This only applies to gray-clouded (unproxied) load balancers.
     */
    ttl?: pulumi.Input<number>;
}
export interface LoadBalancerRuleOverridesAdaptiveRouting {
    /**
     * Extends zero-downtime failover of requests to healthy origins from alternate pools, when no healthy alternate exists in the same pool, according to the failover order defined by traffic and origin steering. When set false (the default) zero-downtime failover will only occur between origins within the same pool. See `sessionAffinityAttributes` for control over when sessions are broken or reassigned.
     */
    failoverAcrossPools?: pulumi.Input<boolean>;
}
export interface LoadBalancerRuleOverridesLocationStrategy {
    /**
     * Determines the authoritative location when ECS is not preferred, does not exist in the request, or its GeoIP lookup is unsuccessful.
     */
    mode?: pulumi.Input<string>;
    /**
     * Whether the EDNS Client Subnet (ECS) GeoIP should be preferred as the authoritative location.
     */
    preferEcs?: pulumi.Input<string>;
}
export interface LoadBalancerRuleOverridesRandomSteering {
    /**
     * The default weight for pools in the load balancer that are not specified in the poolWeights map.
     */
    defaultWeight?: pulumi.Input<number>;
    /**
     * A mapping of pool IDs to custom weights. The weight is relative to other pools in the load balancer.
     */
    poolWeights?: pulumi.Input<{
        [key: string]: pulumi.Input<number>;
    }>;
}
export interface LoadBalancerRuleOverridesSessionAffinityAttributes {
    /**
     * Configures the drain duration in seconds. This field is only used when session affinity is enabled on the load balancer.
     */
    drainDuration?: pulumi.Input<number>;
    /**
     * Configures the names of HTTP headers to base session affinity on when header `sessionAffinity` is enabled. At least one HTTP header name must be provided. To specify the exact cookies to be used, include an item in the following format: `"cookie:<cookie-name-1>,<cookie-name-2>"` (example) where everything after the colon is a comma-separated list of cookie names. Providing only `"cookie"` will result in all cookies being used. The default max number of HTTP header names that can be provided depends on your plan: 5 for Enterprise, 1 for all other plans.
     */
    headers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * When header `sessionAffinity` is enabled, this option can be used to specify how HTTP headers on load balancing requests will be used. The supported values are: - `"true"`: Load balancing requests must contain *all* of the HTTP headers specified by the `headers` session affinity attribute, otherwise sessions aren't created. - `"false"`: Load balancing requests must contain *at least one* of the HTTP headers specified by the `headers` session affinity attribute, otherwise sessions aren't created.
     */
    requireAllHeaders?: pulumi.Input<boolean>;
    /**
     * Configures the SameSite attribute on session affinity cookie. Value "Auto" will be translated to "Lax" or "None" depending if Always Use HTTPS is enabled. Note: when using value "None", the secure attribute can not be set to "Never".
     * Available values: "Auto", "Lax", "None", "Strict".
     */
    samesite?: pulumi.Input<string>;
    /**
     * Configures the Secure attribute on session affinity cookie. Value "Always" indicates the Secure attribute will be set in the Set-Cookie header, "Never" indicates the Secure attribute will not be set, and "Auto" will set the Secure attribute depending if Always Use HTTPS is enabled.
     * Available values: "Auto", "Always", "Never".
     */
    secure?: pulumi.Input<string>;
    /**
     * Configures the zero-downtime failover between origins within a pool when session affinity is enabled. This feature is currently incompatible with Argo, Tiered Cache, and Bandwidth Alliance. The supported values are: - `"none"`: No failover takes place for sessions pinned to the origin (default). - `"temporary"`: Traffic will be sent to another other healthy origin until the originally pinned origin is available; note that this can potentially result in heavy origin flapping. - `"sticky"`: The session affinity cookie is updated and subsequent requests are sent to the new origin. Note: Zero-downtime failover with sticky sessions is currently not supported for session affinity by header.
     * Available values: "none", "temporary", "sticky".
     */
    zeroDowntimeFailover?: pulumi.Input<string>;
}
export interface LoadBalancerSessionAffinityAttributes {
    /**
     * Configures the drain duration in seconds. This field is only used when session affinity is enabled on the load balancer.
     */
    drainDuration?: pulumi.Input<number>;
    /**
     * Configures the names of HTTP headers to base session affinity on when header `sessionAffinity` is enabled. At least one HTTP header name must be provided. To specify the exact cookies to be used, include an item in the following format: `"cookie:<cookie-name-1>,<cookie-name-2>"` (example) where everything after the colon is a comma-separated list of cookie names. Providing only `"cookie"` will result in all cookies being used. The default max number of HTTP header names that can be provided depends on your plan: 5 for Enterprise, 1 for all other plans.
     */
    headers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * When header `sessionAffinity` is enabled, this option can be used to specify how HTTP headers on load balancing requests will be used. The supported values are: - `"true"`: Load balancing requests must contain *all* of the HTTP headers specified by the `headers` session affinity attribute, otherwise sessions aren't created. - `"false"`: Load balancing requests must contain *at least one* of the HTTP headers specified by the `headers` session affinity attribute, otherwise sessions aren't created.
     */
    requireAllHeaders?: pulumi.Input<boolean>;
    /**
     * Configures the SameSite attribute on session affinity cookie. Value "Auto" will be translated to "Lax" or "None" depending if Always Use HTTPS is enabled. Note: when using value "None", the secure attribute can not be set to "Never".
     * Available values: "Auto", "Lax", "None", "Strict".
     */
    samesite?: pulumi.Input<string>;
    /**
     * Configures the Secure attribute on session affinity cookie. Value "Always" indicates the Secure attribute will be set in the Set-Cookie header, "Never" indicates the Secure attribute will not be set, and "Auto" will set the Secure attribute depending if Always Use HTTPS is enabled.
     * Available values: "Auto", "Always", "Never".
     */
    secure?: pulumi.Input<string>;
    /**
     * Configures the zero-downtime failover between origins within a pool when session affinity is enabled. This feature is currently incompatible with Argo, Tiered Cache, and Bandwidth Alliance. The supported values are: - `"none"`: No failover takes place for sessions pinned to the origin (default). - `"temporary"`: Traffic will be sent to another other healthy origin until the originally pinned origin is available; note that this can potentially result in heavy origin flapping. - `"sticky"`: The session affinity cookie is updated and subsequent requests are sent to the new origin. Note: Zero-downtime failover with sticky sessions is currently not supported for session affinity by header.
     * Available values: "none", "temporary", "sticky".
     */
    zeroDowntimeFailover?: pulumi.Input<string>;
}
export interface LogpushJobOutputOptions {
    /**
     * String to be prepended before each batch.
     */
    batchPrefix?: pulumi.Input<string>;
    /**
     * String to be appended after each batch.
     */
    batchSuffix?: pulumi.Input<string>;
    /**
     * If set to true, will cause all occurrences of `${` in the generated files to be replaced with `x{`.
     */
    cve202144228?: pulumi.Input<boolean>;
    /**
     * String to join fields. This field be ignored when `recordTemplate` is set.
     */
    fieldDelimiter?: pulumi.Input<string>;
    /**
     * List of field names to be included in the Logpush output. For the moment, there is no option to add all fields at once, so you must specify all the fields names you are interested in.
     */
    fieldNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Specifies the output type, such as `ndjson` or `csv`. This sets default values for the rest of the settings, depending on the chosen output type. Some formatting rules, like string quoting, are different between output types.
     * Available values: "ndjson", "csv".
     */
    outputType?: pulumi.Input<string>;
    /**
     * String to be inserted in-between the records as separator.
     */
    recordDelimiter?: pulumi.Input<string>;
    /**
     * String to be prepended before each record.
     */
    recordPrefix?: pulumi.Input<string>;
    /**
     * String to be appended after each record.
     */
    recordSuffix?: pulumi.Input<string>;
    /**
     * String to use as template for each record instead of the default json key value mapping. All fields used in the template must be present in `fieldNames` as well, otherwise they will end up as null. Format as a Go `text/template` without any standard functions, like conditionals, loops, sub-templates, etc.
     */
    recordTemplate?: pulumi.Input<string>;
    /**
     * Floating number to specify sampling rate. Sampling is applied on top of filtering, and regardless of the current `sampleInterval` of the data.
     */
    sampleRate?: pulumi.Input<number>;
    /**
     * String to specify the format for timestamps, such as `unixnano`, `unix`, or `rfc3339`.
     * Available values: "unixnano", "unix", "rfc3339".
     */
    timestampFormat?: pulumi.Input<string>;
}
export interface MagicNetworkMonitoringConfigurationWarpDevice {
    /**
     * Unique identifier for the warp device.
     */
    id: pulumi.Input<string>;
    /**
     * Name of the warp device.
     */
    name: pulumi.Input<string>;
    /**
     * IPv4 CIDR of the router sourcing flow data associated with this warp device. Only /32 addresses are currently supported.
     */
    routerIp: pulumi.Input<string>;
}
export interface MagicTransitConnectorDevice {
    id?: pulumi.Input<string>;
    serialNumber?: pulumi.Input<string>;
}
export interface MagicTransitSiteAclLan1 {
    /**
     * The identifier for the LAN you want to create an ACL policy with.
     */
    lanId: pulumi.Input<string>;
    /**
     * The name of the LAN based on the provided lan_id.
     */
    lanName?: pulumi.Input<string>;
    /**
     * Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.
     */
    portRanges?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.
     */
    ports?: pulumi.Input<pulumi.Input<number>[]>;
    /**
     * Array of subnet IPs within the LAN that will be included in the ACL. If no subnets are provided, communication on any subnets on this LAN are allowed.
     */
    subnets?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface MagicTransitSiteAclLan2 {
    /**
     * The identifier for the LAN you want to create an ACL policy with.
     */
    lanId: pulumi.Input<string>;
    /**
     * The name of the LAN based on the provided lan_id.
     */
    lanName?: pulumi.Input<string>;
    /**
     * Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.
     */
    portRanges?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.
     */
    ports?: pulumi.Input<pulumi.Input<number>[]>;
    /**
     * Array of subnet IPs within the LAN that will be included in the ACL. If no subnets are provided, communication on any subnets on this LAN are allowed.
     */
    subnets?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface MagicTransitSiteLanNat {
    /**
     * A valid CIDR notation representing an IP range.
     */
    staticPrefix?: pulumi.Input<string>;
}
export interface MagicTransitSiteLanRoutedSubnet {
    nat?: pulumi.Input<inputs.MagicTransitSiteLanRoutedSubnetNat>;
    /**
     * A valid IPv4 address.
     */
    nextHop: pulumi.Input<string>;
    /**
     * A valid CIDR notation representing an IP range.
     */
    prefix: pulumi.Input<string>;
}
export interface MagicTransitSiteLanRoutedSubnetNat {
    /**
     * A valid CIDR notation representing an IP range.
     */
    staticPrefix?: pulumi.Input<string>;
}
export interface MagicTransitSiteLanStaticAddressing {
    /**
     * A valid CIDR notation representing an IP range.
     */
    address: pulumi.Input<string>;
    dhcpRelay?: pulumi.Input<inputs.MagicTransitSiteLanStaticAddressingDhcpRelay>;
    dhcpServer?: pulumi.Input<inputs.MagicTransitSiteLanStaticAddressingDhcpServer>;
    /**
     * A valid CIDR notation representing an IP range.
     */
    secondaryAddress?: pulumi.Input<string>;
    /**
     * A valid CIDR notation representing an IP range.
     */
    virtualAddress?: pulumi.Input<string>;
}
export interface MagicTransitSiteLanStaticAddressingDhcpRelay {
    /**
     * List of DHCP server IPs.
     */
    serverAddresses?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface MagicTransitSiteLanStaticAddressingDhcpServer {
    /**
     * A valid IPv4 address.
     */
    dhcpPoolEnd?: pulumi.Input<string>;
    /**
     * A valid IPv4 address.
     */
    dhcpPoolStart?: pulumi.Input<string>;
    /**
     * A valid IPv4 address.
     */
    dnsServer?: pulumi.Input<string>;
    dnsServers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Mapping of MAC addresses to IP addresses
     */
    reservations?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
}
export interface MagicTransitSiteLocation {
    /**
     * Latitude
     */
    lat?: pulumi.Input<string>;
    /**
     * Longitude
     */
    lon?: pulumi.Input<string>;
}
export interface MagicTransitSiteWanStaticAddressing {
    /**
     * A valid CIDR notation representing an IP range.
     */
    address: pulumi.Input<string>;
    /**
     * A valid IPv4 address.
     */
    gatewayAddress: pulumi.Input<string>;
    /**
     * A valid CIDR notation representing an IP range.
     */
    secondaryAddress?: pulumi.Input<string>;
}
export interface MagicWanGreTunnelHealthCheck {
    /**
     * The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.
     * Available values: "unidirectional", "bidirectional".
     */
    direction?: pulumi.Input<string>;
    /**
     * Determines whether to run healthchecks for a tunnel.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * How frequent the health check is run. The default value is `mid`.
     * Available values: "low", "mid", "high".
     */
    rate?: pulumi.Input<string>;
    /**
     * The destination address in a request type health check. After the healthcheck is decapsulated at the customer end of the tunnel, the ICMP echo will be forwarded to this address. This field defaults to `customerGreEndpoint address`. This field is ignored for bidirectional healthchecks as the interface*address (not assigned to the Cloudflare side of the tunnel) is used as the target. Must be in object form if the x-magic-new-hc-target header is set to true and string form if x-magic-new-hc-target is absent or set to false.
     */
    target?: pulumi.Input<inputs.MagicWanGreTunnelHealthCheckTarget>;
    /**
     * The type of healthcheck to run, reply or request. The default value is `reply`.
     * Available values: "reply", "request".
     */
    type?: pulumi.Input<string>;
}
export interface MagicWanGreTunnelHealthCheckTarget {
    /**
     * The effective health check target. If 'saved' is empty, then this field will be populated with the calculated default value on GET requests. Ignored in POST, PUT, and PATCH requests.
     */
    effective?: pulumi.Input<string>;
    /**
     * The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.
     */
    saved?: pulumi.Input<string>;
}
export interface MagicWanIpsecTunnelHealthCheck {
    /**
     * The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.
     * Available values: "unidirectional", "bidirectional".
     */
    direction?: pulumi.Input<string>;
    /**
     * Determines whether to run healthchecks for a tunnel.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * How frequent the health check is run. The default value is `mid`.
     * Available values: "low", "mid", "high".
     */
    rate?: pulumi.Input<string>;
    /**
     * The destination address in a request type health check. After the healthcheck is decapsulated at the customer end of the tunnel, the ICMP echo will be forwarded to this address. This field defaults to `customerGreEndpoint address`. This field is ignored for bidirectional healthchecks as the interface*address (not assigned to the Cloudflare side of the tunnel) is used as the target. Must be in object form if the x-magic-new-hc-target header is set to true and string form if x-magic-new-hc-target is absent or set to false.
     */
    target?: pulumi.Input<inputs.MagicWanIpsecTunnelHealthCheckTarget>;
    /**
     * The type of healthcheck to run, reply or request. The default value is `reply`.
     * Available values: "reply", "request".
     */
    type?: pulumi.Input<string>;
}
export interface MagicWanIpsecTunnelHealthCheckTarget {
    /**
     * The effective health check target. If 'saved' is empty, then this field will be populated with the calculated default value on GET requests. Ignored in POST, PUT, and PATCH requests.
     */
    effective?: pulumi.Input<string>;
    /**
     * The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.
     */
    saved?: pulumi.Input<string>;
}
export interface MagicWanIpsecTunnelPskMetadata {
    /**
     * The date and time the tunnel was last modified.
     */
    lastGeneratedOn?: pulumi.Input<string>;
}
export interface MagicWanStaticRouteScope {
    /**
     * List of colo names for the ECMP scope.
     */
    coloNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of colo regions for the ECMP scope.
     */
    coloRegions?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ManagedHeadersManagedRequestHeader {
    /**
     * Whether the Managed Transform is enabled.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The human-readable identifier of the Managed Transform.
     */
    id: pulumi.Input<string>;
}
export interface ManagedHeadersManagedResponseHeader {
    /**
     * Whether the Managed Transform is enabled.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The human-readable identifier of the Managed Transform.
     */
    id: pulumi.Input<string>;
}
export interface ManagedTransformsManagedRequestHeader {
    /**
     * Whether the Managed Transform is enabled.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The human-readable identifier of the Managed Transform.
     */
    id: pulumi.Input<string>;
}
export interface ManagedTransformsManagedResponseHeader {
    /**
     * Whether the Managed Transform is enabled.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The human-readable identifier of the Managed Transform.
     */
    id: pulumi.Input<string>;
}
export interface NotificationPolicyFilters {
    /**
     * Usage depends on specific alert type
     */
    actions?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring radar_notification
     */
    affectedAsns?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring incident_alert
     */
    affectedComponents?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring radar_notification
     */
    affectedLocations?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring maintenance*event*notification
     */
    airportCodes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    alertTriggerPreferences?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    alertTriggerPreferencesValues?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring load*balancing*pool*enablement*alert
     */
    enableds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring pages*event*alert
     */
    environments?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring load*balancing*health_alert
     */
    eventSources?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    eventTypes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring pages*event*alert
     */
    events?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    groupBies?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring health*check*status_notification
     */
    healthCheckIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring incident_alert
     */
    incidentImpacts?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring stream*live*notifications
     */
    inputIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring security*insights*alert
     */
    insightClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring billing*usage*alert
     */
    limits?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring logo*match*alert
     */
    logoTags?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring advanced*ddos*attack*l4*alert
     */
    megabitsPerSeconds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring load*balancing*health_alert
     */
    newHealths?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring tunnel*health*event
     */
    newStatuses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring advanced*ddos*attack*l4*alert
     */
    packetsPerSeconds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    poolIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    popNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring billing*usage*alert
     */
    products?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring pages*event*alert
     */
    projectIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring advanced*ddos*attack*l4*alert
     */
    protocols?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    queryTags?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring advanced*ddos*attack*l7*alert
     */
    requestsPerSeconds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    selectors?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring clickhouse*alert*fw*ent*anomaly
     */
    services?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    slos?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring health*check*status_notification
     */
    statuses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring advanced*ddos*attack*l7*alert
     */
    targetHostnames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring advanced*ddos*attack*l4*alert
     */
    targetIps?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring advanced*ddos*attack*l7*alert
     */
    targetZoneNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring traffic*anomalies*alert
     */
    trafficExclusions?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Used for configuring tunnel*health*event
     */
    tunnelIds?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    tunnelNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    wheres?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Usage depends on specific alert type
     */
    zones?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface NotificationPolicyMechanisms {
    emails?: pulumi.Input<pulumi.Input<inputs.NotificationPolicyMechanismsEmail>[]>;
    pagerduties?: pulumi.Input<pulumi.Input<inputs.NotificationPolicyMechanismsPagerduty>[]>;
    webhooks?: pulumi.Input<pulumi.Input<inputs.NotificationPolicyMechanismsWebhook>[]>;
}
export interface NotificationPolicyMechanismsEmail {
    /**
     * The email address
     */
    id?: pulumi.Input<string>;
}
export interface NotificationPolicyMechanismsPagerduty {
    /**
     * UUID
     */
    id?: pulumi.Input<string>;
}
export interface NotificationPolicyMechanismsWebhook {
    /**
     * UUID
     */
    id?: pulumi.Input<string>;
}
export interface ObservatoryScheduledTestSchedule {
    /**
     * The frequency of the test.
     * Available values: "DAILY", "WEEKLY".
     */
    frequency?: pulumi.Input<string>;
    /**
     * A test region.
     * Available values: "asia-east1", "asia-northeast1", "asia-northeast2", "asia-south1", "asia-southeast1", "australia-southeast1", "europe-north1", "europe-southwest1", "europe-west1", "europe-west2", "europe-west3", "europe-west4", "europe-west8", "europe-west9", "me-west1", "southamerica-east1", "us-central1", "us-east1", "us-east4", "us-south1", "us-west1".
     */
    region?: pulumi.Input<string>;
    /**
     * A URL.
     */
    url?: pulumi.Input<string>;
}
export interface ObservatoryScheduledTestTest {
    date?: pulumi.Input<string>;
    /**
     * The Lighthouse report.
     */
    desktopReport?: pulumi.Input<inputs.ObservatoryScheduledTestTestDesktopReport>;
    /**
     * UUID.
     */
    id?: pulumi.Input<string>;
    /**
     * The Lighthouse report.
     */
    mobileReport?: pulumi.Input<inputs.ObservatoryScheduledTestTestMobileReport>;
    /**
     * A test region with a label.
     */
    region?: pulumi.Input<inputs.ObservatoryScheduledTestTestRegion>;
    /**
     * The frequency of the test.
     * Available values: "DAILY", "WEEKLY".
     */
    scheduleFrequency?: pulumi.Input<string>;
    /**
     * A URL.
     */
    url?: pulumi.Input<string>;
}
export interface ObservatoryScheduledTestTestDesktopReport {
    /**
     * Cumulative Layout Shift.
     */
    cls?: pulumi.Input<number>;
    /**
     * The type of device.
     * Available values: "DESKTOP", "MOBILE".
     */
    deviceType?: pulumi.Input<string>;
    error?: pulumi.Input<inputs.ObservatoryScheduledTestTestDesktopReportError>;
    /**
     * First Contentful Paint.
     */
    fcp?: pulumi.Input<number>;
    /**
     * The URL to the full Lighthouse JSON report.
     */
    jsonReportUrl?: pulumi.Input<string>;
    /**
     * Largest Contentful Paint.
     */
    lcp?: pulumi.Input<number>;
    /**
     * The Lighthouse performance score.
     */
    performanceScore?: pulumi.Input<number>;
    /**
     * Speed Index.
     */
    si?: pulumi.Input<number>;
    /**
     * The state of the Lighthouse report.
     * Available values: "RUNNING", "COMPLETE", "FAILED".
     */
    state?: pulumi.Input<string>;
    /**
     * Total Blocking Time.
     */
    tbt?: pulumi.Input<number>;
    /**
     * Time To First Byte.
     */
    ttfb?: pulumi.Input<number>;
    /**
     * Time To Interactive.
     */
    tti?: pulumi.Input<number>;
}
export interface ObservatoryScheduledTestTestDesktopReportError {
    /**
     * The error code of the Lighthouse result.
     * Available values: "NOT*REACHABLE", "DNS*FAILURE", "NOT*HTML", "LIGHTHOUSE*TIMEOUT", "UNKNOWN".
     */
    code?: pulumi.Input<string>;
    /**
     * Detailed error message.
     */
    detail?: pulumi.Input<string>;
    /**
     * The final URL displayed to the user.
     */
    finalDisplayedUrl?: pulumi.Input<string>;
}
export interface ObservatoryScheduledTestTestMobileReport {
    /**
     * Cumulative Layout Shift.
     */
    cls?: pulumi.Input<number>;
    /**
     * The type of device.
     * Available values: "DESKTOP", "MOBILE".
     */
    deviceType?: pulumi.Input<string>;
    error?: pulumi.Input<inputs.ObservatoryScheduledTestTestMobileReportError>;
    /**
     * First Contentful Paint.
     */
    fcp?: pulumi.Input<number>;
    /**
     * The URL to the full Lighthouse JSON report.
     */
    jsonReportUrl?: pulumi.Input<string>;
    /**
     * Largest Contentful Paint.
     */
    lcp?: pulumi.Input<number>;
    /**
     * The Lighthouse performance score.
     */
    performanceScore?: pulumi.Input<number>;
    /**
     * Speed Index.
     */
    si?: pulumi.Input<number>;
    /**
     * The state of the Lighthouse report.
     * Available values: "RUNNING", "COMPLETE", "FAILED".
     */
    state?: pulumi.Input<string>;
    /**
     * Total Blocking Time.
     */
    tbt?: pulumi.Input<number>;
    /**
     * Time To First Byte.
     */
    ttfb?: pulumi.Input<number>;
    /**
     * Time To Interactive.
     */
    tti?: pulumi.Input<number>;
}
export interface ObservatoryScheduledTestTestMobileReportError {
    /**
     * The error code of the Lighthouse result.
     * Available values: "NOT*REACHABLE", "DNS*FAILURE", "NOT*HTML", "LIGHTHOUSE*TIMEOUT", "UNKNOWN".
     */
    code?: pulumi.Input<string>;
    /**
     * Detailed error message.
     */
    detail?: pulumi.Input<string>;
    /**
     * The final URL displayed to the user.
     */
    finalDisplayedUrl?: pulumi.Input<string>;
}
export interface ObservatoryScheduledTestTestRegion {
    label?: pulumi.Input<string>;
    /**
     * A test region.
     * Available values: "asia-east1", "asia-northeast1", "asia-northeast2", "asia-south1", "asia-southeast1", "australia-southeast1", "europe-north1", "europe-southwest1", "europe-west1", "europe-west2", "europe-west3", "europe-west4", "europe-west8", "europe-west9", "me-west1", "southamerica-east1", "us-central1", "us-east1", "us-east4", "us-south1", "us-west1".
     */
    value?: pulumi.Input<string>;
}
export interface PageRuleActions {
    alwaysUseHttps?: pulumi.Input<boolean>;
    automaticHttpsRewrites?: pulumi.Input<string>;
    browserCacheTtl?: pulumi.Input<number>;
    browserCheck?: pulumi.Input<string>;
    bypassCacheOnCookie?: pulumi.Input<string>;
    cacheByDeviceType?: pulumi.Input<string>;
    cacheDeceptionArmor?: pulumi.Input<string>;
    cacheKeyFields?: pulumi.Input<inputs.PageRuleActionsCacheKeyFields>;
    cacheLevel?: pulumi.Input<string>;
    cacheOnCookie?: pulumi.Input<string>;
    cacheTtlByStatus?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
    disableApps?: pulumi.Input<boolean>;
    disablePerformance?: pulumi.Input<boolean>;
    disableSecurity?: pulumi.Input<boolean>;
    disableZaraz?: pulumi.Input<boolean>;
    edgeCacheTtl?: pulumi.Input<number>;
    emailObfuscation?: pulumi.Input<string>;
    explicitCacheControl?: pulumi.Input<string>;
    forwardingUrl?: pulumi.Input<inputs.PageRuleActionsForwardingUrl>;
    hostHeaderOverride?: pulumi.Input<string>;
    ipGeolocation?: pulumi.Input<string>;
    mirage?: pulumi.Input<string>;
    opportunisticEncryption?: pulumi.Input<string>;
    originErrorPagePassThru?: pulumi.Input<string>;
    polish?: pulumi.Input<string>;
    resolveOverride?: pulumi.Input<string>;
    respectStrongEtag?: pulumi.Input<string>;
    responseBuffering?: pulumi.Input<string>;
    rocketLoader?: pulumi.Input<string>;
    securityLevel?: pulumi.Input<string>;
    sortQueryStringForCache?: pulumi.Input<string>;
    ssl?: pulumi.Input<string>;
    trueClientIpHeader?: pulumi.Input<string>;
    waf?: pulumi.Input<string>;
}
export interface PageRuleActionsCacheKeyFields {
    cookie?: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsCookie>;
    header?: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsHeader>;
    host?: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsHost>;
    queryString?: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsQueryString>;
    user?: pulumi.Input<inputs.PageRuleActionsCacheKeyFieldsUser>;
}
export interface PageRuleActionsCacheKeyFieldsCookie {
    checkPresences?: pulumi.Input<pulumi.Input<string>[]>;
    includes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface PageRuleActionsCacheKeyFieldsHeader {
    checkPresences?: pulumi.Input<pulumi.Input<string>[]>;
    excludes?: pulumi.Input<pulumi.Input<string>[]>;
    includes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface PageRuleActionsCacheKeyFieldsHost {
    resolved?: pulumi.Input<boolean>;
}
export interface PageRuleActionsCacheKeyFieldsQueryString {
    excludes?: pulumi.Input<pulumi.Input<string>[]>;
    includes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface PageRuleActionsCacheKeyFieldsUser {
    deviceType?: pulumi.Input<boolean>;
    geo?: pulumi.Input<boolean>;
    lang?: pulumi.Input<boolean>;
}
export interface PageRuleActionsForwardingUrl {
    statusCode: pulumi.Input<number>;
    url: pulumi.Input<string>;
}
export interface PagesDomainValidationData {
    errorMessage?: pulumi.Input<string>;
    /**
     * Available values: "http", "txt".
     */
    method?: pulumi.Input<string>;
    /**
     * Available values: "initializing", "pending", "active", "deactivated", "error".
     */
    status?: pulumi.Input<string>;
    txtName?: pulumi.Input<string>;
    txtValue?: pulumi.Input<string>;
}
export interface PagesDomainVerificationData {
    errorMessage?: pulumi.Input<string>;
    /**
     * Available values: "pending", "active", "deactivated", "blocked", "error".
     */
    status?: pulumi.Input<string>;
}
export interface PagesProjectBuildConfig {
    /**
     * Enable build caching for the project.
     */
    buildCaching?: pulumi.Input<boolean>;
    /**
     * Command used to build project.
     */
    buildCommand?: pulumi.Input<string>;
    /**
     * Output directory of the build.
     */
    destinationDir?: pulumi.Input<string>;
    /**
     * Directory to run the command.
     */
    rootDir?: pulumi.Input<string>;
    /**
     * The classifying tag for analytics.
     */
    webAnalyticsTag?: pulumi.Input<string>;
    /**
     * The auth token for analytics.
     */
    webAnalyticsToken?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeployment {
    /**
     * A list of alias URLs pointing to this deployment.
     */
    aliases?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Configs for the project build process.
     */
    buildConfig?: pulumi.Input<inputs.PagesProjectCanonicalDeploymentBuildConfig>;
    /**
     * When the deployment was created.
     */
    createdOn?: pulumi.Input<string>;
    /**
     * Info about what caused the deployment.
     */
    deploymentTrigger?: pulumi.Input<inputs.PagesProjectCanonicalDeploymentDeploymentTrigger>;
    /**
     * Environment variables used for builds and Pages Functions.
     */
    envVars?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectCanonicalDeploymentEnvVars>;
    }>;
    /**
     * Type of deploy.
     * Available values: "preview", "production".
     */
    environment?: pulumi.Input<string>;
    /**
     * Id of the deployment.
     */
    id?: pulumi.Input<string>;
    /**
     * If the deployment has been skipped.
     */
    isSkipped?: pulumi.Input<boolean>;
    /**
     * The status of the deployment.
     */
    latestStage?: pulumi.Input<inputs.PagesProjectCanonicalDeploymentLatestStage>;
    /**
     * When the deployment was last modified.
     */
    modifiedOn?: pulumi.Input<string>;
    /**
     * Id of the project.
     */
    projectId?: pulumi.Input<string>;
    /**
     * Name of the project.
     */
    projectName?: pulumi.Input<string>;
    /**
     * Short Id (8 character) of the deployment.
     */
    shortId?: pulumi.Input<string>;
    source?: pulumi.Input<inputs.PagesProjectCanonicalDeploymentSource>;
    /**
     * List of past stages.
     */
    stages?: pulumi.Input<pulumi.Input<inputs.PagesProjectCanonicalDeploymentStage>[]>;
    /**
     * The live URL to view this deployment.
     */
    url?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentBuildConfig {
    /**
     * Enable build caching for the project.
     */
    buildCaching?: pulumi.Input<boolean>;
    /**
     * Command used to build project.
     */
    buildCommand?: pulumi.Input<string>;
    /**
     * Output directory of the build.
     */
    destinationDir?: pulumi.Input<string>;
    /**
     * Directory to run the command.
     */
    rootDir?: pulumi.Input<string>;
    /**
     * The classifying tag for analytics.
     */
    webAnalyticsTag?: pulumi.Input<string>;
    /**
     * The auth token for analytics.
     */
    webAnalyticsToken?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentDeploymentTrigger {
    /**
     * Additional info about the trigger.
     */
    metadata?: pulumi.Input<inputs.PagesProjectCanonicalDeploymentDeploymentTriggerMetadata>;
    /**
     * What caused the deployment.
     * Available values: "push", "adHoc".
     */
    type?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentDeploymentTriggerMetadata {
    /**
     * Where the trigger happened.
     */
    branch?: pulumi.Input<string>;
    /**
     * Hash of the deployment trigger commit.
     */
    commitHash?: pulumi.Input<string>;
    /**
     * Message of the deployment trigger commit.
     */
    commitMessage?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentEnvVars {
    /**
     * Available values: "plain*text", "secret*text".
     */
    type?: pulumi.Input<string>;
    /**
     * Environment variable value.
     */
    value?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentLatestStage {
    /**
     * When the stage ended.
     */
    endedOn?: pulumi.Input<string>;
    /**
     * The current build stage.
     * Available values: "queued", "initialize", "cloneRepo", "build", "deploy".
     */
    name?: pulumi.Input<string>;
    /**
     * When the stage started.
     */
    startedOn?: pulumi.Input<string>;
    /**
     * State of the current stage.
     * Available values: "success", "idle", "active", "failure", "canceled".
     */
    status?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentSource {
    config?: pulumi.Input<inputs.PagesProjectCanonicalDeploymentSourceConfig>;
    type?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentSourceConfig {
    deploymentsEnabled?: pulumi.Input<boolean>;
    owner?: pulumi.Input<string>;
    pathExcludes?: pulumi.Input<pulumi.Input<string>[]>;
    pathIncludes?: pulumi.Input<pulumi.Input<string>[]>;
    prCommentsEnabled?: pulumi.Input<boolean>;
    previewBranchExcludes?: pulumi.Input<pulumi.Input<string>[]>;
    previewBranchIncludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Available values: "all", "none", "custom".
     */
    previewDeploymentSetting?: pulumi.Input<string>;
    productionBranch?: pulumi.Input<string>;
    productionDeploymentsEnabled?: pulumi.Input<boolean>;
    repoName?: pulumi.Input<string>;
}
export interface PagesProjectCanonicalDeploymentStage {
    /**
     * When the stage ended.
     */
    endedOn?: pulumi.Input<string>;
    /**
     * The current build stage.
     * Available values: "queued", "initialize", "cloneRepo", "build", "deploy".
     */
    name?: pulumi.Input<string>;
    /**
     * When the stage started.
     */
    startedOn?: pulumi.Input<string>;
    /**
     * State of the current stage.
     * Available values: "success", "idle", "active", "failure", "canceled".
     */
    status?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigs {
    /**
     * Configs for preview deploys.
     */
    preview?: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreview>;
    /**
     * Configs for production deploys.
     */
    production?: pulumi.Input<inputs.PagesProjectDeploymentConfigsProduction>;
}
export interface PagesProjectDeploymentConfigsPreview {
    /**
     * Constellation bindings used for Pages Functions.
     */
    aiBindings?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewAiBindings>;
    }>;
    /**
     * Analytics Engine bindings used for Pages Functions.
     */
    analyticsEngineDatasets?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewAnalyticsEngineDatasets>;
    }>;
    /**
     * Browser bindings used for Pages Functions.
     */
    browsers?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewBrowsers>;
    }>;
    /**
     * Compatibility date used for Pages Functions.
     */
    compatibilityDate?: pulumi.Input<string>;
    /**
     * Compatibility flags used for Pages Functions.
     */
    compatibilityFlags?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * D1 databases used for Pages Functions.
     */
    d1Databases?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewD1Databases>;
    }>;
    /**
     * Durable Object namespaces used for Pages Functions.
     */
    durableObjectNamespaces?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewDurableObjectNamespaces>;
    }>;
    /**
     * Environment variables used for builds and Pages Functions.
     */
    envVars?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewEnvVars>;
    }>;
    /**
     * Hyperdrive bindings used for Pages Functions.
     */
    hyperdriveBindings?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewHyperdriveBindings>;
    }>;
    /**
     * KV namespaces used for Pages Functions.
     */
    kvNamespaces?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewKvNamespaces>;
    }>;
    /**
     * mTLS bindings used for Pages Functions.
     */
    mtlsCertificates?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewMtlsCertificates>;
    }>;
    /**
     * Placement setting used for Pages Functions.
     */
    placement?: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewPlacement>;
    /**
     * Queue Producer bindings used for Pages Functions.
     */
    queueProducers?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewQueueProducers>;
    }>;
    /**
     * R2 buckets used for Pages Functions.
     */
    r2Buckets?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewR2Buckets>;
    }>;
    /**
     * Services used for Pages Functions.
     */
    services?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewServices>;
    }>;
    /**
     * Vectorize bindings used for Pages Functions.
     */
    vectorizeBindings?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsPreviewVectorizeBindings>;
    }>;
}
export interface PagesProjectDeploymentConfigsPreviewAiBindings {
    projectId?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewAnalyticsEngineDatasets {
    /**
     * Name of the dataset.
     */
    dataset?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewBrowsers {
}
export interface PagesProjectDeploymentConfigsPreviewD1Databases {
    /**
     * UUID of the D1 database.
     */
    id?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewDurableObjectNamespaces {
    /**
     * ID of the Durable Object namespace.
     */
    namespaceId?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewEnvVars {
    /**
     * Available values: "plain*text", "secret*text".
     */
    type: pulumi.Input<string>;
    /**
     * Environment variable value.
     */
    value: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewHyperdriveBindings {
    id?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewKvNamespaces {
    /**
     * ID of the KV namespace.
     */
    namespaceId?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewMtlsCertificates {
    certificateId?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewPlacement {
    /**
     * Placement mode.
     */
    mode?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewQueueProducers {
    /**
     * Name of the Queue.
     */
    name?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewR2Buckets {
    /**
     * Jurisdiction of the R2 bucket.
     */
    jurisdiction?: pulumi.Input<string>;
    /**
     * Name of the R2 bucket.
     */
    name?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewServices {
    /**
     * The entrypoint to bind to.
     */
    entrypoint?: pulumi.Input<string>;
    /**
     * The Service environment.
     */
    environment?: pulumi.Input<string>;
    /**
     * The Service name.
     */
    service?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsPreviewVectorizeBindings {
    indexName?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProduction {
    /**
     * Constellation bindings used for Pages Functions.
     */
    aiBindings?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionAiBindings>;
    }>;
    /**
     * Analytics Engine bindings used for Pages Functions.
     */
    analyticsEngineDatasets?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionAnalyticsEngineDatasets>;
    }>;
    /**
     * Browser bindings used for Pages Functions.
     */
    browsers?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionBrowsers>;
    }>;
    /**
     * Compatibility date used for Pages Functions.
     */
    compatibilityDate?: pulumi.Input<string>;
    /**
     * Compatibility flags used for Pages Functions.
     */
    compatibilityFlags?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * D1 databases used for Pages Functions.
     */
    d1Databases?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionD1Databases>;
    }>;
    /**
     * Durable Object namespaces used for Pages Functions.
     */
    durableObjectNamespaces?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionDurableObjectNamespaces>;
    }>;
    /**
     * Environment variables used for builds and Pages Functions.
     */
    envVars?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionEnvVars>;
    }>;
    /**
     * Hyperdrive bindings used for Pages Functions.
     */
    hyperdriveBindings?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionHyperdriveBindings>;
    }>;
    /**
     * KV namespaces used for Pages Functions.
     */
    kvNamespaces?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionKvNamespaces>;
    }>;
    /**
     * mTLS bindings used for Pages Functions.
     */
    mtlsCertificates?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionMtlsCertificates>;
    }>;
    /**
     * Placement setting used for Pages Functions.
     */
    placement?: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionPlacement>;
    /**
     * Queue Producer bindings used for Pages Functions.
     */
    queueProducers?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionQueueProducers>;
    }>;
    /**
     * R2 buckets used for Pages Functions.
     */
    r2Buckets?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionR2Buckets>;
    }>;
    /**
     * Services used for Pages Functions.
     */
    services?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionServices>;
    }>;
    /**
     * Vectorize bindings used for Pages Functions.
     */
    vectorizeBindings?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectDeploymentConfigsProductionVectorizeBindings>;
    }>;
}
export interface PagesProjectDeploymentConfigsProductionAiBindings {
    projectId?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionAnalyticsEngineDatasets {
    /**
     * Name of the dataset.
     */
    dataset?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionBrowsers {
}
export interface PagesProjectDeploymentConfigsProductionD1Databases {
    /**
     * UUID of the D1 database.
     */
    id?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionDurableObjectNamespaces {
    /**
     * ID of the Durable Object namespace.
     */
    namespaceId?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionEnvVars {
    /**
     * Available values: "plain*text", "secret*text".
     */
    type: pulumi.Input<string>;
    /**
     * Environment variable value.
     */
    value: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionHyperdriveBindings {
    id?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionKvNamespaces {
    /**
     * ID of the KV namespace.
     */
    namespaceId?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionMtlsCertificates {
    certificateId?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionPlacement {
    /**
     * Placement mode.
     */
    mode?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionQueueProducers {
    /**
     * Name of the Queue.
     */
    name?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionR2Buckets {
    /**
     * Jurisdiction of the R2 bucket.
     */
    jurisdiction?: pulumi.Input<string>;
    /**
     * Name of the R2 bucket.
     */
    name?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionServices {
    /**
     * The entrypoint to bind to.
     */
    entrypoint?: pulumi.Input<string>;
    /**
     * The Service environment.
     */
    environment?: pulumi.Input<string>;
    /**
     * The Service name.
     */
    service?: pulumi.Input<string>;
}
export interface PagesProjectDeploymentConfigsProductionVectorizeBindings {
    indexName?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeployment {
    /**
     * A list of alias URLs pointing to this deployment.
     */
    aliases?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Configs for the project build process.
     */
    buildConfig?: pulumi.Input<inputs.PagesProjectLatestDeploymentBuildConfig>;
    /**
     * When the deployment was created.
     */
    createdOn?: pulumi.Input<string>;
    /**
     * Info about what caused the deployment.
     */
    deploymentTrigger?: pulumi.Input<inputs.PagesProjectLatestDeploymentDeploymentTrigger>;
    /**
     * Environment variables used for builds and Pages Functions.
     */
    envVars?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.PagesProjectLatestDeploymentEnvVars>;
    }>;
    /**
     * Type of deploy.
     * Available values: "preview", "production".
     */
    environment?: pulumi.Input<string>;
    /**
     * Id of the deployment.
     */
    id?: pulumi.Input<string>;
    /**
     * If the deployment has been skipped.
     */
    isSkipped?: pulumi.Input<boolean>;
    /**
     * The status of the deployment.
     */
    latestStage?: pulumi.Input<inputs.PagesProjectLatestDeploymentLatestStage>;
    /**
     * When the deployment was last modified.
     */
    modifiedOn?: pulumi.Input<string>;
    /**
     * Id of the project.
     */
    projectId?: pulumi.Input<string>;
    /**
     * Name of the project.
     */
    projectName?: pulumi.Input<string>;
    /**
     * Short Id (8 character) of the deployment.
     */
    shortId?: pulumi.Input<string>;
    source?: pulumi.Input<inputs.PagesProjectLatestDeploymentSource>;
    /**
     * List of past stages.
     */
    stages?: pulumi.Input<pulumi.Input<inputs.PagesProjectLatestDeploymentStage>[]>;
    /**
     * The live URL to view this deployment.
     */
    url?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentBuildConfig {
    /**
     * Enable build caching for the project.
     */
    buildCaching?: pulumi.Input<boolean>;
    /**
     * Command used to build project.
     */
    buildCommand?: pulumi.Input<string>;
    /**
     * Output directory of the build.
     */
    destinationDir?: pulumi.Input<string>;
    /**
     * Directory to run the command.
     */
    rootDir?: pulumi.Input<string>;
    /**
     * The classifying tag for analytics.
     */
    webAnalyticsTag?: pulumi.Input<string>;
    /**
     * The auth token for analytics.
     */
    webAnalyticsToken?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentDeploymentTrigger {
    /**
     * Additional info about the trigger.
     */
    metadata?: pulumi.Input<inputs.PagesProjectLatestDeploymentDeploymentTriggerMetadata>;
    /**
     * What caused the deployment.
     * Available values: "push", "adHoc".
     */
    type?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentDeploymentTriggerMetadata {
    /**
     * Where the trigger happened.
     */
    branch?: pulumi.Input<string>;
    /**
     * Hash of the deployment trigger commit.
     */
    commitHash?: pulumi.Input<string>;
    /**
     * Message of the deployment trigger commit.
     */
    commitMessage?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentEnvVars {
    /**
     * Available values: "plain*text", "secret*text".
     */
    type?: pulumi.Input<string>;
    /**
     * Environment variable value.
     */
    value?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentLatestStage {
    /**
     * When the stage ended.
     */
    endedOn?: pulumi.Input<string>;
    /**
     * The current build stage.
     * Available values: "queued", "initialize", "cloneRepo", "build", "deploy".
     */
    name?: pulumi.Input<string>;
    /**
     * When the stage started.
     */
    startedOn?: pulumi.Input<string>;
    /**
     * State of the current stage.
     * Available values: "success", "idle", "active", "failure", "canceled".
     */
    status?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentSource {
    config?: pulumi.Input<inputs.PagesProjectLatestDeploymentSourceConfig>;
    type?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentSourceConfig {
    deploymentsEnabled?: pulumi.Input<boolean>;
    owner?: pulumi.Input<string>;
    pathExcludes?: pulumi.Input<pulumi.Input<string>[]>;
    pathIncludes?: pulumi.Input<pulumi.Input<string>[]>;
    prCommentsEnabled?: pulumi.Input<boolean>;
    previewBranchExcludes?: pulumi.Input<pulumi.Input<string>[]>;
    previewBranchIncludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Available values: "all", "none", "custom".
     */
    previewDeploymentSetting?: pulumi.Input<string>;
    productionBranch?: pulumi.Input<string>;
    productionDeploymentsEnabled?: pulumi.Input<boolean>;
    repoName?: pulumi.Input<string>;
}
export interface PagesProjectLatestDeploymentStage {
    /**
     * When the stage ended.
     */
    endedOn?: pulumi.Input<string>;
    /**
     * The current build stage.
     * Available values: "queued", "initialize", "cloneRepo", "build", "deploy".
     */
    name?: pulumi.Input<string>;
    /**
     * When the stage started.
     */
    startedOn?: pulumi.Input<string>;
    /**
     * State of the current stage.
     * Available values: "success", "idle", "active", "failure", "canceled".
     */
    status?: pulumi.Input<string>;
}
export interface PagesProjectSource {
    config?: pulumi.Input<inputs.PagesProjectSourceConfig>;
    type?: pulumi.Input<string>;
}
export interface PagesProjectSourceConfig {
    deploymentsEnabled?: pulumi.Input<boolean>;
    owner?: pulumi.Input<string>;
    pathExcludes?: pulumi.Input<pulumi.Input<string>[]>;
    pathIncludes?: pulumi.Input<pulumi.Input<string>[]>;
    prCommentsEnabled?: pulumi.Input<boolean>;
    previewBranchExcludes?: pulumi.Input<pulumi.Input<string>[]>;
    previewBranchIncludes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Available values: "all", "none", "custom".
     */
    previewDeploymentSetting?: pulumi.Input<string>;
    productionBranch?: pulumi.Input<string>;
    productionDeploymentsEnabled?: pulumi.Input<boolean>;
    repoName?: pulumi.Input<string>;
}
export interface QueueConsumer {
    /**
     * A Resource identifier.
     */
    consumerId?: pulumi.Input<string>;
    createdOn?: pulumi.Input<string>;
    /**
     * A Resource identifier.
     */
    queueId?: pulumi.Input<string>;
    /**
     * Name of a Worker
     */
    script?: pulumi.Input<string>;
    /**
     * Name of a Worker
     */
    scriptName?: pulumi.Input<string>;
    settings?: pulumi.Input<inputs.QueueConsumerSettings>;
    /**
     * Available values: "worker", "httpPull".
     */
    type?: pulumi.Input<string>;
}
export interface QueueConsumerSettings {
    /**
     * The maximum number of messages to include in a batch.
     */
    batchSize?: pulumi.Input<number>;
    /**
     * Maximum number of concurrent consumers that may consume from this Queue. Set to `null` to automatically opt in to the platform's maximum (recommended).
     */
    maxConcurrency?: pulumi.Input<number>;
    /**
     * The maximum number of retries
     */
    maxRetries?: pulumi.Input<number>;
    /**
     * The number of milliseconds to wait for a batch to fill up before attempting to deliver it
     */
    maxWaitTimeMs?: pulumi.Input<number>;
    /**
     * The number of seconds to delay before making the message available for another attempt.
     */
    retryDelay?: pulumi.Input<number>;
    /**
     * The number of milliseconds that a message is exclusively leased. After the timeout, the message becomes available for another attempt.
     */
    visibilityTimeoutMs?: pulumi.Input<number>;
}
export interface QueueProducer {
    bucketName?: pulumi.Input<string>;
    script?: pulumi.Input<string>;
    /**
     * Available values: "worker", "r2Bucket".
     */
    type?: pulumi.Input<string>;
}
export interface QueueSettings {
    /**
     * Number of seconds to delay delivery of all messages to consumers.
     */
    deliveryDelay?: pulumi.Input<number>;
    /**
     * Indicates if message delivery to consumers is currently paused.
     */
    deliveryPaused?: pulumi.Input<boolean>;
    /**
     * Number of seconds after which an unconsumed message will be delayed.
     */
    messageRetentionPeriod?: pulumi.Input<number>;
}
export interface R2BucketCorsRule {
    /**
     * Object specifying allowed origins, methods and headers for this CORS rule.
     */
    allowed: pulumi.Input<inputs.R2BucketCorsRuleAllowed>;
    /**
     * Specifies the headers that can be exposed back, and accessed by, the JavaScript making the cross-origin request. If you need to access headers beyond the safelisted response headers, such as Content-Encoding or cf-cache-status, you must specify it here.
     */
    exposeHeaders?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Identifier for this rule.
     */
    id?: pulumi.Input<string>;
    /**
     * Specifies the amount of time (in seconds) browsers are allowed to cache CORS preflight responses. Browsers may limit this to 2 hours or less, even if the maximum value (86400) is specified.
     */
    maxAgeSeconds?: pulumi.Input<number>;
}
export interface R2BucketCorsRuleAllowed {
    /**
     * Specifies the value for the Access-Control-Allow-Headers header R2 sets when requesting objects in this bucket from a browser. Cross-origin requests that include custom headers (e.g. x-user-id) should specify these headers as AllowedHeaders.
     */
    headers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Specifies the value for the Access-Control-Allow-Methods header R2 sets when requesting objects in a bucket from a browser.
     */
    methods: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Specifies the value for the Access-Control-Allow-Origin header R2 sets when requesting objects in a bucket from a browser.
     */
    origins: pulumi.Input<pulumi.Input<string>[]>;
}
export interface R2BucketEventNotificationRule {
    /**
     * Array of R2 object actions that will trigger notifications.
     */
    actions: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A description that can be used to identify the event notification rule after creation.
     */
    description?: pulumi.Input<string>;
    /**
     * Notifications will be sent only for objects with this prefix.
     */
    prefix?: pulumi.Input<string>;
    /**
     * Notifications will be sent only for objects with this suffix.
     */
    suffix?: pulumi.Input<string>;
}
export interface R2BucketLifecycleRule {
    /**
     * Transition to abort ongoing multipart uploads.
     */
    abortMultipartUploadsTransition?: pulumi.Input<inputs.R2BucketLifecycleRuleAbortMultipartUploadsTransition>;
    /**
     * Conditions that apply to all transitions of this rule.
     */
    conditions: pulumi.Input<inputs.R2BucketLifecycleRuleConditions>;
    /**
     * Transition to delete objects.
     */
    deleteObjectsTransition?: pulumi.Input<inputs.R2BucketLifecycleRuleDeleteObjectsTransition>;
    /**
     * Whether or not this rule is in effect.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * Unique identifier for this rule.
     */
    id: pulumi.Input<string>;
    /**
     * Transitions to change the storage class of objects.
     */
    storageClassTransitions?: pulumi.Input<pulumi.Input<inputs.R2BucketLifecycleRuleStorageClassTransition>[]>;
}
export interface R2BucketLifecycleRuleAbortMultipartUploadsTransition {
    /**
     * Condition for lifecycle transitions to apply after an object reaches an age in seconds.
     */
    condition?: pulumi.Input<inputs.R2BucketLifecycleRuleAbortMultipartUploadsTransitionCondition>;
}
export interface R2BucketLifecycleRuleAbortMultipartUploadsTransitionCondition {
    maxAge: pulumi.Input<number>;
    /**
     * Available values: "Age".
     */
    type: pulumi.Input<string>;
}
export interface R2BucketLifecycleRuleConditions {
    /**
     * Transitions will only apply to objects/uploads in the bucket that start with the given prefix, an empty prefix can be provided to scope rule to all objects/uploads.
     */
    prefix: pulumi.Input<string>;
}
export interface R2BucketLifecycleRuleDeleteObjectsTransition {
    /**
     * Condition for lifecycle transitions to apply after an object reaches an age in seconds.
     */
    condition?: pulumi.Input<inputs.R2BucketLifecycleRuleDeleteObjectsTransitionCondition>;
}
export interface R2BucketLifecycleRuleDeleteObjectsTransitionCondition {
    date?: pulumi.Input<string>;
    maxAge?: pulumi.Input<number>;
    /**
     * Available values: "Age", "Date".
     */
    type: pulumi.Input<string>;
}
export interface R2BucketLifecycleRuleStorageClassTransition {
    /**
     * Condition for lifecycle transitions to apply after an object reaches an age in seconds.
     */
    condition: pulumi.Input<inputs.R2BucketLifecycleRuleStorageClassTransitionCondition>;
    /**
     * Available values: "InfrequentAccess".
     */
    storageClass: pulumi.Input<string>;
}
export interface R2BucketLifecycleRuleStorageClassTransitionCondition {
    date?: pulumi.Input<string>;
    maxAge?: pulumi.Input<number>;
    /**
     * Available values: "Age", "Date".
     */
    type: pulumi.Input<string>;
}
export interface R2BucketLockRule {
    /**
     * Condition to apply a lock rule to an object for how long in seconds.
     */
    condition: pulumi.Input<inputs.R2BucketLockRuleCondition>;
    /**
     * Whether or not this rule is in effect.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * Unique identifier for this rule.
     */
    id: pulumi.Input<string>;
    /**
     * Rule will only apply to objects/uploads in the bucket that start with the given prefix, an empty prefix can be provided to scope rule to all objects/uploads.
     */
    prefix?: pulumi.Input<string>;
}
export interface R2BucketLockRuleCondition {
    date?: pulumi.Input<string>;
    maxAgeSeconds?: pulumi.Input<number>;
    /**
     * Available values: "Age", "Date", "Indefinite".
     */
    type: pulumi.Input<string>;
}
export interface R2BucketSippyDestination {
    /**
     * ID of a Cloudflare API token.
     * This is the value labelled "Access Key ID" when creating an API.
     * token from the [R2 dashboard](https://dash.cloudflare.com/?to=/:account/r2/api-tokens).
     */
    accessKeyId?: pulumi.Input<string>;
    /**
     * Available values: "r2".
     */
    cloudProvider?: pulumi.Input<string>;
    /**
     * Value of a Cloudflare API token.
     * This is the value labelled "Secret Access Key" when creating an API.
     * token from the [R2 dashboard](https://dash.cloudflare.com/?to=/:account/r2/api-tokens).
     *
     * Sippy will use this token when writing objects to R2, so it is
     * best to scope this token to the bucket you're enabling Sippy for.
     */
    secretAccessKey?: pulumi.Input<string>;
}
export interface R2BucketSippySource {
    /**
     * Access Key ID of an IAM credential (ideally scoped to a single S3 bucket).
     */
    accessKeyId?: pulumi.Input<string>;
    /**
     * Name of the AWS S3 bucket.
     */
    bucket?: pulumi.Input<string>;
    /**
     * Client email of an IAM credential (ideally scoped to a single GCS bucket).
     */
    clientEmail?: pulumi.Input<string>;
    /**
     * Available values: "aws", "gcs".
     */
    cloudProvider?: pulumi.Input<string>;
    /**
     * Private Key of an IAM credential (ideally scoped to a single GCS bucket).
     */
    privateKey?: pulumi.Input<string>;
    /**
     * Name of the AWS availability zone.
     */
    region?: pulumi.Input<string>;
    /**
     * Secret Access Key of an IAM credential (ideally scoped to a single S3 bucket).
     */
    secretAccessKey?: pulumi.Input<string>;
}
export interface R2CustomDomainStatus {
    /**
     * Ownership status of the domain.
     * Available values: "pending", "active", "deactivated", "blocked", "error", "unknown".
     */
    ownership?: pulumi.Input<string>;
    /**
     * SSL certificate status.
     * Available values: "initializing", "pending", "active", "deactivated", "error", "unknown".
     */
    ssl?: pulumi.Input<string>;
}
export interface RateLimitAction {
    /**
     * The action to perform.
     * Available values: "simulate", "ban", "challenge", "js*challenge", "managed*challenge".
     */
    mode?: pulumi.Input<string>;
    /**
     * A custom content type and reponse to return when the threshold is exceeded. The custom response configured in this object will override the custom error for the zone. This object is optional.
     * Notes: If you omit this object, Cloudflare will use the default HTML error page. If "mode" is "challenge", "managed*challenge", or "js*challenge", Cloudflare will use the zone challenge pages and you should not provide the "response" object.
     */
    response?: pulumi.Input<inputs.RateLimitActionResponse>;
    /**
     * The time in seconds during which Cloudflare will perform the mitigation action. Must be an integer value greater than or equal to the period.
     * Notes: If "mode" is "challenge", "managed*challenge", or "js*challenge", Cloudflare will use the zone's Challenge Passage time and you should not provide this value.
     */
    timeout?: pulumi.Input<number>;
}
export interface RateLimitActionResponse {
    /**
     * The response body to return. The value must conform to the configured content type.
     */
    body?: pulumi.Input<string>;
    /**
     * The content type of the body. Must be one of the following: `text/plain`, `text/xml`, or `application/json`.
     */
    contentType?: pulumi.Input<string>;
}
export interface RateLimitBypass {
    /**
     * Available values: "url".
     */
    name?: pulumi.Input<string>;
    /**
     * The URL to bypass.
     */
    value?: pulumi.Input<string>;
}
export interface RateLimitMatch {
    headers?: pulumi.Input<pulumi.Input<inputs.RateLimitMatchHeader>[]>;
    request?: pulumi.Input<inputs.RateLimitMatchRequest>;
    response?: pulumi.Input<inputs.RateLimitMatchResponse>;
}
export interface RateLimitMatchHeader {
    /**
     * The name of the response header to match.
     */
    name?: pulumi.Input<string>;
    /**
     * The operator used when matching: `eq` means "equal" and `ne` means "not equal".
     * Available values: "eq", "ne".
     */
    op?: pulumi.Input<string>;
    /**
     * The value of the response header, which must match exactly.
     */
    value?: pulumi.Input<string>;
}
export interface RateLimitMatchRequest {
    /**
     * The HTTP methods to match. You can specify a subset (for example, `['POST','PUT']`) or all methods (`['_ALL_']`). This field is optional when creating a rate limit.
     */
    methods?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The HTTP schemes to match. You can specify one scheme (`['HTTPS']`), both schemes (`['HTTP','HTTPS']`), or all schemes (`['_ALL_']`). This field is optional.
     */
    schemes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The URL pattern to match, composed of a host and a path such as `example.org/path*`. Normalization is applied before the pattern is matched. `*` wildcards are expanded to match applicable traffic. Query strings are not matched. Set the value to `*` to match all traffic to your zone.
     */
    url?: pulumi.Input<string>;
}
export interface RateLimitMatchResponse {
    /**
     * When true, only the uncached traffic served from your origin servers will count towards rate limiting. In this case, any cached traffic served by Cloudflare will not count towards rate limiting. This field is optional.
     * Notes: This field is deprecated. Instead, use response headers and set "origin*traffic" to "false" to avoid legacy behaviour interacting with the "response*headers" property.
     */
    originTraffic?: pulumi.Input<boolean>;
}
export interface RecordData {
    /**
     * Algorithm.
     */
    algorithm?: pulumi.Input<number>;
    /**
     * Altitude of location in meters.
     */
    altitude?: pulumi.Input<number>;
    /**
     * Certificate.
     */
    certificate?: pulumi.Input<string>;
    /**
     * Digest.
     */
    digest?: pulumi.Input<string>;
    /**
     * Digest Type.
     */
    digestType?: pulumi.Input<number>;
    /**
     * Fingerprint.
     */
    fingerprint?: pulumi.Input<string>;
    /**
     * Flags for the CAA record.
     */
    flags?: any;
    /**
     * Key Tag.
     */
    keyTag?: pulumi.Input<number>;
    /**
     * Degrees of latitude.
     */
    latDegrees?: pulumi.Input<number>;
    /**
     * Latitude direction.
     * Available values: "N", "S".
     */
    latDirection?: pulumi.Input<string>;
    /**
     * Minutes of latitude.
     */
    latMinutes?: pulumi.Input<number>;
    /**
     * Seconds of latitude.
     */
    latSeconds?: pulumi.Input<number>;
    /**
     * Degrees of longitude.
     */
    longDegrees?: pulumi.Input<number>;
    /**
     * Longitude direction.
     * Available values: "E", "W".
     */
    longDirection?: pulumi.Input<string>;
    /**
     * Minutes of longitude.
     */
    longMinutes?: pulumi.Input<number>;
    /**
     * Seconds of longitude.
     */
    longSeconds?: pulumi.Input<number>;
    /**
     * Matching Type.
     */
    matchingType?: pulumi.Input<number>;
    /**
     * Order.
     */
    order?: pulumi.Input<number>;
    /**
     * The port of the service.
     */
    port?: pulumi.Input<number>;
    /**
     * Horizontal precision of location.
     */
    precisionHorz?: pulumi.Input<number>;
    /**
     * Vertical precision of location.
     */
    precisionVert?: pulumi.Input<number>;
    /**
     * Preference.
     */
    preference?: pulumi.Input<number>;
    /**
     * Priority.
     */
    priority?: pulumi.Input<number>;
    /**
     * Protocol.
     */
    protocol?: pulumi.Input<number>;
    /**
     * Public Key.
     */
    publicKey?: pulumi.Input<string>;
    /**
     * Regex.
     */
    regex?: pulumi.Input<string>;
    /**
     * Replacement.
     */
    replacement?: pulumi.Input<string>;
    /**
     * Selector.
     */
    selector?: pulumi.Input<number>;
    /**
     * Service.
     */
    service?: pulumi.Input<string>;
    /**
     * Size of location in meters.
     */
    size?: pulumi.Input<number>;
    /**
     * Name of the property controlled by this record (e.g.: issue, issuewild, iodef).
     */
    tag?: pulumi.Input<string>;
    /**
     * Target.
     */
    target?: pulumi.Input<string>;
    /**
     * Type.
     */
    type?: pulumi.Input<number>;
    /**
     * Usage.
     */
    usage?: pulumi.Input<number>;
    /**
     * Value of the record. This field's semantics depend on the chosen tag.
     */
    value?: pulumi.Input<string>;
    /**
     * The record weight.
     */
    weight?: pulumi.Input<number>;
}
export interface RecordSettings {
    /**
     * If enabled, causes the CNAME record to be resolved externally and the resulting address records (e.g., A and AAAA) to be returned instead of the CNAME record itself. This setting is unavailable for proxied records, since they are always flattened.
     */
    flattenCname?: pulumi.Input<boolean>;
    /**
     * When enabled, only A records will be generated, and AAAA records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
     */
    ipv4Only?: pulumi.Input<boolean>;
    /**
     * When enabled, only AAAA records will be generated, and A records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
     */
    ipv6Only?: pulumi.Input<boolean>;
}
export interface RiskBehaviorBehaviors {
    enabled: pulumi.Input<boolean>;
    /**
     * Available values: "low", "medium", "high".
     */
    riskLevel: pulumi.Input<string>;
}
export interface RulesetRule {
    /**
     * The action to perform when the rule matches.
     * Available values: "block", "challenge", "compress*response", "ddos*dynamic", "execute", "force*connection*close", "js*challenge", "log", "log*custom*field", "managed*challenge", "redirect", "rewrite", "route", "score", "serve*error", "set*cache*settings", "set*config", "skip".
     */
    action: pulumi.Input<string>;
    /**
     * The parameters configuring the rule's action.
     */
    actionParameters?: pulumi.Input<inputs.RulesetRuleActionParameters>;
    /**
     * An informative description of the rule.
     */
    description?: pulumi.Input<string>;
    /**
     * Whether the rule should be executed.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Configuration for exposed credential checking.
     */
    exposedCredentialCheck?: pulumi.Input<inputs.RulesetRuleExposedCredentialCheck>;
    /**
     * The expression defining which traffic will match the rule.
     */
    expression: pulumi.Input<string>;
    /**
     * The unique ID of the rule.
     */
    id?: pulumi.Input<string>;
    /**
     * An object configuring the rule's logging behavior.
     */
    logging?: pulumi.Input<inputs.RulesetRuleLogging>;
    /**
     * An object configuring the rule's rate limit behavior.
     */
    ratelimit?: pulumi.Input<inputs.RulesetRuleRatelimit>;
    /**
     * The reference of the rule (the rule's ID by default).
     */
    ref?: pulumi.Input<string>;
}
export interface RulesetRuleActionParameters {
    /**
     * A list of additional ports that caching should be enabled on.
     */
    additionalCacheablePorts?: pulumi.Input<pulumi.Input<number>[]>;
    /**
     * Custom order for compression algorithms.
     */
    algorithms?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersAlgorithm>[]>;
    /**
     * The name of a custom asset to serve as the response.
     */
    assetName?: pulumi.Input<string>;
    /**
     * Whether to enable Automatic HTTPS Rewrites.
     */
    automaticHttpsRewrites?: pulumi.Input<boolean>;
    /**
     * Which file extensions to minify automatically.
     */
    autominify?: pulumi.Input<inputs.RulesetRuleActionParametersAutominify>;
    /**
     * Whether to enable Browser Integrity Check (BIC).
     */
    bic?: pulumi.Input<boolean>;
    /**
     * How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
     */
    browserTtl?: pulumi.Input<inputs.RulesetRuleActionParametersBrowserTtl>;
    /**
     * Whether the request's response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
     */
    cache?: pulumi.Input<boolean>;
    /**
     * Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
     */
    cacheKey?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKey>;
    /**
     * Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
     */
    cacheReserve?: pulumi.Input<inputs.RulesetRuleActionParametersCacheReserve>;
    /**
     * The response content.
     */
    content?: pulumi.Input<string>;
    /**
     * The content type header to set with the error response.
     * Available values: "application/json", "text/html", "text/plain", "text/xml".
     */
    contentType?: pulumi.Input<string>;
    /**
     * The cookie fields to log.
     */
    cookieFields?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersCookieField>[]>;
    /**
     * Whether to disable Cloudflare Apps.
     */
    disableApps?: pulumi.Input<boolean>;
    /**
     * Whether to disable Real User Monitoring (RUM).
     */
    disableRum?: pulumi.Input<boolean>;
    /**
     * Whether to disable Zaraz.
     */
    disableZaraz?: pulumi.Input<boolean>;
    /**
     * How long the Cloudflare edge network should cache the response.
     */
    edgeTtl?: pulumi.Input<inputs.RulesetRuleActionParametersEdgeTtl>;
    /**
     * Whether to enable Email Obfuscation.
     */
    emailObfuscation?: pulumi.Input<boolean>;
    /**
     * Whether to enable Cloudflare Fonts.
     */
    fonts?: pulumi.Input<boolean>;
    /**
     * A redirect based on a bulk list lookup.
     */
    fromList?: pulumi.Input<inputs.RulesetRuleActionParametersFromList>;
    /**
     * A redirect based on the request properties.
     */
    fromValue?: pulumi.Input<inputs.RulesetRuleActionParametersFromValue>;
    /**
     * A map of headers to rewrite.
     */
    headers?: pulumi.Input<{
        [key: string]: pulumi.Input<inputs.RulesetRuleActionParametersHeaders>;
    }>;
    /**
     * A value to rewrite the HTTP host header to.
     */
    hostHeader?: pulumi.Input<string>;
    /**
     * Whether to enable Hotlink Protection.
     */
    hotlinkProtection?: pulumi.Input<boolean>;
    /**
     * The ID of the ruleset to execute.
     */
    id?: pulumi.Input<string>;
    /**
     * A delta to change the score by, which can be either positive or negative.
     */
    increment?: pulumi.Input<number>;
    /**
     * The configuration to use for matched data logging.
     */
    matchedData?: pulumi.Input<inputs.RulesetRuleActionParametersMatchedData>;
    /**
     * Whether to enable Mirage.
     */
    mirage?: pulumi.Input<boolean>;
    /**
     * Whether to enable Opportunistic Encryption.
     */
    opportunisticEncryption?: pulumi.Input<boolean>;
    /**
     * An origin to route to.
     */
    origin?: pulumi.Input<inputs.RulesetRuleActionParametersOrigin>;
    /**
     * Whether Cloudflare will aim to strictly adhere to RFC 7234.
     */
    originCacheControl?: pulumi.Input<boolean>;
    /**
     * Whether to generate Cloudflare error pages for issues from the origin server.
     */
    originErrorPagePassthru?: pulumi.Input<boolean>;
    /**
     * A set of overrides to apply to the target ruleset.
     */
    overrides?: pulumi.Input<inputs.RulesetRuleActionParametersOverrides>;
    /**
     * A list of phases to skip the execution of. This option is incompatible with the rulesets option.
     * Available values: "ddos*l4", "ddos*l7", "http*config*settings", "http*custom*errors", "http*log*custom*fields", "http*ratelimit", "http*request*cache*settings", "http*request*dynamic*redirect", "http*request*firewall*custom", "http*request*firewall*managed", "http*request*late*transform", "http*request*origin", "http*request*redirect", "http*request*sanitize", "http*request*sbfm", "http*request*transform", "http*response*compression", "http*response*firewall*managed", "http*response*headers*transform", "magic*transit", "magic*transit*ids*managed", "magic*transit*managed", "magic*transit_ratelimit".
     */
    phases?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The Polish level to configure.
     * Available values: "off", "lossless", "lossy", "webp".
     */
    polish?: pulumi.Input<string>;
    /**
     * A list of legacy security products to skip the execution of.
     * Available values: "bic", "hot", "rateLimit", "securityLevel", "uaBlock", "waf", "zoneLockdown".
     */
    products?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The raw response fields to log.
     */
    rawResponseFields?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersRawResponseField>[]>;
    /**
     * A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
     */
    readTimeout?: pulumi.Input<number>;
    /**
     * The raw request fields to log.
     */
    requestFields?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersRequestField>[]>;
    /**
     * Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
     */
    respectStrongEtags?: pulumi.Input<boolean>;
    /**
     * The response to show when the block is applied.
     */
    response?: pulumi.Input<inputs.RulesetRuleActionParametersResponse>;
    /**
     * The transformed response fields to log.
     */
    responseFields?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersResponseField>[]>;
    /**
     * Whether to enable Rocket Loader.
     */
    rocketLoader?: pulumi.Input<boolean>;
    /**
     * A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
     */
    rules?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * A ruleset to skip the execution of. This option is incompatible with the rulesets option.
     * Available values: "current".
     */
    ruleset?: pulumi.Input<string>;
    /**
     * A list of ruleset IDs to skip the execution of. This option is incompatible with the ruleset and phases options.
     */
    rulesets?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The Security Level to configure.
     * Available values: "off", "essentially*off", "low", "medium", "high", "under*attack".
     */
    securityLevel?: pulumi.Input<string>;
    /**
     * When to serve stale content from cache.
     */
    serveStale?: pulumi.Input<inputs.RulesetRuleActionParametersServeStale>;
    /**
     * Whether to enable Server-Side Excludes.
     */
    serverSideExcludes?: pulumi.Input<boolean>;
    /**
     * A Server Name Indication (SNI) override.
     */
    sni?: pulumi.Input<inputs.RulesetRuleActionParametersSni>;
    /**
     * The SSL level to configure.
     * Available values: "off", "flexible", "full", "strict", "originPull".
     */
    ssl?: pulumi.Input<string>;
    /**
     * The status code to use for the error.
     */
    statusCode?: pulumi.Input<number>;
    /**
     * Whether to enable Signed Exchanges (SXG).
     */
    sxg?: pulumi.Input<boolean>;
    /**
     * The transformed request fields to log.
     */
    transformedRequestFields?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersTransformedRequestField>[]>;
    /**
     * A URI rewrite.
     */
    uri?: pulumi.Input<inputs.RulesetRuleActionParametersUri>;
}
export interface RulesetRuleActionParametersAlgorithm {
    /**
     * Name of the compression algorithm to enable.
     * Available values: "none", "auto", "default", "gzip", "brotli", "zstd".
     */
    name?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersAutominify {
    /**
     * Whether to minify CSS files.
     */
    css?: pulumi.Input<boolean>;
    /**
     * Whether to minify HTML files.
     */
    html?: pulumi.Input<boolean>;
    /**
     * Whether to minify JavaScript files.
     */
    js?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersBrowserTtl {
    /**
     * The browser TTL (in seconds) if you choose the "overrideOrigin" mode.
     */
    default?: pulumi.Input<number>;
    /**
     * The browser TTL mode.
     * Available values: "respect*origin", "bypass*by*default", "override*origin", "bypass".
     */
    mode: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersCacheKey {
    /**
     * Whether to separate cached content based on the visitor's device type.
     */
    cacheByDeviceType?: pulumi.Input<boolean>;
    /**
     * Whether to protect from web cache deception attacks, while allowing static assets to be cached.
     */
    cacheDeceptionArmor?: pulumi.Input<boolean>;
    /**
     * Which components of the request are included or excluded from the cache key.
     */
    customKey?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKey>;
    /**
     * Whether to treat requests with the same query parameters the same, regardless of the order those query parameters are in.
     */
    ignoreQueryStringsOrder?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKey {
    /**
     * Which cookies to include in the cache key.
     */
    cookie?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKeyCookie>;
    /**
     * Which headers to include in the cache key.
     */
    header?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKeyHeader>;
    /**
     * How to use the host in the cache key.
     */
    host?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKeyHost>;
    /**
     * Which query string parameters to include in or exclude from the cache key.
     */
    queryString?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKeyQueryString>;
    /**
     * How to use characteristics of the request user agent in the cache key.
     */
    user?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKeyUser>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKeyCookie {
    /**
     * A list of cookies to check for the presence of. The presence of these cookies is included in the cache key.
     */
    checkPresences?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of cookies to include in the cache key.
     */
    includes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKeyHeader {
    /**
     * A list of headers to check for the presence of. The presence of these headers is included in the cache key.
     */
    checkPresences?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A mapping of header names to a list of values. If a header is present in the request and contains any of the values provided, its value is included in the cache key.
     */
    contains?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * Whether to exclude the origin header in the cache key.
     */
    excludeOrigin?: pulumi.Input<boolean>;
    /**
     * A list of headers to include in the cache key.
     */
    includes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKeyHost {
    /**
     * Whether to use the resolved host in the cache key.
     */
    resolved?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKeyQueryString {
    /**
     * Which query string parameters to exclude from the cache key.
     */
    exclude?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKeyQueryStringExclude>;
    /**
     * Which query string parameters to include in the cache key.
     */
    include?: pulumi.Input<inputs.RulesetRuleActionParametersCacheKeyCustomKeyQueryStringInclude>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKeyQueryStringExclude {
    /**
     * Whether to exclude all query string parameters from the cache key.
     */
    all?: pulumi.Input<boolean>;
    /**
     * A list of query string parameters to exclude from the cache key.
     */
    lists?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKeyQueryStringInclude {
    /**
     * Whether to include all query string parameters in the cache key.
     */
    all?: pulumi.Input<boolean>;
    /**
     * A list of query string parameters to include in the cache key.
     */
    lists?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface RulesetRuleActionParametersCacheKeyCustomKeyUser {
    /**
     * Whether to use the user agent's device type in the cache key.
     */
    deviceType?: pulumi.Input<boolean>;
    /**
     * Whether to use the user agents's country in the cache key.
     */
    geo?: pulumi.Input<boolean>;
    /**
     * Whether to use the user agent's language in the cache key.
     */
    lang?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersCacheReserve {
    /**
     * Whether Cache Reserve is enabled. If this is true and a request meets eligibility criteria, Cloudflare will write the resource to Cache Reserve.
     */
    eligible: pulumi.Input<boolean>;
    /**
     * The minimum file size eligible for storage in Cache Reserve.
     */
    minimumFileSize?: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersCookieField {
    /**
     * The name of the cookie.
     */
    name: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersEdgeTtl {
    /**
     * The edge TTL (in seconds) if you choose the "overrideOrigin" mode.
     */
    default?: pulumi.Input<number>;
    /**
     * The edge TTL mode.
     * Available values: "respect*origin", "bypass*by*default", "override*origin".
     */
    mode: pulumi.Input<string>;
    /**
     * A list of TTLs to apply to specific status codes or status code ranges.
     */
    statusCodeTtls?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersEdgeTtlStatusCodeTtl>[]>;
}
export interface RulesetRuleActionParametersEdgeTtlStatusCodeTtl {
    /**
     * A single status code to apply the TTL to.
     */
    statusCode?: pulumi.Input<number>;
    /**
     * A range of status codes to apply the TTL to.
     */
    statusCodeRange?: pulumi.Input<inputs.RulesetRuleActionParametersEdgeTtlStatusCodeTtlStatusCodeRange>;
    /**
     * The time to cache the response for (in seconds). A value of 0 is equivalent to setting the cache control header with the value "no-cache". A value of -1 is equivalent to setting the cache control header with the value of "no-store".
     */
    value: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersEdgeTtlStatusCodeTtlStatusCodeRange {
    /**
     * The lower bound of the range.
     */
    from?: pulumi.Input<number>;
    /**
     * The upper bound of the range.
     */
    to?: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersFromList {
    /**
     * An expression that evaluates to the list lookup key.
     */
    key: pulumi.Input<string>;
    /**
     * The name of the list to match against.
     */
    name: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersFromValue {
    /**
     * Whether to keep the query string of the original request.
     */
    preserveQueryString?: pulumi.Input<boolean>;
    /**
     * The status code to use for the redirect.
     */
    statusCode?: pulumi.Input<number>;
    /**
     * A URL to redirect the request to.
     */
    targetUrl: pulumi.Input<inputs.RulesetRuleActionParametersFromValueTargetUrl>;
}
export interface RulesetRuleActionParametersFromValueTargetUrl {
    /**
     * An expression that evaluates to a URL to redirect the request to.
     */
    expression?: pulumi.Input<string>;
    /**
     * A URL to redirect the request to.
     */
    value?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersHeaders {
    /**
     * An expression that evaluates to a value for the header.
     */
    expression?: pulumi.Input<string>;
    /**
     * The operation to perform on the header.
     * Available values: "add", "set", "remove".
     */
    operation: pulumi.Input<string>;
    /**
     * A static value for the header.
     */
    value?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersMatchedData {
    /**
     * The public key to encrypt matched data logs with.
     */
    publicKey: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersOrigin {
    /**
     * A resolved host to route to.
     */
    host?: pulumi.Input<string>;
    /**
     * A destination port to route to.
     */
    port?: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersOverrides {
    /**
     * An action to override all rules with. This option has lower precedence than rule and category overrides.
     */
    action?: pulumi.Input<string>;
    /**
     * A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
     */
    categories?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersOverridesCategory>[]>;
    /**
     * Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * A list of rule-level overrides. This option has the highest precedence.
     */
    rules?: pulumi.Input<pulumi.Input<inputs.RulesetRuleActionParametersOverridesRule>[]>;
    /**
     * A sensitivity level to set for all rules. This option has lower precedence than rule and category overrides and is only applicable for DDoS phases.
     * Available values: "default", "medium", "low", "eoff".
     */
    sensitivityLevel?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersOverridesCategory {
    /**
     * The action to override rules in the category with.
     */
    action?: pulumi.Input<string>;
    /**
     * The name of the category to override.
     */
    category: pulumi.Input<string>;
    /**
     * Whether to enable execution of rules in the category.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The sensitivity level to use for rules in the category. This option is only applicable for DDoS phases.
     * Available values: "default", "medium", "low", "eoff".
     */
    sensitivityLevel?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersOverridesRule {
    /**
     * The action to override the rule with.
     */
    action?: pulumi.Input<string>;
    /**
     * Whether to enable execution of the rule.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The ID of the rule to override.
     */
    id: pulumi.Input<string>;
    /**
     * The score threshold to use for the rule.
     */
    scoreThreshold?: pulumi.Input<number>;
    /**
     * The sensitivity level to use for the rule. This option is only applicable for DDoS phases.
     * Available values: "default", "medium", "low", "eoff".
     */
    sensitivityLevel?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersRawResponseField {
    /**
     * The name of the response header.
     */
    name: pulumi.Input<string>;
    /**
     * Whether to log duplicate values of the same header.
     */
    preserveDuplicates?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersRequestField {
    /**
     * The name of the header.
     */
    name: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersResponse {
    /**
     * The content to return.
     */
    content: pulumi.Input<string>;
    /**
     * The type of the content to return.
     */
    contentType: pulumi.Input<string>;
    /**
     * The status code to return.
     */
    statusCode: pulumi.Input<number>;
}
export interface RulesetRuleActionParametersResponseField {
    /**
     * The name of the response header.
     */
    name: pulumi.Input<string>;
    /**
     * Whether to log duplicate values of the same header.
     */
    preserveDuplicates?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersServeStale {
    /**
     * Whether Cloudflare should disable serving stale content while getting the latest content from the origin.
     */
    disableStaleWhileUpdating?: pulumi.Input<boolean>;
}
export interface RulesetRuleActionParametersSni {
    /**
     * A value to override the SNI to.
     */
    value: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersTransformedRequestField {
    /**
     * The name of the header.
     */
    name: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersUri {
    /**
     * A URI path rewrite.
     */
    path?: pulumi.Input<inputs.RulesetRuleActionParametersUriPath>;
    /**
     * A URI query rewrite.
     */
    query?: pulumi.Input<inputs.RulesetRuleActionParametersUriQuery>;
}
export interface RulesetRuleActionParametersUriPath {
    /**
     * An expression that evaluates to a value to rewrite the URI path to.
     */
    expression?: pulumi.Input<string>;
    /**
     * A value to rewrite the URI path to.
     */
    value?: pulumi.Input<string>;
}
export interface RulesetRuleActionParametersUriQuery {
    /**
     * An expression that evaluates to a value to rewrite the URI query to.
     */
    expression?: pulumi.Input<string>;
    /**
     * A value to rewrite the URI query to.
     */
    value?: pulumi.Input<string>;
}
export interface RulesetRuleExposedCredentialCheck {
    /**
     * An expression that selects the password used in the credentials check.
     */
    passwordExpression: pulumi.Input<string>;
    /**
     * An expression that selects the user ID used in the credentials check.
     */
    usernameExpression: pulumi.Input<string>;
}
export interface RulesetRuleLogging {
    /**
     * Whether to generate a log when the rule matches.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface RulesetRuleRatelimit {
    /**
     * Characteristics of the request on which the rate limit counter will be incremented.
     */
    characteristics: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
     */
    countingExpression?: pulumi.Input<string>;
    /**
     * Period of time in seconds after which the action will be disabled following its first execution.
     */
    mitigationTimeout?: pulumi.Input<number>;
    /**
     * Period in seconds over which the counter is being incremented.
     */
    period: pulumi.Input<number>;
    /**
     * The threshold of requests per period after which the action will be executed for the first time.
     */
    requestsPerPeriod?: pulumi.Input<number>;
    /**
     * Whether counting is only performed when an origin is reached.
     */
    requestsToOrigin?: pulumi.Input<boolean>;
    /**
     * The score threshold per period for which the action will be executed the first time.
     */
    scorePerPeriod?: pulumi.Input<number>;
    /**
     * A response header name provided by the origin, which contains the score to increment rate limit counter with.
     */
    scoreResponseHeaderName?: pulumi.Input<string>;
}
export interface SnippetFile {
    content: pulumi.Input<string>;
    name: pulumi.Input<string>;
}
export interface SnippetMetadata {
    /**
     * Name of the file that contains the main module of the snippet.
     */
    mainModule: pulumi.Input<string>;
}
export interface SnippetRulesRule {
    /**
     * An informative description of the rule.
     */
    description?: pulumi.Input<string>;
    /**
     * Whether the rule should be executed.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The expression defining which traffic will match the rule.
     */
    expression: pulumi.Input<string>;
    /**
     * The unique ID of the rule.
     */
    id?: pulumi.Input<string>;
    /**
     * The timestamp of when the rule was last modified.
     */
    lastUpdated?: pulumi.Input<string>;
    /**
     * The identifying name of the snippet.
     */
    snippetName: pulumi.Input<string>;
}
export interface SnippetsMetadata {
    /**
     * Name of the file that contains the main module of the snippet.
     */
    mainModule: pulumi.Input<string>;
}
export interface SpectrumApplicationDns {
    /**
     * The name of the DNS record associated with the application.
     */
    name?: pulumi.Input<string>;
    /**
     * The type of DNS record associated with the application.
     * Available values: "CNAME", "ADDRESS".
     */
    type?: pulumi.Input<string>;
}
export interface SpectrumApplicationEdgeIps {
    /**
     * The IP versions supported for inbound connections on Spectrum anycast IPs.
     * Available values: "all", "ipv4", "ipv6".
     */
    connectivity?: pulumi.Input<string>;
    /**
     * The array of customer owned IPs we broadcast via anycast for this hostname and application.
     */
    ips?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The type of edge IP configuration specified. Dynamically allocated edge IPs use Spectrum anycast IPs in accordance with the connectivity you specify. Only valid with CNAME DNS names.
     * Available values: "dynamic", "static".
     */
    type?: pulumi.Input<string>;
}
export interface SpectrumApplicationOriginDns {
    /**
     * The name of the DNS record associated with the origin.
     */
    name?: pulumi.Input<string>;
    /**
     * The TTL of our resolution of your DNS record in seconds.
     */
    ttl?: pulumi.Input<number>;
    /**
     * The type of DNS record associated with the origin. "" is used to specify a combination of A/AAAA records.
     * Available values: "", "A", "AAAA", "SRV".
     */
    type?: pulumi.Input<string>;
}
export interface StaticRouteScope {
    /**
     * List of colo names for the ECMP scope.
     */
    coloNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of colo regions for the ECMP scope.
     */
    coloRegions?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface StreamInput {
    /**
     * The video height in pixels. A value of `-1` means the height is unknown. The value becomes available after the upload and before the video is ready.
     */
    height?: pulumi.Input<number>;
    /**
     * The video width in pixels. A value of `-1` means the width is unknown. The value becomes available after the upload and before the video is ready.
     */
    width?: pulumi.Input<number>;
}
export interface StreamLiveInputRecording {
    /**
     * Lists the origins allowed to display videos created with this input. Enter allowed origin domains in an array and use `*` for wildcard subdomains. An empty array allows videos to be viewed on any origin.
     */
    allowedOrigins?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Disables reporting the number of live viewers when this property is set to `true`.
     */
    hideLiveViewerCount?: pulumi.Input<boolean>;
    /**
     * Specifies the recording behavior for the live input. Set this value to `off` to prevent a recording. Set the value to `automatic` to begin a recording and transition to on-demand after Stream Live stops receiving input.
     * Available values: "off", "automatic".
     */
    mode?: pulumi.Input<string>;
    /**
     * Indicates if a video using the live input has the `requireSignedURLs` property set. Also enforces access controls on any video recording of the livestream with the live input.
     */
    requireSignedUrls?: pulumi.Input<boolean>;
    /**
     * Determines the amount of time a live input configured in `automatic` mode should wait before a recording transitions from live to on-demand. `0` is recommended for most use cases and indicates the platform default should be used.
     */
    timeoutSeconds?: pulumi.Input<number>;
}
export interface StreamLiveInputRtmps {
    /**
     * The secret key to use when streaming via RTMPS to a live input.
     */
    streamKey?: pulumi.Input<string>;
    /**
     * The RTMPS URL you provide to the broadcaster, which they stream live video to.
     */
    url?: pulumi.Input<string>;
}
export interface StreamLiveInputRtmpsPlayback {
    /**
     * The secret key to use for playback via RTMPS.
     */
    streamKey?: pulumi.Input<string>;
    /**
     * The URL used to play live video over RTMPS.
     */
    url?: pulumi.Input<string>;
}
export interface StreamLiveInputSrt {
    /**
     * The secret key to use when streaming via SRT to a live input.
     */
    passphrase?: pulumi.Input<string>;
    /**
     * The identifier of the live input to use when streaming via SRT.
     */
    streamId?: pulumi.Input<string>;
    /**
     * The SRT URL you provide to the broadcaster, which they stream live video to.
     */
    url?: pulumi.Input<string>;
}
export interface StreamLiveInputSrtPlayback {
    /**
     * The secret key to use for playback via SRT.
     */
    passphrase?: pulumi.Input<string>;
    /**
     * The identifier of the live input to use for playback via SRT.
     */
    streamId?: pulumi.Input<string>;
    /**
     * The URL used to play live video over SRT.
     */
    url?: pulumi.Input<string>;
}
export interface StreamLiveInputWebRtc {
    /**
     * The WebRTC URL you provide to the broadcaster, which they stream live video to.
     */
    url?: pulumi.Input<string>;
}
export interface StreamLiveInputWebRtcPlayback {
    /**
     * The URL used to play live video over WebRTC.
     */
    url?: pulumi.Input<string>;
}
export interface StreamPlayback {
    /**
     * DASH Media Presentation Description for the video.
     */
    dash?: pulumi.Input<string>;
    /**
     * The HLS manifest for the video.
     */
    hls?: pulumi.Input<string>;
}
export interface StreamStatus {
    /**
     * Specifies why the video failed to encode. This field is empty if the video is not in an `error` state. Preferred for programmatic use.
     */
    errorReasonCode?: pulumi.Input<string>;
    /**
     * Specifies why the video failed to encode using a human readable error message in English. This field is empty if the video is not in an `error` state.
     */
    errorReasonText?: pulumi.Input<string>;
    /**
     * Indicates the size of the entire upload in bytes. The value must be a non-negative integer.
     */
    pctComplete?: pulumi.Input<string>;
    /**
     * Specifies the processing status for all quality levels for a video.
     * Available values: "pendingupload", "downloading", "queued", "inprogress", "ready", "error", "live-inprogress".
     */
    state?: pulumi.Input<string>;
}
export interface StreamWatermark {
    /**
     * The date and a time a watermark profile was created.
     */
    created?: pulumi.Input<string>;
    /**
     * The source URL for a downloaded image. If the watermark profile was created via direct upload, this field is null.
     */
    downloadedFrom?: pulumi.Input<string>;
    /**
     * The height of the image in pixels.
     */
    height?: pulumi.Input<number>;
    /**
     * A short description of the watermark profile.
     */
    name?: pulumi.Input<string>;
    /**
     * The translucency of the image. A value of `0.0` makes the image completely transparent, and `1.0` makes the image completely opaque. Note that if the image is already semi-transparent, setting this to `1.0` will not make the image completely opaque.
     */
    opacity?: pulumi.Input<number>;
    /**
     * The whitespace between the adjacent edges (determined by position) of the video and the image. `0.0` indicates no padding, and `1.0` indicates a fully padded video width or length, as determined by the algorithm.
     */
    padding?: pulumi.Input<number>;
    /**
     * The location of the image. Valid positions are: `upperRight`, `upperLeft`, `lowerLeft`, `lowerRight`, and `center`. Note that `center` ignores the `padding` parameter.
     */
    position?: pulumi.Input<string>;
    /**
     * The size of the image relative to the overall size of the video. This parameter will adapt to horizontal and vertical videos automatically. `0.0` indicates no scaling (use the size of the image as-is), and `1.0`fills the entire video.
     */
    scale?: pulumi.Input<number>;
    /**
     * The size of the image in bytes.
     */
    size?: pulumi.Input<number>;
    /**
     * The unique identifier for a watermark profile.
     */
    uid?: pulumi.Input<string>;
    /**
     * The width of the image in pixels.
     */
    width?: pulumi.Input<number>;
}
export interface TeamsAccountSettings {
    /**
     * Activity log settings.
     */
    activityLog?: pulumi.Input<inputs.TeamsAccountSettingsActivityLog>;
    /**
     * Anti-virus settings.
     */
    antivirus?: pulumi.Input<inputs.TeamsAccountSettingsAntivirus>;
    /**
     * Block page layout settings.
     */
    blockPage?: pulumi.Input<inputs.TeamsAccountSettingsBlockPage>;
    /**
     * DLP body scanning settings.
     */
    bodyScanning?: pulumi.Input<inputs.TeamsAccountSettingsBodyScanning>;
    /**
     * Browser isolation settings.
     */
    browserIsolation?: pulumi.Input<inputs.TeamsAccountSettingsBrowserIsolation>;
    /**
     * Certificate settings for Gateway TLS interception. If not specified, the Cloudflare Root CA will be used.
     */
    certificate?: pulumi.Input<inputs.TeamsAccountSettingsCertificate>;
    /**
     * Custom certificate settings for BYO-PKI. (deprecated and replaced by `certificate`).
     *
     * @deprecated This attribute is deprecated.
     */
    customCertificate?: pulumi.Input<inputs.TeamsAccountSettingsCustomCertificate>;
    /**
     * Extended e-mail matching settings.
     */
    extendedEmailMatching?: pulumi.Input<inputs.TeamsAccountSettingsExtendedEmailMatching>;
    /**
     * FIPS settings.
     */
    fips?: pulumi.Input<inputs.TeamsAccountSettingsFips>;
    /**
     * Setting to enable host selector in egress policies.
     */
    hostSelector?: pulumi.Input<inputs.TeamsAccountSettingsHostSelector>;
    /**
     * Setting to define inspection settings.
     */
    inspection?: pulumi.Input<inputs.TeamsAccountSettingsInspection>;
    /**
     * Protocol Detection settings.
     */
    protocolDetection?: pulumi.Input<inputs.TeamsAccountSettingsProtocolDetection>;
    /**
     * Sandbox settings.
     */
    sandbox?: pulumi.Input<inputs.TeamsAccountSettingsSandbox>;
    /**
     * TLS interception settings.
     */
    tlsDecrypt?: pulumi.Input<inputs.TeamsAccountSettingsTlsDecrypt>;
}
export interface TeamsAccountSettingsActivityLog {
    /**
     * Enable activity logging.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface TeamsAccountSettingsAntivirus {
    /**
     * Enable anti-virus scanning on downloads.
     */
    enabledDownloadPhase?: pulumi.Input<boolean>;
    /**
     * Enable anti-virus scanning on uploads.
     */
    enabledUploadPhase?: pulumi.Input<boolean>;
    /**
     * Block requests for files that cannot be scanned.
     */
    failClosed?: pulumi.Input<boolean>;
    /**
     * Configure a message to display on the user's device when an antivirus search is performed.
     */
    notificationSettings?: pulumi.Input<inputs.TeamsAccountSettingsAntivirusNotificationSettings>;
}
export interface TeamsAccountSettingsAntivirusNotificationSettings {
    /**
     * Set notification on.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * If true, context information will be passed as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * Customize the message shown in the notification.
     */
    msg?: pulumi.Input<string>;
    /**
     * Optional URL to direct users to additional information. If not set, the notification will open a block page.
     */
    supportUrl?: pulumi.Input<string>;
}
export interface TeamsAccountSettingsBlockPage {
    /**
     * If mode is customized_block_page: block page background color in #rrggbb format.
     */
    backgroundColor?: pulumi.Input<string>;
    /**
     * Enable only cipher suites and TLS versions compliant with FIPS. 140-2.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * If mode is customized_block_page: block page footer text.
     */
    footerText?: pulumi.Input<string>;
    /**
     * If mode is customized_block_page: block page header text.
     */
    headerText?: pulumi.Input<string>;
    /**
     * If mode is redirect_uri: when enabled, context will be appended to targetUri as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * If mode is customized_block_page: full URL to the logo file.
     */
    logoPath?: pulumi.Input<string>;
    /**
     * If mode is customized_block_page: admin email for users to contact.
     */
    mailtoAddress?: pulumi.Input<string>;
    /**
     * If mode is customized_block_page: subject line for emails created from block page.
     */
    mailtoSubject?: pulumi.Input<string>;
    /**
     * Controls whether the user is redirected to a Cloudflare-hosted block page or to a customer-provided URI.
     * Available values: "", "customizedBlockPage", "redirectUri".
     */
    mode?: pulumi.Input<string>;
    /**
     * If mode is customized_block_page: block page title.
     */
    name?: pulumi.Input<string>;
    /**
     * This setting was shared via the Orgs API and cannot be edited by the current account.
     */
    readOnly?: pulumi.Input<boolean>;
    /**
     * Account tag of account that shared this setting.
     */
    sourceAccount?: pulumi.Input<string>;
    /**
     * If mode is customized_block_page: suppress detailed info at the bottom of the block page.
     */
    suppressFooter?: pulumi.Input<boolean>;
    /**
     * If mode is redirect_uri: URI to which the user should be redirected.
     */
    targetUri?: pulumi.Input<string>;
    /**
     * Version number of the setting.
     */
    version?: pulumi.Input<number>;
}
export interface TeamsAccountSettingsBodyScanning {
    /**
     * Set the inspection mode to either `deep` or `shallow`.
     * Available values: "deep", "shallow".
     */
    inspectionMode?: pulumi.Input<string>;
}
export interface TeamsAccountSettingsBrowserIsolation {
    /**
     * Enable non-identity onramp support for Browser Isolation.
     */
    nonIdentityEnabled?: pulumi.Input<boolean>;
    /**
     * Enable Clientless Browser Isolation.
     */
    urlBrowserIsolationEnabled?: pulumi.Input<boolean>;
}
export interface TeamsAccountSettingsCertificate {
    /**
     * UUID of certificate to be used for interception. Certificate must be available (previously called 'active') on the edge. A nil UUID will indicate the Cloudflare Root CA should be used.
     */
    id: pulumi.Input<string>;
}
export interface TeamsAccountSettingsCustomCertificate {
    /**
     * Certificate status (internal).
     */
    bindingStatus?: pulumi.Input<string>;
    /**
     * Enable use of custom certificate authority for signing Gateway. traffic.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * UUID of certificate (ID from MTLS certificate store).
     */
    id?: pulumi.Input<string>;
    updatedAt?: pulumi.Input<string>;
}
export interface TeamsAccountSettingsExtendedEmailMatching {
    /**
     * Enable matching all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * This setting was shared via the Orgs API and cannot be edited by the current account.
     */
    readOnly?: pulumi.Input<boolean>;
    /**
     * Account tag of account that shared this setting.
     */
    sourceAccount?: pulumi.Input<string>;
    /**
     * Version number of the setting.
     */
    version?: pulumi.Input<number>;
}
export interface TeamsAccountSettingsFips {
    /**
     * Enable only cipher suites and TLS versions compliant with FIPS. 140-2.
     */
    tls?: pulumi.Input<boolean>;
}
export interface TeamsAccountSettingsHostSelector {
    /**
     * Enable filtering via hosts for egress policies.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface TeamsAccountSettingsInspection {
    /**
     * Defines the mode of inspection the proxy will use.
     * - static: Gateway will use static inspection to inspect HTTP on TCP(80). If TLS decryption is on, Gateway will inspect HTTPS traffic on TCP(443) & UDP(443).
     * - dynamic: Gateway will use protocol detection to dynamically inspect HTTP and HTTPS traffic on any port. TLS decryption must be on to inspect HTTPS traffic.
     * Available values: "static", "dynamic".
     */
    mode?: pulumi.Input<string>;
}
export interface TeamsAccountSettingsProtocolDetection {
    /**
     * Enable detecting protocol on initial bytes of client traffic.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface TeamsAccountSettingsSandbox {
    /**
     * Enable sandbox.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Action to take when the file cannot be scanned.
     * Available values: "allow", "block".
     */
    fallbackAction?: pulumi.Input<string>;
}
export interface TeamsAccountSettingsTlsDecrypt {
    /**
     * Enable inspecting encrypted HTTP traffic.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface TeamsListItem {
    /**
     * The description of the list item, if present.
     */
    description?: pulumi.Input<string>;
    /**
     * The value of the item in a list.
     */
    value?: pulumi.Input<string>;
}
export interface TeamsLocationEndpoints {
    doh: pulumi.Input<inputs.TeamsLocationEndpointsDoh>;
    dot: pulumi.Input<inputs.TeamsLocationEndpointsDot>;
    ipv4: pulumi.Input<inputs.TeamsLocationEndpointsIpv4>;
    ipv6: pulumi.Input<inputs.TeamsLocationEndpointsIpv6>;
}
export interface TeamsLocationEndpointsDoh {
    /**
     * True if the endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * A list of allowed source IP network ranges for this endpoint. When empty, all source IPs are allowed. A non-empty list is only effective if the endpoint is enabled for this location.
     */
    networks?: pulumi.Input<pulumi.Input<inputs.TeamsLocationEndpointsDohNetwork>[]>;
    /**
     * True if the endpoint requires [user identity](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/agentless/dns/dns-over-https/#filter-doh-requests-by-user) authentication.
     */
    requireToken?: pulumi.Input<boolean>;
}
export interface TeamsLocationEndpointsDohNetwork {
    /**
     * The IP address or IP CIDR.
     */
    network: pulumi.Input<string>;
}
export interface TeamsLocationEndpointsDot {
    /**
     * True if the endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * A list of allowed source IP network ranges for this endpoint. When empty, all source IPs are allowed. A non-empty list is only effective if the endpoint is enabled for this location.
     */
    networks?: pulumi.Input<pulumi.Input<inputs.TeamsLocationEndpointsDotNetwork>[]>;
}
export interface TeamsLocationEndpointsDotNetwork {
    /**
     * The IP address or IP CIDR.
     */
    network: pulumi.Input<string>;
}
export interface TeamsLocationEndpointsIpv4 {
    /**
     * True if the endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface TeamsLocationEndpointsIpv6 {
    /**
     * True if the endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * A list of allowed source IPv6 network ranges for this endpoint. When empty, all source IPs are allowed. A non-empty list is only effective if the endpoint is enabled for this location.
     */
    networks?: pulumi.Input<pulumi.Input<inputs.TeamsLocationEndpointsIpv6Network>[]>;
}
export interface TeamsLocationEndpointsIpv6Network {
    /**
     * The IPv6 address or IPv6 CIDR.
     */
    network: pulumi.Input<string>;
}
export interface TeamsLocationNetwork {
    /**
     * The IPv4 address or IPv4 CIDR. IPv4 CIDRs are limited to a maximum of /24.
     */
    network: pulumi.Input<string>;
}
export interface TeamsRuleExpiration {
    /**
     * The default duration a policy will be active in minutes. Must be set in order to use the `resetExpiration` endpoint on this rule.
     */
    duration?: pulumi.Input<number>;
    /**
     * Whether the policy has expired.
     */
    expired?: pulumi.Input<boolean>;
    /**
     * The time stamp at which the policy will expire and cease to be
     * applied.
     */
    expiresAt: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettings {
    /**
     * Add custom headers to allowed requests, in the form of key-value pairs. Keys are header names, pointing to an array with its header value(s).
     */
    addHeaders?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * Set by parent MSP accounts to enable their children to bypass this rule.
     */
    allowChildBypass?: pulumi.Input<boolean>;
    /**
     * Settings for the Audit SSH action.
     */
    auditSsh?: pulumi.Input<inputs.TeamsRuleRuleSettingsAuditSsh>;
    /**
     * Configure how browser isolation behaves.
     */
    bisoAdminControls?: pulumi.Input<inputs.TeamsRuleRuleSettingsBisoAdminControls>;
    /**
     * Custom block page settings. If missing/null, blocking will use the the account settings.
     */
    blockPage?: pulumi.Input<inputs.TeamsRuleRuleSettingsBlockPage>;
    /**
     * Enable the custom block page.
     */
    blockPageEnabled?: pulumi.Input<boolean>;
    /**
     * The text describing why this block occurred, displayed on the custom block page (if enabled).
     */
    blockReason?: pulumi.Input<string>;
    /**
     * Set by children MSP accounts to bypass their parent's rules.
     */
    bypassParentRule?: pulumi.Input<boolean>;
    /**
     * Configure how session check behaves.
     */
    checkSession?: pulumi.Input<inputs.TeamsRuleRuleSettingsCheckSession>;
    /**
     * Add your own custom resolvers to route queries that match the resolver policy. Cannot be used when 'resolve*dns*through*cloudflare' or 'resolve*dns*internally' are set. DNS queries will route to the address closest to their origin. Only valid when a rule's action is set to 'resolve'.
     */
    dnsResolvers?: pulumi.Input<inputs.TeamsRuleRuleSettingsDnsResolvers>;
    /**
     * Configure how Gateway Proxy traffic egresses. You can enable this setting for rules with Egress actions and filters, or omit it to indicate local egress via WARP IPs.
     */
    egress?: pulumi.Input<inputs.TeamsRuleRuleSettingsEgress>;
    /**
     * Set to true, to ignore the category matches at CNAME domains in a response. If unchecked, the categories in this rule will be checked against all the CNAME domain categories in a response.
     */
    ignoreCnameCategoryMatches?: pulumi.Input<boolean>;
    /**
     * INSECURE - disable DNSSEC validation (for Allow actions).
     */
    insecureDisableDnssecValidation?: pulumi.Input<boolean>;
    /**
     * Set to true to enable IPs in DNS resolver category blocks. By default categories only block based on domain names.
     */
    ipCategories?: pulumi.Input<boolean>;
    /**
     * Set to true to include IPs in DNS resolver indicator feed blocks. By default indicator feeds only block based on domain names.
     */
    ipIndicatorFeeds?: pulumi.Input<boolean>;
    /**
     * Send matching traffic to the supplied destination IP address. and port.
     */
    l4override?: pulumi.Input<inputs.TeamsRuleRuleSettingsL4override>;
    /**
     * Configure a notification to display on the user's device when this rule is matched.
     */
    notificationSettings?: pulumi.Input<inputs.TeamsRuleRuleSettingsNotificationSettings>;
    /**
     * Override matching DNS queries with a hostname.
     */
    overrideHost?: pulumi.Input<string>;
    /**
     * Override matching DNS queries with an IP or set of IPs.
     */
    overrideIps?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Configure DLP payload logging.
     */
    payloadLog?: pulumi.Input<inputs.TeamsRuleRuleSettingsPayloadLog>;
    /**
     * Settings that apply to quarantine rules.
     */
    quarantine?: pulumi.Input<inputs.TeamsRuleRuleSettingsQuarantine>;
    /**
     * Settings that apply to redirect rules.
     */
    redirect?: pulumi.Input<inputs.TeamsRuleRuleSettingsRedirect>;
    /**
     * Configure to forward the query to the internal DNS service, passing the specified 'view*id' as input. Cannot be set when 'dns*resolvers' are specified or 'resolve*dns*through*cloudflare' is set. Only valid when a rule's action is set to 'resolve'.
     */
    resolveDnsInternally?: pulumi.Input<inputs.TeamsRuleRuleSettingsResolveDnsInternally>;
    /**
     * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot be set when 'dns*resolvers' are specified or 'resolve*dns_internally' is set. Only valid when a rule's action is set to 'resolve'.
     */
    resolveDnsThroughCloudflare?: pulumi.Input<boolean>;
    /**
     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
     */
    untrustedCert?: pulumi.Input<inputs.TeamsRuleRuleSettingsUntrustedCert>;
}
export interface TeamsRuleRuleSettingsAuditSsh {
    /**
     * Enable to turn on SSH command logging.
     */
    commandLogging?: pulumi.Input<boolean>;
}
export interface TeamsRuleRuleSettingsBisoAdminControls {
    /**
     * Configure whether copy is enabled or not. When set with "remote*only", copying isolated content from the remote browser to the user's local clipboard is disabled. When absent, copy is enabled. Only applies when `version == "v2"`.
     * Available values: "enabled", "disabled", "remote*only".
     */
    copy?: pulumi.Input<string>;
    /**
     * Set to false to enable copy-pasting. Only applies when `version == "v1"`.
     */
    dcp?: pulumi.Input<boolean>;
    /**
     * Set to false to enable downloading. Only applies when `version == "v1"`.
     */
    dd?: pulumi.Input<boolean>;
    /**
     * Set to false to enable keyboard usage. Only applies when `version == "v1"`.
     */
    dk?: pulumi.Input<boolean>;
    /**
     * Configure whether downloading enabled or not. When set with "remote*only", downloads are only available for viewing. Only applies when `version == "v2"`.
     * Available values: "enabled", "disabled", "remote*only".
     */
    download?: pulumi.Input<string>;
    /**
     * Set to false to enable printing. Only applies when `version == "v1"`.
     */
    dp?: pulumi.Input<boolean>;
    /**
     * Set to false to enable uploading. Only applies when `version == "v1"`.
     */
    du?: pulumi.Input<boolean>;
    /**
     * Configure whether keyboard usage is enabled or not. When absent, keyboard usage is enabled. Only applies when `version == "v2"`.
     * Available values: "enabled", "disabled".
     */
    keyboard?: pulumi.Input<string>;
    /**
     * Configure whether pasting is enabled or not. When set with "remote*only", pasting content from the user's local clipboard into isolated pages is disabled. When absent, paste is enabled. Only applies when `version == "v2"`.
     * Available values: "enabled", "disabled", "remote*only".
     */
    paste?: pulumi.Input<string>;
    /**
     * Configure whether printing is enabled or not. When absent, printing is enabled. Only applies when `version == "v2"`.
     * Available values: "enabled", "disabled".
     */
    printing?: pulumi.Input<string>;
    /**
     * Configure whether uploading is enabled or not. When absent, uploading is enabled. Only applies when `version == "v2"`.
     * Available values: "enabled", "disabled".
     */
    upload?: pulumi.Input<string>;
    /**
     * Indicates which version of the browser isolation controls should apply.
     * Available values: "v1", "v2".
     */
    version?: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsBlockPage {
    /**
     * If true, context information will be passed as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * URI to which the user will be redirected.
     */
    targetUri: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsCheckSession {
    duration?: pulumi.Input<string>;
    /**
     * Set to true to enable session enforcement.
     */
    enforce?: pulumi.Input<boolean>;
}
export interface TeamsRuleRuleSettingsDnsResolvers {
    ipv4s?: pulumi.Input<pulumi.Input<inputs.TeamsRuleRuleSettingsDnsResolversIpv4>[]>;
    ipv6s?: pulumi.Input<pulumi.Input<inputs.TeamsRuleRuleSettingsDnsResolversIpv6>[]>;
}
export interface TeamsRuleRuleSettingsDnsResolversIpv4 {
    /**
     * IPv4 address of upstream resolver.
     */
    ip: pulumi.Input<string>;
    /**
     * A port number to use for upstream resolver. Defaults to 53 if unspecified.
     */
    port?: pulumi.Input<number>;
    /**
     * Whether to connect to this resolver over a private network. Must be set when vnetId is set.
     */
    routeThroughPrivateNetwork?: pulumi.Input<boolean>;
    /**
     * Optionally specify a virtual network for this resolver. Uses default virtual network id if omitted.
     */
    vnetId?: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsDnsResolversIpv6 {
    /**
     * IPv6 address of upstream resolver.
     */
    ip: pulumi.Input<string>;
    /**
     * A port number to use for upstream resolver. Defaults to 53 if unspecified.
     */
    port?: pulumi.Input<number>;
    /**
     * Whether to connect to this resolver over a private network. Must be set when vnetId is set.
     */
    routeThroughPrivateNetwork?: pulumi.Input<boolean>;
    /**
     * Optionally specify a virtual network for this resolver. Uses default virtual network id if omitted.
     */
    vnetId?: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsEgress {
    /**
     * The IPv4 address to be used for egress.
     */
    ipv4?: pulumi.Input<string>;
    /**
     * The fallback IPv4 address to be used for egress in the event of an error egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via WARP IPs.
     */
    ipv4Fallback?: pulumi.Input<string>;
    /**
     * The IPv6 range to be used for egress.
     */
    ipv6?: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsL4override {
    /**
     * IPv4 or IPv6 address.
     */
    ip?: pulumi.Input<string>;
    /**
     * A port number to use for TCP/UDP overrides.
     */
    port?: pulumi.Input<number>;
}
export interface TeamsRuleRuleSettingsNotificationSettings {
    /**
     * Set notification on.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * If true, context information will be passed as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * Customize the message shown in the notification.
     */
    msg?: pulumi.Input<string>;
    /**
     * Optional URL to direct users to additional information. If not set, the notification will open a block page.
     */
    supportUrl?: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsPayloadLog {
    /**
     * Set to true to enable DLP payload logging for this rule.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface TeamsRuleRuleSettingsQuarantine {
    /**
     * Types of files to sandbox.
     */
    fileTypes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface TeamsRuleRuleSettingsRedirect {
    /**
     * If true, context information will be passed as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * If true, the path and query parameters from the original request will be appended to target_uri.
     */
    preservePathAndQuery?: pulumi.Input<boolean>;
    /**
     * URI to which the user will be redirected.
     */
    targetUri: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsResolveDnsInternally {
    /**
     * The fallback behavior to apply when the internal DNS response code is different from 'NOERROR' or when the response data only contains CNAME records for 'A' or 'AAAA' queries.
     * Available values: "none", "publicDns".
     */
    fallback?: pulumi.Input<string>;
    /**
     * The internal DNS view identifier that's passed to the internal DNS service.
     */
    viewId?: pulumi.Input<string>;
}
export interface TeamsRuleRuleSettingsUntrustedCert {
    /**
     * The action performed when an untrusted certificate is seen. The default action is an error with HTTP code 526.
     * Available values: "passThrough", "block", "error".
     */
    action?: pulumi.Input<string>;
}
export interface TeamsRuleSchedule {
    /**
     * The time intervals when the rule will be active on Fridays, in increasing order from 00:00-24:00.  If this parameter is omitted, the rule will be deactivated on Fridays.
     */
    fri?: pulumi.Input<string>;
    /**
     * The time intervals when the rule will be active on Mondays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Mondays.
     */
    mon?: pulumi.Input<string>;
    /**
     * The time intervals when the rule will be active on Saturdays, in increasing order from 00:00-24:00.  If this parameter is omitted, the rule will be deactivated on Saturdays.
     */
    sat?: pulumi.Input<string>;
    /**
     * The time intervals when the rule will be active on Sundays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Sundays.
     */
    sun?: pulumi.Input<string>;
    /**
     * The time intervals when the rule will be active on Thursdays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Thursdays.
     */
    thu?: pulumi.Input<string>;
    /**
     * The time zone the rule will be evaluated against. If a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway will always use the current time at that time zone. If this parameter is omitted, then Gateway will use the time zone inferred from the user's source IP to evaluate the rule. If Gateway cannot determine the time zone from the IP, we will fall back to the time zone of the user's connected data center.
     */
    timeZone?: pulumi.Input<string>;
    /**
     * The time intervals when the rule will be active on Tuesdays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Tuesdays.
     */
    tue?: pulumi.Input<string>;
    /**
     * The time intervals when the rule will be active on Wednesdays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Wednesdays.
     */
    wed?: pulumi.Input<string>;
}
export interface TunnelConfigConfig {
    /**
     * List of public hostname definitions. At least one ingress rule needs to be defined for the tunnel.
     */
    ingresses?: pulumi.Input<pulumi.Input<inputs.TunnelConfigConfigIngress>[]>;
    /**
     * Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.
     */
    originRequest?: pulumi.Input<inputs.TunnelConfigConfigOriginRequest>;
    /**
     * Enable private network access from WARP users to private network routes. This is enabled if the tunnel has an assigned route.
     */
    warpRouting?: pulumi.Input<inputs.TunnelConfigConfigWarpRouting>;
}
export interface TunnelConfigConfigIngress {
    /**
     * Public hostname for this service.
     */
    hostname?: pulumi.Input<string>;
    /**
     * Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.
     */
    originRequest?: pulumi.Input<inputs.TunnelConfigConfigIngressOriginRequest>;
    /**
     * Requests with this path route to this public hostname.
     */
    path?: pulumi.Input<string>;
    /**
     * Protocol and address of destination server. Supported protocols: http://, https://, unix://, tcp://, ssh://, rdp://, unix+tls://, smb://. Alternatively can return a HTTP status code http*status:[code] e.g. 'http*status:404'.
     */
    service: pulumi.Input<string>;
}
export interface TunnelConfigConfigIngressOriginRequest {
    /**
     * For all L7 requests to this hostname, cloudflared will validate each request's Cf-Access-Jwt-Assertion request header.
     */
    access?: pulumi.Input<inputs.TunnelConfigConfigIngressOriginRequestAccess>;
    /**
     * Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
     */
    caPool?: pulumi.Input<string>;
    /**
     * Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.
     */
    connectTimeout?: pulumi.Input<number>;
    /**
     * Disables chunked transfer encoding. Useful if you are running a WSGI server.
     */
    disableChunkedEncoding?: pulumi.Input<boolean>;
    /**
     * Attempt to connect to origin using HTTP2. Origin must be configured as https.
     */
    http2Origin?: pulumi.Input<boolean>;
    /**
     * Sets the HTTP Host header on requests sent to the local service.
     */
    httpHostHeader?: pulumi.Input<string>;
    /**
     * Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
     */
    keepAliveConnections?: pulumi.Input<number>;
    /**
     * Timeout after which an idle keepalive connection can be discarded.
     */
    keepAliveTimeout?: pulumi.Input<number>;
    /**
     * Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
     */
    noHappyEyeballs?: pulumi.Input<boolean>;
    /**
     * Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
     */
    noTlsVerify?: pulumi.Input<boolean>;
    /**
     * Hostname that cloudflared should expect from your origin server certificate.
     */
    originServerName?: pulumi.Input<string>;
    /**
     * cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
     */
    proxyType?: pulumi.Input<string>;
    /**
     * The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
     */
    tcpKeepAlive?: pulumi.Input<number>;
    /**
     * Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
     */
    tlsTimeout?: pulumi.Input<number>;
}
export interface TunnelConfigConfigIngressOriginRequestAccess {
    /**
     * Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.
     */
    audTags: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Deny traffic that has not fulfilled Access authorization.
     */
    required?: pulumi.Input<boolean>;
    teamName: pulumi.Input<string>;
}
export interface TunnelConfigConfigOriginRequest {
    /**
     * For all L7 requests to this hostname, cloudflared will validate each request's Cf-Access-Jwt-Assertion request header.
     */
    access?: pulumi.Input<inputs.TunnelConfigConfigOriginRequestAccess>;
    /**
     * Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
     */
    caPool?: pulumi.Input<string>;
    /**
     * Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.
     */
    connectTimeout?: pulumi.Input<number>;
    /**
     * Disables chunked transfer encoding. Useful if you are running a WSGI server.
     */
    disableChunkedEncoding?: pulumi.Input<boolean>;
    /**
     * Attempt to connect to origin using HTTP2. Origin must be configured as https.
     */
    http2Origin?: pulumi.Input<boolean>;
    /**
     * Sets the HTTP Host header on requests sent to the local service.
     */
    httpHostHeader?: pulumi.Input<string>;
    /**
     * Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
     */
    keepAliveConnections?: pulumi.Input<number>;
    /**
     * Timeout after which an idle keepalive connection can be discarded.
     */
    keepAliveTimeout?: pulumi.Input<number>;
    /**
     * Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
     */
    noHappyEyeballs?: pulumi.Input<boolean>;
    /**
     * Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
     */
    noTlsVerify?: pulumi.Input<boolean>;
    /**
     * Hostname that cloudflared should expect from your origin server certificate.
     */
    originServerName?: pulumi.Input<string>;
    /**
     * cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
     */
    proxyType?: pulumi.Input<string>;
    /**
     * The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
     */
    tcpKeepAlive?: pulumi.Input<number>;
    /**
     * Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
     */
    tlsTimeout?: pulumi.Input<number>;
}
export interface TunnelConfigConfigOriginRequestAccess {
    /**
     * Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.
     */
    audTags: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Deny traffic that has not fulfilled Access authorization.
     */
    required?: pulumi.Input<boolean>;
    teamName: pulumi.Input<string>;
}
export interface TunnelConfigConfigWarpRouting {
    enabled?: pulumi.Input<boolean>;
}
export interface TunnelConnection {
    /**
     * UUID of the Cloudflare Tunnel connector.
     */
    clientId?: pulumi.Input<string>;
    /**
     * The cloudflared version used to establish this connection.
     */
    clientVersion?: pulumi.Input<string>;
    /**
     * The Cloudflare data center used for this connection.
     */
    coloName?: pulumi.Input<string>;
    /**
     * UUID of the Cloudflare Tunnel connection.
     */
    id?: pulumi.Input<string>;
    /**
     * Cloudflare continues to track connections for several minutes after they disconnect. This is an optimization to improve latency and reliability of reconnecting.  If `true`, the connection has disconnected but is still being tracked. If `false`, the connection is actively serving traffic.
     */
    isPendingReconnect?: pulumi.Input<boolean>;
    /**
     * Timestamp of when the connection was established.
     */
    openedAt?: pulumi.Input<string>;
    /**
     * The public IP address of the host running cloudflared.
     */
    originIp?: pulumi.Input<string>;
    /**
     * UUID of the Cloudflare Tunnel connection.
     */
    uuid?: pulumi.Input<string>;
}
export interface UserAgentBlockingRuleConfiguration {
    /**
     * The configuration target. You must set the target to `ua` when specifying a user agent in the rule.
     * Available values: "ua".
     */
    target?: pulumi.Input<string>;
    /**
     * the user agent to exactly match
     */
    value?: pulumi.Input<string>;
}
export interface UserOrganization {
    /**
     * Identifier
     */
    id?: pulumi.Input<string>;
    /**
     * Organization name.
     */
    name?: pulumi.Input<string>;
    /**
     * Access permissions for this User.
     */
    permissions?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of roles that a user has within an organization.
     */
    roles?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Whether the user is a member of the organization or has an invitation pending.
     * Available values: "member", "invited".
     */
    status?: pulumi.Input<string>;
}
export interface WaitingRoomAdditionalRoute {
    /**
     * The hostname to which this waiting room will be applied (no wildcards). The hostname must be the primary domain, subdomain, or custom hostname (if using SSL for SaaS) of this zone. Please do not include the scheme (http:// or https://).
     */
    host?: pulumi.Input<string>;
    /**
     * Sets the path within the host to enable the waiting room on. The waiting room will be enabled for all subpaths as well. If there are two waiting rooms on the same subpath, the waiting room for the most specific path will be chosen. Wildcards and query parameters are not supported.
     */
    path?: pulumi.Input<string>;
}
export interface WaitingRoomCookieAttributes {
    /**
     * Configures the SameSite attribute on the waiting room cookie. Value `auto` will be translated to `lax` or `none` depending if **Always Use HTTPS** is enabled. Note that when using value `none`, the secure attribute cannot be set to `never`.
     * Available values: "auto", "lax", "none", "strict".
     */
    samesite?: pulumi.Input<string>;
    /**
     * Configures the Secure attribute on the waiting room cookie. Value `always` indicates that the Secure attribute will be set in the Set-Cookie header, `never` indicates that the Secure attribute will not be set, and `auto` will set the Secure attribute depending if **Always Use HTTPS** is enabled.
     * Available values: "auto", "always", "never".
     */
    secure?: pulumi.Input<string>;
}
export interface WaitingRoomRulesRule {
    /**
     * The action to take when the expression matches.
     * Available values: "bypass*waiting*room".
     */
    action: pulumi.Input<string>;
    /**
     * The description of the rule.
     */
    description?: pulumi.Input<string>;
    /**
     * When set to true, the rule is enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Criteria defining when there is a match for the current rule.
     */
    expression: pulumi.Input<string>;
}
export interface WebAnalyticsSiteRule {
    created?: pulumi.Input<string>;
    /**
     * The hostname the rule will be applied to.
     */
    host?: pulumi.Input<string>;
    /**
     * The Web Analytics rule identifier.
     */
    id?: pulumi.Input<string>;
    /**
     * Whether the rule includes or excludes traffic from being measured.
     */
    inclusive?: pulumi.Input<boolean>;
    /**
     * Whether the rule is paused or not.
     */
    isPaused?: pulumi.Input<boolean>;
    /**
     * The paths the rule will be applied to.
     */
    paths?: pulumi.Input<pulumi.Input<string>[]>;
    priority?: pulumi.Input<number>;
}
export interface WebAnalyticsSiteRuleset {
    /**
     * Whether the ruleset is enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The Web Analytics ruleset identifier.
     */
    id?: pulumi.Input<string>;
    zoneName?: pulumi.Input<string>;
    /**
     * The zone identifier.
     */
    zoneTag?: pulumi.Input<string>;
}
export interface WorkerCronTriggerSchedule {
    createdOn?: pulumi.Input<string>;
    cron: pulumi.Input<string>;
    modifiedOn?: pulumi.Input<string>;
}
export interface WorkerObservability {
    /**
     * Whether observability is enabled for the Worker.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The sampling rate for observability. From 0 to 1 (1 = 100%, 0.1 = 10%).
     */
    headSamplingRate?: pulumi.Input<number>;
    /**
     * Log settings for the Worker.
     */
    logs?: pulumi.Input<inputs.WorkerObservabilityLogs>;
}
export interface WorkerObservabilityLogs {
    /**
     * Whether logs are enabled for the Worker.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The sampling rate for logs. From 0 to 1 (1 = 100%, 0.1 = 10%).
     */
    headSamplingRate?: pulumi.Input<number>;
    /**
     * Whether [invocation logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/#invocation-logs) are enabled for the Worker.
     */
    invocationLogs?: pulumi.Input<boolean>;
}
export interface WorkerScriptAssets {
    /**
     * Configuration for assets within a Worker.
     */
    config?: pulumi.Input<inputs.WorkerScriptAssetsConfig>;
    /**
     * Token provided upon successful upload of all files from a registered manifest.
     */
    jwt?: pulumi.Input<string>;
}
export interface WorkerScriptAssetsConfig {
    /**
     * The contents of a _headers file (used to attach custom headers on asset responses).
     */
    headers?: pulumi.Input<string>;
    /**
     * Determines the redirects and rewrites of requests for HTML content.
     * Available values: "auto-trailing-slash", "force-trailing-slash", "drop-trailing-slash", "none".
     */
    htmlHandling?: pulumi.Input<string>;
    /**
     * Determines the response when a request does not match a static asset, and there is no Worker script.
     * Available values: "none", "404-page", "single-page-application".
     */
    notFoundHandling?: pulumi.Input<string>;
    /**
     * The contents of a _redirects file (used to apply redirects or proxy paths ahead of asset serving).
     */
    redirects?: pulumi.Input<string>;
    /**
     * When true, requests will always invoke the Worker script. Otherwise, attempt to serve an asset matching the request, falling back to the Worker script.
     */
    runWorkerFirst?: pulumi.Input<boolean>;
    /**
     * When true and the incoming request matches an asset, that will be served instead of invoking the Worker script. When false, requests will always invoke the Worker script.
     *
     * @deprecated This attribute is deprecated.
     */
    serveDirectly?: pulumi.Input<boolean>;
}
export interface WorkerScriptBinding {
    /**
     * Algorithm-specific key parameters. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#algorithm).
     */
    algorithm?: pulumi.Input<string>;
    /**
     * R2 bucket to bind to.
     */
    bucketName?: pulumi.Input<string>;
    /**
     * Identifier of the certificate to bind to.
     */
    certificateId?: pulumi.Input<string>;
    /**
     * The exported class name of the Durable Object.
     */
    className?: pulumi.Input<string>;
    /**
     * The name of the dataset to bind to.
     */
    dataset?: pulumi.Input<string>;
    /**
     * The environment of the scriptName to bind to.
     */
    environment?: pulumi.Input<string>;
    /**
     * Data format of the key. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#format).
     * Available values: "raw", "pkcs8", "spki", "jwk".
     */
    format?: pulumi.Input<string>;
    /**
     * Identifier of the D1 database to bind to.
     */
    id?: pulumi.Input<string>;
    /**
     * Name of the Vectorize index to bind to.
     */
    indexName?: pulumi.Input<string>;
    /**
     * JSON data to use.
     */
    json?: pulumi.Input<string>;
    /**
     * Base64-encoded key data. Required if `format` is "raw", "pkcs8", or "spki".
     */
    keyBase64?: pulumi.Input<string>;
    /**
     * Key data in [JSON Web Key](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#json_web_key) format. Required if `format` is "jwk".
     */
    keyJwk?: pulumi.Input<string>;
    /**
     * A JavaScript variable name for the binding.
     */
    name: pulumi.Input<string>;
    /**
     * Namespace to bind to.
     */
    namespace?: pulumi.Input<string>;
    /**
     * Namespace identifier tag.
     */
    namespaceId?: pulumi.Input<string>;
    /**
     * Outbound worker.
     */
    outbound?: pulumi.Input<inputs.WorkerScriptBindingOutbound>;
    /**
     * Name of the Pipeline to bind to.
     */
    pipeline?: pulumi.Input<string>;
    /**
     * Name of the Queue to bind to.
     */
    queueName?: pulumi.Input<string>;
    /**
     * The script where the Durable Object is defined, if it is external to this Worker.
     */
    scriptName?: pulumi.Input<string>;
    /**
     * Name of the secret in the store.
     */
    secretName?: pulumi.Input<string>;
    /**
     * Name of Worker to bind to.
     */
    service?: pulumi.Input<string>;
    /**
     * ID of the store containing the secret.
     */
    storeId?: pulumi.Input<string>;
    /**
     * The text value to use.
     */
    text?: pulumi.Input<string>;
    /**
     * The kind of resource that the binding provides.
     * Available values: "ai", "analytics*engine", "assets", "browser", "d1", "dispatch*namespace", "durable*object*namespace", "hyperdrive", "json", "kv*namespace", "mtls*certificate", "plain*text", "pipelines", "queue", "r2*bucket", "secret*text", "service", "tail*consumer", "vectorize", "version*metadata", "secrets*store*secret", "secret*key", "workflow".
     */
    type: pulumi.Input<string>;
    /**
     * Allowed operations with the key. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#keyUsages).
     */
    usages?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Name of the Workflow to bind to.
     */
    workflowName?: pulumi.Input<string>;
}
export interface WorkerScriptBindingOutbound {
    /**
     * Pass information from the Dispatch Worker to the Outbound Worker through the parameters.
     */
    params?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Outbound worker.
     */
    worker?: pulumi.Input<inputs.WorkerScriptBindingOutboundWorker>;
}
export interface WorkerScriptBindingOutboundWorker {
    /**
     * Environment of the outbound worker.
     */
    environment?: pulumi.Input<string>;
    /**
     * Name of the outbound worker.
     */
    service?: pulumi.Input<string>;
}
export interface WorkerScriptLimits {
    /**
     * The amount of CPU time this Worker can use in milliseconds.
     */
    cpuMs?: pulumi.Input<number>;
}
export interface WorkerScriptNamedHandler {
    /**
     * The names of handlers exported as part of the named export.
     */
    handlers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The name of the export.
     */
    name?: pulumi.Input<string>;
}
export interface WorkerScriptObservability {
    /**
     * Whether observability is enabled for the Worker.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The sampling rate for incoming requests. From 0 to 1 (1 = 100%, 0.1 = 10%). Default is 1.
     */
    headSamplingRate?: pulumi.Input<number>;
    /**
     * Log settings for the Worker.
     */
    logs?: pulumi.Input<inputs.WorkerScriptObservabilityLogs>;
}
export interface WorkerScriptObservabilityLogs {
    /**
     * Whether logs are enabled for the Worker.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The sampling rate for logs. From 0 to 1 (1 = 100%, 0.1 = 10%). Default is 1.
     */
    headSamplingRate?: pulumi.Input<number>;
    /**
     * Whether [invocation logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/#invocation-logs) are enabled for the Worker.
     */
    invocationLogs: pulumi.Input<boolean>;
}
export interface WorkerScriptPlacement {
    /**
     * The last time the script was analyzed for [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement).
     */
    lastAnalyzedAt?: pulumi.Input<string>;
    /**
     * Enables [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement).
     * Available values: "smart".
     */
    mode?: pulumi.Input<string>;
    /**
     * Status of [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement).
     * Available values: "SUCCESS", "UNSUPPORTED*APPLICATION", "INSUFFICIENT*INVOCATIONS".
     */
    status?: pulumi.Input<string>;
}
export interface WorkerScriptTailConsumer {
    /**
     * Optional environment if the Worker utilizes one.
     */
    environment?: pulumi.Input<string>;
    /**
     * Optional dispatch namespace the script belongs to.
     */
    namespace?: pulumi.Input<string>;
    /**
     * Name of Worker that is to be the consumer.
     */
    service: pulumi.Input<string>;
}
export interface WorkerSubdomain {
    /**
     * Whether the *.workers.dev subdomain is enabled for the Worker.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Whether [preview URLs](https://developers.cloudflare.com/workers/configuration/previews/) are enabled for the Worker.
     */
    previewsEnabled?: pulumi.Input<boolean>;
}
export interface WorkerTailConsumer {
    /**
     * Name of the consumer Worker.
     */
    name: pulumi.Input<string>;
}
export interface WorkerVersionAnnotations {
    /**
     * Human-readable message about the version.
     */
    workersMessage?: pulumi.Input<string>;
    /**
     * User-provided identifier for the version.
     */
    workersTag?: pulumi.Input<string>;
    /**
     * Operation that triggered the creation of the version.
     */
    workersTriggeredBy?: pulumi.Input<string>;
}
export interface WorkerVersionAssets {
    /**
     * Configuration for assets within a Worker.
     */
    config?: pulumi.Input<inputs.WorkerVersionAssetsConfig>;
}
export interface WorkerVersionAssetsConfig {
    /**
     * Determines the redirects and rewrites of requests for HTML content.
     * Available values: "auto-trailing-slash", "force-trailing-slash", "drop-trailing-slash", "none".
     */
    htmlHandling?: pulumi.Input<string>;
    /**
     * Determines the response when a request does not match a static asset, and there is no Worker script.
     * Available values: "none", "404-page", "single-page-application".
     */
    notFoundHandling?: pulumi.Input<string>;
    /**
     * Contains a list path rules to control routing to either the Worker or assets. Glob (*) and negative (!) rules are supported. Rules must start with either '/' or '!/'. At least one non-negative rule must be provided, and negative rules have higher precedence than non-negative rules.
     */
    runWorkerFirsts?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface WorkerVersionBinding {
    /**
     * Algorithm-specific key parameters. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#algorithm).
     */
    algorithm?: pulumi.Input<string>;
    /**
     * R2 bucket to bind to.
     */
    bucketName?: pulumi.Input<string>;
    /**
     * Identifier of the certificate to bind to.
     */
    certificateId?: pulumi.Input<string>;
    /**
     * The exported class name of the Durable Object.
     */
    className?: pulumi.Input<string>;
    /**
     * The name of the dataset to bind to.
     */
    dataset?: pulumi.Input<string>;
    /**
     * The environment of the scriptName to bind to.
     */
    environment?: pulumi.Input<string>;
    /**
     * Data format of the key. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#format).
     * Available values: "raw", "pkcs8", "spki", "jwk".
     */
    format?: pulumi.Input<string>;
    /**
     * Identifier of the D1 database to bind to.
     */
    id?: pulumi.Input<string>;
    /**
     * Name of the Vectorize index to bind to.
     */
    indexName?: pulumi.Input<string>;
    /**
     * JSON data to use.
     */
    json?: pulumi.Input<string>;
    /**
     * Base64-encoded key data. Required if `format` is "raw", "pkcs8", or "spki".
     */
    keyBase64?: pulumi.Input<string>;
    /**
     * Key data in [JSON Web Key](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#json_web_key) format. Required if `format` is "jwk".
     */
    keyJwk?: pulumi.Input<string>;
    /**
     * A JavaScript variable name for the binding.
     */
    name: pulumi.Input<string>;
    /**
     * Namespace to bind to.
     */
    namespace?: pulumi.Input<string>;
    /**
     * Namespace identifier tag.
     */
    namespaceId?: pulumi.Input<string>;
    /**
     * Outbound worker.
     */
    outbound?: pulumi.Input<inputs.WorkerVersionBindingOutbound>;
    /**
     * Name of the Pipeline to bind to.
     */
    pipeline?: pulumi.Input<string>;
    /**
     * Name of the Queue to bind to.
     */
    queueName?: pulumi.Input<string>;
    /**
     * The script where the Durable Object is defined, if it is external to this Worker.
     */
    scriptName?: pulumi.Input<string>;
    /**
     * Name of the secret in the store.
     */
    secretName?: pulumi.Input<string>;
    /**
     * Name of Worker to bind to.
     */
    service?: pulumi.Input<string>;
    /**
     * ID of the store containing the secret.
     */
    storeId?: pulumi.Input<string>;
    /**
     * The text value to use.
     */
    text?: pulumi.Input<string>;
    /**
     * The kind of resource that the binding provides.
     * Available values: "ai", "analytics*engine", "assets", "browser", "d1", "dispatch*namespace", "durable*object*namespace", "hyperdrive", "json", "kv*namespace", "mtls*certificate", "plain*text", "pipelines", "queue", "r2*bucket", "secret*text", "service", "tail*consumer", "vectorize", "version*metadata", "secrets*store*secret", "secret*key", "workflow".
     */
    type: pulumi.Input<string>;
    /**
     * Allowed operations with the key. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#keyUsages).
     */
    usages?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Name of the Workflow to bind to.
     */
    workflowName?: pulumi.Input<string>;
}
export interface WorkerVersionBindingOutbound {
    /**
     * Pass information from the Dispatch Worker to the Outbound Worker through the parameters.
     */
    params?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Outbound worker.
     */
    worker?: pulumi.Input<inputs.WorkerVersionBindingOutboundWorker>;
}
export interface WorkerVersionBindingOutboundWorker {
    /**
     * Environment of the outbound worker.
     */
    environment?: pulumi.Input<string>;
    /**
     * Name of the outbound worker.
     */
    service?: pulumi.Input<string>;
}
export interface WorkerVersionLimits {
    /**
     * CPU time limit in milliseconds.
     */
    cpuMs: pulumi.Input<number>;
}
export interface WorkerVersionMigrations {
    /**
     * A list of classes to delete Durable Object namespaces from.
     */
    deletedClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces from.
     */
    newClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces with SQLite from.
     */
    newSqliteClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Tag to set as the latest migration tag.
     */
    newTag?: pulumi.Input<string>;
    /**
     * Tag used to verify against the latest migration tag for this Worker. If they don't match, the upload is rejected.
     */
    oldTag?: pulumi.Input<string>;
    /**
     * A list of classes with Durable Object namespaces that were renamed.
     */
    renamedClasses?: pulumi.Input<pulumi.Input<inputs.WorkerVersionMigrationsRenamedClass>[]>;
    /**
     * Migrations to apply in order.
     */
    steps?: pulumi.Input<pulumi.Input<inputs.WorkerVersionMigrationsStep>[]>;
    /**
     * A list of transfers for Durable Object namespaces from a different Worker and class to a class defined in this Worker.
     */
    transferredClasses?: pulumi.Input<pulumi.Input<inputs.WorkerVersionMigrationsTransferredClass>[]>;
}
export interface WorkerVersionMigrationsRenamedClass {
    from?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkerVersionMigrationsStep {
    /**
     * A list of classes to delete Durable Object namespaces from.
     */
    deletedClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces from.
     */
    newClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes to create Durable Object namespaces with SQLite from.
     */
    newSqliteClasses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A list of classes with Durable Object namespaces that were renamed.
     */
    renamedClasses?: pulumi.Input<pulumi.Input<inputs.WorkerVersionMigrationsStepRenamedClass>[]>;
    /**
     * A list of transfers for Durable Object namespaces from a different Worker and class to a class defined in this Worker.
     */
    transferredClasses?: pulumi.Input<pulumi.Input<inputs.WorkerVersionMigrationsStepTransferredClass>[]>;
}
export interface WorkerVersionMigrationsStepRenamedClass {
    from?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkerVersionMigrationsStepTransferredClass {
    from?: pulumi.Input<string>;
    fromScript?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkerVersionMigrationsTransferredClass {
    from?: pulumi.Input<string>;
    fromScript?: pulumi.Input<string>;
    to?: pulumi.Input<string>;
}
export interface WorkerVersionModule {
    /**
     * The file path of the module content.
     */
    contentFile: pulumi.Input<string>;
    /**
     * The SHA-256 hash of the module content.
     */
    contentSha256?: pulumi.Input<string>;
    /**
     * The content type of the module.
     */
    contentType: pulumi.Input<string>;
    /**
     * The name of the module.
     */
    name: pulumi.Input<string>;
}
export interface WorkerVersionPlacement {
    /**
     * Placement mode for the version.
     * Available values: "smart".
     */
    mode?: pulumi.Input<string>;
}
export interface WorkersCronTriggerSchedule {
    createdOn?: pulumi.Input<string>;
    cron: pulumi.Input<string>;
    modifiedOn?: pulumi.Input<string>;
}
export interface WorkersDeploymentAnnotations {
    /**
     * Human-readable message about the deployment. Truncated to 100 bytes.
     */
    workersMessage?: pulumi.Input<string>;
    /**
     * Operation that triggered the creation of the deployment.
     */
    workersTriggeredBy?: pulumi.Input<string>;
}
export interface WorkersDeploymentVersion {
    percentage: pulumi.Input<number>;
    versionId: pulumi.Input<string>;
}
export interface WorkersScriptAssets {
    /**
     * Configuration for assets within a Worker.
     */
    config?: pulumi.Input<inputs.WorkersScriptAssetsConfig>;
    /**
     * Token provided upon successful upload of all files from a registered manifest.
     */
    jwt?: pulumi.Input<string>;
}
export interface WorkersScriptAssetsConfig {
    /**
     * The contents of a _headers file (used to attach custom headers on asset responses).
     */
    headers?: pulumi.Input<string>;
    /**
     * Determines the redirects and rewrites of requests for HTML content.
     * Available values: "auto-trailing-slash", "force-trailing-slash", "drop-trailing-slash", "none".
     */
    htmlHandling?: pulumi.Input<string>;
    /**
     * Determines the response when a request does not match a static asset, and there is no Worker script.
     * Available values: "none", "404-page", "single-page-application".
     */
    notFoundHandling?: pulumi.Input<string>;
    /**
     * The contents of a _redirects file (used to apply redirects or proxy paths ahead of asset serving).
     */
    redirects?: pulumi.Input<string>;
    /**
     * When true, requests will always invoke the Worker script. Otherwise, attempt to serve an asset matching the request, falling back to the Worker script.
     */
    runWorkerFirst?: pulumi.Input<boolean>;
    /**
     * When true and the incoming request matches an asset, that will be served instead of invoking the Worker script. When false, requests will always invoke the Worker script.
     *
     * @deprecated This attribute is deprecated.
     */
    serveDirectly?: pulumi.Input<boolean>;
}
export interface WorkersScriptBinding {
    /**
     * Algorithm-specific key parameters. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#algorithm).
     */
    algorithm?: pulumi.Input<string>;
    /**
     * R2 bucket to bind to.
     */
    bucketName?: pulumi.Input<string>;
    /**
     * Identifier of the certificate to bind to.
     */
    certificateId?: pulumi.Input<string>;
    /**
     * The exported class name of the Durable Object.
     */
    className?: pulumi.Input<string>;
    /**
     * The name of the dataset to bind to.
     */
    dataset?: pulumi.Input<string>;
    /**
     * The environment of the scriptName to bind to.
     */
    environment?: pulumi.Input<string>;
    /**
     * Data format of the key. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#format).
     * Available values: "raw", "pkcs8", "spki", "jwk".
     */
    format?: pulumi.Input<string>;
    /**
     * Identifier of the D1 database to bind to.
     */
    id?: pulumi.Input<string>;
    /**
     * Name of the Vectorize index to bind to.
     */
    indexName?: pulumi.Input<string>;
    /**
     * JSON data to use.
     */
    json?: pulumi.Input<string>;
    /**
     * Base64-encoded key data. Required if `format` is "raw", "pkcs8", or "spki".
     */
    keyBase64?: pulumi.Input<string>;
    /**
     * Key data in [JSON Web Key](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#json_web_key) format. Required if `format` is "jwk".
     */
    keyJwk?: pulumi.Input<string>;
    /**
     * A JavaScript variable name for the binding.
     */
    name: pulumi.Input<string>;
    /**
     * Namespace to bind to.
     */
    namespace?: pulumi.Input<string>;
    /**
     * Namespace identifier tag.
     */
    namespaceId?: pulumi.Input<string>;
    /**
     * Outbound worker.
     */
    outbound?: pulumi.Input<inputs.WorkersScriptBindingOutbound>;
    /**
     * Name of the Pipeline to bind to.
     */
    pipeline?: pulumi.Input<string>;
    /**
     * Name of the Queue to bind to.
     */
    queueName?: pulumi.Input<string>;
    /**
     * The script where the Durable Object is defined, if it is external to this Worker.
     */
    scriptName?: pulumi.Input<string>;
    /**
     * Name of the secret in the store.
     */
    secretName?: pulumi.Input<string>;
    /**
     * Name of Worker to bind to.
     */
    service?: pulumi.Input<string>;
    /**
     * ID of the store containing the secret.
     */
    storeId?: pulumi.Input<string>;
    /**
     * The text value to use.
     */
    text?: pulumi.Input<string>;
    /**
     * The kind of resource that the binding provides.
     * Available values: "ai", "analytics*engine", "assets", "browser", "d1", "dispatch*namespace", "durable*object*namespace", "hyperdrive", "json", "kv*namespace", "mtls*certificate", "plain*text", "pipelines", "queue", "r2*bucket", "secret*text", "service", "tail*consumer", "vectorize", "version*metadata", "secrets*store*secret", "secret*key", "workflow".
     */
    type: pulumi.Input<string>;
    /**
     * Allowed operations with the key. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#keyUsages).
     */
    usages?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Name of the Workflow to bind to.
     */
    workflowName?: pulumi.Input<string>;
}
export interface WorkersScriptBindingOutbound {
    /**
     * Pass information from the Dispatch Worker to the Outbound Worker through the parameters.
     */
    params?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Outbound worker.
     */
    worker?: pulumi.Input<inputs.WorkersScriptBindingOutboundWorker>;
}
export interface WorkersScriptBindingOutboundWorker {
    /**
     * Environment of the outbound worker.
     */
    environment?: pulumi.Input<string>;
    /**
     * Name of the outbound worker.
     */
    service?: pulumi.Input<string>;
}
export interface WorkersScriptLimits {
    /**
     * The amount of CPU time this Worker can use in milliseconds.
     */
    cpuMs?: pulumi.Input<number>;
}
export interface WorkersScriptNamedHandler {
    /**
     * The names of handlers exported as part of the named export.
     */
    handlers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The name of the export.
     */
    name?: pulumi.Input<string>;
}
export interface WorkersScriptObservability {
    /**
     * Whether observability is enabled for the Worker.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The sampling rate for incoming requests. From 0 to 1 (1 = 100%, 0.1 = 10%). Default is 1.
     */
    headSamplingRate?: pulumi.Input<number>;
    /**
     * Log settings for the Worker.
     */
    logs?: pulumi.Input<inputs.WorkersScriptObservabilityLogs>;
}
export interface WorkersScriptObservabilityLogs {
    /**
     * Whether logs are enabled for the Worker.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * The sampling rate for logs. From 0 to 1 (1 = 100%, 0.1 = 10%). Default is 1.
     */
    headSamplingRate?: pulumi.Input<number>;
    /**
     * Whether [invocation logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/#invocation-logs) are enabled for the Worker.
     */
    invocationLogs: pulumi.Input<boolean>;
}
export interface WorkersScriptPlacement {
    /**
     * The last time the script was analyzed for [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement).
     */
    lastAnalyzedAt?: pulumi.Input<string>;
    /**
     * Enables [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement).
     * Available values: "smart".
     */
    mode?: pulumi.Input<string>;
    /**
     * Status of [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement).
     * Available values: "SUCCESS", "UNSUPPORTED*APPLICATION", "INSUFFICIENT*INVOCATIONS".
     */
    status?: pulumi.Input<string>;
}
export interface WorkersScriptTailConsumer {
    /**
     * Optional environment if the Worker utilizes one.
     */
    environment?: pulumi.Input<string>;
    /**
     * Optional dispatch namespace the script belongs to.
     */
    namespace?: pulumi.Input<string>;
    /**
     * Name of Worker that is to be the consumer.
     */
    service: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationCorsHeaders {
    /**
     * Allows all HTTP request headers.
     */
    allowAllHeaders?: pulumi.Input<boolean>;
    /**
     * Allows all HTTP request methods.
     */
    allowAllMethods?: pulumi.Input<boolean>;
    /**
     * Allows all origins.
     */
    allowAllOrigins?: pulumi.Input<boolean>;
    /**
     * When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.
     */
    allowCredentials?: pulumi.Input<boolean>;
    /**
     * Allowed HTTP request headers.
     */
    allowedHeaders?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Allowed HTTP request methods.
     */
    allowedMethods?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Allowed origins.
     */
    allowedOrigins?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The maximum number of seconds the results of a preflight request can be cached.
     */
    maxAge?: pulumi.Input<number>;
}
export interface ZeroTrustAccessApplicationDestination {
    /**
     * The CIDR range of the destination. Single IPs will be computed as /32.
     */
    cidr?: pulumi.Input<string>;
    /**
     * The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
     */
    hostname?: pulumi.Input<string>;
    /**
     * The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.
     * Available values: "tcp", "udp".
     */
    l4Protocol?: pulumi.Input<string>;
    /**
     * The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.
     */
    portRange?: pulumi.Input<string>;
    /**
     * Available values: "public", "private".
     */
    type?: pulumi.Input<string>;
    /**
     * The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
     */
    uri?: pulumi.Input<string>;
    /**
     * The VNET ID to match the destination. When omitted, all VNETs will match.
     */
    vnetId?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationFooterLink {
    /**
     * The hypertext in the footer link.
     */
    name: pulumi.Input<string>;
    /**
     * the hyperlink in the footer link.
     */
    url: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationLandingPageDesign {
    /**
     * The background color of the log in button on the landing page.
     */
    buttonColor?: pulumi.Input<string>;
    /**
     * The color of the text in the log in button on the landing page.
     */
    buttonTextColor?: pulumi.Input<string>;
    /**
     * The URL of the image shown on the landing page.
     */
    imageUrl?: pulumi.Input<string>;
    /**
     * The message shown on the landing page.
     */
    message?: pulumi.Input<string>;
    /**
     * The title shown on the landing page.
     */
    title?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicy {
    /**
     * The rules that define how users may connect to the targets secured by your application.
     */
    connectionRules?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyConnectionRules>;
    /**
     * The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
     * Available values: "allow", "deny", "nonIdentity", "bypass".
     */
    decision?: pulumi.Input<string>;
    /**
     * Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
     */
    excludes?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExclude>[]>;
    /**
     * The UUID of the policy
     */
    id?: pulumi.Input<string>;
    /**
     * Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
     */
    includes?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyInclude>[]>;
    /**
     * The name of the Access policy.
     */
    name?: pulumi.Input<string>;
    /**
     * The order of execution for this policy. Must be unique for each policy within an app.
     */
    precedence?: pulumi.Input<number>;
    /**
     * Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
     */
    requires?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequire>[]>;
}
export interface ZeroTrustAccessApplicationPolicyConnectionRules {
    /**
     * The SSH-specific rules that define how users may connect to the targets secured by your application.
     */
    ssh?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyConnectionRulesSsh>;
}
export interface ZeroTrustAccessApplicationPolicyConnectionRulesSsh {
    /**
     * Enables using Identity Provider email alias as SSH username.
     */
    allowEmailAlias?: pulumi.Input<boolean>;
    /**
     * Contains the Unix usernames that may be used when connecting over SSH.
     */
    usernames: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ZeroTrustAccessApplicationPolicyExclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyExcludeServiceToken>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeAnyValidServiceToken {
}
export interface ZeroTrustAccessApplicationPolicyExcludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeCertificate {
}
export interface ZeroTrustAccessApplicationPolicyExcludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeEveryone {
}
export interface ZeroTrustAccessApplicationPolicyExcludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyExcludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyInclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyIncludeServiceToken>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeAnyValidServiceToken {
}
export interface ZeroTrustAccessApplicationPolicyIncludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeCertificate {
}
export interface ZeroTrustAccessApplicationPolicyIncludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeEveryone {
}
export interface ZeroTrustAccessApplicationPolicyIncludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyIncludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequire {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessApplicationPolicyRequireServiceToken>;
}
export interface ZeroTrustAccessApplicationPolicyRequireAnyValidServiceToken {
}
export interface ZeroTrustAccessApplicationPolicyRequireAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireCertificate {
}
export interface ZeroTrustAccessApplicationPolicyRequireCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireEveryone {
}
export interface ZeroTrustAccessApplicationPolicyRequireExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationPolicyRequireServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationSaasApp {
    /**
     * The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.
     */
    accessTokenLifetime?: pulumi.Input<string>;
    /**
     * If client secret should be required on the token endpoint when authorization*code*with_pkce grant is used.
     */
    allowPkceWithoutClientSecret?: pulumi.Input<boolean>;
    /**
     * The URL where this applications tile redirects users
     */
    appLauncherUrl?: pulumi.Input<string>;
    /**
     * Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"
     * Available values: "saml", "oidc".
     */
    authType?: pulumi.Input<string>;
    /**
     * The application client id
     */
    clientId?: pulumi.Input<string>;
    /**
     * The application client secret, only returned on POST request.
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.
     */
    consumerServiceUrl?: pulumi.Input<string>;
    createdAt?: pulumi.Input<string>;
    customAttributes?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessApplicationSaasAppCustomAttribute>[]>;
    customClaims?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessApplicationSaasAppCustomClaim>[]>;
    /**
     * The URL that the user will be redirected to after a successful login for IDP initiated logins.
     */
    defaultRelayState?: pulumi.Input<string>;
    /**
     * The OIDC flows supported by this application
     */
    grantTypes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
     */
    groupFilterRegex?: pulumi.Input<string>;
    hybridAndImplicitOptions?: pulumi.Input<inputs.ZeroTrustAccessApplicationSaasAppHybridAndImplicitOptions>;
    /**
     * The unique identifier for your SaaS application.
     */
    idpEntityId?: pulumi.Input<string>;
    /**
     * The format of the name identifier sent to the SaaS application.
     * Available values: "id", "email".
     */
    nameIdFormat?: pulumi.Input<string>;
    /**
     * A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `nameIdFormat` setting.
     */
    nameIdTransformJsonata?: pulumi.Input<string>;
    /**
     * The Access public certificate that will be used to verify your identity.
     */
    publicKey?: pulumi.Input<string>;
    /**
     * The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens
     */
    redirectUris?: pulumi.Input<pulumi.Input<string>[]>;
    refreshTokenOptions?: pulumi.Input<inputs.ZeroTrustAccessApplicationSaasAppRefreshTokenOptions>;
    /**
     * A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml*attributes or oidc*fields of the identity provider used to authenticate. The output of this expression must be a JSON object.
     */
    samlAttributeTransformJsonata?: pulumi.Input<string>;
    /**
     * Define the user information shared with access, "offlineAccess" scope will be automatically enabled if refresh tokens are enabled
     */
    scopes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * A globally unique name for an identity or service provider.
     */
    spEntityId?: pulumi.Input<string>;
    /**
     * The endpoint where your SaaS application will send login requests.
     */
    ssoEndpoint?: pulumi.Input<string>;
    updatedAt?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationSaasAppCustomAttribute {
    /**
     * The SAML FriendlyName of the attribute.
     */
    friendlyName?: pulumi.Input<string>;
    /**
     * The name of the attribute.
     */
    name?: pulumi.Input<string>;
    /**
     * A globally unique name for an identity or service provider.
     * Available values: "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified", "urn:oasis:names:tc:SAML:2.0:attrname-format:basic", "urn:oasis:names:tc:SAML:2.0:attrname-format:uri".
     */
    nameFormat?: pulumi.Input<string>;
    /**
     * If the attribute is required when building a SAML assertion.
     */
    required?: pulumi.Input<boolean>;
    source?: pulumi.Input<inputs.ZeroTrustAccessApplicationSaasAppCustomAttributeSource>;
}
export interface ZeroTrustAccessApplicationSaasAppCustomAttributeSource {
    /**
     * The name of the IdP attribute.
     */
    name?: pulumi.Input<string>;
    /**
     * A mapping from IdP ID to attribute name.
     */
    nameByIdps?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessApplicationSaasAppCustomAttributeSourceNameByIdp>[]>;
}
export interface ZeroTrustAccessApplicationSaasAppCustomAttributeSourceNameByIdp {
    /**
     * The UID of the IdP.
     */
    idpId?: pulumi.Input<string>;
    /**
     * The name of the IdP provided attribute.
     */
    sourceName?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationSaasAppCustomClaim {
    /**
     * The name of the claim.
     */
    name?: pulumi.Input<string>;
    /**
     * If the claim is required when building an OIDC token.
     */
    required?: pulumi.Input<boolean>;
    /**
     * The scope of the claim.
     * Available values: "groups", "profile", "email", "openid".
     */
    scope?: pulumi.Input<string>;
    source?: pulumi.Input<inputs.ZeroTrustAccessApplicationSaasAppCustomClaimSource>;
}
export interface ZeroTrustAccessApplicationSaasAppCustomClaimSource {
    /**
     * The name of the IdP claim.
     */
    name?: pulumi.Input<string>;
    /**
     * A mapping from IdP ID to claim name.
     */
    nameByIdp?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    }>;
}
export interface ZeroTrustAccessApplicationSaasAppHybridAndImplicitOptions {
    /**
     * If an Access Token should be returned from the OIDC Authorization endpoint
     */
    returnAccessTokenFromAuthorizationEndpoint?: pulumi.Input<boolean>;
    /**
     * If an ID Token should be returned from the OIDC Authorization endpoint
     */
    returnIdTokenFromAuthorizationEndpoint?: pulumi.Input<boolean>;
}
export interface ZeroTrustAccessApplicationSaasAppRefreshTokenOptions {
    /**
     * How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.
     */
    lifetime?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationScimConfig {
    /**
     * Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
     */
    authentication?: pulumi.Input<inputs.ZeroTrustAccessApplicationScimConfigAuthentication>;
    /**
     * If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.
     */
    deactivateOnDelete?: pulumi.Input<boolean>;
    /**
     * Whether SCIM provisioning is turned on for this application.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * The UID of the IdP to use as the source for SCIM resources to provision to this application.
     */
    idpUid: pulumi.Input<string>;
    /**
     * A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
     */
    mappings?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessApplicationScimConfigMapping>[]>;
    /**
     * The base URI for the application's SCIM-compatible API.
     */
    remoteUri: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationScimConfigAuthentication {
    /**
     * URL used to generate the auth code used during token generation.
     */
    authorizationUrl?: pulumi.Input<string>;
    /**
     * Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.
     */
    clientId?: pulumi.Input<string>;
    /**
     * Secret used to authenticate when generating a token for authenticating with the remove SCIM service.
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * Password used to authenticate with the remote SCIM service.
     */
    password?: pulumi.Input<string>;
    /**
     * The authentication scheme to use when making SCIM requests to this application.
     * Available values: "httpbasic", "oauthbearertoken", "oauth2", "access*service*token".
     */
    scheme: pulumi.Input<string>;
    /**
     * The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.
     */
    scopes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Token used to authenticate with the remote SCIM service.
     */
    token?: pulumi.Input<string>;
    /**
     * URL used to generate the token used to authenticate with the remote SCIM service.
     */
    tokenUrl?: pulumi.Input<string>;
    /**
     * User name used to authenticate with the remote SCIM service.
     */
    user?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationScimConfigMapping {
    /**
     * Whether or not this mapping is enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.
     */
    filter?: pulumi.Input<string>;
    /**
     * Whether or not this mapping applies to creates, updates, or deletes.
     */
    operations?: pulumi.Input<inputs.ZeroTrustAccessApplicationScimConfigMappingOperations>;
    /**
     * Which SCIM resource type this mapping applies to.
     */
    schema: pulumi.Input<string>;
    /**
     * The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
     * Available values: "strict", "passthrough".
     */
    strictness?: pulumi.Input<string>;
    /**
     * A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.
     */
    transformJsonata?: pulumi.Input<string>;
}
export interface ZeroTrustAccessApplicationScimConfigMappingOperations {
    /**
     * Whether or not this mapping applies to create (POST) operations.
     */
    create?: pulumi.Input<boolean>;
    /**
     * Whether or not this mapping applies to DELETE operations.
     */
    delete?: pulumi.Input<boolean>;
    /**
     * Whether or not this mapping applies to update (PATCH/PUT) operations.
     */
    update?: pulumi.Input<boolean>;
}
export interface ZeroTrustAccessApplicationTargetCriteria {
    /**
     * The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.
     */
    port: pulumi.Input<number>;
    /**
     * The communication protocol your application secures.
     * Available values: "SSH", "RDP".
     */
    protocol: pulumi.Input<string>;
    /**
     * Contains a map of target attribute keys to target attribute values.
     */
    targetAttributes: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
}
export interface ZeroTrustAccessGroupExclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessGroupExcludeServiceToken>;
}
export interface ZeroTrustAccessGroupExcludeAnyValidServiceToken {
}
export interface ZeroTrustAccessGroupExcludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeCertificate {
}
export interface ZeroTrustAccessGroupExcludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeEveryone {
}
export interface ZeroTrustAccessGroupExcludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupExcludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupInclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessGroupIncludeServiceToken>;
}
export interface ZeroTrustAccessGroupIncludeAnyValidServiceToken {
}
export interface ZeroTrustAccessGroupIncludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeCertificate {
}
export interface ZeroTrustAccessGroupIncludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeEveryone {
}
export interface ZeroTrustAccessGroupIncludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupIncludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequire {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessGroupRequireServiceToken>;
}
export interface ZeroTrustAccessGroupRequireAnyValidServiceToken {
}
export interface ZeroTrustAccessGroupRequireAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireCertificate {
}
export interface ZeroTrustAccessGroupRequireCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireEveryone {
}
export interface ZeroTrustAccessGroupRequireExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessGroupRequireServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessIdentityProviderConfig {
    /**
     * Your companies TLD
     */
    appsDomain?: pulumi.Input<string>;
    /**
     * A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
     */
    attributes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The authorizationEndpoint URL of your IdP
     */
    authUrl?: pulumi.Input<string>;
    /**
     * Your okta authorization server id
     */
    authorizationServerId?: pulumi.Input<string>;
    /**
     * Your centrify account url
     */
    centrifyAccount?: pulumi.Input<string>;
    /**
     * Your centrify app id
     */
    centrifyAppId?: pulumi.Input<string>;
    /**
     * The jwksUri endpoint of your IdP to allow the IdP keys to sign the tokens
     */
    certsUrl?: pulumi.Input<string>;
    /**
     * Custom claims
     */
    claims?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Your OAuth Client ID
     */
    clientId?: pulumi.Input<string>;
    /**
     * Your OAuth Client Secret
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * Should Cloudflare try to load authentication contexts from your account
     */
    conditionalAccessEnabled?: pulumi.Input<boolean>;
    /**
     * Your Azure directory uuid
     */
    directoryId?: pulumi.Input<string>;
    /**
     * The attribute name for email in the SAML response.
     */
    emailAttributeName?: pulumi.Input<string>;
    /**
     * The claim name for email in the idToken response.
     */
    emailClaimName?: pulumi.Input<string>;
    /**
     * Add a list of attribute names that will be returned in the response header from the Access callback.
     */
    headerAttributes?: pulumi.Input<pulumi.Input<inputs.ZeroTrustAccessIdentityProviderConfigHeaderAttribute>[]>;
    /**
     * X509 certificate to verify the signature in the SAML authentication response
     */
    idpPublicCerts?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * IdP Entity ID or Issuer URL
     */
    issuerUrl?: pulumi.Input<string>;
    /**
     * Your okta account url
     */
    oktaAccount?: pulumi.Input<string>;
    /**
     * Your OneLogin account url
     */
    oneloginAccount?: pulumi.Input<string>;
    /**
     * Your PingOne environment identifier
     */
    pingEnvId?: pulumi.Input<string>;
    /**
     * Enable Proof Key for Code Exchange (PKCE)
     */
    pkceEnabled?: pulumi.Input<boolean>;
    /**
     * Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn't presented with any interactive prompt. If the request can't be completed silently by using single-sign on, the Microsoft identity platform returns an interaction*required error. prompt=select*account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
     * Available values: "login", "selectAccount", "none".
     */
    prompt?: pulumi.Input<string>;
    redirectUrl?: pulumi.Input<string>;
    /**
     * OAuth scopes
     */
    scopes?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
     */
    signRequest?: pulumi.Input<boolean>;
    /**
     * URL to send the SAML authentication requests to
     */
    ssoTargetUrl?: pulumi.Input<string>;
    /**
     * Should Cloudflare try to load groups from your account
     */
    supportGroups?: pulumi.Input<boolean>;
    /**
     * The tokenEndpoint URL of your IdP
     */
    tokenUrl?: pulumi.Input<string>;
}
export interface ZeroTrustAccessIdentityProviderConfigHeaderAttribute {
    /**
     * attribute name from the IDP
     */
    attributeName?: pulumi.Input<string>;
    /**
     * header that will be added on the request to the origin
     */
    headerName?: pulumi.Input<string>;
}
export interface ZeroTrustAccessIdentityProviderScimConfig {
    /**
     * A flag to enable or disable SCIM for the identity provider.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Indicates how a SCIM event updates a user identity used for policy evaluation. Use "automatic" to automatically update a user's identity and augment it with fields from the SCIM user resource. Use "reauth" to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With "reauth" identities will not contain fields from the SCIM user resource. With "no*action" identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.
     * Available values: "automatic", "reauth", "no*action".
     */
    identityUpdateBehavior?: pulumi.Input<string>;
    /**
     * The base URL of Cloudflare's SCIM V2.0 API endpoint.
     */
    scimBaseUrl?: pulumi.Input<string>;
    /**
     * A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider.  This cannot be enabled unless userDeprovision is also enabled.
     */
    seatDeprovision?: pulumi.Input<boolean>;
    /**
     * A read-only token generated when the SCIM integration is enabled for the first time.  It is redacted on subsequent requests.  If you lose this you will need to refresh it at /access/identity*providers/:idpID/refresh*scim_secret.
     */
    secret?: pulumi.Input<string>;
    /**
     * A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
     */
    userDeprovision?: pulumi.Input<boolean>;
}
export interface ZeroTrustAccessInfrastructureTargetIp {
    /**
     * The target's IPv4 address
     */
    ipv4?: pulumi.Input<inputs.ZeroTrustAccessInfrastructureTargetIpIpv4>;
    /**
     * The target's IPv6 address
     */
    ipv6?: pulumi.Input<inputs.ZeroTrustAccessInfrastructureTargetIpIpv6>;
}
export interface ZeroTrustAccessInfrastructureTargetIpIpv4 {
    /**
     * IP address of the target
     */
    ipAddr?: pulumi.Input<string>;
    /**
     * (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.
     */
    virtualNetworkId?: pulumi.Input<string>;
}
export interface ZeroTrustAccessInfrastructureTargetIpIpv6 {
    /**
     * IP address of the target
     */
    ipAddr?: pulumi.Input<string>;
    /**
     * (optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.
     */
    virtualNetworkId?: pulumi.Input<string>;
}
export interface ZeroTrustAccessMtlsHostnameSettingsSetting {
    /**
     * Request client certificates for this hostname in China. Can only be set to true if this zone is china network enabled.
     */
    chinaNetwork: pulumi.Input<boolean>;
    /**
     * Client Certificate Forwarding is a feature that takes the client cert provided by the eyeball to the edge, and forwards it to the origin as a HTTP header to allow logging on the origin.
     */
    clientCertificateForwarding: pulumi.Input<boolean>;
    /**
     * The hostname that these settings apply to.
     */
    hostname: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyApprovalGroup {
    /**
     * The number of approvals needed to obtain access.
     */
    approvalsNeeded: pulumi.Input<number>;
    /**
     * A list of emails that can approve the access request.
     */
    emailAddresses?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The UUID of an re-usable email list.
     */
    emailListUuid?: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyExcludeServiceToken>;
}
export interface ZeroTrustAccessPolicyExcludeAnyValidServiceToken {
}
export interface ZeroTrustAccessPolicyExcludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeCertificate {
}
export interface ZeroTrustAccessPolicyExcludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeEveryone {
}
export interface ZeroTrustAccessPolicyExcludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyExcludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyInclude {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyIncludeServiceToken>;
}
export interface ZeroTrustAccessPolicyIncludeAnyValidServiceToken {
}
export interface ZeroTrustAccessPolicyIncludeAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeCertificate {
}
export interface ZeroTrustAccessPolicyIncludeCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeEveryone {
}
export interface ZeroTrustAccessPolicyIncludeExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyIncludeServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequire {
    /**
     * An empty object which matches on all service tokens.
     */
    anyValidServiceToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireAnyValidServiceToken>;
    authContext?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireAuthContext>;
    authMethod?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireAuthMethod>;
    azureAd?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireAzureAd>;
    certificate?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireCertificate>;
    commonName?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireCommonName>;
    devicePosture?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireDevicePosture>;
    email?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireEmail>;
    emailDomain?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireEmailDomain>;
    emailList?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireEmailList>;
    /**
     * An empty object which matches on all users.
     */
    everyone?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireEveryone>;
    externalEvaluation?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireExternalEvaluation>;
    geo?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireGeo>;
    githubOrganization?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireGithubOrganization>;
    group?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireGroup>;
    gsuite?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireGsuite>;
    ip?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireIp>;
    ipList?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireIpList>;
    linkedAppToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireLinkedAppToken>;
    loginMethod?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireLoginMethod>;
    oidc?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireOidc>;
    okta?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireOkta>;
    saml?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireSaml>;
    serviceToken?: pulumi.Input<inputs.ZeroTrustAccessPolicyRequireServiceToken>;
}
export interface ZeroTrustAccessPolicyRequireAnyValidServiceToken {
}
export interface ZeroTrustAccessPolicyRequireAuthContext {
    /**
     * The ACID of an Authentication context.
     */
    acId: pulumi.Input<string>;
    /**
     * The ID of an Authentication context.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireAuthMethod {
    /**
     * The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
     */
    authMethod: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireAzureAd {
    /**
     * The ID of an Azure group.
     */
    id: pulumi.Input<string>;
    /**
     * The ID of your Azure identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireCertificate {
}
export interface ZeroTrustAccessPolicyRequireCommonName {
    /**
     * The common name to match.
     */
    commonName: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireDevicePosture {
    /**
     * The ID of a device posture integration.
     */
    integrationUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireEmail {
    /**
     * The email of the user.
     */
    email: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireEmailDomain {
    /**
     * The email domain to match.
     */
    domain: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireEmailList {
    /**
     * The ID of a previously created email list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireEveryone {
}
export interface ZeroTrustAccessPolicyRequireExternalEvaluation {
    /**
     * The API endpoint containing your business logic.
     */
    evaluateUrl: pulumi.Input<string>;
    /**
     * The API endpoint containing the key that Access uses to verify that the response came from your API.
     */
    keysUrl: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireGeo {
    /**
     * The country code that should be matched.
     */
    countryCode: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireGithubOrganization {
    /**
     * The ID of your Github identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the organization.
     */
    name: pulumi.Input<string>;
    /**
     * The name of the team
     */
    team?: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireGroup {
    /**
     * The ID of a previously created Access group.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireGsuite {
    /**
     * The email of the Google Workspace group.
     */
    email: pulumi.Input<string>;
    /**
     * The ID of your Google Workspace identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireIp {
    /**
     * An IPv4 or IPv6 CIDR block.
     */
    ip: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireIpList {
    /**
     * The ID of a previously created IP list.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireLinkedAppToken {
    /**
     * The ID of an Access OIDC SaaS application
     */
    appUid: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireLoginMethod {
    /**
     * The ID of an identity provider.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireOidc {
    /**
     * The name of the OIDC claim.
     */
    claimName: pulumi.Input<string>;
    /**
     * The OIDC claim value to look for.
     */
    claimValue: pulumi.Input<string>;
    /**
     * The ID of your OIDC identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireOkta {
    /**
     * The ID of your Okta identity provider.
     */
    identityProviderId: pulumi.Input<string>;
    /**
     * The name of the Okta group.
     */
    name: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireSaml {
    /**
     * The name of the SAML attribute.
     */
    attributeName: pulumi.Input<string>;
    /**
     * The SAML attribute value to look for.
     */
    attributeValue: pulumi.Input<string>;
    /**
     * The ID of your SAML identity provider.
     */
    identityProviderId: pulumi.Input<string>;
}
export interface ZeroTrustAccessPolicyRequireServiceToken {
    /**
     * The ID of a Service Token.
     */
    tokenId: pulumi.Input<string>;
}
export interface ZeroTrustDeviceCustomProfileExclude {
    /**
     * The address in CIDR format to exclude from the tunnel. If `address` is present, `host` must not be present.
     */
    address?: pulumi.Input<string>;
    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * The domain name to exclude from the tunnel. If `host` is present, `address` must not be present.
     */
    host?: pulumi.Input<string>;
}
export interface ZeroTrustDeviceCustomProfileFallbackDomain {
    /**
     * A description of the fallback domain, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * A list of IP addresses to handle domain resolution.
     */
    dnsServers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The domain suffix to match when resolving locally.
     */
    suffix?: pulumi.Input<string>;
}
export interface ZeroTrustDeviceCustomProfileInclude {
    /**
     * The address in CIDR format to include in the tunnel. If `address` is present, `host` must not be present.
     */
    address?: pulumi.Input<string>;
    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * The domain name to include in the tunnel. If `host` is present, `address` must not be present.
     */
    host?: pulumi.Input<string>;
}
export interface ZeroTrustDeviceCustomProfileLocalDomainFallbackDomain {
    /**
     * A description of the fallback domain, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * A list of IP addresses to handle domain resolution.
     */
    dnsServers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The domain suffix to match when resolving locally.
     */
    suffix: pulumi.Input<string>;
}
export interface ZeroTrustDeviceCustomProfileServiceModeV2 {
    /**
     * The mode to run the WARP client under.
     */
    mode?: pulumi.Input<string>;
    /**
     * The port number when used with proxy mode.
     */
    port?: pulumi.Input<number>;
}
export interface ZeroTrustDeviceCustomProfileTargetTest {
    /**
     * The id of the DEX test targeting this policy.
     */
    id?: pulumi.Input<string>;
    /**
     * The name of the DEX test targeting this policy.
     */
    name?: pulumi.Input<string>;
}
export interface ZeroTrustDeviceDefaultProfileExclude {
    /**
     * The address in CIDR format to exclude from the tunnel. If `address` is present, `host` must not be present.
     */
    address?: pulumi.Input<string>;
    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * The domain name to exclude from the tunnel. If `host` is present, `address` must not be present.
     */
    host?: pulumi.Input<string>;
}
export interface ZeroTrustDeviceDefaultProfileFallbackDomain {
    /**
     * A description of the fallback domain, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * A list of IP addresses to handle domain resolution.
     */
    dnsServers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The domain suffix to match when resolving locally.
     */
    suffix?: pulumi.Input<string>;
}
export interface ZeroTrustDeviceDefaultProfileInclude {
    /**
     * The address in CIDR format to include in the tunnel. If `address` is present, `host` must not be present.
     */
    address?: pulumi.Input<string>;
    /**
     * A description of the Split Tunnel item, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * The domain name to include in the tunnel. If `host` is present, `address` must not be present.
     */
    host?: pulumi.Input<string>;
}
export interface ZeroTrustDeviceDefaultProfileLocalDomainFallbackDomain {
    /**
     * A description of the fallback domain, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * A list of IP addresses to handle domain resolution.
     */
    dnsServers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The domain suffix to match when resolving locally.
     */
    suffix: pulumi.Input<string>;
}
export interface ZeroTrustDeviceDefaultProfileServiceModeV2 {
    /**
     * The mode to run the WARP client under.
     */
    mode?: pulumi.Input<string>;
    /**
     * The port number when used with proxy mode.
     */
    port?: pulumi.Input<number>;
}
export interface ZeroTrustDeviceManagedNetworksConfig {
    /**
     * The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.
     */
    sha256?: pulumi.Input<string>;
    /**
     * A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.
     */
    tlsSockaddr: pulumi.Input<string>;
}
export interface ZeroTrustDevicePostureIntegrationConfig {
    /**
     * If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `apiUrl`.
     */
    accessClientId?: pulumi.Input<string>;
    /**
     * If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `apiUrl`.
     */
    accessClientSecret?: pulumi.Input<string>;
    /**
     * The Workspace One API URL provided in the Workspace One Admin Dashboard.
     */
    apiUrl?: pulumi.Input<string>;
    /**
     * The Workspace One Authorization URL depending on your region.
     */
    authUrl?: pulumi.Input<string>;
    /**
     * The Workspace One client ID provided in the Workspace One Admin Dashboard.
     */
    clientId?: pulumi.Input<string>;
    /**
     * The Uptycs client secret.
     */
    clientKey?: pulumi.Input<string>;
    /**
     * The Workspace One client secret provided in the Workspace One Admin Dashboard.
     */
    clientSecret?: pulumi.Input<string>;
    /**
     * The Crowdstrike customer ID.
     */
    customerId?: pulumi.Input<string>;
}
export interface ZeroTrustDevicePostureRuleInput {
    /**
     * The Number of active threats.
     */
    activeThreats?: pulumi.Input<number>;
    /**
     * UUID of Cloudflare managed certificate.
     */
    certificateId?: pulumi.Input<string>;
    /**
     * List of volume names to be checked for encryption.
     */
    checkDisks?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.
     */
    checkPrivateKey?: pulumi.Input<boolean>;
    /**
     * Common Name that is protected by the certificate.
     */
    cn?: pulumi.Input<string>;
    /**
     * Compliance Status.
     * Available values: "compliant", "noncompliant", "unknown", "notapplicable", "ingraceperiod", "error".
     */
    complianceStatus?: pulumi.Input<string>;
    /**
     * Posture Integration ID.
     */
    connectionId?: pulumi.Input<string>;
    /**
     * Count Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    countOperator?: pulumi.Input<string>;
    /**
     * Domain.
     */
    domain?: pulumi.Input<string>;
    /**
     * For more details on eid last seen, refer to the Tanium documentation.
     */
    eidLastSeen?: pulumi.Input<string>;
    /**
     * Enabled.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Whether or not file exists.
     */
    exists?: pulumi.Input<boolean>;
    /**
     * List of values indicating purposes for which the certificate public key can be used.
     */
    extendedKeyUsages?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List ID.
     */
    id?: pulumi.Input<string>;
    /**
     * Whether device is infected.
     */
    infected?: pulumi.Input<boolean>;
    /**
     * Whether device is active.
     */
    isActive?: pulumi.Input<boolean>;
    /**
     * The Number of Issues.
     */
    issueCount?: pulumi.Input<string>;
    /**
     * For more details on last seen, please refer to the Crowdstrike documentation.
     */
    lastSeen?: pulumi.Input<string>;
    locations?: pulumi.Input<inputs.ZeroTrustDevicePostureRuleInputLocations>;
    /**
     * Network status of device.
     * Available values: "connected", "disconnected", "disconnecting", "connecting".
     */
    networkStatus?: pulumi.Input<string>;
    /**
     * Operating system.
     * Available values: "windows", "linux", "mac", "android", "ios", "chromeos".
     */
    operatingSystem?: pulumi.Input<string>;
    /**
     * Agent operational state.
     * Available values: "na", "partially*disabled", "auto*fully*disabled", "fully*disabled", "auto*partially*disabled", "disabled*error", "db*corruption".
     */
    operationalState?: pulumi.Input<string>;
    /**
     * Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    operator?: pulumi.Input<string>;
    /**
     * Os Version.
     */
    os?: pulumi.Input<string>;
    /**
     * Operating System Distribution Name (linux only).
     */
    osDistroName?: pulumi.Input<string>;
    /**
     * Version of OS Distribution (linux only).
     */
    osDistroRevision?: pulumi.Input<string>;
    /**
     * Additional version data. For Mac or iOS, the Product Version Extra. For Linux, the kernel release version. (Mac, iOS, and Linux only).
     */
    osVersionExtra?: pulumi.Input<string>;
    /**
     * Overall.
     */
    overall?: pulumi.Input<string>;
    /**
     * File path.
     */
    path?: pulumi.Input<string>;
    /**
     * Whether to check all disks for encryption.
     */
    requireAll?: pulumi.Input<boolean>;
    /**
     * For more details on risk level, refer to the Tanium documentation.
     * Available values: "low", "medium", "high", "critical".
     */
    riskLevel?: pulumi.Input<string>;
    /**
     * A value between 0-100 assigned to devices set by the 3rd party posture provider.
     */
    score?: pulumi.Input<number>;
    /**
     * Score Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    scoreOperator?: pulumi.Input<string>;
    /**
     * SensorConfig.
     */
    sensorConfig?: pulumi.Input<string>;
    /**
     * SHA-256.
     */
    sha256?: pulumi.Input<string>;
    /**
     * For more details on state, please refer to the Crowdstrike documentation.
     * Available values: "online", "offline", "unknown".
     */
    state?: pulumi.Input<string>;
    /**
     * List of certificate Subject Alternative Names.
     */
    subjectAlternativeNames?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Signing certificate thumbprint.
     */
    thumbprint?: pulumi.Input<string>;
    /**
     * For more details on total score, refer to the Tanium documentation.
     */
    totalScore?: pulumi.Input<number>;
    /**
     * Version of OS.
     */
    version?: pulumi.Input<string>;
    /**
     * Version Operator.
     * Available values: "<", "<=", ">", ">=", "==".
     */
    versionOperator?: pulumi.Input<string>;
}
export interface ZeroTrustDevicePostureRuleInputLocations {
    /**
     * List of paths to check for client certificate on linux.
     */
    paths?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of trust stores to check for client certificate.
     */
    trustStores?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ZeroTrustDevicePostureRuleMatch {
    /**
     * Available values: "windows", "mac", "linux", "android", "ios", "chromeos".
     */
    platform?: pulumi.Input<string>;
}
export interface ZeroTrustDexTestData {
    /**
     * The desired endpoint to test.
     */
    host?: pulumi.Input<string>;
    /**
     * The type of test.
     */
    kind?: pulumi.Input<string>;
    /**
     * The HTTP request method type.
     */
    method?: pulumi.Input<string>;
}
export interface ZeroTrustDexTestTargetPolicy {
    /**
     * Whether the DEX rule is the account default
     */
    default?: pulumi.Input<boolean>;
    /**
     * The id of the DEX rule
     */
    id?: pulumi.Input<string>;
    /**
     * The name of the DEX rule
     */
    name?: pulumi.Input<string>;
}
export interface ZeroTrustDlpCustomEntryConfidence {
    /**
     * Indicates whether this entry has AI remote service validation.
     */
    aiContextAvailable?: pulumi.Input<boolean>;
    /**
     * Indicates whether this entry has any form of validation that is not an AI remote service.
     */
    available?: pulumi.Input<boolean>;
}
export interface ZeroTrustDlpCustomEntryPattern {
    regex: pulumi.Input<string>;
    /**
     * Available values: "luhn".
     *
     * @deprecated This attribute is deprecated.
     */
    validation?: pulumi.Input<string>;
}
export interface ZeroTrustDlpCustomEntryVariant {
    description?: pulumi.Input<string>;
    /**
     * Available values: "Intent", "Content".
     */
    topicType?: pulumi.Input<string>;
    /**
     * Available values: "PromptTopic".
     */
    type?: pulumi.Input<string>;
}
export interface ZeroTrustDlpCustomProfileContextAwareness {
    /**
     * If true, scan the context of predefined entries to only return matches surrounded by keywords.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * Content types to exclude from context analysis and return all matches.
     */
    skip: pulumi.Input<inputs.ZeroTrustDlpCustomProfileContextAwarenessSkip>;
}
export interface ZeroTrustDlpCustomProfileContextAwarenessSkip {
    /**
     * If the content type is a file, skip context analysis and return all matches.
     */
    files: pulumi.Input<boolean>;
}
export interface ZeroTrustDlpCustomProfileEntry {
    enabled: pulumi.Input<boolean>;
    entryId?: pulumi.Input<string>;
    name: pulumi.Input<string>;
    pattern: pulumi.Input<inputs.ZeroTrustDlpCustomProfileEntryPattern>;
}
export interface ZeroTrustDlpCustomProfileEntryPattern {
    regex: pulumi.Input<string>;
    /**
     * Available values: "luhn".
     *
     * @deprecated This attribute is deprecated.
     */
    validation?: pulumi.Input<string>;
}
export interface ZeroTrustDlpCustomProfileSharedEntry {
    enabled: pulumi.Input<boolean>;
    entryId: pulumi.Input<string>;
    /**
     * Available values: "custom", "predefined", "integration", "exact*data", "document*fingerprint".
     */
    entryType: pulumi.Input<string>;
}
export interface ZeroTrustDlpDatasetColumn {
    entryId?: pulumi.Input<string>;
    headerName?: pulumi.Input<string>;
    numCells?: pulumi.Input<number>;
    /**
     * Available values: "empty", "uploading", "pending", "processing", "failed", "complete".
     */
    uploadStatus?: pulumi.Input<string>;
}
export interface ZeroTrustDlpDatasetDataset {
    caseSensitive?: pulumi.Input<boolean>;
    columns?: pulumi.Input<pulumi.Input<inputs.ZeroTrustDlpDatasetDatasetColumn>[]>;
    createdAt?: pulumi.Input<string>;
    /**
     * The description of the dataset.
     */
    description?: pulumi.Input<string>;
    encodingVersion?: pulumi.Input<number>;
    id?: pulumi.Input<string>;
    name?: pulumi.Input<string>;
    numCells?: pulumi.Input<number>;
    secret?: pulumi.Input<boolean>;
    /**
     * Available values: "empty", "uploading", "pending", "processing", "failed", "complete".
     */
    status?: pulumi.Input<string>;
    /**
     * When the dataset was last updated.
     */
    updatedAt?: pulumi.Input<string>;
    uploads?: pulumi.Input<pulumi.Input<inputs.ZeroTrustDlpDatasetDatasetUpload>[]>;
}
export interface ZeroTrustDlpDatasetDatasetColumn {
    entryId?: pulumi.Input<string>;
    headerName?: pulumi.Input<string>;
    numCells?: pulumi.Input<number>;
    /**
     * Available values: "empty", "uploading", "pending", "processing", "failed", "complete".
     */
    uploadStatus?: pulumi.Input<string>;
}
export interface ZeroTrustDlpDatasetDatasetUpload {
    numCells?: pulumi.Input<number>;
    /**
     * Available values: "empty", "uploading", "pending", "processing", "failed", "complete".
     */
    status?: pulumi.Input<string>;
    version?: pulumi.Input<number>;
}
export interface ZeroTrustDlpDatasetUpload {
    numCells?: pulumi.Input<number>;
    /**
     * Available values: "empty", "uploading", "pending", "processing", "failed", "complete".
     */
    status?: pulumi.Input<string>;
    version?: pulumi.Input<number>;
}
export interface ZeroTrustDlpEntryConfidence {
    /**
     * Indicates whether this entry has AI remote service validation.
     */
    aiContextAvailable?: pulumi.Input<boolean>;
    /**
     * Indicates whether this entry has any form of validation that is not an AI remote service.
     */
    available?: pulumi.Input<boolean>;
}
export interface ZeroTrustDlpEntryPattern {
    regex: pulumi.Input<string>;
    /**
     * Available values: "luhn".
     *
     * @deprecated This attribute is deprecated.
     */
    validation?: pulumi.Input<string>;
}
export interface ZeroTrustDlpEntryVariant {
    description?: pulumi.Input<string>;
    /**
     * Available values: "Intent", "Content".
     */
    topicType?: pulumi.Input<string>;
    /**
     * Available values: "PromptTopic".
     */
    type?: pulumi.Input<string>;
}
export interface ZeroTrustDlpIntegrationEntryConfidence {
    /**
     * Indicates whether this entry has AI remote service validation.
     */
    aiContextAvailable?: pulumi.Input<boolean>;
    /**
     * Indicates whether this entry has any form of validation that is not an AI remote service.
     */
    available?: pulumi.Input<boolean>;
}
export interface ZeroTrustDlpIntegrationEntryPattern {
    regex?: pulumi.Input<string>;
    /**
     * Available values: "luhn".
     *
     * @deprecated This attribute is deprecated.
     */
    validation?: pulumi.Input<string>;
}
export interface ZeroTrustDlpIntegrationEntryVariant {
    description?: pulumi.Input<string>;
    /**
     * Available values: "Intent", "Content".
     */
    topicType?: pulumi.Input<string>;
    /**
     * Available values: "PromptTopic".
     */
    type?: pulumi.Input<string>;
}
export interface ZeroTrustDlpPredefinedEntryConfidence {
    /**
     * Indicates whether this entry has AI remote service validation.
     */
    aiContextAvailable?: pulumi.Input<boolean>;
    /**
     * Indicates whether this entry has any form of validation that is not an AI remote service.
     */
    available?: pulumi.Input<boolean>;
}
export interface ZeroTrustDlpPredefinedEntryPattern {
    regex?: pulumi.Input<string>;
    /**
     * Available values: "luhn".
     *
     * @deprecated This attribute is deprecated.
     */
    validation?: pulumi.Input<string>;
}
export interface ZeroTrustDlpPredefinedEntryVariant {
    description?: pulumi.Input<string>;
    /**
     * Available values: "Intent", "Content".
     */
    topicType?: pulumi.Input<string>;
    /**
     * Available values: "PromptTopic".
     */
    type?: pulumi.Input<string>;
}
export interface ZeroTrustDlpPredefinedProfileContextAwareness {
    /**
     * If true, scan the context of predefined entries to only return matches surrounded by keywords.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * Content types to exclude from context analysis and return all matches.
     */
    skip: pulumi.Input<inputs.ZeroTrustDlpPredefinedProfileContextAwarenessSkip>;
}
export interface ZeroTrustDlpPredefinedProfileContextAwarenessSkip {
    /**
     * If the content type is a file, skip context analysis and return all matches.
     */
    files: pulumi.Input<boolean>;
}
export interface ZeroTrustDlpPredefinedProfileEntry {
    enabled: pulumi.Input<boolean>;
    id: pulumi.Input<string>;
}
export interface ZeroTrustDnsLocationEndpoints {
    doh: pulumi.Input<inputs.ZeroTrustDnsLocationEndpointsDoh>;
    dot: pulumi.Input<inputs.ZeroTrustDnsLocationEndpointsDot>;
    ipv4: pulumi.Input<inputs.ZeroTrustDnsLocationEndpointsIpv4>;
    ipv6: pulumi.Input<inputs.ZeroTrustDnsLocationEndpointsIpv6>;
}
export interface ZeroTrustDnsLocationEndpointsDoh {
    /**
     * True if the endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * A list of allowed source IP network ranges for this endpoint. When empty, all source IPs are allowed. A non-empty list is only effective if the endpoint is enabled for this location.
     */
    networks?: pulumi.Input<pulumi.Input<inputs.ZeroTrustDnsLocationEndpointsDohNetwork>[]>;
    /**
     * True if the endpoint requires [user identity](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/agentless/dns/dns-over-https/#filter-doh-requests-by-user) authentication.
     */
    requireToken?: pulumi.Input<boolean>;
}
export interface ZeroTrustDnsLocationEndpointsDohNetwork {
    /**
     * The IP address or IP CIDR.
     */
    network: pulumi.Input<string>;
}
export interface ZeroTrustDnsLocationEndpointsDot {
    /**
     * True if the endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * A list of allowed source IP network ranges for this endpoint. When empty, all source IPs are allowed. A non-empty list is only effective if the endpoint is enabled for this location.
     */
    networks?: pulumi.Input<pulumi.Input<inputs.ZeroTrustDnsLocationEndpointsDotNetwork>[]>;
}
export interface ZeroTrustDnsLocationEndpointsDotNetwork {
    /**
     * The IP address or IP CIDR.
     */
    network: pulumi.Input<string>;
}
export interface ZeroTrustDnsLocationEndpointsIpv4 {
    /**
     * True if the endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustDnsLocationEndpointsIpv6 {
    /**
     * True if the endpoint is enabled for this location.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * A list of allowed source IPv6 network ranges for this endpoint. When empty, all source IPs are allowed. A non-empty list is only effective if the endpoint is enabled for this location.
     */
    networks?: pulumi.Input<pulumi.Input<inputs.ZeroTrustDnsLocationEndpointsIpv6Network>[]>;
}
export interface ZeroTrustDnsLocationEndpointsIpv6Network {
    /**
     * The IPv6 address or IPv6 CIDR.
     */
    network: pulumi.Input<string>;
}
export interface ZeroTrustDnsLocationNetwork {
    /**
     * The IPv4 address or IPv4 CIDR. IPv4 CIDRs are limited to a maximum of /24.
     */
    network: pulumi.Input<string>;
}
export interface ZeroTrustGatewayLoggingSettingsByRuleType {
    dns?: pulumi.Input<inputs.ZeroTrustGatewayLoggingSettingsByRuleTypeDns>;
    http?: pulumi.Input<inputs.ZeroTrustGatewayLoggingSettingsByRuleTypeHttp>;
    l4?: pulumi.Input<inputs.ZeroTrustGatewayLoggingSettingsByRuleTypeL4>;
}
export interface ZeroTrustGatewayLoggingSettingsByRuleTypeDns {
    /**
     * Log all requests to this service.
     */
    logAll?: pulumi.Input<boolean>;
    /**
     * Log only blocking requests to this service.
     */
    logBlocks?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewayLoggingSettingsByRuleTypeHttp {
    /**
     * Log all requests to this service.
     */
    logAll?: pulumi.Input<boolean>;
    /**
     * Log only blocking requests to this service.
     */
    logBlocks?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewayLoggingSettingsByRuleTypeL4 {
    /**
     * Log all requests to this service.
     */
    logAll?: pulumi.Input<boolean>;
    /**
     * Log only blocking requests to this service.
     */
    logBlocks?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewayPolicyExpiration {
    /**
     * The default duration a policy will be active in minutes. Must be set in order to use the `resetExpiration` endpoint on this rule.
     */
    duration?: pulumi.Input<number>;
    /**
     * Whether the policy has expired.
     */
    expired?: pulumi.Input<boolean>;
    /**
     * The time stamp at which the policy will expire and cease to be
     * applied.
     */
    expiresAt: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettings {
    /**
     * Add custom headers to allowed requests, in the form of key-value pairs. Keys are header names, pointing to an array with its header value(s).
     */
    addHeaders?: pulumi.Input<{
        [key: string]: pulumi.Input<pulumi.Input<string>[]>;
    }>;
    /**
     * Set by parent MSP accounts to enable their children to bypass this rule.
     */
    allowChildBypass?: pulumi.Input<boolean>;
    /**
     * Settings for the Audit SSH action.
     */
    auditSsh?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsAuditSsh>;
    /**
     * Configure how browser isolation behaves.
     */
    bisoAdminControls?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsBisoAdminControls>;
    /**
     * Custom block page settings. If missing/null, blocking will use the the account settings.
     */
    blockPage?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsBlockPage>;
    /**
     * Enable the custom block page.
     */
    blockPageEnabled?: pulumi.Input<boolean>;
    /**
     * The text describing why this block occurred, displayed on the custom block page (if enabled).
     */
    blockReason?: pulumi.Input<string>;
    /**
     * Set by children MSP accounts to bypass their parent's rules.
     */
    bypassParentRule?: pulumi.Input<boolean>;
    /**
     * Configure how session check behaves.
     */
    checkSession?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsCheckSession>;
    /**
     * Add your own custom resolvers to route queries that match the resolver policy. Cannot be used when 'resolve*dns*through*cloudflare' or 'resolve*dns*internally' are set. DNS queries will route to the address closest to their origin. Only valid when a rule's action is set to 'resolve'.
     */
    dnsResolvers?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsDnsResolvers>;
    /**
     * Configure how Gateway Proxy traffic egresses. You can enable this setting for rules with Egress actions and filters, or omit it to indicate local egress via WARP IPs.
     */
    egress?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsEgress>;
    /**
     * Set to true, to ignore the category matches at CNAME domains in a response. If unchecked, the categories in this rule will be checked against all the CNAME domain categories in a response.
     */
    ignoreCnameCategoryMatches?: pulumi.Input<boolean>;
    /**
     * INSECURE - disable DNSSEC validation (for Allow actions).
     */
    insecureDisableDnssecValidation?: pulumi.Input<boolean>;
    /**
     * Set to true to enable IPs in DNS resolver category blocks. By default categories only block based on domain names.
     */
    ipCategories?: pulumi.Input<boolean>;
    /**
     * Set to true to include IPs in DNS resolver indicator feed blocks. By default indicator feeds only block based on domain names.
     */
    ipIndicatorFeeds?: pulumi.Input<boolean>;
    /**
     * Send matching traffic to the supplied destination IP address. and port.
     */
    l4override?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsL4override>;
    /**
     * Configure a notification to display on the user's device when this rule is matched.
     */
    notificationSettings?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsNotificationSettings>;
    /**
     * Override matching DNS queries with a hostname.
     */
    overrideHost?: pulumi.Input<string>;
    /**
     * Override matching DNS queries with an IP or set of IPs.
     */
    overrideIps?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Configure DLP payload logging.
     */
    payloadLog?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsPayloadLog>;
    /**
     * Settings that apply to quarantine rules.
     */
    quarantine?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsQuarantine>;
    /**
     * Settings that apply to redirect rules.
     */
    redirect?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsRedirect>;
    /**
     * Configure to forward the query to the internal DNS service, passing the specified 'view*id' as input. Cannot be set when 'dns*resolvers' are specified or 'resolve*dns*through*cloudflare' is set. Only valid when a rule's action is set to 'resolve'.
     */
    resolveDnsInternally?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsResolveDnsInternally>;
    /**
     * Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot be set when 'dns*resolvers' are specified or 'resolve*dns_internally' is set. Only valid when a rule's action is set to 'resolve'.
     */
    resolveDnsThroughCloudflare?: pulumi.Input<boolean>;
    /**
     * Configure behavior when an upstream cert is invalid or an SSL error occurs.
     */
    untrustedCert?: pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsUntrustedCert>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsAuditSsh {
    /**
     * Enable to turn on SSH command logging.
     */
    commandLogging?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsBisoAdminControls {
    /**
     * Configure whether copy is enabled or not. When set with "remote*only", copying isolated content from the remote browser to the user's local clipboard is disabled. When absent, copy is enabled. Only applies when `version == "v2"`.
     * Available values: "enabled", "disabled", "remote*only".
     */
    copy?: pulumi.Input<string>;
    /**
     * Set to false to enable copy-pasting. Only applies when `version == "v1"`.
     */
    dcp?: pulumi.Input<boolean>;
    /**
     * Set to false to enable downloading. Only applies when `version == "v1"`.
     */
    dd?: pulumi.Input<boolean>;
    /**
     * Set to false to enable keyboard usage. Only applies when `version == "v1"`.
     */
    dk?: pulumi.Input<boolean>;
    /**
     * Configure whether downloading enabled or not. When set with "remote*only", downloads are only available for viewing. Only applies when `version == "v2"`.
     * Available values: "enabled", "disabled", "remote*only".
     */
    download?: pulumi.Input<string>;
    /**
     * Set to false to enable printing. Only applies when `version == "v1"`.
     */
    dp?: pulumi.Input<boolean>;
    /**
     * Set to false to enable uploading. Only applies when `version == "v1"`.
     */
    du?: pulumi.Input<boolean>;
    /**
     * Configure whether keyboard usage is enabled or not. When absent, keyboard usage is enabled. Only applies when `version == "v2"`.
     * Available values: "enabled", "disabled".
     */
    keyboard?: pulumi.Input<string>;
    /**
     * Configure whether pasting is enabled or not. When set with "remote*only", pasting content from the user's local clipboard into isolated pages is disabled. When absent, paste is enabled. Only applies when `version == "v2"`.
     * Available values: "enabled", "disabled", "remote*only".
     */
    paste?: pulumi.Input<string>;
    /**
     * Configure whether printing is enabled or not. When absent, printing is enabled. Only applies when `version == "v2"`.
     * Available values: "enabled", "disabled".
     */
    printing?: pulumi.Input<string>;
    /**
     * Configure whether uploading is enabled or not. When absent, uploading is enabled. Only applies when `version == "v2"`.
     * Available values: "enabled", "disabled".
     */
    upload?: pulumi.Input<string>;
    /**
     * Indicates which version of the browser isolation controls should apply.
     * Available values: "v1", "v2".
     */
    version?: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsBlockPage {
    /**
     * If true, context information will be passed as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * URI to which the user will be redirected.
     */
    targetUri: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsCheckSession {
    duration?: pulumi.Input<string>;
    /**
     * Set to true to enable session enforcement.
     */
    enforce?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsDnsResolvers {
    ipv4s?: pulumi.Input<pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv4>[]>;
    ipv6s?: pulumi.Input<pulumi.Input<inputs.ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv6>[]>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv4 {
    /**
     * IPv4 address of upstream resolver.
     */
    ip: pulumi.Input<string>;
    /**
     * A port number to use for upstream resolver. Defaults to 53 if unspecified.
     */
    port?: pulumi.Input<number>;
    /**
     * Whether to connect to this resolver over a private network. Must be set when vnetId is set.
     */
    routeThroughPrivateNetwork?: pulumi.Input<boolean>;
    /**
     * Optionally specify a virtual network for this resolver. Uses default virtual network id if omitted.
     */
    vnetId?: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsDnsResolversIpv6 {
    /**
     * IPv6 address of upstream resolver.
     */
    ip: pulumi.Input<string>;
    /**
     * A port number to use for upstream resolver. Defaults to 53 if unspecified.
     */
    port?: pulumi.Input<number>;
    /**
     * Whether to connect to this resolver over a private network. Must be set when vnetId is set.
     */
    routeThroughPrivateNetwork?: pulumi.Input<boolean>;
    /**
     * Optionally specify a virtual network for this resolver. Uses default virtual network id if omitted.
     */
    vnetId?: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsEgress {
    /**
     * The IPv4 address to be used for egress.
     */
    ipv4?: pulumi.Input<string>;
    /**
     * The fallback IPv4 address to be used for egress in the event of an error egressing with the primary IPv4. Can be '0.0.0.0' to indicate local egress via WARP IPs.
     */
    ipv4Fallback?: pulumi.Input<string>;
    /**
     * The IPv6 range to be used for egress.
     */
    ipv6?: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsL4override {
    /**
     * IPv4 or IPv6 address.
     */
    ip?: pulumi.Input<string>;
    /**
     * A port number to use for TCP/UDP overrides.
     */
    port?: pulumi.Input<number>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsNotificationSettings {
    /**
     * Set notification on.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * If true, context information will be passed as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * Customize the message shown in the notification.
     */
    msg?: pulumi.Input<string>;
    /**
     * Optional URL to direct users to additional information. If not set, the notification will open a block page.
     */
    supportUrl?: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsPayloadLog {
    /**
     * Set to true to enable DLP payload logging for this rule.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsQuarantine {
    /**
     * Types of files to sandbox.
     */
    fileTypes?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsRedirect {
    /**
     * If true, context information will be passed as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * If true, the path and query parameters from the original request will be appended to target_uri.
     */
    preservePathAndQuery?: pulumi.Input<boolean>;
    /**
     * URI to which the user will be redirected.
     */
    targetUri: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsResolveDnsInternally {
    /**
     * The fallback behavior to apply when the internal DNS response code is different from 'NOERROR' or when the response data only contains CNAME records for 'A' or 'AAAA' queries.
     * Available values: "none", "publicDns".
     */
    fallback?: pulumi.Input<string>;
    /**
     * The internal DNS view identifier that's passed to the internal DNS service.
     */
    viewId?: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicyRuleSettingsUntrustedCert {
    /**
     * The action performed when an untrusted certificate is seen. The default action is an error with HTTP code 526.
     * Available values: "passThrough", "block", "error".
     */
    action?: pulumi.Input<string>;
}
export interface ZeroTrustGatewayPolicySchedule {
    /**
     * The time intervals when the rule will be active on Fridays, in increasing order from 00:00-24:00.  If this parameter is omitted, the rule will be deactivated on Fridays.
     */
    fri?: pulumi.Input<string>;
    /**
     * The time intervals when the rule will be active on Mondays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Mondays.
     */
    mon?: pulumi.Input<string>;
    /**
     * The time intervals when the rule will be active on Saturdays, in increasing order from 00:00-24:00.  If this parameter is omitted, the rule will be deactivated on Saturdays.
     */
    sat?: pulumi.Input<string>;
    /**
     * The time intervals when the rule will be active on Sundays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Sundays.
     */
    sun?: pulumi.Input<string>;
    /**
     * The time intervals when the rule will be active on Thursdays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Thursdays.
     */
    thu?: pulumi.Input<string>;
    /**
     * The time zone the rule will be evaluated against. If a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway will always use the current time at that time zone. If this parameter is omitted, then Gateway will use the time zone inferred from the user's source IP to evaluate the rule. If Gateway cannot determine the time zone from the IP, we will fall back to the time zone of the user's connected data center.
     */
    timeZone?: pulumi.Input<string>;
    /**
     * The time intervals when the rule will be active on Tuesdays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Tuesdays.
     */
    tue?: pulumi.Input<string>;
    /**
     * The time intervals when the rule will be active on Wednesdays, in increasing order from 00:00-24:00. If this parameter is omitted, the rule will be deactivated on Wednesdays.
     */
    wed?: pulumi.Input<string>;
}
export interface ZeroTrustGatewaySettingsSettings {
    /**
     * Activity log settings.
     */
    activityLog?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsActivityLog>;
    /**
     * Anti-virus settings.
     */
    antivirus?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsAntivirus>;
    /**
     * Block page layout settings.
     */
    blockPage?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsBlockPage>;
    /**
     * DLP body scanning settings.
     */
    bodyScanning?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsBodyScanning>;
    /**
     * Browser isolation settings.
     */
    browserIsolation?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsBrowserIsolation>;
    /**
     * Certificate settings for Gateway TLS interception. If not specified, the Cloudflare Root CA will be used.
     */
    certificate?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsCertificate>;
    /**
     * Custom certificate settings for BYO-PKI. (deprecated and replaced by `certificate`).
     *
     * @deprecated This attribute is deprecated.
     */
    customCertificate?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsCustomCertificate>;
    /**
     * Extended e-mail matching settings.
     */
    extendedEmailMatching?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsExtendedEmailMatching>;
    /**
     * FIPS settings.
     */
    fips?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsFips>;
    /**
     * Setting to enable host selector in egress policies.
     */
    hostSelector?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsHostSelector>;
    /**
     * Setting to define inspection settings.
     */
    inspection?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsInspection>;
    /**
     * Protocol Detection settings.
     */
    protocolDetection?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsProtocolDetection>;
    /**
     * Sandbox settings.
     */
    sandbox?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsSandbox>;
    /**
     * TLS interception settings.
     */
    tlsDecrypt?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsTlsDecrypt>;
}
export interface ZeroTrustGatewaySettingsSettingsActivityLog {
    /**
     * Enable activity logging.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewaySettingsSettingsAntivirus {
    /**
     * Enable anti-virus scanning on downloads.
     */
    enabledDownloadPhase?: pulumi.Input<boolean>;
    /**
     * Enable anti-virus scanning on uploads.
     */
    enabledUploadPhase?: pulumi.Input<boolean>;
    /**
     * Block requests for files that cannot be scanned.
     */
    failClosed?: pulumi.Input<boolean>;
    /**
     * Configure a message to display on the user's device when an antivirus search is performed.
     */
    notificationSettings?: pulumi.Input<inputs.ZeroTrustGatewaySettingsSettingsAntivirusNotificationSettings>;
}
export interface ZeroTrustGatewaySettingsSettingsAntivirusNotificationSettings {
    /**
     * Set notification on.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * If true, context information will be passed as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * Customize the message shown in the notification.
     */
    msg?: pulumi.Input<string>;
    /**
     * Optional URL to direct users to additional information. If not set, the notification will open a block page.
     */
    supportUrl?: pulumi.Input<string>;
}
export interface ZeroTrustGatewaySettingsSettingsBlockPage {
    /**
     * If mode is customized_block_page: block page background color in #rrggbb format.
     */
    backgroundColor?: pulumi.Input<string>;
    /**
     * Enable only cipher suites and TLS versions compliant with FIPS. 140-2.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * If mode is customized_block_page: block page footer text.
     */
    footerText?: pulumi.Input<string>;
    /**
     * If mode is customized_block_page: block page header text.
     */
    headerText?: pulumi.Input<string>;
    /**
     * If mode is redirect_uri: when enabled, context will be appended to targetUri as query parameters.
     */
    includeContext?: pulumi.Input<boolean>;
    /**
     * If mode is customized_block_page: full URL to the logo file.
     */
    logoPath?: pulumi.Input<string>;
    /**
     * If mode is customized_block_page: admin email for users to contact.
     */
    mailtoAddress?: pulumi.Input<string>;
    /**
     * If mode is customized_block_page: subject line for emails created from block page.
     */
    mailtoSubject?: pulumi.Input<string>;
    /**
     * Controls whether the user is redirected to a Cloudflare-hosted block page or to a customer-provided URI.
     * Available values: "", "customizedBlockPage", "redirectUri".
     */
    mode?: pulumi.Input<string>;
    /**
     * If mode is customized_block_page: block page title.
     */
    name?: pulumi.Input<string>;
    /**
     * This setting was shared via the Orgs API and cannot be edited by the current account.
     */
    readOnly?: pulumi.Input<boolean>;
    /**
     * Account tag of account that shared this setting.
     */
    sourceAccount?: pulumi.Input<string>;
    /**
     * If mode is customized_block_page: suppress detailed info at the bottom of the block page.
     */
    suppressFooter?: pulumi.Input<boolean>;
    /**
     * If mode is redirect_uri: URI to which the user should be redirected.
     */
    targetUri?: pulumi.Input<string>;
    /**
     * Version number of the setting.
     */
    version?: pulumi.Input<number>;
}
export interface ZeroTrustGatewaySettingsSettingsBodyScanning {
    /**
     * Set the inspection mode to either `deep` or `shallow`.
     * Available values: "deep", "shallow".
     */
    inspectionMode?: pulumi.Input<string>;
}
export interface ZeroTrustGatewaySettingsSettingsBrowserIsolation {
    /**
     * Enable non-identity onramp support for Browser Isolation.
     */
    nonIdentityEnabled?: pulumi.Input<boolean>;
    /**
     * Enable Clientless Browser Isolation.
     */
    urlBrowserIsolationEnabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewaySettingsSettingsCertificate {
    /**
     * UUID of certificate to be used for interception. Certificate must be available (previously called 'active') on the edge. A nil UUID will indicate the Cloudflare Root CA should be used.
     */
    id: pulumi.Input<string>;
}
export interface ZeroTrustGatewaySettingsSettingsCustomCertificate {
    /**
     * Certificate status (internal).
     */
    bindingStatus?: pulumi.Input<string>;
    /**
     * Enable use of custom certificate authority for signing Gateway. traffic.
     */
    enabled: pulumi.Input<boolean>;
    /**
     * UUID of certificate (ID from MTLS certificate store).
     */
    id?: pulumi.Input<string>;
    updatedAt?: pulumi.Input<string>;
}
export interface ZeroTrustGatewaySettingsSettingsExtendedEmailMatching {
    /**
     * Enable matching all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * This setting was shared via the Orgs API and cannot be edited by the current account.
     */
    readOnly?: pulumi.Input<boolean>;
    /**
     * Account tag of account that shared this setting.
     */
    sourceAccount?: pulumi.Input<string>;
    /**
     * Version number of the setting.
     */
    version?: pulumi.Input<number>;
}
export interface ZeroTrustGatewaySettingsSettingsFips {
    /**
     * Enable only cipher suites and TLS versions compliant with FIPS. 140-2.
     */
    tls?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewaySettingsSettingsHostSelector {
    /**
     * Enable filtering via hosts for egress policies.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewaySettingsSettingsInspection {
    /**
     * Defines the mode of inspection the proxy will use.
     * - static: Gateway will use static inspection to inspect HTTP on TCP(80). If TLS decryption is on, Gateway will inspect HTTPS traffic on TCP(443) & UDP(443).
     * - dynamic: Gateway will use protocol detection to dynamically inspect HTTP and HTTPS traffic on any port. TLS decryption must be on to inspect HTTPS traffic.
     * Available values: "static", "dynamic".
     */
    mode?: pulumi.Input<string>;
}
export interface ZeroTrustGatewaySettingsSettingsProtocolDetection {
    /**
     * Enable detecting protocol on initial bytes of client traffic.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustGatewaySettingsSettingsSandbox {
    /**
     * Enable sandbox.
     */
    enabled?: pulumi.Input<boolean>;
    /**
     * Action to take when the file cannot be scanned.
     * Available values: "allow", "block".
     */
    fallbackAction?: pulumi.Input<string>;
}
export interface ZeroTrustGatewaySettingsSettingsTlsDecrypt {
    /**
     * Enable inspecting encrypted HTTP traffic.
     */
    enabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustListItem {
    /**
     * The description of the list item, if present.
     */
    description?: pulumi.Input<string>;
    /**
     * The value of the item in a list.
     */
    value?: pulumi.Input<string>;
}
export interface ZeroTrustLocalFallbackDomainDomain {
    /**
     * A description of the fallback domain, displayed in the client UI.
     */
    description?: pulumi.Input<string>;
    /**
     * A list of IP addresses to handle domain resolution.
     */
    dnsServers?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * The domain suffix to match when resolving locally.
     */
    suffix: pulumi.Input<string>;
}
export interface ZeroTrustOrganizationCustomPages {
    /**
     * The uid of the custom page to use when a user is denied access after failing a non-identity rule.
     */
    forbidden?: pulumi.Input<string>;
    /**
     * The uid of the custom page to use when a user is denied access.
     */
    identityDenied?: pulumi.Input<string>;
}
export interface ZeroTrustOrganizationLoginDesign {
    /**
     * The background color on your login page.
     */
    backgroundColor?: pulumi.Input<string>;
    /**
     * The text at the bottom of your login page.
     */
    footerText?: pulumi.Input<string>;
    /**
     * The text at the top of your login page.
     */
    headerText?: pulumi.Input<string>;
    /**
     * The URL of the logo on your login page.
     */
    logoPath?: pulumi.Input<string>;
    /**
     * The text color on your login page.
     */
    textColor?: pulumi.Input<string>;
}
export interface ZeroTrustRiskBehaviorBehaviors {
    enabled: pulumi.Input<boolean>;
    /**
     * Available values: "low", "medium", "high".
     */
    riskLevel: pulumi.Input<string>;
}
export interface ZeroTrustTunnelCloudflaredConfigConfig {
    /**
     * List of public hostname definitions. At least one ingress rule needs to be defined for the tunnel.
     */
    ingresses?: pulumi.Input<pulumi.Input<inputs.ZeroTrustTunnelCloudflaredConfigConfigIngress>[]>;
    /**
     * Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.
     */
    originRequest?: pulumi.Input<inputs.ZeroTrustTunnelCloudflaredConfigConfigOriginRequest>;
    /**
     * Enable private network access from WARP users to private network routes. This is enabled if the tunnel has an assigned route.
     */
    warpRouting?: pulumi.Input<inputs.ZeroTrustTunnelCloudflaredConfigConfigWarpRouting>;
}
export interface ZeroTrustTunnelCloudflaredConfigConfigIngress {
    /**
     * Public hostname for this service.
     */
    hostname?: pulumi.Input<string>;
    /**
     * Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.
     */
    originRequest?: pulumi.Input<inputs.ZeroTrustTunnelCloudflaredConfigConfigIngressOriginRequest>;
    /**
     * Requests with this path route to this public hostname.
     */
    path?: pulumi.Input<string>;
    /**
     * Protocol and address of destination server. Supported protocols: http://, https://, unix://, tcp://, ssh://, rdp://, unix+tls://, smb://. Alternatively can return a HTTP status code http*status:[code] e.g. 'http*status:404'.
     */
    service: pulumi.Input<string>;
}
export interface ZeroTrustTunnelCloudflaredConfigConfigIngressOriginRequest {
    /**
     * For all L7 requests to this hostname, cloudflared will validate each request's Cf-Access-Jwt-Assertion request header.
     */
    access?: pulumi.Input<inputs.ZeroTrustTunnelCloudflaredConfigConfigIngressOriginRequestAccess>;
    /**
     * Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
     */
    caPool?: pulumi.Input<string>;
    /**
     * Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.
     */
    connectTimeout?: pulumi.Input<number>;
    /**
     * Disables chunked transfer encoding. Useful if you are running a WSGI server.
     */
    disableChunkedEncoding?: pulumi.Input<boolean>;
    /**
     * Attempt to connect to origin using HTTP2. Origin must be configured as https.
     */
    http2Origin?: pulumi.Input<boolean>;
    /**
     * Sets the HTTP Host header on requests sent to the local service.
     */
    httpHostHeader?: pulumi.Input<string>;
    /**
     * Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
     */
    keepAliveConnections?: pulumi.Input<number>;
    /**
     * Timeout after which an idle keepalive connection can be discarded.
     */
    keepAliveTimeout?: pulumi.Input<number>;
    /**
     * Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
     */
    noHappyEyeballs?: pulumi.Input<boolean>;
    /**
     * Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
     */
    noTlsVerify?: pulumi.Input<boolean>;
    /**
     * Hostname that cloudflared should expect from your origin server certificate.
     */
    originServerName?: pulumi.Input<string>;
    /**
     * cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
     */
    proxyType?: pulumi.Input<string>;
    /**
     * The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
     */
    tcpKeepAlive?: pulumi.Input<number>;
    /**
     * Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
     */
    tlsTimeout?: pulumi.Input<number>;
}
export interface ZeroTrustTunnelCloudflaredConfigConfigIngressOriginRequestAccess {
    /**
     * Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.
     */
    audTags: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Deny traffic that has not fulfilled Access authorization.
     */
    required?: pulumi.Input<boolean>;
    teamName: pulumi.Input<string>;
}
export interface ZeroTrustTunnelCloudflaredConfigConfigOriginRequest {
    /**
     * For all L7 requests to this hostname, cloudflared will validate each request's Cf-Access-Jwt-Assertion request header.
     */
    access?: pulumi.Input<inputs.ZeroTrustTunnelCloudflaredConfigConfigOriginRequestAccess>;
    /**
     * Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
     */
    caPool?: pulumi.Input<string>;
    /**
     * Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.
     */
    connectTimeout?: pulumi.Input<number>;
    /**
     * Disables chunked transfer encoding. Useful if you are running a WSGI server.
     */
    disableChunkedEncoding?: pulumi.Input<boolean>;
    /**
     * Attempt to connect to origin using HTTP2. Origin must be configured as https.
     */
    http2Origin?: pulumi.Input<boolean>;
    /**
     * Sets the HTTP Host header on requests sent to the local service.
     */
    httpHostHeader?: pulumi.Input<string>;
    /**
     * Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
     */
    keepAliveConnections?: pulumi.Input<number>;
    /**
     * Timeout after which an idle keepalive connection can be discarded.
     */
    keepAliveTimeout?: pulumi.Input<number>;
    /**
     * Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
     */
    noHappyEyeballs?: pulumi.Input<boolean>;
    /**
     * Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
     */
    noTlsVerify?: pulumi.Input<boolean>;
    /**
     * Hostname that cloudflared should expect from your origin server certificate.
     */
    originServerName?: pulumi.Input<string>;
    /**
     * cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
     */
    proxyType?: pulumi.Input<string>;
    /**
     * The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
     */
    tcpKeepAlive?: pulumi.Input<number>;
    /**
     * Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
     */
    tlsTimeout?: pulumi.Input<number>;
}
export interface ZeroTrustTunnelCloudflaredConfigConfigOriginRequestAccess {
    /**
     * Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.
     */
    audTags: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * Deny traffic that has not fulfilled Access authorization.
     */
    required?: pulumi.Input<boolean>;
    teamName: pulumi.Input<string>;
}
export interface ZeroTrustTunnelCloudflaredConfigConfigWarpRouting {
    enabled?: pulumi.Input<boolean>;
}
export interface ZeroTrustTunnelCloudflaredConnection {
    /**
     * UUID of the Cloudflare Tunnel connector.
     */
    clientId?: pulumi.Input<string>;
    /**
     * The cloudflared version used to establish this connection.
     */
    clientVersion?: pulumi.Input<string>;
    /**
     * The Cloudflare data center used for this connection.
     */
    coloName?: pulumi.Input<string>;
    /**
     * UUID of the Cloudflare Tunnel connection.
     */
    id?: pulumi.Input<string>;
    /**
     * Cloudflare continues to track connections for several minutes after they disconnect. This is an optimization to improve latency and reliability of reconnecting.  If `true`, the connection has disconnected but is still being tracked. If `false`, the connection is actively serving traffic.
     */
    isPendingReconnect?: pulumi.Input<boolean>;
    /**
     * Timestamp of when the connection was established.
     */
    openedAt?: pulumi.Input<string>;
    /**
     * The public IP address of the host running cloudflared.
     */
    originIp?: pulumi.Input<string>;
    /**
     * UUID of the Cloudflare Tunnel connection.
     */
    uuid?: pulumi.Input<string>;
}
export interface ZeroTrustTunnelWarpConnectorConnection {
    /**
     * UUID of the Cloudflare Tunnel connector.
     */
    clientId?: pulumi.Input<string>;
    /**
     * The cloudflared version used to establish this connection.
     */
    clientVersion?: pulumi.Input<string>;
    /**
     * The Cloudflare data center used for this connection.
     */
    coloName?: pulumi.Input<string>;
    /**
     * UUID of the Cloudflare Tunnel connection.
     */
    id?: pulumi.Input<string>;
    /**
     * Cloudflare continues to track connections for several minutes after they disconnect. This is an optimization to improve latency and reliability of reconnecting.  If `true`, the connection has disconnected but is still being tracked. If `false`, the connection is actively serving traffic.
     */
    isPendingReconnect?: pulumi.Input<boolean>;
    /**
     * Timestamp of when the connection was established.
     */
    openedAt?: pulumi.Input<string>;
    /**
     * The public IP address of the host running cloudflared.
     */
    originIp?: pulumi.Input<string>;
    /**
     * UUID of the Cloudflare Tunnel connection.
     */
    uuid?: pulumi.Input<string>;
}
export interface ZoneAccount {
    /**
     * Identifier
     */
    id?: pulumi.Input<string>;
}
export interface ZoneCacheVariantsValue {
    /**
     * List of strings with the MIME types of all the variants that should be served for avif.
     */
    avifs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for bmp.
     */
    bmps?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for gif.
     */
    gifs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for jp2.
     */
    jp2s?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for jpeg.
     */
    jpegs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for jpg2.
     */
    jpg2s?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for jpg.
     */
    jpgs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for png.
     */
    pngs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for tiff.
     */
    tiffs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for tif.
     */
    tifs?: pulumi.Input<pulumi.Input<string>[]>;
    /**
     * List of strings with the MIME types of all the variants that should be served for webp.
     */
    webps?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ZoneDnsSettingsInternalDns {
    /**
     * The ID of the zone to fallback to.
     */
    referenceZoneId?: pulumi.Input<string>;
}
export interface ZoneDnsSettingsNameservers {
    /**
     * Configured nameserver set to be used for this zone
     */
    nsSet?: pulumi.Input<number>;
    /**
     * Nameserver type
     * Available values: "cloudflare.standard", "custom.account", "custom.tenant", "custom.zone".
     */
    type: pulumi.Input<string>;
}
export interface ZoneDnsSettingsSoa {
    /**
     * Time in seconds of being unable to query the primary server after which secondary servers should stop serving the zone.
     */
    expire: pulumi.Input<number>;
    /**
     * The time to live (TTL) for negative caching of records within the zone.
     */
    minTtl: pulumi.Input<number>;
    /**
     * The primary nameserver, which may be used for outbound zone transfers.
     */
    mname: pulumi.Input<string>;
    /**
     * Time in seconds after which secondary servers should re-check the SOA record to see if the zone has been updated.
     */
    refresh: pulumi.Input<number>;
    /**
     * Time in seconds after which secondary servers should retry queries after the primary server was unresponsive.
     */
    retry: pulumi.Input<number>;
    /**
     * The email address of the zone administrator, with the first label representing the local part of the email address.
     */
    rname: pulumi.Input<string>;
    /**
     * The time to live (TTL) of the SOA record itself.
     */
    ttl: pulumi.Input<number>;
}
export interface ZoneLockdownConfiguration {
    /**
     * The configuration target. You must set the target to `ip` when specifying an IP address in the Zone Lockdown rule.
     * Available values: "ip", "ipRange".
     */
    target?: pulumi.Input<string>;
    /**
     * The IP address to match. This address will be compared to the IP address of incoming requests.
     */
    value?: pulumi.Input<string>;
}
export interface ZoneMeta {
    /**
     * The zone is only configured for CDN.
     */
    cdnOnly?: pulumi.Input<boolean>;
    /**
     * Number of Custom Certificates the zone can have.
     */
    customCertificateQuota?: pulumi.Input<number>;
    /**
     * The zone is only configured for DNS.
     */
    dnsOnly?: pulumi.Input<boolean>;
    /**
     * The zone is setup with Foundation DNS.
     */
    foundationDns?: pulumi.Input<boolean>;
    /**
     * Number of Page Rules a zone can have.
     */
    pageRuleQuota?: pulumi.Input<number>;
    /**
     * The zone has been flagged for phishing.
     */
    phishingDetected?: pulumi.Input<boolean>;
    step?: pulumi.Input<number>;
}
export interface ZoneOwner {
    /**
     * Identifier
     */
    id?: pulumi.Input<string>;
    /**
     * Name of the owner.
     */
    name?: pulumi.Input<string>;
    /**
     * The type of owner.
     */
    type?: pulumi.Input<string>;
}
export interface ZonePlan {
    /**
     * States if the subscription can be activated.
     */
    canSubscribe?: pulumi.Input<boolean>;
    /**
     * The denomination of the customer.
     */
    currency?: pulumi.Input<string>;
    /**
     * If this Zone is managed by another company.
     */
    externallyManaged?: pulumi.Input<boolean>;
    /**
     * How often the customer is billed.
     */
    frequency?: pulumi.Input<string>;
    /**
     * Identifier
     */
    id?: pulumi.Input<string>;
    /**
     * States if the subscription active.
     */
    isSubscribed?: pulumi.Input<boolean>;
    /**
     * If the legacy discount applies to this Zone.
     */
    legacyDiscount?: pulumi.Input<boolean>;
    /**
     * The legacy name of the plan.
     */
    legacyId?: pulumi.Input<string>;
    /**
     * Name of the owner.
     */
    name?: pulumi.Input<string>;
    /**
     * How much the customer is paying.
     */
    price?: pulumi.Input<number>;
}
export interface ZoneSubscriptionRatePlan {
    /**
     * The currency applied to the rate plan subscription.
     */
    currency?: pulumi.Input<string>;
    /**
     * Whether this rate plan is managed externally from Cloudflare.
     */
    externallyManaged?: pulumi.Input<boolean>;
    /**
     * The ID of the rate plan.
     * Available values: "free", "lite", "pro", "pro*plus", "business", "enterprise", "partners*free", "partners*pro", "partners*business", "partnersEnterprise".
     */
    id?: pulumi.Input<string>;
    /**
     * Whether a rate plan is enterprise-based (or newly adopted term contract).
     */
    isContract?: pulumi.Input<boolean>;
    /**
     * The full name of the rate plan.
     */
    publicName?: pulumi.Input<string>;
    /**
     * The scope that this rate plan applies to.
     */
    scope?: pulumi.Input<string>;
    /**
     * The list of sets this rate plan applies to.
     */
    sets?: pulumi.Input<pulumi.Input<string>[]>;
}
export interface ZoneTenant {
    /**
     * Identifier
     */
    id?: pulumi.Input<string>;
    /**
     * The name of the Tenant account.
     */
    name?: pulumi.Input<string>;
}
export interface ZoneTenantUnit {
    /**
     * Identifier
     */
    id?: pulumi.Input<string>;
}