openapi: 3.0.0
info:
  version: 2015-07-09
  x-release: v4
  title: APIs.io Engineering Platform Amazon API Gateway 2014 11 13 Access Applications API
  description: <fullname>Amazon API Gateway</fullname> <p>Amazon API Gateway helps developers deliver robust, secure, and scalable mobile and web application back ends. API Gateway allows developers to securely connect mobile and web applications to APIs that run on AWS Lambda, Amazon EC2, or other publicly addressable web services that are hosted outside of AWS.</p>
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_twitter.com_awscloud_profile_image.png
    backgroundColor: '#FFFFFF'
  termsOfService: https://aws.amazon.com/service-terms/
  contact:
    name: Mike Ralphson
    email: mike.ralphson@gmail.com
    url: https://github.com/mermade/aws2openapi
    x-twitter: PermittedSoc
  license:
    name: Apache 2.0 License
    url: http://www.apache.org/licenses/
  x-providerName: amazonaws.com
  x-serviceName: apigateway
  x-origin:
  - contentType: application/json
    url: https://raw.githubusercontent.com/aws/aws-sdk-js/master/apis/apigateway-2015-07-09.normal.json
    converter:
      url: https://github.com/mermade/aws2openapi
      version: 1.0.0
    x-apisguru-driver: external
  x-apiClientRegistration:
    url: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc2=h_ct
  x-apisguru-categories:
  - cloud
  x-preferred: true
servers:
- url: http://apigateway.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The Amazon API Gateway multi-region endpoint
- url: https://apigateway.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The Amazon API Gateway multi-region endpoint
- url: http://apigateway.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The Amazon API Gateway endpoint for China (Beijing) and China (Ningxia)
- url: https://apigateway.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The Amazon API Gateway endpoint for China (Beijing) and China (Ningxia)
security:
- hmac: []
tags:
- name: Access Applications
paths:
  /accounts/{account_id}/access/apps:
    get:
      description: Lists all Access applications in an account.
      operationId: access-applications-list-access-applications
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: List Access applications response failure
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_apps_components-schemas-response_collection'
          description: List Access applications response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform List Access applications
      tags:
      - Access Applications
      x-api-token-group:
      - 'Access: Apps and Policies Revoke'
      - 'Access: Apps and Policies Write'
      - 'Access: Apps and Policies Read'
    post:
      description: Adds a new application to Access.
      operationId: access-applications-add-an-application
      parameters:
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/access_app_request'
        required: true
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Add an Access application response failure
        '201':
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/access_apps_components-schemas-single_response'
                - properties:
                    result:
                      $ref: '#/components/schemas/access_app_response'
          description: Add an Access application response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Add an Access application
      tags:
      - Access Applications
      x-api-token-group:
      - 'Access: Apps and Policies Write'
  /accounts/{account_id}/access/apps/{app_id}:
    delete:
      description: Deletes an application from Access.
      operationId: access-applications-delete-an-access-application
      parameters:
      - in: path
        name: app_id
        required: true
        schema:
          $ref: '#/components/schemas/access_app_id'
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Delete an Access application response failure
        '202':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_id_response'
          description: Delete an Access application response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Delete an Access application
      tags:
      - Access Applications
      x-api-token-group:
      - 'Access: Apps and Policies Write'
    get:
      description: Fetches information about an Access application.
      operationId: access-applications-get-an-access-application
      parameters:
      - in: path
        name: app_id
        required: true
        schema:
          $ref: '#/components/schemas/access_app_id'
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Get an Access application response failure
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_apps_components-schemas-single_response'
          description: Get an Access application response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Get an Access application
      tags:
      - Access Applications
      x-api-token-group:
      - 'Access: Apps and Policies Write'
      - 'Access: Apps and Policies Read'
    put:
      description: Updates an Access application.
      operationId: access-applications-update-an-access-application
      parameters:
      - in: path
        name: app_id
        required: true
        schema:
          $ref: '#/components/schemas/access_app_id'
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/access_app_request'
        required: true
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Update an Access application response failure
        '200':
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/access_apps_components-schemas-single_response'
                - properties:
                    result:
                      $ref: '#/components/schemas/access_app_response'
          description: Update an Access application response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Update an Access application
      tags:
      - Access Applications
      x-api-token-group:
      - 'Access: Apps and Policies Write'
  /accounts/{account_id}/access/apps/{app_id}/revoke_tokens:
    post:
      description: Revokes all tokens issued for an application.
      operationId: access-applications-revoke-service-tokens
      parameters:
      - in: path
        name: app_id
        required: true
        schema:
          $ref: '#/components/schemas/access_app_id'
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Revoke application tokens response failure
        '202':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_schemas-empty_response'
          description: Revoke application tokens response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Revoke application tokens
      tags:
      - Access Applications
      x-api-token-group:
      - 'Access: Apps and Policies Revoke'
      - 'Access: Apps and Policies Write'
  /accounts/{account_id}/access/apps/{app_id}/user_policy_checks:
    get:
      description: Tests if a specific user has permission to access an application.
      operationId: access-applications-test-access-policies
      parameters:
      - in: path
        name: app_id
        required: true
        schema:
          $ref: '#/components/schemas/access_app_id'
      - in: path
        name: account_id
        required: true
        schema:
          $ref: '#/components/schemas/access_identifier'
      responses:
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_api-response-common-failure'
          description: Test Access policies response failure
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/access_policy_check_response'
          description: Test Access policies response
      security:
      - api_email: []
        api_key: []
      summary: APIs.io Engineering Platform Test Access policies
      tags:
      - Access Applications
      x-api-token-group:
      - 'Access: Apps and Policies Write'
      - 'Access: Apps and Policies Read'
components:
  schemas:
    access_approval_groups:
      description: Administrators who can approve a temporary authentication request.
      example:
      - approvals_needed: 1
        email_addresses:
        - test1@cloudflare.com
        - test2@cloudflare.com
      - approvals_needed: 3
        email_list_uuid: 597147a1-976b-4ef2-9af0-81d5d007fc34
      items:
        $ref: '#/components/schemas/access_approval_group'
      type: array
    access_schemas-session_duration:
      default: 24h
      description: 'The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.'
      example: 24h
      type: string
    access_service_token_rule:
      description: Matches a specific Access Service Token
      properties:
        service_token:
          properties:
            token_id:
              description: The ID of a Service Token.
              example: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
              type: string
          required:
          - token_id
          type: object
      required:
      - service_token
      title: Service Token
      type: object
    access_api-response-collection:
      allOf:
      - $ref: '#/components/schemas/access_api-response-common'
      - properties:
          result_info:
            $ref: '#/components/schemas/access_result_info'
      type: object
    access_policy_components-schemas-name:
      description: The name of the Access policy.
      example: Allow devs
      type: string
    access_vnc_props:
      allOf:
      - $ref: '#/components/schemas/access_self_hosted_props'
      - properties:
          type:
            description: The application type.
            example: vnc
            type: string
    access_identifier:
      description: Identifier
      example: 023e105f4ecef8ad9ca31a8372d0c353
      maxLength: 32
      type: string
    access_allowed_origins:
      description: Allowed origins.
      example:
      - https://example.com
      items:
        type: string
      type: array
    access_approval_required:
      default: false
      description: Requires the user to request access from an administrator at the start of each session.
      example: true
      type: boolean
    access_allow_all_origins:
      description: Allows all origins.
      type: boolean
    access_schemas-empty_response:
      allOf:
      - properties:
          result:
            nullable: true
            type: object
          success:
            enum:
            - true
            - false
            example: true
            type: boolean
    access_app_launcher_props:
      allOf:
      - $ref: '#/components/schemas/access_feature_app_props'
      - properties:
          domain:
            example: authdomain.cloudflareaccess.com
            readOnly: true
          name:
            default: App Launcher
            example: App Launcher
            readOnly: true
          type:
            description: The application type.
            example: app_launcher
            type: string
    access_app_launcher_visible:
      default: true
      description: Displays the application in the App Launcher.
      example: true
      type: boolean
    access_email_rule:
      description: Matches a specific email.
      properties:
        email:
          properties:
            email:
              description: The email of the user.
              example: test@example.com
              format: email
              type: string
          required:
          - email
          type: object
      required:
      - email
      title: Email
      type: object
    access_external_evaluation_rule:
      description: Create Allow or Block policies which evaluate the user based on custom criteria.
      properties:
        external_evaluation:
          properties:
            evaluate_url:
              description: The API endpoint containing your business logic.
              example: https://eval.example.com
              type: string
            keys_url:
              description: The API endpoint containing the key that Access uses to verify that the response came from your API.
              example: https://eval.example.com/keys
              type: string
          required:
          - evaluate_url
          - keys_url
          type: object
      required:
      - external_evaluation
      title: External Evaluation
      type: object
    access_app_response:
      anyOf:
      - allOf:
        - $ref: '#/components/schemas/access_basic_app_response_props'
        - $ref: '#/components/schemas/access_self_hosted_props'
        - $ref: '#/components/schemas/access_app_resp_embedded_policies'
        title: Self Hosted Application
        type: object
      - allOf:
        - $ref: '#/components/schemas/access_basic_app_response_props'
        - $ref: '#/components/schemas/access_saas_props'
        - $ref: '#/components/schemas/access_app_resp_embedded_policies'
        title: SaaS Application
        type: object
      - allOf:
        - $ref: '#/components/schemas/access_basic_app_response_props'
        - $ref: '#/components/schemas/access_ssh_props'
        - $ref: '#/components/schemas/access_app_resp_embedded_policies'
        title: Browser SSH Application
        type: object
      - allOf:
        - $ref: '#/components/schemas/access_basic_app_response_props'
        - $ref: '#/components/schemas/access_vnc_props'
        - $ref: '#/components/schemas/access_app_resp_embedded_policies'
        title: Browser VNC Application
        type: object
      - allOf:
        - $ref: '#/components/schemas/access_basic_app_response_props'
        - $ref: '#/components/schemas/access_app_launcher_props'
        - $ref: '#/components/schemas/access_app_resp_embedded_policies'
        title: App Launcher Application
        type: object
      - allOf:
        - $ref: '#/components/schemas/access_basic_app_response_props'
        - $ref: '#/components/schemas/access_warp_props'
        - $ref: '#/components/schemas/access_app_resp_embedded_policies'
        title: Device Enrollment Permissions Application
        type: object
      - allOf:
        - $ref: '#/components/schemas/access_basic_app_response_props'
        - $ref: '#/components/schemas/access_biso_props'
        - $ref: '#/components/schemas/access_app_resp_embedded_policies'
        title: Browser Isolation Permissions Application
        type: object
      - allOf:
        - $ref: '#/components/schemas/access_basic_app_response_props'
        - $ref: '#/components/schemas/access_bookmark_props'
        title: Bookmark application
        type: object
    access_footer_links:
      description: The links in the App Launcher footer.
      example:
      - name: Cloudflare's Privacy Policy
        url: https://www.cloudflare.com/privacypolicy/
      items:
        properties:
          name:
            description: The hypertext in the footer link.
            example: Cloudflare's Privacy Policy
            type: string
          url:
            description: the hyperlink in the footer link.
            example: https://www.cloudflare.com/privacypolicy/
            type: string
        required:
        - name
        - url
        type: object
      type: array
    access_landing_page_design:
      description: The design of the App Launcher landing page shown to users when they log in.
      properties:
        button_color:
          $ref: '#/components/schemas/access_button_color'
        button_text_color:
          $ref: '#/components/schemas/access_button_text_color'
        image_url:
          $ref: '#/components/schemas/access_image_url'
        message:
          $ref: '#/components/schemas/access_message'
        title:
          $ref: '#/components/schemas/access_title'
      type: object
    access_scim_config_authentication_http_basic:
      description: Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
      properties:
        password:
          description: Password used to authenticate with the remote SCIM service.
          type: string
        scheme:
          description: The authentication scheme to use when making SCIM requests to this application.
          enum:
          - httpbasic
          type: string
        user:
          description: User name used to authenticate with the remote SCIM service.
          type: string
      required:
      - scheme
      - user
      - password
      title: HTTP Basic
      type: object
    access_scim_config_authentication_oauth_bearer_token:
      description: Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
      properties:
        scheme:
          description: The authentication scheme to use when making SCIM requests to this application.
          enum:
          - oauthbearertoken
          type: string
        token:
          description: Token used to authenticate with the remote SCIM service.
          type: string
      required:
      - scheme
      - token
      title: OAuth Bearer Token
      type: object
    access_self_hosted_props:
      properties:
        allow_authenticate_via_warp:
          $ref: '#/components/schemas/access_schemas-allow_authenticate_via_warp'
        allowed_idps:
          $ref: '#/components/schemas/access_allowed_idps'
        app_launcher_visible:
          $ref: '#/components/schemas/access_app_launcher_visible'
        auto_redirect_to_identity:
          $ref: '#/components/schemas/access_schemas-auto_redirect_to_identity'
        cors_headers:
          $ref: '#/components/schemas/access_cors_headers'
        custom_deny_message:
          $ref: '#/components/schemas/access_custom_deny_message'
        custom_deny_url:
          $ref: '#/components/schemas/access_custom_deny_url'
        custom_non_identity_deny_url:
          $ref: '#/components/schemas/access_custom_non_identity_deny_url'
        custom_pages:
          $ref: '#/components/schemas/access_schemas-custom_pages'
        domain:
          $ref: '#/components/schemas/access_domain'
        enable_binding_cookie:
          $ref: '#/components/schemas/access_enable_binding_cookie'
        http_only_cookie_attribute:
          $ref: '#/components/schemas/access_http_only_cookie_attribute'
        logo_url:
          $ref: '#/components/schemas/access_logo_url'
        name:
          $ref: '#/components/schemas/access_apps_components-schemas-name'
        options_preflight_bypass:
          $ref: '#/components/schemas/access_options_preflight_bypass'
        path_cookie_attribute:
          $ref: '#/components/schemas/access_path_cookie_attribute'
        same_site_cookie_attribute:
          $ref: '#/components/schemas/access_same_site_cookie_attribute'
        self_hosted_domains:
          $ref: '#/components/schemas/access_self_hosted_domains'
        service_auth_401_redirect:
          $ref: '#/components/schemas/access_service_auth_401_redirect'
        session_duration:
          $ref: '#/components/schemas/access_schemas-session_duration'
        skip_interstitial:
          $ref: '#/components/schemas/access_skip_interstitial'
        tags:
          $ref: '#/components/schemas/access_tags'
        type:
          description: The application type.
          example: self_hosted
          type: string
      required:
      - type
      - domain
      title: Self Hosted Application
      type: object
    access_timestamp:
      example: '2014-01-01T05:20:00.12345Z'
      format: date-time
      type: string
    access_message:
      description: The message shown on the landing page.
      example: Log in below to reach your applications behind Access.
      type: string
    access_cors_headers:
      properties:
        allow_all_headers:
          $ref: '#/components/schemas/access_allow_all_headers'
        allow_all_methods:
          $ref: '#/components/schemas/access_allow_all_methods'
        allow_all_origins:
          $ref: '#/components/schemas/access_allow_all_origins'
        allow_credentials:
          $ref: '#/components/schemas/access_allow_credentials'
        allowed_headers:
          $ref: '#/components/schemas/access_allowed_headers'
        allowed_methods:
          $ref: '#/components/schemas/access_allowed_methods'
        allowed_origins:
          $ref: '#/components/schemas/access_allowed_origins'
        max_age:
          $ref: '#/components/schemas/access_max_age'
      type: object
    access_same_site_cookie_attribute:
      description: Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
      example: strict
      type: string
    access_app_req_embedded_scim_config:
      properties:
        scim_config:
          $ref: '#/components/schemas/access_scim_config'
      type: object
    access_button_color:
      description: The background color of the log in button on the landing page.
      example: '#ff0000'
      type: string
    access_ssh_props:
      allOf:
      - $ref: '#/components/schemas/access_self_hosted_props'
      - properties:
          type:
            description: The application type.
            example: ssh
            type: string
    access_button_text_color:
      description: The color of the text in the log in button on the landing page.
      example: '#ff0000'
      type: string
    access_purpose_justification_prompt:
      description: A custom message that will appear on the purpose justification screen.
      example: Please enter a justification for entering this protected domain.
      type: string
    access_basic_app_response_props:
      properties:
        aud:
          $ref: '#/components/schemas/access_schemas-aud'
        created_at:
          $ref: '#/components/schemas/access_timestamp'
        id:
          $ref: '#/components/schemas/access_uuid'
        scim_config:
          $ref: '#/components/schemas/access_scim_config'
        updated_at:
          $ref: '#/components/schemas/access_timestamp'
      type: object
    access_app_resp_embedded_policies:
      description: The policies that will apply to the application.
      properties:
        policies:
          items:
            $ref: '#/components/schemas/access_app_policy_response'
          type: array
      type: object
    access_include:
      description: Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
      items:
        $ref: '#/components/schemas/access_rule'
      type: array
    access_app_req_embedded_policies:
      properties:
        policies:
          description: The policies that will apply to the application, in ascending order of precedence. Items can reference existing policies or create new policies exclusive to the application.
          items:
            oneOf:
            - $ref: '#/components/schemas/access_app_policy_link'
            - allOf:
              - description: A policy UID to link to this application.
              - $ref: '#/components/schemas/access_schemas-uuid'
            - allOf:
              - type: object
              - description: An application-scoped policy JSON. If the policy does not yet exist, it will be created.
                properties:
                  id:
                    $ref: '#/components/schemas/access_schemas-uuid'
              - $ref: '#/components/schemas/access_app_policy_request'
          type: array
      type: object
    access_any_valid_service_token_rule:
      description: Matches any valid Access Service Token
      properties:
        any_valid_service_token:
          description: An empty object which matches on all service tokens.
          example: {}
          type: object
      required:
      - any_valid_service_token
      title: Any Valid Service Token
      type: object
    access_rule:
      oneOf:
      - $ref: '#/components/schemas/access_email_rule'
      - $ref: '#/components/schemas/access_email_list_rule'
      - $ref: '#/components/schemas/access_domain_rule'
      - $ref: '#/components/schemas/access_everyone_rule'
      - $ref: '#/components/schemas/access_ip_rule'
      - $ref: '#/components/schemas/access_ip_list_rule'
      - $ref: '#/components/schemas/access_certificate_rule'
      - $ref: '#/components/schemas/access_access_group_rule'
      - $ref: '#/components/schemas/access_azure_group_rule'
      - $ref: '#/components/schemas/access_github_organization_rule'
      - $ref: '#/components/schemas/access_gsuite_group_rule'
      - $ref: '#/components/schemas/access_okta_group_rule'
      - $ref: '#/components/schemas/access_saml_group_rule'
      - $ref: '#/components/schemas/access_service_token_rule'
      - $ref: '#/components/schemas/access_any_valid_service_token_rule'
      - $ref: '#/components/schemas/access_external_evaluation_rule'
      - $ref: '#/components/schemas/access_country_rule'
      - $ref: '#/components/schemas/access_authentication_method_rule'
      - $ref: '#/components/schemas/access_device_posture_rule'
      type: object
    access_github_organization_rule:
      description: 'Matches a Github organization.

        Requires a Github identity provider.'
      properties:
        github-organization:
          properties:
            identity_provider_id:
              description: The ID of your Github identity provider.
              example: ea85612a-29c8-46c2-bacb-669d65136971
              type: string
            name:
              description: The name of the organization.
              example: cloudflare
              type: string
          required:
          - name
          - identity_provider_id
          type: object
      required:
      - github-organization
      title: Github organization
      type: object
    access_app_policy_response:
      allOf:
      - $ref: '#/components/schemas/access_policy_resp'
      properties:
        precedence:
          $ref: '#/components/schemas/access_precedence'
      type: object
    access_custom_non_identity_deny_url:
      description: The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.
      type: string
    access_custom_deny_message:
      description: The custom error message shown to a user when they are denied access to the application.
      type: string
    access_app_policy_link:
      description: A JSON that links a reusable policy to an application.
      properties:
        id:
          $ref: '#/components/schemas/access_schemas-uuid'
        precedence:
          $ref: '#/components/schemas/access_precedence'
      type: object
    access_api-response-common-failure:
      properties:
        errors:
          allOf:
          - $ref: '#/components/schemas/access_messages'
          example:
          - code: 7003
            message: No route for the URI
          minLength: 1
        messages:
          allOf:
          - $ref: '#/components/schemas/access_messages'
          example: []
        result:
          enum:
          - null
          nullable: true
          type: object
        success:
          description: Whether the API call was successful
          enum:
          - false
          example: false
          type: boolean
      required:
      - success
      - errors
      - messages
      - result
      type: object
    access_ip_list_rule:
      description: Matches an IP address from a list.
      properties:
        ip_list:
          properties:
            id:
              description: The ID of a previously created IP list.
              example: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
              type: string
          required:
          - id
          type: object
      required:
      - ip_list
      title: IP list
      type: object
    access_scim_config_authentication_oauth2:
      description: Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
      properties:
        authorization_url:
          description: URL used to generate the auth code used during token generation.
          type: string
        client_id:
          description: Client ID used to authenticate when generating a token for authenticating with the remote SCIM service.
          type: string
        client_secret:
          description: Secret used to authenticate when generating a token for authenticating with the remove SCIM service.
          type: string
        scheme:
          description: The authentication scheme to use when making SCIM requests to this application.
          enum:
          - oauth2
          type: string
        scopes:
          description: The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.
          items:
            type: string
          type: array
        token_url:
          description: URL used to generate the token used to authenticate with the remote SCIM service.
          type: string
      required:
      - scheme
      - client_id
      - client_secret
      - authorization_url
      - token_url
      title: OAuth 2
      type: object
    access_ip_rule:
      description: Matches an IP address block.
      properties:
        ip:
          properties:
            ip:
              description: An IPv4 or IPv6 CIDR block.
              example: 2400:cb00:21:10a::/64
              type: string
          required:
          - ip
          type: object
      required:
      - ip
      title: IP ranges
      type: object
    access_isolation_required:
      default: false
      description: Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
      example: false
      type: boolean
    access_apps_components-schemas-single_response:
      allOf:
      - $ref: '#/components/schemas/access_api-response-single'
      - properties:
          result:
            $ref: '#/components/schemas/access_app_response'
    access_okta_group_rule:
      description: 'Matches an Okta group.

        Requires an Okta identity provider.'
      properties:
        okta:
          properties:
            identity_provider_id:
              description: The ID of your Okta identity provider.
              example: ea85612a-29c8-46c2-bacb-669d65136971
              type: string
            name:
              description: The name of the Okta group.
              example: devs
              type: string
          required:
          - name
          - identity_provider_id
          type: object
      required:
      - okta
      title: Okta group
      type: object
    access_components-schemas-session_duration:
      default: 24h
      description: 'The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.'
      example: 24h
      type: string
    access_schemas-exclude:
      description: Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
      items:
        $ref: '#/components/schemas/access_rule'
      type: array
    access_type:
      description: The application type.
      enum:
      - self_hosted
      - saas
      - ssh
      - vnc
      - app_launcher
      - warp
      - biso
      - bookmark
      - dash_sso
      example: self_hosted
      type: string
    access_skip_interstitial:
      description: Enables automatic authentication through cloudflared.
      example: true
      type: boolean
    access_everyone_rule:
      description: Matches everyone.
      properties:
        everyone:
          description: An empty object which matches on all users.
          example: {}
          type: object
      required:
      - everyone
      title: Everyone
      type: object
    access_path_cookie_attribute:
      default: false
      description: Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default
      example: true
      type: boolean
    access_warp_props:
      allOf:
      - $ref: '#/components/schemas/access_feature_app_props'
      - properties:
          domain:
            example: authdomain.cloudflareaccess.com/warp
            readOnly: true
          name:
            default: Warp Login App
            example: Warp Login App
            readOnly: true
          type:
            description: The application type.
            example: warp
            type: string
    access_oidc_saas_app:
      properties:
        access_token_lifetime:
          description: The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.
          example: 5m
          type: string
        allow_pkce_without_client_secret:
          description: If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.
          example: true
          type: boolean
        app_launcher_url:
          description: The URL where this applications tile redirects users
          example: https://example.com/login
          type: string
        auth_type:
          description: Identifier of the authentication protocol used for the saas app. Required for OIDC.
          enum:
          - saml
          - oidc
          example: oidc
          type: string
        client_id:
          description: The application client id
          example: oidc client id
          type: string
        client_secret:
          description: The application client secret, only returned on POST request.
          example: oidc client secret
          type: string
        created_at:
          $ref: '#/components/schemas/access_timestamp'
        custom_claims:
          properties:
            name:
              description: The name of the claim.
              example: family_name
              type: string
            required:
              description: If the claim is required when building an OIDC token.
              example: true
              type: boolean
            scope:
              description: The scope of the claim.
              enum:
              - groups
              - profile
              - email
              - openid
              example: profile
              type: string
            source:
              properties:
                name:
                  description: The name of the IdP claim.
                  example: last_name
                  type: string
                name_by_idp:
                  additionalProperties:
                    type: string
                  description: A mapping from IdP ID to claim name.
                  example:
                    exampleIdPID1: ClaimName1
                    exampleIdPID2: ClaimName2
                  type: object
              type: object
          type: object
        grant_types:
          description: The OIDC flows supported by this application
          example:
          - authorization_code
          items:
            enum:
            - authorization_code
            - authorization_code_with_pkce
            - refresh_tokens
            - hybrid
            - implicit
            type: string
          type: array
        group_filter_regex:
          description: A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
          example: ^GROUP_FILTER-*$
          type: string
        hybrid_and_implicit_options:
          properties:
            return_access_token_from_authorization_endpoint:
              description: If an Access Token should be returned from the OIDC Authorization endpoint
              type: boolean
            return_id_token_from_authorization_endpoint:
              description: If an ID Token should be returned from the OIDC Authorization endpoint
              type: boolean
          type: object
        public_key:
          description: The Access public certificate that will be used to verify your identity.
          example: example unique name
          type: string
        redirect_uris:
          description: The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens
          example:
          - https://example.com
          items:
            type: string
          type: array
        refresh_token_options:
          properties:
            lifetime:
              description: How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.
              example: 30d
              type: string
          type: object
        scopes:
          description: Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled
          example:
          - openid
          - groups
          - email
          - profile
          items:
            enum:
            - openid
            - groups
            - email
            - profile
            type: string
          type: array
        updated_at:
          $ref: '#/components/schemas/access_timestamp'
      title: OIDC SaaS App
      type: object
    access_azure_group_rule:
      description: 'Matches an Azure group.

        Requires an Azure identity provider.'
      properties:
        azureAD:
          properties:
            id:
              description: The ID of an Azure group.
              example: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
              type: string
            identity_provider_id:
              description: The ID of your Azure identity provider.
              example: ea85612a-29c8-46c2-bacb-669d65136971
              type: string
          required:
          - id
          - identity_provider_id
          type: object
      required:
      - azureAD
      title: Azure group
      type: object
    access_custom_deny_url:
      description: The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.
      type: string
    access_app_id:
      oneOf:
      - $ref: '#/components/schemas/access_identifier'
      - $ref: '#/components/schemas/access_uuid'
    access_saas_props:
      properties:
        allowed_idps:
          $ref: '#/components/schemas/access_allowed_idps'
        app_launcher_visible:
          $ref: '#/components/schemas/access_app_launcher_visible'
        auto_redirect_to_identity:
          $ref: '#/components/schemas/access_schemas-auto_redirect_to_identity'
        custom_pages:
          $ref: '#/components/schemas/access_schemas-custom_pages'
        logo_url:
          $ref: '#/components/schemas/access_logo_url'
        name:
          $ref: '#/components/schemas/access_apps_components-schemas-name'
        saas_app:
          oneOf:
          - $ref: '#/components/schemas/access_saml_saas_app'
          - $ref: '#/components/schemas/access_oidc_saas_app'
          type: object
        tags:
          $ref: '#/components/schemas/access_tags'
        type:
          description: The application type.
          example: saas
          type: string
      title: SaaS Application
      type: object
    access_schemas-auto_redirect_to_identity:
      default: false
      description: When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
      type: boolean
    access_options_preflight_bypass:
      description: Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
      example: true
      type: boolean
    access_uuid:
      description: UUID
      example: f174e90a-fafe-4643-bbbc-4a0ed4fc8415
      maxLength: 36
      type: string
    access_apps_components-schemas-name:
      description: The name of the application.
      example: Admin Site
      type: string
    access_allow_all_methods:
      description: Allows all HTTP request methods.
      type: boolean
    access_schemas-allow_authenticate_via_warp:
      description: When set to true, users can authenticate to this application using their WARP session.  When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.
      example: true
      type: boolean
    access_authentication_method_rule:
      description: Enforce different MFA options
      properties:
        auth_method:
          properties:
            auth_method:
              description: The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
              example: mfa
              type: string
          required:
          - auth_method
          type: object
      required:
      - auth_method
      title: Authentication method
      type: object
    access_apps_components-schemas-response_collection:
      allOf:
      - $ref: '#/components/schemas/access_api-response-collection'
      - properties:
          result:
            items:
              $ref: '#/components/schemas/access_app_response'
            type: array
    access_country_rule:
      description: Matches a specific country
      properties:
        geo:
          properties:
            country_code:
              description: The country code that should be matched.
              example: US
              type: string
          required:
          - country_code
          type: object
      required:
      - geo
      title: Country
      type: object
    access_app_policy_request:
      allOf:
      - properties:
          precedence:
            $ref: '#/components/schemas/access_precedence'
        type: object
      - $ref: '#/components/schemas/access_policy_req'
    access_max_age:
      description: The maximum number of seconds the results of a preflight request can be cached.
      example: -1
      maximum: 86400
      minimum: -1
      type: number
    access_purpose_justification_required:
      default: false
      description: Require users to enter a justification when they log in to the application.
      example: true
      type: boolean
    access_gsuite_group_rule:
      description: 'Matches a group in Google Workspace.

        Requires a Google Workspace identity provider.'
      properties:
        gsuite:
          properties:
            email:
              description: The email of the Google Workspace group.
              example: devs@cloudflare.com
              type: string
            identity_provider_id:
              description: The ID of your Google Workspace identity provider.
              example: ea85612a-29c8-46c2-bacb-669d65136971
              type: string
          required:
          - email
          - identity_provider_id
          type: object
      required:
      - gsuite
      title: Google Workspace group
      type: object
    access_scim_config:
      description: Configuration for provisioning to this application via SCIM. This is currently in closed beta.
      properties:
        authentication:
          oneOf:
          - $ref: '#/components/schemas/access_scim_config_authentication_http_basic'
          - $ref: '#/components/schemas/access_scim_config_authentication_oauth_bearer_token'
          - $ref: '#/components/schemas/access_scim_config_authentication_oauth2'
        deactivate_on_delete:
          description: 'If false, propagates DELETE requests to the target application for SCIM resources. If true, sets ''active'' to false on the SCIM resource. Note: Some targets do not support DELETE operations.'
          type: boolean
        enabled:
          description: Whether SCIM provisioning is turned on for this application.
          type: boolean
        idp_uid:
          description: The UID of the IdP to use as the source for SCIM resources to provision to this application.
          type: string
        mappings:
          description: A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
          items:
            $ref: '#/components/schemas/access_scim_config_mapping'
          type: array
        remote_uri:
          description: The base URI for the application's SCIM-compatible API.
          type: string
      required:
      - remote_uri
      - idp_uid
      type: object
    access_api-response-common:
      properties:
        errors:
          $ref: '#/components/schemas/access_messages'
        messages:
          $ref: '#/components/schemas/access_messages'
        success:
          description: Whether the API call was successful
          enum:
          - true
          example: true
          type: boolean
      required:
      - success
      - errors
      - messages
      type: object
    access_domain_rule:
      description: Match an entire email domain.
      properties:
        email_domain:
          properties:
            domain:
              description: The email domain to match.
              example: example.com
              type: string
          required:
          - domain
          type: object
      required:
      - email_domain
      title: Email domain
      type: object
    access_policy_check_response:
      allOf:
      - $ref: '#/components/schemas/access_api-response-single'
      - properties:
          result:
            properties:
              app_state:
                properties:
                  app_uid:
                    $ref: '#/components/schemas/access_uuid'
                  aud:
                    example: 737646a56ab1df6ec9bddc7e5ca84eaf3b0768850f3ffb5d74f1534911fe389
                    type: string
                  hostname:
                    example: test.com
                    type: string
                  name:
                    example: Test App
                    type: string
                  policies:
                    example:
                    - decision: allow
                      exclude: []
                      include:
                      - _type: email
                        email: testuser@gmail.com
                      precedence: 0
                      require: []
                      status: Success
                    items:
                      type: object
                    type: array
                  status:
                    example: Success
                    type: string
                type: object
              user_identity:
                properties:
                  account_id:
                    example: 41ecfbb341f033e52b46742756aabb8b
                    type: string
                  device_sessions:
                    example: {}
                    type: object
                  email:
                    example: testuser@gmail.com
                    type: string
                  geo:
                    properties:
                      country:
                        example: US
                        type: string
                    type: object
                  iat:
                    type: integer
                  id:
                    example: '1164449231815010287495'
                    type: string
                  is_gateway:
                    example: false
                    type: boolean
                  is_warp:
                    example: false
                    type: boolean
                  name:
                    example: Test User
                    type: string
                  user_uuid:
                    $ref: '#/components/schemas/access_uuid'
                  version:
                    type: integer
                type: object
            type: object
    access_schemas-custom_pages:
      description: The custom pages that will be displayed when applicable for this application
      items:
        description: The custom pages selected for application.
        example: 699d98642c564d2e855e9661899b7252
        type: string
      type: array
    access_device_posture_rule:
      description: Enforces a device posture rule has run successfully
      properties:
        device_posture:
          properties:
            integration_uid:
              description: The ID of a device posture integration.
              example: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
              type: string
          required:
          - integration_uid
          type: object
      required:
      - device_posture
      title: Device Posture
      type: object
    access_id_response:
      allOf:
      - $ref: '#/components/schemas/access_api-response-single'
      - properties:
          result:
            properties:
              id:
                $ref: '#/components/schemas/access_uuid'
            type: object
    access_email_list_rule:
      description: Matches an email address from a list.
      properties:
        email_list:
          properties:
            id:
              description: The ID of a previously created email list.
              example: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
              type: string
          required:
          - id
          type: object
      required:
      - email_list
      title: Email list
      type: object
    access_allowed_methods:
      description: Allowed HTTP request methods.
      example:
      - GET
      items:
        enum:
        - GET
        - POST
        - HEAD
        - PUT
        - DELETE
        - CONNECT
        - OPTIONS
        - TRACE
        - PATCH
        type: string
      type: array
    access_tags:
      description: The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.
      items:
        description: The tag associated with an application.
        example: engineers
        type: string
      type: array
    access_self_hosted_domains:
      description: List of domains that Access will secure.
      example:
      - test.example.com/admin
      - test.anotherexample.com/staff
      items:
        description: A domain that Access will secure.
        type: string
      type: array
    access_image_url:
      description: The URL of the image shown on the landing page.
      example: https://www.cloudflare.com/img/logo-web-badges/cf-logo-on-white-bg.svg
      type: string
    access_feature_app_props:
      properties:
        allowed_idps:
          $ref: '#/components/schemas/access_allowed_idps'
        app_launcher_logo_url:
          $ref: '#/components/schemas/access_app_launcher_logo_url'
        auto_redirect_to_identity:
          $ref: '#/components/schemas/access_schemas-auto_redirect_to_identity'
        bg_color:
          $ref: '#/components/schemas/access_bg_color'
        domain:
          $ref: '#/components/schemas/access_domain'
        footer_links:
          $ref: '#/components/schemas/access_footer_links'
        header_bg_color:
          $ref: '#/components/schemas/access_header_bg_color'
        landing_page_design:
          $ref: '#/components/schemas/access_landing_page_design'
        name:
          $ref: '#/components/schemas/access_apps_components-schemas-name'
        session_duration:
          $ref: '#/components/schemas/access_schemas-session_duration'
        skip_app_launcher_login_page:
          $ref: '#/components/schemas/access_skip_app_launcher_login_page'
        type:
          $ref: '#/components/schemas/access_type'
      required:
      - type
      type: object
    access_policy_req:
      properties:
        approval_groups:
          $ref: '#/components/schemas/access_approval_groups'
        approval_required:
          $ref: '#/components/schemas/access_approval_required'
        decision:
          $ref: '#/components/schemas/access_decision'
        exclude:
          $ref: '#/components/schemas/access_schemas-exclude'
        include:
          $ref: '#/components/schemas/access_include'
        isolation_required:
          $ref: '#/components/schemas/access_isolation_required'
        name:
          $ref: '#/components/schemas/access_policy_components-schemas-name'
        purpose_justification_prompt:
          $ref: '#/components/schemas/access_purpose_justification_prompt'
        purpose_justification_required:
          $ref: '#/components/schemas/access_purpose_justification_required'
        require:
          $ref: '#/components/schemas/access_schemas-require'
        session_duration:
          $ref: '#/components/schemas/access_components-schemas-session_duration'
      required:
      - name
      - decision
      - include
      type: object
    access_schemas-require:
      description: Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
      items:
        $ref: '#/components/schemas/access_rule'
      type: array
    access_skip_app_launcher_login_page:
      default: false
      description: Determines when to skip the App Launcher landing page.
      example: true
      type: boolean
    access_title:
      default: Welcome!
      description: The title shown on the landing page.
      example: Welcome back!
      type: string
    access_app_launcher_logo_url:
      description: The image URL of the logo shown in the App Launcher header.
      example: https://www.cloudflare.com/img/logo-web-badges/cf-logo-on-white-bg.svg
      type: string
    access_bg_color:
      description: The background color of the App Launcher page.
      example: '#ff0000'
      type: string
    access_allowed_idps:
      description: The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
      items:
        description: The identity providers selected for application.
        example: 699d98642c564d2e855e9661899b7252
        type: string
      type: array
    access_saml_saas_app:
      properties:
        auth_type:
          description: Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is "saml"
          enum:
          - saml
          - oidc
          example: saml
          type: string
        consumer_service_url:
          description: The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.
          example: https://example.com
          type: string
        created_at:
          $ref: '#/components/schemas/access_timestamp'
        custom_attributes:
          properties:
            friendly_name:
              description: The SAML FriendlyName of the attribute.
              example: Last Name
              type: string
            name:
              description: The name of the attribute.
              example: family_name
              type: string
            name_format:
              description: A globally unique name for an identity or service provider.
              enum:
              - urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
              - urn:oasis:names:tc:SAML:2.0:attrname-format:basic
              - urn:oasis:names:tc:SAML:2.0:attrname-format:uri
              example: urn:oasis:names:tc:SAML:2.0:attrname-format:basic
              type: string
            required:
              description: If the attribute is required when building a SAML assertion.
              example: true
              type: boolean
            source:
              properties:
                name:
                  description: The name of the IdP attribute.
                  example: last_name
                  type: string
                name_by_idp:
                  additionalProperties:
                    type: string
                  description: A mapping from IdP ID to attribute name.
                  example:
                    exampleIdPID1: AttributeName1
                    exampleIdPID2: AttributeName2
                  type: object
              type: object
          type: object
        default_relay_state:
          description: The URL that the user will be redirected to after a successful login for IDP initiated logins.
          example: https://example.com
          type: string
        idp_entity_id:
          description: The unique identifier for your SaaS application.
          example: https://example.cloudflareaccess.com
          type: string
        name_id_format:
          description: The format of the name identifier sent to the SaaS application.
          enum:
          - id
          - email
          example: id
          type: string
        name_id_transform_jsonata:
          description: 'A [JSONata](https://jsonata.org/) expression that transforms an application''s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the `name_id_format` setting.

            '
          example: $substringBefore(email, '@') & '+sandbox@' & $substringAfter(email, '@')
          type: string
        public_key:
          description: The Access public certificate that will be used to verify your identity.
          example: example unique name
          type: string
        saml_attribute_transform_jsonata:
          description: 'A [JSONata] (https://jsonata.org/) expression that transforms an application''s user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml_attributes or oidc_fields of the identity provider used to authenticate. The output of this expression must be a JSON object.

            '
          example: '$ ~>| groups | {''group_name'': name} |'
          type: string
        sp_entity_id:
          description: A globally unique name for an identity or service provider.
          example: example unique name
          type: string
        sso_endpoint:
          description: The endpoint where your SaaS application will send login requests.
          example: https://example.cloudflareaccess.com/cdn-cgi/access/sso/saml/b3f58a2b414e0b51d45c8c2af26fccca0e27c63763c426fa52f98dcf0b3b3bfd
          type: string
        updated_at:
          $ref: '#/components/schemas/access_timestamp'
      title: SAML SaaS App
      type: object
    access_allow_all_headers:
      description: Allows all HTTP request headers.
      example: true
      type: boolean
    access_service_auth_401_redirect:
      description: Returns a 401 status code when the request is blocked by a Service Auth policy.
      example: true
      type: boolean
    access_saml_group_rule:
      description: 'Matches a SAML group.

        Requires a SAML identity provider.'
      properties:
        saml:
          properties:
            attribute_name:
              description: The name of the SAML attribute.
              example: group
              type: string
            attribute_value:
              description: The SAML attribute value to look for.
              example: devs@cloudflare.com
              type: string
            identity_provider_id:
              description: The ID of your SAML identity provider.
              example: ea85612a-29c8-46c2-bacb-669d65136971
              type: string
          required:
          - attribute_name
          - attribute_value
          - identity_provider_id
          type: object
      required:
      - saml
      title: SAML group
      type: object
    access_access_group_rule:
      description: Matches an Access group.
      properties:
        group:
          properties:
            id:
              description: The ID of a previously created Access group.
              example: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
              type: string
          required:
          - id
          type: object
      required:
      - group
      title: Access groups
      type: object
    access_result_info:
      properties:
        count:
          description: Total number of results for the requested service
          example: 1
          type: number
        page:
          description: Current page within paginated list of results
          example: 1
          type: number
        per_page:
          description: Number of results per page of results
          example: 20
          type: number
        total_count:
          description: Total results available without any search parameters
          example: 2000
          type: number
      type: object
    access_policy_resp:
      properties:
        approval_groups:
          $ref: '#/components/schemas/access_approval_groups'
        approval_required:
          $ref: '#/components/schemas/access_approval_required'
        created_at:
          $ref: '#/components/schemas/access_timestamp'
        decision:
          $ref: '#/components/schemas/access_decision'
        exclude:
          $ref: '#/components/schemas/access_schemas-exclude'
        id:
          $ref: '#/components/schemas/access_schemas-uuid'
        include:
          $ref: '#/components/schemas/access_include'
        isolation_required:
          $ref: '#/components/schemas/access_isolation_required'
        name:
          $ref: '#/components/schemas/access_policy_components-schemas-name'
        purpose_justification_prompt:
          $ref: '#/components/schemas/access_purpose_justification_prompt'
        purpose_justification_required:
          $ref: '#/components/schemas/access_purpose_justification_required'
        require:
          $ref: '#/components/schemas/access_schemas-require'
        session_duration:
          $ref: '#/components/schemas/access_components-schemas-session_duration'
        updated_at:
          $ref: '#/components/schemas/access_timestamp'
      type: object
    access_allow_credentials:
      description: When set to `true`, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.
      type: boolean
    access_app_request:
      anyOf:
      - allOf:
        - $ref: '#/components/schemas/access_self_hosted_props'
        - $ref: '#/components/schemas/access_app_req_embedded_policies'
        - $ref: '#/components/schemas/access_app_req_embedded_scim_config'
        title: Self Hosted Application
        type: object
      - allOf:
        - $ref: '#/components/schemas/access_saas_props'
        - $ref: '#/components/schemas/access_app_req_embedded_policies'
        - $ref: '#/components/schemas/access_app_req_embedded_scim_config'
        title: SaaS Application
        type: object
      - allOf:
        - $ref: '#/components/schemas/access_ssh_props'
        - $ref: '#/components/schemas/access_app_req_embedded_policies'
        - $ref: '#/components/schemas/access_app_req_embedded_scim_config'
        title: Browser SSH Application
        type: object
      - allOf:
        - $ref: '#/components/schemas/access_vnc_props'
        - $ref: '#/components/schemas/access_app_req_embedded_policies'
        - $ref: '#/components/schemas/access_app_req_embedded_scim_config'
        title: Browser VNC Application
        type: object
      - allOf:
        - $ref: '#/components/schemas/access_app_launcher_props'
        - $ref: '#/components/schemas/access_app_req_embedded_policies'
        - $ref: '#/components/schemas/access_app_req_embedded_scim_config'
        title: App Launcher Application
        type: object
      - allOf:
        - $ref: '#/components/schemas/access_warp_props'
        - $ref: '#/components/schemas/access_app_req_embedded_policies'
        - $ref: '#/components/schemas/access_app_req_embedded_scim_config'
        title: Device Enrollment Permissions Application
        type: object
      - allOf:
        - $ref: '#/components/schemas/access_biso_props'
        - $ref: '#/components/schemas/access_app_req_embedded_policies'
        - $ref: '#/components/schemas/access_app_req_embedded_scim_config'
        title: Browser Isolation Permissions Application
        type: object
      - allOf:
        - $ref: '#/components/schemas/access_bookmark_props'
        - $ref: '#/components/schemas/access_app_req_embedded_scim_config'
        title: Bookmark application
        type: object
    access_logo_url:
      description: The image URL for the logo shown in the App Launcher dashboard.
      example: https://www.cloudflare.com/img/logo-web-badges/cf-logo-on-white-bg.svg
      type: string
    access_messages:
      example: []
      items:
        properties:
          code:
            minimum: 1000
            type: integer
          message:
            type: string
        required:
        - code
        - message
        type: object
        uniqueItems: true
      type: array
    access_biso_props:
      allOf:
      - $ref: '#/components/schemas/access_feature_app_props'
      - properties:
          domain:
            example: authdomain.cloudflareaccess.com/browser
            readOnly: true
          name:
            default: Clientless Web Isolation
            example: Clientless Web Isolation
            readOnly: true
          type:
            description: The application type.
            example: biso
            type: string
    access_allowed_headers:
      description: Allowed HTTP request headers.
      items:
        type: string
      type: array
    access_decision:
      description: The action Access will take if a user matches this policy.
      enum:
      - allow
      - deny
      - non_identity
      - bypass
      example: allow
      type: string
    access_schemas-aud:
      description: Audience tag.
      example: 737646a56ab1df6ec9bddc7e5ca84eaf3b0768850f3ffb5d74f1534911fe3893
      maxLength: 64
      readOnly: true
      type: string
    access_scim_config_mapping:
      description: Transformations and filters applied to resources before they are provisioned in the remote SCIM service.
      properties:
        enabled:
          description: Whether or not this mapping is enabled.
          type: boolean
        filter:
          description: A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.
          example: title pr or userType eq "Intern"
          type: string
        operations:
          description: Whether or not this mapping applies to creates, updates, or deletes.
          properties:
            create:
              description: Whether or not this mapping applies to create (POST) operations.
              type: boolean
            delete:
              description: Whether or not this mapping applies to DELETE operations.
              type: boolean
            update:
              description: Whether or not this mapping applies to update (PATCH/PUT) operations.
              type: boolean
          type: object
        schema:
          description: Which SCIM resource type this mapping applies to.
          example: urn:ietf:params:scim:schemas:core:2.0:User
          type: string
        transform_jsonata:
          description: A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.
          example: '$merge([$, {''userName'': $substringBefore($.userName, ''@'') & ''+test@'' & $substringAfter($.userName, ''@'')}])'
          type: string
      required:
      - schema
      type: object
    access_http_only_cookie_attribute:
      default: true
      description: Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
      example: true
      type: boolean
    access_domain:
      description: The primary hostname and path that Access will secure. If the app is visible in the App Launcher dashboard, this is the domain that will be displayed.
      example: test.example.com/admin
      type: string
    access_precedence:
      description: The order of execution for this policy. Must be unique for each policy within an app.
      type: integer
    access_approval_group:
      description: A group of email addresses that can approve a temporary authentication request.
      properties:
        approvals_needed:
          description: The number of approvals needed to obtain access.
          example: 1
          minimum: 0
          type: number
        email_addresses:
          description: A list of emails that can approve the access request.
          example:
          - test@cloudflare.com
          - test2@cloudflare.com
          items:
            type: string
          type: array
        email_list_uuid:
          description: The UUID of an re-usable email list.
          type: string
      required:
      - approvals_needed
      type: object
    access_header_bg_color:
      description: The background color of the App Launcher header.
      example: '#ff0000'
      type: string
    access_bookmark_props:
      properties:
        app_launcher_visible:
          $ref: '#/components/schemas/access_app_launcher_visible'
        domain:
          description: The URL or domain of the bookmark.
          example: https://mybookmark.com
          type: string
        logo_url:
          $ref: '#/components/schemas/access_logo_url'
        name:
          $ref: '#/components/schemas/access_apps_components-schemas-name'
        tags:
          $ref: '#/components/schemas/access_tags'
        type:
          description: The application type.
          example: bookmark
          type: string
      title: Bookmark application
      type: object
    access_enable_binding_cookie:
      default: false
      description: Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
      type: boolean
    access_certificate_rule:
      description: Matches any valid client certificate.
      example:
        certificate: {}
      properties:
        certificate:
          example: {}
          type: object
      required:
      - certificate
      title: Valid certificate
      type: object
    access_schemas-uuid:
      description: The UUID of the policy
      example: f174e90a-fafe-4643-bbbc-4a0ed4fc8415
      maxLength: 36
      type: string
    access_api-response-single:
      allOf:
      - $ref: '#/components/schemas/access_api-response-common'
      type: object
  securitySchemes:
    hmac:
      type: apiKey
      name: Authorization
      in: header
      description: Amazon Signature authorization v4
      x-amazon-apigateway-authtype: awsSigv4
externalDocs:
  description: Amazon Web Services documentation
  url: https://docs.aws.amazon.com/apigateway/
x-hasEquivalentPaths: true