// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

package zero_trust

import (
	"context"
	"errors"
	"fmt"
	"net/http"
	"net/url"
	"reflect"
	"slices"
	"time"

	"github.com/cloudflare/cloudflare-go/v6/internal/apijson"
	"github.com/cloudflare/cloudflare-go/v6/internal/apiquery"
	"github.com/cloudflare/cloudflare-go/v6/internal/param"
	"github.com/cloudflare/cloudflare-go/v6/internal/requestconfig"
	"github.com/cloudflare/cloudflare-go/v6/option"
	"github.com/cloudflare/cloudflare-go/v6/packages/pagination"
	"github.com/tidwall/gjson"
)

// AccessApplicationService contains methods and other services that help with
// interacting with the cloudflare API.
//
// Note, unlike clients, this service does not read variables from the environment
// automatically. You should not instantiate this service directly, and instead use
// the [NewAccessApplicationService] method instead.
type AccessApplicationService struct {
	Options          []option.RequestOption
	CAs              *AccessApplicationCAService
	UserPolicyChecks *AccessApplicationUserPolicyCheckService
	Policies         *AccessApplicationPolicyService
	PolicyTests      *AccessApplicationPolicyTestService
	Settings         *AccessApplicationSettingService
}

// NewAccessApplicationService generates a new service that applies the given
// options to each request. These options are applied after the parent client's
// options (if there is one), and before any request-specific options.
func NewAccessApplicationService(opts ...option.RequestOption) (r *AccessApplicationService) {
	r = &AccessApplicationService{}
	r.Options = opts
	r.CAs = NewAccessApplicationCAService(opts...)
	r.UserPolicyChecks = NewAccessApplicationUserPolicyCheckService(opts...)
	r.Policies = NewAccessApplicationPolicyService(opts...)
	r.PolicyTests = NewAccessApplicationPolicyTestService(opts...)
	r.Settings = NewAccessApplicationSettingService(opts...)
	return
}

// Adds a new application to Access.
func (r *AccessApplicationService) New(ctx context.Context, params AccessApplicationNewParams, opts ...option.RequestOption) (res *AccessApplicationNewResponse, err error) {
	var env AccessApplicationNewResponseEnvelope
	opts = slices.Concat(r.Options, opts)
	var accountOrZone string
	var accountOrZoneID param.Field[string]
	if params.AccountID.Value != "" && params.ZoneID.Value != "" {
		err = errors.New("account ID and zone ID are mutually exclusive")
		return
	}
	if params.AccountID.Value == "" && params.ZoneID.Value == "" {
		err = errors.New("either account ID or zone ID must be provided")
		return
	}
	if params.AccountID.Value != "" {
		accountOrZone = "accounts"
		accountOrZoneID = params.AccountID
	}
	if params.ZoneID.Value != "" {
		accountOrZone = "zones"
		accountOrZoneID = params.ZoneID
	}
	path := fmt.Sprintf("%s/%s/access/apps", accountOrZone, accountOrZoneID)
	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPost, path, params, &env, opts...)
	if err != nil {
		return
	}
	res = &env.Result
	return
}

// Updates an Access application.
func (r *AccessApplicationService) Update(ctx context.Context, appID AppIDParam, params AccessApplicationUpdateParams, opts ...option.RequestOption) (res *AccessApplicationUpdateResponse, err error) {
	var env AccessApplicationUpdateResponseEnvelope
	opts = slices.Concat(r.Options, opts)
	var accountOrZone string
	var accountOrZoneID param.Field[string]
	if params.AccountID.Value != "" && params.ZoneID.Value != "" {
		err = errors.New("account ID and zone ID are mutually exclusive")
		return
	}
	if params.AccountID.Value == "" && params.ZoneID.Value == "" {
		err = errors.New("either account ID or zone ID must be provided")
		return
	}
	if params.AccountID.Value != "" {
		accountOrZone = "accounts"
		accountOrZoneID = params.AccountID
	}
	if params.ZoneID.Value != "" {
		accountOrZone = "zones"
		accountOrZoneID = params.ZoneID
	}
	if appID == "" {
		err = errors.New("missing required app_id parameter")
		return
	}
	path := fmt.Sprintf("%s/%s/access/apps/%s", accountOrZone, accountOrZoneID, appID)
	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPut, path, params, &env, opts...)
	if err != nil {
		return
	}
	res = &env.Result
	return
}

// Lists all Access applications in an account or zone.
func (r *AccessApplicationService) List(ctx context.Context, params AccessApplicationListParams, opts ...option.RequestOption) (res *pagination.V4PagePaginationArray[AccessApplicationListResponse], err error) {
	var raw *http.Response
	opts = slices.Concat(r.Options, opts)
	opts = append([]option.RequestOption{option.WithResponseInto(&raw)}, opts...)
	var accountOrZone string
	var accountOrZoneID param.Field[string]
	if params.AccountID.Value != "" && params.ZoneID.Value != "" {
		err = errors.New("account ID and zone ID are mutually exclusive")
		return
	}
	if params.AccountID.Value == "" && params.ZoneID.Value == "" {
		err = errors.New("either account ID or zone ID must be provided")
		return
	}
	if params.AccountID.Value != "" {
		accountOrZone = "accounts"
		accountOrZoneID = params.AccountID
	}
	if params.ZoneID.Value != "" {
		accountOrZone = "zones"
		accountOrZoneID = params.ZoneID
	}
	path := fmt.Sprintf("%s/%s/access/apps", accountOrZone, accountOrZoneID)
	cfg, err := requestconfig.NewRequestConfig(ctx, http.MethodGet, path, params, &res, opts...)
	if err != nil {
		return nil, err
	}
	err = cfg.Execute()
	if err != nil {
		return nil, err
	}
	res.SetPageConfig(cfg, raw)
	return res, nil
}

// Lists all Access applications in an account or zone.
func (r *AccessApplicationService) ListAutoPaging(ctx context.Context, params AccessApplicationListParams, opts ...option.RequestOption) *pagination.V4PagePaginationArrayAutoPager[AccessApplicationListResponse] {
	return pagination.NewV4PagePaginationArrayAutoPager(r.List(ctx, params, opts...))
}

// Deletes an application from Access.
func (r *AccessApplicationService) Delete(ctx context.Context, appID AppIDParam, body AccessApplicationDeleteParams, opts ...option.RequestOption) (res *AccessApplicationDeleteResponse, err error) {
	var env AccessApplicationDeleteResponseEnvelope
	opts = slices.Concat(r.Options, opts)
	var accountOrZone string
	var accountOrZoneID param.Field[string]
	if body.AccountID.Value != "" && body.ZoneID.Value != "" {
		err = errors.New("account ID and zone ID are mutually exclusive")
		return
	}
	if body.AccountID.Value == "" && body.ZoneID.Value == "" {
		err = errors.New("either account ID or zone ID must be provided")
		return
	}
	if body.AccountID.Value != "" {
		accountOrZone = "accounts"
		accountOrZoneID = body.AccountID
	}
	if body.ZoneID.Value != "" {
		accountOrZone = "zones"
		accountOrZoneID = body.ZoneID
	}
	if appID == "" {
		err = errors.New("missing required app_id parameter")
		return
	}
	path := fmt.Sprintf("%s/%s/access/apps/%s", accountOrZone, accountOrZoneID, appID)
	err = requestconfig.ExecuteNewRequest(ctx, http.MethodDelete, path, nil, &env, opts...)
	if err != nil {
		return
	}
	res = &env.Result
	return
}

// Fetches information about an Access application.
func (r *AccessApplicationService) Get(ctx context.Context, appID AppIDParam, query AccessApplicationGetParams, opts ...option.RequestOption) (res *AccessApplicationGetResponse, err error) {
	var env AccessApplicationGetResponseEnvelope
	opts = slices.Concat(r.Options, opts)
	var accountOrZone string
	var accountOrZoneID param.Field[string]
	if query.AccountID.Value != "" && query.ZoneID.Value != "" {
		err = errors.New("account ID and zone ID are mutually exclusive")
		return
	}
	if query.AccountID.Value == "" && query.ZoneID.Value == "" {
		err = errors.New("either account ID or zone ID must be provided")
		return
	}
	if query.AccountID.Value != "" {
		accountOrZone = "accounts"
		accountOrZoneID = query.AccountID
	}
	if query.ZoneID.Value != "" {
		accountOrZone = "zones"
		accountOrZoneID = query.ZoneID
	}
	if appID == "" {
		err = errors.New("missing required app_id parameter")
		return
	}
	path := fmt.Sprintf("%s/%s/access/apps/%s", accountOrZone, accountOrZoneID, appID)
	err = requestconfig.ExecuteNewRequest(ctx, http.MethodGet, path, nil, &env, opts...)
	if err != nil {
		return
	}
	res = &env.Result
	return
}

// Revokes all tokens issued for an application.
func (r *AccessApplicationService) RevokeTokens(ctx context.Context, appID AppIDParam, body AccessApplicationRevokeTokensParams, opts ...option.RequestOption) (res *AccessApplicationRevokeTokensResponse, err error) {
	var env AccessApplicationRevokeTokensResponseEnvelope
	opts = slices.Concat(r.Options, opts)
	var accountOrZone string
	var accountOrZoneID param.Field[string]
	if body.AccountID.Value != "" && body.ZoneID.Value != "" {
		err = errors.New("account ID and zone ID are mutually exclusive")
		return
	}
	if body.AccountID.Value == "" && body.ZoneID.Value == "" {
		err = errors.New("either account ID or zone ID must be provided")
		return
	}
	if body.AccountID.Value != "" {
		accountOrZone = "accounts"
		accountOrZoneID = body.AccountID
	}
	if body.ZoneID.Value != "" {
		accountOrZone = "zones"
		accountOrZoneID = body.ZoneID
	}
	if appID == "" {
		err = errors.New("missing required app_id parameter")
		return
	}
	path := fmt.Sprintf("%s/%s/access/apps/%s/revoke_tokens", accountOrZone, accountOrZoneID, appID)
	err = requestconfig.ExecuteNewRequest(ctx, http.MethodPost, path, nil, &env, opts...)
	if err != nil {
		return
	}
	res = &env.Result
	return
}

type AllowedHeaders = string

type AllowedHeadersParam = string

type AllowedIdPs = string

type AllowedIdPsParam = string

type AllowedMethods string

const (
	AllowedMethodsGet     AllowedMethods = "GET"
	AllowedMethodsPost    AllowedMethods = "POST"
	AllowedMethodsHead    AllowedMethods = "HEAD"
	AllowedMethodsPut     AllowedMethods = "PUT"
	AllowedMethodsDelete  AllowedMethods = "DELETE"
	AllowedMethodsConnect AllowedMethods = "CONNECT"
	AllowedMethodsOptions AllowedMethods = "OPTIONS"
	AllowedMethodsTrace   AllowedMethods = "TRACE"
	AllowedMethodsPatch   AllowedMethods = "PATCH"
)

func (r AllowedMethods) IsKnown() bool {
	switch r {
	case AllowedMethodsGet, AllowedMethodsPost, AllowedMethodsHead, AllowedMethodsPut, AllowedMethodsDelete, AllowedMethodsConnect, AllowedMethodsOptions, AllowedMethodsTrace, AllowedMethodsPatch:
		return true
	}
	return false
}

type AllowedOrigins = string

type AllowedOriginsParam = string

type AppIDParam = string

// The application type.
type ApplicationType string

const (
	ApplicationTypeSelfHosted     ApplicationType = "self_hosted"
	ApplicationTypeSaaS           ApplicationType = "saas"
	ApplicationTypeSSH            ApplicationType = "ssh"
	ApplicationTypeVNC            ApplicationType = "vnc"
	ApplicationTypeAppLauncher    ApplicationType = "app_launcher"
	ApplicationTypeWARP           ApplicationType = "warp"
	ApplicationTypeBISO           ApplicationType = "biso"
	ApplicationTypeBookmark       ApplicationType = "bookmark"
	ApplicationTypeDashSSO        ApplicationType = "dash_sso"
	ApplicationTypeInfrastructure ApplicationType = "infrastructure"
	ApplicationTypeRdp            ApplicationType = "rdp"
	ApplicationTypeMcp            ApplicationType = "mcp"
	ApplicationTypeMcpPortal      ApplicationType = "mcp_portal"
	ApplicationTypeProxyEndpoint  ApplicationType = "proxy_endpoint"
)

func (r ApplicationType) IsKnown() bool {
	switch r {
	case ApplicationTypeSelfHosted, ApplicationTypeSaaS, ApplicationTypeSSH, ApplicationTypeVNC, ApplicationTypeAppLauncher, ApplicationTypeWARP, ApplicationTypeBISO, ApplicationTypeBookmark, ApplicationTypeDashSSO, ApplicationTypeInfrastructure, ApplicationTypeRdp, ApplicationTypeMcp, ApplicationTypeMcpPortal, ApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

type CORSHeaders struct {
	// Allows all HTTP request headers.
	AllowAllHeaders bool `json:"allow_all_headers"`
	// Allows all HTTP request methods.
	AllowAllMethods bool `json:"allow_all_methods"`
	// Allows all origins.
	AllowAllOrigins bool `json:"allow_all_origins"`
	// When set to `true`, includes credentials (cookies, authorization headers, or TLS
	// client certificates) with requests.
	AllowCredentials bool `json:"allow_credentials"`
	// Allowed HTTP request headers.
	AllowedHeaders []AllowedHeaders `json:"allowed_headers"`
	// Allowed HTTP request methods.
	AllowedMethods []AllowedMethods `json:"allowed_methods"`
	// Allowed origins.
	AllowedOrigins []AllowedOrigins `json:"allowed_origins"`
	// The maximum number of seconds the results of a preflight request can be cached.
	MaxAge float64         `json:"max_age"`
	JSON   corsHeadersJSON `json:"-"`
}

// corsHeadersJSON contains the JSON metadata for the struct [CORSHeaders]
type corsHeadersJSON struct {
	AllowAllHeaders  apijson.Field
	AllowAllMethods  apijson.Field
	AllowAllOrigins  apijson.Field
	AllowCredentials apijson.Field
	AllowedHeaders   apijson.Field
	AllowedMethods   apijson.Field
	AllowedOrigins   apijson.Field
	MaxAge           apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *CORSHeaders) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r corsHeadersJSON) RawJSON() string {
	return r.raw
}

type CORSHeadersParam struct {
	// Allows all HTTP request headers.
	AllowAllHeaders param.Field[bool] `json:"allow_all_headers"`
	// Allows all HTTP request methods.
	AllowAllMethods param.Field[bool] `json:"allow_all_methods"`
	// Allows all origins.
	AllowAllOrigins param.Field[bool] `json:"allow_all_origins"`
	// When set to `true`, includes credentials (cookies, authorization headers, or TLS
	// client certificates) with requests.
	AllowCredentials param.Field[bool] `json:"allow_credentials"`
	// Allowed HTTP request headers.
	AllowedHeaders param.Field[[]AllowedHeadersParam] `json:"allowed_headers"`
	// Allowed HTTP request methods.
	AllowedMethods param.Field[[]AllowedMethods] `json:"allowed_methods"`
	// Allowed origins.
	AllowedOrigins param.Field[[]AllowedOriginsParam] `json:"allowed_origins"`
	// The maximum number of seconds the results of a preflight request can be cached.
	MaxAge param.Field[float64] `json:"max_age"`
}

func (r CORSHeadersParam) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// The action Access will take if a user matches this policy. Infrastructure
// application policies can only use the Allow action.
type Decision string

const (
	DecisionAllow       Decision = "allow"
	DecisionDeny        Decision = "deny"
	DecisionNonIdentity Decision = "non_identity"
	DecisionBypass      Decision = "bypass"
)

func (r Decision) IsKnown() bool {
	switch r {
	case DecisionAllow, DecisionDeny, DecisionNonIdentity, DecisionBypass:
		return true
	}
	return false
}

type OIDCSaaSApp struct {
	// The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must
	// be greater than or equal to 1m and less than or equal to 24h.
	AccessTokenLifetime string `json:"access_token_lifetime"`
	// If client secret should be required on the token endpoint when
	// authorization_code_with_pkce grant is used.
	AllowPKCEWithoutClientSecret bool `json:"allow_pkce_without_client_secret"`
	// The URL where this applications tile redirects users
	AppLauncherURL string `json:"app_launcher_url"`
	// Identifier of the authentication protocol used for the saas app. Required for
	// OIDC.
	AuthType OIDCSaaSAppAuthType `json:"auth_type"`
	// The application client id
	ClientID string `json:"client_id"`
	// The application client secret, only returned on POST request.
	ClientSecret string                   `json:"client_secret"`
	CustomClaims []OIDCSaaSAppCustomClaim `json:"custom_claims"`
	// The OIDC flows supported by this application
	GrantTypes []OIDCSaaSAppGrantType `json:"grant_types"`
	// A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
	GroupFilterRegex         string                              `json:"group_filter_regex"`
	HybridAndImplicitOptions OIDCSaaSAppHybridAndImplicitOptions `json:"hybrid_and_implicit_options"`
	// The Access public certificate that will be used to verify your identity.
	PublicKey string `json:"public_key"`
	// The permitted URL's for Cloudflare to return Authorization codes and Access/ID
	// tokens
	RedirectURIs        []string                       `json:"redirect_uris"`
	RefreshTokenOptions OIDCSaaSAppRefreshTokenOptions `json:"refresh_token_options"`
	// Define the user information shared with access, "offline_access" scope will be
	// automatically enabled if refresh tokens are enabled
	Scopes []OIDCSaaSAppScope `json:"scopes"`
	JSON   oidcSaaSAppJSON    `json:"-"`
}

// oidcSaaSAppJSON contains the JSON metadata for the struct [OIDCSaaSApp]
type oidcSaaSAppJSON struct {
	AccessTokenLifetime          apijson.Field
	AllowPKCEWithoutClientSecret apijson.Field
	AppLauncherURL               apijson.Field
	AuthType                     apijson.Field
	ClientID                     apijson.Field
	ClientSecret                 apijson.Field
	CustomClaims                 apijson.Field
	GrantTypes                   apijson.Field
	GroupFilterRegex             apijson.Field
	HybridAndImplicitOptions     apijson.Field
	PublicKey                    apijson.Field
	RedirectURIs                 apijson.Field
	RefreshTokenOptions          apijson.Field
	Scopes                       apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *OIDCSaaSApp) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r oidcSaaSAppJSON) RawJSON() string {
	return r.raw
}

func (r OIDCSaaSApp) implementsAccessApplicationNewResponseSaaSApplicationSaaSApp() {}

func (r OIDCSaaSApp) implementsAccessApplicationUpdateResponseSaaSApplicationSaaSApp() {}

func (r OIDCSaaSApp) implementsAccessApplicationListResponseSaaSApplicationSaaSApp() {}

func (r OIDCSaaSApp) implementsAccessApplicationGetResponseSaaSApplicationSaaSApp() {}

// Identifier of the authentication protocol used for the saas app. Required for
// OIDC.
type OIDCSaaSAppAuthType string

const (
	OIDCSaaSAppAuthTypeSAML OIDCSaaSAppAuthType = "saml"
	OIDCSaaSAppAuthTypeOIDC OIDCSaaSAppAuthType = "oidc"
)

func (r OIDCSaaSAppAuthType) IsKnown() bool {
	switch r {
	case OIDCSaaSAppAuthTypeSAML, OIDCSaaSAppAuthTypeOIDC:
		return true
	}
	return false
}

type OIDCSaaSAppCustomClaim struct {
	// The name of the claim.
	Name string `json:"name"`
	// If the claim is required when building an OIDC token.
	Required bool `json:"required"`
	// The scope of the claim.
	Scope  OIDCSaaSAppCustomClaimsScope  `json:"scope"`
	Source OIDCSaaSAppCustomClaimsSource `json:"source"`
	JSON   oidcSaaSAppCustomClaimJSON    `json:"-"`
}

// oidcSaaSAppCustomClaimJSON contains the JSON metadata for the struct
// [OIDCSaaSAppCustomClaim]
type oidcSaaSAppCustomClaimJSON struct {
	Name        apijson.Field
	Required    apijson.Field
	Scope       apijson.Field
	Source      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *OIDCSaaSAppCustomClaim) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r oidcSaaSAppCustomClaimJSON) RawJSON() string {
	return r.raw
}

// The scope of the claim.
type OIDCSaaSAppCustomClaimsScope string

const (
	OIDCSaaSAppCustomClaimsScopeGroups  OIDCSaaSAppCustomClaimsScope = "groups"
	OIDCSaaSAppCustomClaimsScopeProfile OIDCSaaSAppCustomClaimsScope = "profile"
	OIDCSaaSAppCustomClaimsScopeEmail   OIDCSaaSAppCustomClaimsScope = "email"
	OIDCSaaSAppCustomClaimsScopeOpenid  OIDCSaaSAppCustomClaimsScope = "openid"
)

func (r OIDCSaaSAppCustomClaimsScope) IsKnown() bool {
	switch r {
	case OIDCSaaSAppCustomClaimsScopeGroups, OIDCSaaSAppCustomClaimsScopeProfile, OIDCSaaSAppCustomClaimsScopeEmail, OIDCSaaSAppCustomClaimsScopeOpenid:
		return true
	}
	return false
}

type OIDCSaaSAppCustomClaimsSource struct {
	// The name of the IdP claim.
	Name string `json:"name"`
	// A mapping from IdP ID to claim name.
	NameByIdP map[string]string                 `json:"name_by_idp"`
	JSON      oidcSaaSAppCustomClaimsSourceJSON `json:"-"`
}

// oidcSaaSAppCustomClaimsSourceJSON contains the JSON metadata for the struct
// [OIDCSaaSAppCustomClaimsSource]
type oidcSaaSAppCustomClaimsSourceJSON struct {
	Name        apijson.Field
	NameByIdP   apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *OIDCSaaSAppCustomClaimsSource) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r oidcSaaSAppCustomClaimsSourceJSON) RawJSON() string {
	return r.raw
}

type OIDCSaaSAppGrantType string

const (
	OIDCSaaSAppGrantTypeAuthorizationCode         OIDCSaaSAppGrantType = "authorization_code"
	OIDCSaaSAppGrantTypeAuthorizationCodeWithPKCE OIDCSaaSAppGrantType = "authorization_code_with_pkce"
	OIDCSaaSAppGrantTypeRefreshTokens             OIDCSaaSAppGrantType = "refresh_tokens"
	OIDCSaaSAppGrantTypeHybrid                    OIDCSaaSAppGrantType = "hybrid"
	OIDCSaaSAppGrantTypeImplicit                  OIDCSaaSAppGrantType = "implicit"
)

func (r OIDCSaaSAppGrantType) IsKnown() bool {
	switch r {
	case OIDCSaaSAppGrantTypeAuthorizationCode, OIDCSaaSAppGrantTypeAuthorizationCodeWithPKCE, OIDCSaaSAppGrantTypeRefreshTokens, OIDCSaaSAppGrantTypeHybrid, OIDCSaaSAppGrantTypeImplicit:
		return true
	}
	return false
}

type OIDCSaaSAppHybridAndImplicitOptions struct {
	// If an Access Token should be returned from the OIDC Authorization endpoint
	ReturnAccessTokenFromAuthorizationEndpoint bool `json:"return_access_token_from_authorization_endpoint"`
	// If an ID Token should be returned from the OIDC Authorization endpoint
	ReturnIDTokenFromAuthorizationEndpoint bool                                    `json:"return_id_token_from_authorization_endpoint"`
	JSON                                   oidcSaaSAppHybridAndImplicitOptionsJSON `json:"-"`
}

// oidcSaaSAppHybridAndImplicitOptionsJSON contains the JSON metadata for the
// struct [OIDCSaaSAppHybridAndImplicitOptions]
type oidcSaaSAppHybridAndImplicitOptionsJSON struct {
	ReturnAccessTokenFromAuthorizationEndpoint apijson.Field
	ReturnIDTokenFromAuthorizationEndpoint     apijson.Field
	raw                                        string
	ExtraFields                                map[string]apijson.Field
}

func (r *OIDCSaaSAppHybridAndImplicitOptions) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r oidcSaaSAppHybridAndImplicitOptionsJSON) RawJSON() string {
	return r.raw
}

type OIDCSaaSAppRefreshTokenOptions struct {
	// How long a refresh token will be valid for after creation. Valid units are
	// m,h,d. Must be longer than 1m.
	Lifetime string                             `json:"lifetime"`
	JSON     oidcSaaSAppRefreshTokenOptionsJSON `json:"-"`
}

// oidcSaaSAppRefreshTokenOptionsJSON contains the JSON metadata for the struct
// [OIDCSaaSAppRefreshTokenOptions]
type oidcSaaSAppRefreshTokenOptionsJSON struct {
	Lifetime    apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *OIDCSaaSAppRefreshTokenOptions) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r oidcSaaSAppRefreshTokenOptionsJSON) RawJSON() string {
	return r.raw
}

type OIDCSaaSAppScope string

const (
	OIDCSaaSAppScopeOpenid  OIDCSaaSAppScope = "openid"
	OIDCSaaSAppScopeGroups  OIDCSaaSAppScope = "groups"
	OIDCSaaSAppScopeEmail   OIDCSaaSAppScope = "email"
	OIDCSaaSAppScopeProfile OIDCSaaSAppScope = "profile"
)

func (r OIDCSaaSAppScope) IsKnown() bool {
	switch r {
	case OIDCSaaSAppScopeOpenid, OIDCSaaSAppScopeGroups, OIDCSaaSAppScopeEmail, OIDCSaaSAppScopeProfile:
		return true
	}
	return false
}

type OIDCSaaSAppParam struct {
	// The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must
	// be greater than or equal to 1m and less than or equal to 24h.
	AccessTokenLifetime param.Field[string] `json:"access_token_lifetime"`
	// If client secret should be required on the token endpoint when
	// authorization_code_with_pkce grant is used.
	AllowPKCEWithoutClientSecret param.Field[bool] `json:"allow_pkce_without_client_secret"`
	// The URL where this applications tile redirects users
	AppLauncherURL param.Field[string] `json:"app_launcher_url"`
	// Identifier of the authentication protocol used for the saas app. Required for
	// OIDC.
	AuthType param.Field[OIDCSaaSAppAuthType] `json:"auth_type"`
	// The application client id
	ClientID param.Field[string] `json:"client_id"`
	// The application client secret, only returned on POST request.
	ClientSecret param.Field[string]                        `json:"client_secret"`
	CustomClaims param.Field[[]OIDCSaaSAppCustomClaimParam] `json:"custom_claims"`
	// The OIDC flows supported by this application
	GrantTypes param.Field[[]OIDCSaaSAppGrantType] `json:"grant_types"`
	// A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
	GroupFilterRegex         param.Field[string]                                   `json:"group_filter_regex"`
	HybridAndImplicitOptions param.Field[OIDCSaaSAppHybridAndImplicitOptionsParam] `json:"hybrid_and_implicit_options"`
	// The Access public certificate that will be used to verify your identity.
	PublicKey param.Field[string] `json:"public_key"`
	// The permitted URL's for Cloudflare to return Authorization codes and Access/ID
	// tokens
	RedirectURIs        param.Field[[]string]                            `json:"redirect_uris"`
	RefreshTokenOptions param.Field[OIDCSaaSAppRefreshTokenOptionsParam] `json:"refresh_token_options"`
	// Define the user information shared with access, "offline_access" scope will be
	// automatically enabled if refresh tokens are enabled
	Scopes param.Field[[]OIDCSaaSAppScope] `json:"scopes"`
}

func (r OIDCSaaSAppParam) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r OIDCSaaSAppParam) implementsAccessApplicationNewParamsBodySaaSApplicationSaaSAppUnion() {}

func (r OIDCSaaSAppParam) implementsAccessApplicationUpdateParamsBodySaaSApplicationSaaSAppUnion() {}

type OIDCSaaSAppCustomClaimParam struct {
	// The name of the claim.
	Name param.Field[string] `json:"name"`
	// If the claim is required when building an OIDC token.
	Required param.Field[bool] `json:"required"`
	// The scope of the claim.
	Scope  param.Field[OIDCSaaSAppCustomClaimsScope]       `json:"scope"`
	Source param.Field[OIDCSaaSAppCustomClaimsSourceParam] `json:"source"`
}

func (r OIDCSaaSAppCustomClaimParam) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

type OIDCSaaSAppCustomClaimsSourceParam struct {
	// The name of the IdP claim.
	Name param.Field[string] `json:"name"`
	// A mapping from IdP ID to claim name.
	NameByIdP param.Field[map[string]string] `json:"name_by_idp"`
}

func (r OIDCSaaSAppCustomClaimsSourceParam) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

type OIDCSaaSAppHybridAndImplicitOptionsParam struct {
	// If an Access Token should be returned from the OIDC Authorization endpoint
	ReturnAccessTokenFromAuthorizationEndpoint param.Field[bool] `json:"return_access_token_from_authorization_endpoint"`
	// If an ID Token should be returned from the OIDC Authorization endpoint
	ReturnIDTokenFromAuthorizationEndpoint param.Field[bool] `json:"return_id_token_from_authorization_endpoint"`
}

func (r OIDCSaaSAppHybridAndImplicitOptionsParam) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

type OIDCSaaSAppRefreshTokenOptionsParam struct {
	// How long a refresh token will be valid for after creation. Valid units are
	// m,h,d. Must be longer than 1m.
	Lifetime param.Field[string] `json:"lifetime"`
}

func (r OIDCSaaSAppRefreshTokenOptionsParam) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// The format of the name identifier sent to the SaaS application.
type SaaSAppNameIDFormat string

const (
	SaaSAppNameIDFormatID    SaaSAppNameIDFormat = "id"
	SaaSAppNameIDFormatEmail SaaSAppNameIDFormat = "email"
)

func (r SaaSAppNameIDFormat) IsKnown() bool {
	switch r {
	case SaaSAppNameIDFormatID, SaaSAppNameIDFormatEmail:
		return true
	}
	return false
}

type SAMLSaaSApp struct {
	// Optional identifier indicating the authentication protocol used for the saas
	// app. Required for OIDC. Default if unset is "saml"
	AuthType SAMLSaaSAppAuthType `json:"auth_type"`
	// The service provider's endpoint that is responsible for receiving and parsing a
	// SAML assertion.
	ConsumerServiceURL string                       `json:"consumer_service_url"`
	CustomAttributes   []SAMLSaaSAppCustomAttribute `json:"custom_attributes"`
	// The URL that the user will be redirected to after a successful login for IDP
	// initiated logins.
	DefaultRelayState string `json:"default_relay_state"`
	// The unique identifier for your SaaS application.
	IdPEntityID string `json:"idp_entity_id"`
	// The format of the name identifier sent to the SaaS application.
	NameIDFormat SaaSAppNameIDFormat `json:"name_id_format"`
	// A [JSONata](https://jsonata.org/) expression that transforms an application's
	// user identities into a NameID value for its SAML assertion. This expression
	// should evaluate to a singular string. The output of this expression can override
	// the `name_id_format` setting.
	NameIDTransformJsonata string `json:"name_id_transform_jsonata"`
	// The Access public certificate that will be used to verify your identity.
	PublicKey string `json:"public_key"`
	// A [JSONata] (https://jsonata.org/) expression that transforms an application's
	// user identities into attribute assertions in the SAML response. The expression
	// can transform id, email, name, and groups values. It can also transform fields
	// listed in the saml_attributes or oidc_fields of the identity provider used to
	// authenticate. The output of this expression must be a JSON object.
	SAMLAttributeTransformJsonata string `json:"saml_attribute_transform_jsonata"`
	// A globally unique name for an identity or service provider.
	SPEntityID string `json:"sp_entity_id"`
	// The endpoint where your SaaS application will send login requests.
	SSOEndpoint string          `json:"sso_endpoint"`
	JSON        samlSaaSAppJSON `json:"-"`
}

// samlSaaSAppJSON contains the JSON metadata for the struct [SAMLSaaSApp]
type samlSaaSAppJSON struct {
	AuthType                      apijson.Field
	ConsumerServiceURL            apijson.Field
	CustomAttributes              apijson.Field
	DefaultRelayState             apijson.Field
	IdPEntityID                   apijson.Field
	NameIDFormat                  apijson.Field
	NameIDTransformJsonata        apijson.Field
	PublicKey                     apijson.Field
	SAMLAttributeTransformJsonata apijson.Field
	SPEntityID                    apijson.Field
	SSOEndpoint                   apijson.Field
	raw                           string
	ExtraFields                   map[string]apijson.Field
}

func (r *SAMLSaaSApp) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r samlSaaSAppJSON) RawJSON() string {
	return r.raw
}

func (r SAMLSaaSApp) implementsAccessApplicationNewResponseSaaSApplicationSaaSApp() {}

func (r SAMLSaaSApp) implementsAccessApplicationUpdateResponseSaaSApplicationSaaSApp() {}

func (r SAMLSaaSApp) implementsAccessApplicationListResponseSaaSApplicationSaaSApp() {}

func (r SAMLSaaSApp) implementsAccessApplicationGetResponseSaaSApplicationSaaSApp() {}

// Optional identifier indicating the authentication protocol used for the saas
// app. Required for OIDC. Default if unset is "saml"
type SAMLSaaSAppAuthType string

const (
	SAMLSaaSAppAuthTypeSAML SAMLSaaSAppAuthType = "saml"
	SAMLSaaSAppAuthTypeOIDC SAMLSaaSAppAuthType = "oidc"
)

func (r SAMLSaaSAppAuthType) IsKnown() bool {
	switch r {
	case SAMLSaaSAppAuthTypeSAML, SAMLSaaSAppAuthTypeOIDC:
		return true
	}
	return false
}

type SAMLSaaSAppCustomAttribute struct {
	// The SAML FriendlyName of the attribute.
	FriendlyName string `json:"friendly_name"`
	// The name of the attribute.
	Name string `json:"name"`
	// A globally unique name for an identity or service provider.
	NameFormat SAMLSaaSAppCustomAttributesNameFormat `json:"name_format"`
	// If the attribute is required when building a SAML assertion.
	Required bool                              `json:"required"`
	Source   SAMLSaaSAppCustomAttributesSource `json:"source"`
	JSON     samlSaaSAppCustomAttributeJSON    `json:"-"`
}

// samlSaaSAppCustomAttributeJSON contains the JSON metadata for the struct
// [SAMLSaaSAppCustomAttribute]
type samlSaaSAppCustomAttributeJSON struct {
	FriendlyName apijson.Field
	Name         apijson.Field
	NameFormat   apijson.Field
	Required     apijson.Field
	Source       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *SAMLSaaSAppCustomAttribute) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r samlSaaSAppCustomAttributeJSON) RawJSON() string {
	return r.raw
}

// A globally unique name for an identity or service provider.
type SAMLSaaSAppCustomAttributesNameFormat string

const (
	SAMLSaaSAppCustomAttributesNameFormatUrnOasisNamesTcSAML2_0AttrnameFormatUnspecified SAMLSaaSAppCustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
	SAMLSaaSAppCustomAttributesNameFormatUrnOasisNamesTcSAML2_0AttrnameFormatBasic       SAMLSaaSAppCustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
	SAMLSaaSAppCustomAttributesNameFormatUrnOasisNamesTcSAML2_0AttrnameFormatURI         SAMLSaaSAppCustomAttributesNameFormat = "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
)

func (r SAMLSaaSAppCustomAttributesNameFormat) IsKnown() bool {
	switch r {
	case SAMLSaaSAppCustomAttributesNameFormatUrnOasisNamesTcSAML2_0AttrnameFormatUnspecified, SAMLSaaSAppCustomAttributesNameFormatUrnOasisNamesTcSAML2_0AttrnameFormatBasic, SAMLSaaSAppCustomAttributesNameFormatUrnOasisNamesTcSAML2_0AttrnameFormatURI:
		return true
	}
	return false
}

type SAMLSaaSAppCustomAttributesSource struct {
	// The name of the IdP attribute.
	Name string `json:"name"`
	// A mapping from IdP ID to attribute name.
	NameByIdP []SAMLSaaSAppCustomAttributesSourceNameByIdP `json:"name_by_idp"`
	JSON      samlSaaSAppCustomAttributesSourceJSON        `json:"-"`
}

// samlSaaSAppCustomAttributesSourceJSON contains the JSON metadata for the struct
// [SAMLSaaSAppCustomAttributesSource]
type samlSaaSAppCustomAttributesSourceJSON struct {
	Name        apijson.Field
	NameByIdP   apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *SAMLSaaSAppCustomAttributesSource) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r samlSaaSAppCustomAttributesSourceJSON) RawJSON() string {
	return r.raw
}

type SAMLSaaSAppCustomAttributesSourceNameByIdP struct {
	// The UID of the IdP.
	IdPID string `json:"idp_id"`
	// The name of the IdP provided attribute.
	SourceName string                                         `json:"source_name"`
	JSON       samlSaaSAppCustomAttributesSourceNameByIdPJSON `json:"-"`
}

// samlSaaSAppCustomAttributesSourceNameByIdPJSON contains the JSON metadata for
// the struct [SAMLSaaSAppCustomAttributesSourceNameByIdP]
type samlSaaSAppCustomAttributesSourceNameByIdPJSON struct {
	IdPID       apijson.Field
	SourceName  apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *SAMLSaaSAppCustomAttributesSourceNameByIdP) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r samlSaaSAppCustomAttributesSourceNameByIdPJSON) RawJSON() string {
	return r.raw
}

type SAMLSaaSAppParam struct {
	// Optional identifier indicating the authentication protocol used for the saas
	// app. Required for OIDC. Default if unset is "saml"
	AuthType param.Field[SAMLSaaSAppAuthType] `json:"auth_type"`
	// The service provider's endpoint that is responsible for receiving and parsing a
	// SAML assertion.
	ConsumerServiceURL param.Field[string]                            `json:"consumer_service_url"`
	CustomAttributes   param.Field[[]SAMLSaaSAppCustomAttributeParam] `json:"custom_attributes"`
	// The URL that the user will be redirected to after a successful login for IDP
	// initiated logins.
	DefaultRelayState param.Field[string] `json:"default_relay_state"`
	// The unique identifier for your SaaS application.
	IdPEntityID param.Field[string] `json:"idp_entity_id"`
	// The format of the name identifier sent to the SaaS application.
	NameIDFormat param.Field[SaaSAppNameIDFormat] `json:"name_id_format"`
	// A [JSONata](https://jsonata.org/) expression that transforms an application's
	// user identities into a NameID value for its SAML assertion. This expression
	// should evaluate to a singular string. The output of this expression can override
	// the `name_id_format` setting.
	NameIDTransformJsonata param.Field[string] `json:"name_id_transform_jsonata"`
	// The Access public certificate that will be used to verify your identity.
	PublicKey param.Field[string] `json:"public_key"`
	// A [JSONata] (https://jsonata.org/) expression that transforms an application's
	// user identities into attribute assertions in the SAML response. The expression
	// can transform id, email, name, and groups values. It can also transform fields
	// listed in the saml_attributes or oidc_fields of the identity provider used to
	// authenticate. The output of this expression must be a JSON object.
	SAMLAttributeTransformJsonata param.Field[string] `json:"saml_attribute_transform_jsonata"`
	// A globally unique name for an identity or service provider.
	SPEntityID param.Field[string] `json:"sp_entity_id"`
	// The endpoint where your SaaS application will send login requests.
	SSOEndpoint param.Field[string] `json:"sso_endpoint"`
}

func (r SAMLSaaSAppParam) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r SAMLSaaSAppParam) implementsAccessApplicationNewParamsBodySaaSApplicationSaaSAppUnion() {}

func (r SAMLSaaSAppParam) implementsAccessApplicationUpdateParamsBodySaaSApplicationSaaSAppUnion() {}

type SAMLSaaSAppCustomAttributeParam struct {
	// The SAML FriendlyName of the attribute.
	FriendlyName param.Field[string] `json:"friendly_name"`
	// The name of the attribute.
	Name param.Field[string] `json:"name"`
	// A globally unique name for an identity or service provider.
	NameFormat param.Field[SAMLSaaSAppCustomAttributesNameFormat] `json:"name_format"`
	// If the attribute is required when building a SAML assertion.
	Required param.Field[bool]                                   `json:"required"`
	Source   param.Field[SAMLSaaSAppCustomAttributesSourceParam] `json:"source"`
}

func (r SAMLSaaSAppCustomAttributeParam) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

type SAMLSaaSAppCustomAttributesSourceParam struct {
	// The name of the IdP attribute.
	Name param.Field[string] `json:"name"`
	// A mapping from IdP ID to attribute name.
	NameByIdP param.Field[[]SAMLSaaSAppCustomAttributesSourceNameByIdPParam] `json:"name_by_idp"`
}

func (r SAMLSaaSAppCustomAttributesSourceParam) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

type SAMLSaaSAppCustomAttributesSourceNameByIdPParam struct {
	// The UID of the IdP.
	IdPID param.Field[string] `json:"idp_id"`
	// The name of the IdP provided attribute.
	SourceName param.Field[string] `json:"source_name"`
}

func (r SAMLSaaSAppCustomAttributesSourceNameByIdPParam) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type SCIMConfigAuthenticationHTTPBasic struct {
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme SCIMConfigAuthenticationHTTPBasicScheme `json:"scheme,required"`
	// User name used to authenticate with the remote SCIM service.
	User string                                `json:"user,required"`
	JSON scimConfigAuthenticationHTTPBasicJSON `json:"-"`
}

// scimConfigAuthenticationHTTPBasicJSON contains the JSON metadata for the struct
// [SCIMConfigAuthenticationHTTPBasic]
type scimConfigAuthenticationHTTPBasicJSON struct {
	Password    apijson.Field
	Scheme      apijson.Field
	User        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *SCIMConfigAuthenticationHTTPBasic) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r scimConfigAuthenticationHTTPBasicJSON) RawJSON() string {
	return r.raw
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasic) implementsAccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type SCIMConfigAuthenticationHTTPBasicScheme string

const (
	SCIMConfigAuthenticationHTTPBasicSchemeHttpbasic SCIMConfigAuthenticationHTTPBasicScheme = "httpbasic"
)

func (r SCIMConfigAuthenticationHTTPBasicScheme) IsKnown() bool {
	switch r {
	case SCIMConfigAuthenticationHTTPBasicSchemeHttpbasic:
		return true
	}
	return false
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type SCIMConfigAuthenticationHTTPBasicParam struct {
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string] `json:"password,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[SCIMConfigAuthenticationHTTPBasicScheme] `json:"scheme,required"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user,required"`
}

func (r SCIMConfigAuthenticationHTTPBasicParam) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationHTTPBasicParam) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
// provisioning to an application.
type SCIMConfigAuthenticationOAuthBearerToken struct {
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme SCIMConfigAuthenticationOAuthBearerTokenScheme `json:"scheme,required"`
	JSON   scimConfigAuthenticationOAuthBearerTokenJSON   `json:"-"`
}

// scimConfigAuthenticationOAuthBearerTokenJSON contains the JSON metadata for the
// struct [SCIMConfigAuthenticationOAuthBearerToken]
type scimConfigAuthenticationOAuthBearerTokenJSON struct {
	Token       apijson.Field
	Scheme      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *SCIMConfigAuthenticationOAuthBearerToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r scimConfigAuthenticationOAuthBearerTokenJSON) RawJSON() string {
	return r.raw
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerToken) implementsAccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type SCIMConfigAuthenticationOAuthBearerTokenScheme string

const (
	SCIMConfigAuthenticationOAuthBearerTokenSchemeOauthbearertoken SCIMConfigAuthenticationOAuthBearerTokenScheme = "oauthbearertoken"
)

func (r SCIMConfigAuthenticationOAuthBearerTokenScheme) IsKnown() bool {
	switch r {
	case SCIMConfigAuthenticationOAuthBearerTokenSchemeOauthbearertoken:
		return true
	}
	return false
}

// Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
// provisioning to an application.
type SCIMConfigAuthenticationOAuthBearerTokenParam struct {
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[SCIMConfigAuthenticationOAuthBearerTokenScheme] `json:"scheme,required"`
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOAuthBearerTokenParam) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning
// to an application.
type SCIMConfigAuthenticationOauth2 struct {
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url,required"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id,required"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme SCIMConfigAuthenticationOauth2Scheme `json:"scheme,required"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url,required"`
	// The authorization scopes to request when generating the token used to
	// authenticate with the remove SCIM service.
	Scopes []string                           `json:"scopes"`
	JSON   scimConfigAuthenticationOauth2JSON `json:"-"`
}

// scimConfigAuthenticationOauth2JSON contains the JSON metadata for the struct
// [SCIMConfigAuthenticationOauth2]
type scimConfigAuthenticationOauth2JSON struct {
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Scheme           apijson.Field
	TokenURL         apijson.Field
	Scopes           apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *SCIMConfigAuthenticationOauth2) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r scimConfigAuthenticationOauth2JSON) RawJSON() string {
	return r.raw
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2) implementsAccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type SCIMConfigAuthenticationOauth2Scheme string

const (
	SCIMConfigAuthenticationOauth2SchemeOauth2 SCIMConfigAuthenticationOauth2Scheme = "oauth2"
)

func (r SCIMConfigAuthenticationOauth2Scheme) IsKnown() bool {
	switch r {
	case SCIMConfigAuthenticationOauth2SchemeOauth2:
		return true
	}
	return false
}

// Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning
// to an application.
type SCIMConfigAuthenticationOauth2Param struct {
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url,required"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[SCIMConfigAuthenticationOauth2Scheme] `json:"scheme,required"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url,required"`
	// The authorization scopes to request when generating the token used to
	// authenticate with the remove SCIM service.
	Scopes param.Field[[]string] `json:"scopes"`
}

func (r SCIMConfigAuthenticationOauth2Param) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

func (r SCIMConfigAuthenticationOauth2Param) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// Transformations and filters applied to resources before they are provisioned in
// the remote SCIM service.
type SCIMConfigMapping struct {
	// Which SCIM resource type this mapping applies to.
	Schema string `json:"schema,required"`
	// Whether or not this mapping is enabled.
	Enabled bool `json:"enabled"`
	// A
	// [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2)
	// that matches resources that should be provisioned to this application.
	Filter string `json:"filter"`
	// Whether or not this mapping applies to creates, updates, or deletes.
	Operations SCIMConfigMappingOperations `json:"operations"`
	// The level of adherence to outbound resource schemas when provisioning to this
	// mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown
	// values to the target.
	Strictness SCIMConfigMappingStrictness `json:"strictness"`
	// A [JSONata](https://jsonata.org/) expression that transforms the resource before
	// provisioning it in the application.
	TransformJsonata string                `json:"transform_jsonata"`
	JSON             scimConfigMappingJSON `json:"-"`
}

// scimConfigMappingJSON contains the JSON metadata for the struct
// [SCIMConfigMapping]
type scimConfigMappingJSON struct {
	Schema           apijson.Field
	Enabled          apijson.Field
	Filter           apijson.Field
	Operations       apijson.Field
	Strictness       apijson.Field
	TransformJsonata apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *SCIMConfigMapping) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r scimConfigMappingJSON) RawJSON() string {
	return r.raw
}

// Whether or not this mapping applies to creates, updates, or deletes.
type SCIMConfigMappingOperations struct {
	// Whether or not this mapping applies to create (POST) operations.
	Create bool `json:"create"`
	// Whether or not this mapping applies to DELETE operations.
	Delete bool `json:"delete"`
	// Whether or not this mapping applies to update (PATCH/PUT) operations.
	Update bool                            `json:"update"`
	JSON   scimConfigMappingOperationsJSON `json:"-"`
}

// scimConfigMappingOperationsJSON contains the JSON metadata for the struct
// [SCIMConfigMappingOperations]
type scimConfigMappingOperationsJSON struct {
	Create      apijson.Field
	Delete      apijson.Field
	Update      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *SCIMConfigMappingOperations) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r scimConfigMappingOperationsJSON) RawJSON() string {
	return r.raw
}

// The level of adherence to outbound resource schemas when provisioning to this
// mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown
// values to the target.
type SCIMConfigMappingStrictness string

const (
	SCIMConfigMappingStrictnessStrict      SCIMConfigMappingStrictness = "strict"
	SCIMConfigMappingStrictnessPassthrough SCIMConfigMappingStrictness = "passthrough"
)

func (r SCIMConfigMappingStrictness) IsKnown() bool {
	switch r {
	case SCIMConfigMappingStrictnessStrict, SCIMConfigMappingStrictnessPassthrough:
		return true
	}
	return false
}

// Transformations and filters applied to resources before they are provisioned in
// the remote SCIM service.
type SCIMConfigMappingParam struct {
	// Which SCIM resource type this mapping applies to.
	Schema param.Field[string] `json:"schema,required"`
	// Whether or not this mapping is enabled.
	Enabled param.Field[bool] `json:"enabled"`
	// A
	// [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2)
	// that matches resources that should be provisioned to this application.
	Filter param.Field[string] `json:"filter"`
	// Whether or not this mapping applies to creates, updates, or deletes.
	Operations param.Field[SCIMConfigMappingOperationsParam] `json:"operations"`
	// The level of adherence to outbound resource schemas when provisioning to this
	// mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown
	// values to the target.
	Strictness param.Field[SCIMConfigMappingStrictness] `json:"strictness"`
	// A [JSONata](https://jsonata.org/) expression that transforms the resource before
	// provisioning it in the application.
	TransformJsonata param.Field[string] `json:"transform_jsonata"`
}

func (r SCIMConfigMappingParam) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// Whether or not this mapping applies to creates, updates, or deletes.
type SCIMConfigMappingOperationsParam struct {
	// Whether or not this mapping applies to create (POST) operations.
	Create param.Field[bool] `json:"create"`
	// Whether or not this mapping applies to DELETE operations.
	Delete param.Field[bool] `json:"delete"`
	// Whether or not this mapping applies to update (PATCH/PUT) operations.
	Update param.Field[bool] `json:"update"`
}

func (r SCIMConfigMappingOperationsParam) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

type SelfHostedDomains = string

type SelfHostedDomainsParam = string

type AccessApplicationNewResponse struct {
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// This field can have the runtime type of [[]AllowedIdPs].
	AllowedIdPs interface{} `json:"allowed_idps"`
	// The image URL of the logo shown in the App Launcher header.
	AppLauncherLogoURL string `json:"app_launcher_logo_url"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The background color of the App Launcher page.
	BgColor     string      `json:"bg_color"`
	CORSHeaders CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// This field can have the runtime type of [[]string].
	CustomPages interface{} `json:"custom_pages"`
	// This field can have the runtime type of
	// [[]AccessApplicationNewResponseSelfHostedApplicationDestination],
	// [[]AccessApplicationNewResponseBrowserSSHApplicationDestination],
	// [[]AccessApplicationNewResponseBrowserVNCApplicationDestination],
	// [[]AccessApplicationNewResponseBrowserRdpApplicationDestination].
	Destinations interface{} `json:"destinations"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// This field can have the runtime type of
	// [[]AccessApplicationNewResponseAppLauncherApplicationFooterLink].
	FooterLinks interface{} `json:"footer_links"`
	// The background color of the App Launcher header.
	HeaderBgColor string `json:"header_bg_color"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// This field can have the runtime type of
	// [AccessApplicationNewResponseAppLauncherApplicationLandingPageDesign].
	LandingPageDesign interface{} `json:"landing_page_design"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool `json:"path_cookie_attribute"`
	// This field can have the runtime type of
	// [[]AccessApplicationNewResponseSelfHostedApplicationPolicy],
	// [[]AccessApplicationNewResponseSaaSApplicationPolicy],
	// [[]AccessApplicationNewResponseBrowserSSHApplicationPolicy],
	// [[]AccessApplicationNewResponseBrowserVNCApplicationPolicy],
	// [[]AccessApplicationNewResponseAppLauncherApplicationPolicy],
	// [[]AccessApplicationNewResponseDeviceEnrollmentPermissionsApplicationPolicy],
	// [[]AccessApplicationNewResponseBrowserIsolationPermissionsApplicationPolicy],
	// [[]AccessApplicationNewResponseGatewayIdentityProxyEndpointApplicationPolicy],
	// [[]AccessApplicationNewResponseBookmarkApplicationPolicy],
	// [[]AccessApplicationNewResponseInfrastructureApplicationPolicy],
	// [[]AccessApplicationNewResponseBrowserRdpApplicationPolicy].
	Policies interface{} `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// This field can have the runtime type of
	// [AccessApplicationNewResponseSaaSApplicationSaaSApp].
	SaaSApp interface{} `json:"saas_app"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// This field can have the runtime type of
	// [AccessApplicationNewResponseSelfHostedApplicationSCIMConfig],
	// [AccessApplicationNewResponseSaaSApplicationSCIMConfig],
	// [AccessApplicationNewResponseBrowserSSHApplicationSCIMConfig],
	// [AccessApplicationNewResponseBrowserVNCApplicationSCIMConfig],
	// [AccessApplicationNewResponseBrowserRdpApplicationSCIMConfig].
	SCIMConfig interface{} `json:"scim_config"`
	// This field can have the runtime type of [[]SelfHostedDomains].
	SelfHostedDomains interface{} `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Determines when to skip the App Launcher landing page.
	SkipAppLauncherLoginPage bool `json:"skip_app_launcher_login_page"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// This field can have the runtime type of [[]string].
	Tags interface{} `json:"tags"`
	// This field can have the runtime type of
	// [[]AccessApplicationNewResponseInfrastructureApplicationTargetCriterion],
	// [[]AccessApplicationNewResponseBrowserRdpApplicationTargetCriterion].
	TargetCriteria interface{} `json:"target_criteria"`
	// The application type.
	Type ApplicationType `json:"type"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                             `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationNewResponseJSON `json:"-"`
	union                                AccessApplicationNewResponseUnion
}

// accessApplicationNewResponseJSON contains the JSON metadata for the struct
// [AccessApplicationNewResponse]
type accessApplicationNewResponseJSON struct {
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherLogoURL                   apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	BgColor                              apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	Domain                               apijson.Field
	EnableBindingCookie                  apijson.Field
	FooterLinks                          apijson.Field
	HeaderBgColor                        apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LandingPageDesign                    apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SaaSApp                              apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipAppLauncherLoginPage             apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	TargetCriteria                       apijson.Field
	Type                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r accessApplicationNewResponseJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationNewResponse) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationNewResponse{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a [AccessApplicationNewResponseUnion] interface which you can
// cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationNewResponseSelfHostedApplication],
// [AccessApplicationNewResponseSaaSApplication],
// [AccessApplicationNewResponseBrowserSSHApplication],
// [AccessApplicationNewResponseBrowserVNCApplication],
// [AccessApplicationNewResponseAppLauncherApplication],
// [AccessApplicationNewResponseDeviceEnrollmentPermissionsApplication],
// [AccessApplicationNewResponseBrowserIsolationPermissionsApplication],
// [AccessApplicationNewResponseGatewayIdentityProxyEndpointApplication],
// [AccessApplicationNewResponseBookmarkApplication],
// [AccessApplicationNewResponseInfrastructureApplication],
// [AccessApplicationNewResponseBrowserRdpApplication].
func (r AccessApplicationNewResponse) AsUnion() AccessApplicationNewResponseUnion {
	return r.union
}

// Union satisfied by [AccessApplicationNewResponseSelfHostedApplication],
// [AccessApplicationNewResponseSaaSApplication],
// [AccessApplicationNewResponseBrowserSSHApplication],
// [AccessApplicationNewResponseBrowserVNCApplication],
// [AccessApplicationNewResponseAppLauncherApplication],
// [AccessApplicationNewResponseDeviceEnrollmentPermissionsApplication],
// [AccessApplicationNewResponseBrowserIsolationPermissionsApplication],
// [AccessApplicationNewResponseGatewayIdentityProxyEndpointApplication],
// [AccessApplicationNewResponseBookmarkApplication],
// [AccessApplicationNewResponseInfrastructureApplication] or
// [AccessApplicationNewResponseBrowserRdpApplication].
type AccessApplicationNewResponseUnion interface {
	implementsAccessApplicationNewResponse()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseSelfHostedApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseSaaSApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserSSHApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserVNCApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseAppLauncherApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseDeviceEnrollmentPermissionsApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserIsolationPermissionsApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseGatewayIdentityProxyEndpointApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBookmarkApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseInfrastructureApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserRdpApplication{}),
		},
	)
}

type AccessApplicationNewResponseSelfHostedApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain,required"`
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationNewResponseSelfHostedApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                      `json:"path_cookie_attribute"`
	Policies            []AccessApplicationNewResponseSelfHostedApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationNewResponseSelfHostedApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                  `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationNewResponseSelfHostedApplicationJSON `json:"-"`
}

// accessApplicationNewResponseSelfHostedApplicationJSON contains the JSON metadata
// for the struct [AccessApplicationNewResponseSelfHostedApplication]
type accessApplicationNewResponseSelfHostedApplicationJSON struct {
	Domain                               apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationNewResponseSelfHostedApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseSelfHostedApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseSelfHostedApplication) implementsAccessApplicationNewResponse() {}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewResponseSelfHostedApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationNewResponseSelfHostedApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                            `json:"port_range"`
	Type      AccessApplicationNewResponseSelfHostedApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                           `json:"vnet_id"`
	JSON   accessApplicationNewResponseSelfHostedApplicationDestinationJSON `json:"-"`
	union  AccessApplicationNewResponseSelfHostedApplicationDestinationsUnion
}

// accessApplicationNewResponseSelfHostedApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationNewResponseSelfHostedApplicationDestination]
type accessApplicationNewResponseSelfHostedApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationNewResponseSelfHostedApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationNewResponseSelfHostedApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationNewResponseSelfHostedApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationNewResponseSelfHostedApplicationDestinationsUnion] interface
// which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestination],
// [AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestination],
// [AccessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationNewResponseSelfHostedApplicationDestination) AsUnion() AccessApplicationNewResponseSelfHostedApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestination],
// [AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationNewResponseSelfHostedApplicationDestinationsUnion interface {
	implementsAccessApplicationNewResponseSelfHostedApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseSelfHostedApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestination struct {
	Type AccessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                             `json:"uri"`
	JSON accessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestination]
type accessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestination) implementsAccessApplicationNewResponseSelfHostedApplicationDestination() {
}

type AccessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestinationTypePublic AccessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseSelfHostedApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                              `json:"port_range"`
	Type      AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                              `json:"vnet_id"`
	JSON   accessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestination]
type accessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestination) implementsAccessApplicationNewResponseSelfHostedApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseSelfHostedApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                         `json:"mcp_server_id"`
	Type        AccessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationNewResponseSelfHostedApplicationDestination() {
}

type AccessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewResponseSelfHostedApplicationDestinationsL4Protocol string

const (
	AccessApplicationNewResponseSelfHostedApplicationDestinationsL4ProtocolTCP AccessApplicationNewResponseSelfHostedApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationNewResponseSelfHostedApplicationDestinationsL4ProtocolUdp AccessApplicationNewResponseSelfHostedApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationNewResponseSelfHostedApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseSelfHostedApplicationDestinationsL4ProtocolTCP, AccessApplicationNewResponseSelfHostedApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewResponseSelfHostedApplicationDestinationsType string

const (
	AccessApplicationNewResponseSelfHostedApplicationDestinationsTypePublic             AccessApplicationNewResponseSelfHostedApplicationDestinationsType = "public"
	AccessApplicationNewResponseSelfHostedApplicationDestinationsTypePrivate            AccessApplicationNewResponseSelfHostedApplicationDestinationsType = "private"
	AccessApplicationNewResponseSelfHostedApplicationDestinationsTypeViaMcpServerPortal AccessApplicationNewResponseSelfHostedApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationNewResponseSelfHostedApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseSelfHostedApplicationDestinationsTypePublic, AccessApplicationNewResponseSelfHostedApplicationDestinationsTypePrivate, AccessApplicationNewResponseSelfHostedApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationNewResponseSelfHostedApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                      `json:"session_duration"`
	UpdatedAt       time.Time                                                   `json:"updated_at" format:"date-time"`
	JSON            accessApplicationNewResponseSelfHostedApplicationPolicyJSON `json:"-"`
}

// accessApplicationNewResponseSelfHostedApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationNewResponseSelfHostedApplicationPolicy]
type accessApplicationNewResponseSelfHostedApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseSelfHostedApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseSelfHostedApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationNewResponseSelfHostedApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                             `json:"mappings"`
	JSON     accessApplicationNewResponseSelfHostedApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationNewResponseSelfHostedApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationNewResponseSelfHostedApplicationSCIMConfig]
type accessApplicationNewResponseSelfHostedApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationNewResponseSelfHostedApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseSelfHostedApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                               `json:"user"`
	JSON  accessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationNewResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewResponseSaaSApplication struct {
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name     string                                              `json:"name"`
	Policies []AccessApplicationNewResponseSaaSApplicationPolicy `json:"policies"`
	SaaSApp  AccessApplicationNewResponseSaaSApplicationSaaSApp  `json:"saas_app"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationNewResponseSaaSApplicationSCIMConfig `json:"scim_config"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// The application type.
	Type ApplicationType                                 `json:"type"`
	JSON accessApplicationNewResponseSaaSApplicationJSON `json:"-"`
}

// accessApplicationNewResponseSaaSApplicationJSON contains the JSON metadata for
// the struct [AccessApplicationNewResponseSaaSApplication]
type accessApplicationNewResponseSaaSApplicationJSON struct {
	ID                     apijson.Field
	AllowedIdPs            apijson.Field
	AppLauncherVisible     apijson.Field
	AUD                    apijson.Field
	AutoRedirectToIdentity apijson.Field
	CustomPages            apijson.Field
	LogoURL                apijson.Field
	Name                   apijson.Field
	Policies               apijson.Field
	SaaSApp                apijson.Field
	SCIMConfig             apijson.Field
	Tags                   apijson.Field
	Type                   apijson.Field
	raw                    string
	ExtraFields            map[string]apijson.Field
}

func (r *AccessApplicationNewResponseSaaSApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseSaaSApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseSaaSApplication) implementsAccessApplicationNewResponse() {}

type AccessApplicationNewResponseSaaSApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                `json:"session_duration"`
	UpdatedAt       time.Time                                             `json:"updated_at" format:"date-time"`
	JSON            accessApplicationNewResponseSaaSApplicationPolicyJSON `json:"-"`
}

// accessApplicationNewResponseSaaSApplicationPolicyJSON contains the JSON metadata
// for the struct [AccessApplicationNewResponseSaaSApplicationPolicy]
type accessApplicationNewResponseSaaSApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseSaaSApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseSaaSApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationNewResponseSaaSApplicationSaaSApp struct {
	// The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must
	// be greater than or equal to 1m and less than or equal to 24h.
	AccessTokenLifetime string `json:"access_token_lifetime"`
	// If client secret should be required on the token endpoint when
	// authorization_code_with_pkce grant is used.
	AllowPKCEWithoutClientSecret bool `json:"allow_pkce_without_client_secret"`
	// The URL where this applications tile redirects users
	AppLauncherURL string `json:"app_launcher_url"`
	// Optional identifier indicating the authentication protocol used for the saas
	// app. Required for OIDC. Default if unset is "saml"
	AuthType AccessApplicationNewResponseSaaSApplicationSaaSAppAuthType `json:"auth_type"`
	// The application client id
	ClientID string `json:"client_id"`
	// The application client secret, only returned on POST request.
	ClientSecret string `json:"client_secret"`
	// The service provider's endpoint that is responsible for receiving and parsing a
	// SAML assertion.
	ConsumerServiceURL string `json:"consumer_service_url"`
	// This field can have the runtime type of [[]SAMLSaaSAppCustomAttribute].
	CustomAttributes interface{} `json:"custom_attributes"`
	// This field can have the runtime type of [[]OIDCSaaSAppCustomClaim].
	CustomClaims interface{} `json:"custom_claims"`
	// The URL that the user will be redirected to after a successful login for IDP
	// initiated logins.
	DefaultRelayState string `json:"default_relay_state"`
	// This field can have the runtime type of [[]OIDCSaaSAppGrantType].
	GrantTypes interface{} `json:"grant_types"`
	// A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
	GroupFilterRegex string `json:"group_filter_regex"`
	// This field can have the runtime type of [OIDCSaaSAppHybridAndImplicitOptions].
	HybridAndImplicitOptions interface{} `json:"hybrid_and_implicit_options"`
	// The unique identifier for your SaaS application.
	IdPEntityID string `json:"idp_entity_id"`
	// The format of the name identifier sent to the SaaS application.
	NameIDFormat SaaSAppNameIDFormat `json:"name_id_format"`
	// A [JSONata](https://jsonata.org/) expression that transforms an application's
	// user identities into a NameID value for its SAML assertion. This expression
	// should evaluate to a singular string. The output of this expression can override
	// the `name_id_format` setting.
	NameIDTransformJsonata string `json:"name_id_transform_jsonata"`
	// The Access public certificate that will be used to verify your identity.
	PublicKey string `json:"public_key"`
	// This field can have the runtime type of [[]string].
	RedirectURIs interface{} `json:"redirect_uris"`
	// This field can have the runtime type of [OIDCSaaSAppRefreshTokenOptions].
	RefreshTokenOptions interface{} `json:"refresh_token_options"`
	// A [JSONata] (https://jsonata.org/) expression that transforms an application's
	// user identities into attribute assertions in the SAML response. The expression
	// can transform id, email, name, and groups values. It can also transform fields
	// listed in the saml_attributes or oidc_fields of the identity provider used to
	// authenticate. The output of this expression must be a JSON object.
	SAMLAttributeTransformJsonata string `json:"saml_attribute_transform_jsonata"`
	// This field can have the runtime type of [[]OIDCSaaSAppScope].
	Scopes interface{} `json:"scopes"`
	// A globally unique name for an identity or service provider.
	SPEntityID string `json:"sp_entity_id"`
	// The endpoint where your SaaS application will send login requests.
	SSOEndpoint string                                                 `json:"sso_endpoint"`
	JSON        accessApplicationNewResponseSaaSApplicationSaaSAppJSON `json:"-"`
	union       AccessApplicationNewResponseSaaSApplicationSaaSAppUnion
}

// accessApplicationNewResponseSaaSApplicationSaaSAppJSON contains the JSON
// metadata for the struct [AccessApplicationNewResponseSaaSApplicationSaaSApp]
type accessApplicationNewResponseSaaSApplicationSaaSAppJSON struct {
	AccessTokenLifetime           apijson.Field
	AllowPKCEWithoutClientSecret  apijson.Field
	AppLauncherURL                apijson.Field
	AuthType                      apijson.Field
	ClientID                      apijson.Field
	ClientSecret                  apijson.Field
	ConsumerServiceURL            apijson.Field
	CustomAttributes              apijson.Field
	CustomClaims                  apijson.Field
	DefaultRelayState             apijson.Field
	GrantTypes                    apijson.Field
	GroupFilterRegex              apijson.Field
	HybridAndImplicitOptions      apijson.Field
	IdPEntityID                   apijson.Field
	NameIDFormat                  apijson.Field
	NameIDTransformJsonata        apijson.Field
	PublicKey                     apijson.Field
	RedirectURIs                  apijson.Field
	RefreshTokenOptions           apijson.Field
	SAMLAttributeTransformJsonata apijson.Field
	Scopes                        apijson.Field
	SPEntityID                    apijson.Field
	SSOEndpoint                   apijson.Field
	raw                           string
	ExtraFields                   map[string]apijson.Field
}

func (r accessApplicationNewResponseSaaSApplicationSaaSAppJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationNewResponseSaaSApplicationSaaSApp) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationNewResponseSaaSApplicationSaaSApp{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a [AccessApplicationNewResponseSaaSApplicationSaaSAppUnion]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SAMLSaaSApp], [OIDCSaaSApp].
func (r AccessApplicationNewResponseSaaSApplicationSaaSApp) AsUnion() AccessApplicationNewResponseSaaSApplicationSaaSAppUnion {
	return r.union
}

// Union satisfied by [SAMLSaaSApp] or [OIDCSaaSApp].
type AccessApplicationNewResponseSaaSApplicationSaaSAppUnion interface {
	implementsAccessApplicationNewResponseSaaSApplicationSaaSApp()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseSaaSApplicationSaaSAppUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SAMLSaaSApp{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(OIDCSaaSApp{}),
		},
	)
}

// Optional identifier indicating the authentication protocol used for the saas
// app. Required for OIDC. Default if unset is "saml"
type AccessApplicationNewResponseSaaSApplicationSaaSAppAuthType string

const (
	AccessApplicationNewResponseSaaSApplicationSaaSAppAuthTypeSAML AccessApplicationNewResponseSaaSApplicationSaaSAppAuthType = "saml"
	AccessApplicationNewResponseSaaSApplicationSaaSAppAuthTypeOIDC AccessApplicationNewResponseSaaSApplicationSaaSAppAuthType = "oidc"
)

func (r AccessApplicationNewResponseSaaSApplicationSaaSAppAuthType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseSaaSApplicationSaaSAppAuthTypeSAML, AccessApplicationNewResponseSaaSApplicationSaaSAppAuthTypeOIDC:
		return true
	}
	return false
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationNewResponseSaaSApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                       `json:"mappings"`
	JSON     accessApplicationNewResponseSaaSApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationNewResponseSaaSApplicationSCIMConfigJSON contains the JSON
// metadata for the struct [AccessApplicationNewResponseSaaSApplicationSCIMConfig]
type accessApplicationNewResponseSaaSApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationNewResponseSaaSApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseSaaSApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                         `json:"user"`
	JSON  accessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationNewResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserSSHApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain,required"`
	// The application type.
	Type AccessApplicationNewResponseBrowserSSHApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationNewResponseBrowserSSHApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                      `json:"path_cookie_attribute"`
	Policies            []AccessApplicationNewResponseBrowserSSHApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationNewResponseBrowserSSHApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                  `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationNewResponseBrowserSSHApplicationJSON `json:"-"`
}

// accessApplicationNewResponseBrowserSSHApplicationJSON contains the JSON metadata
// for the struct [AccessApplicationNewResponseBrowserSSHApplication]
type accessApplicationNewResponseBrowserSSHApplicationJSON struct {
	Domain                               apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserSSHApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserSSHApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserSSHApplication) implementsAccessApplicationNewResponse() {}

// The application type.
type AccessApplicationNewResponseBrowserSSHApplicationType string

const (
	AccessApplicationNewResponseBrowserSSHApplicationTypeSelfHosted     AccessApplicationNewResponseBrowserSSHApplicationType = "self_hosted"
	AccessApplicationNewResponseBrowserSSHApplicationTypeSaaS           AccessApplicationNewResponseBrowserSSHApplicationType = "saas"
	AccessApplicationNewResponseBrowserSSHApplicationTypeSSH            AccessApplicationNewResponseBrowserSSHApplicationType = "ssh"
	AccessApplicationNewResponseBrowserSSHApplicationTypeVNC            AccessApplicationNewResponseBrowserSSHApplicationType = "vnc"
	AccessApplicationNewResponseBrowserSSHApplicationTypeAppLauncher    AccessApplicationNewResponseBrowserSSHApplicationType = "app_launcher"
	AccessApplicationNewResponseBrowserSSHApplicationTypeWARP           AccessApplicationNewResponseBrowserSSHApplicationType = "warp"
	AccessApplicationNewResponseBrowserSSHApplicationTypeBISO           AccessApplicationNewResponseBrowserSSHApplicationType = "biso"
	AccessApplicationNewResponseBrowserSSHApplicationTypeBookmark       AccessApplicationNewResponseBrowserSSHApplicationType = "bookmark"
	AccessApplicationNewResponseBrowserSSHApplicationTypeDashSSO        AccessApplicationNewResponseBrowserSSHApplicationType = "dash_sso"
	AccessApplicationNewResponseBrowserSSHApplicationTypeInfrastructure AccessApplicationNewResponseBrowserSSHApplicationType = "infrastructure"
	AccessApplicationNewResponseBrowserSSHApplicationTypeRdp            AccessApplicationNewResponseBrowserSSHApplicationType = "rdp"
	AccessApplicationNewResponseBrowserSSHApplicationTypeMcp            AccessApplicationNewResponseBrowserSSHApplicationType = "mcp"
	AccessApplicationNewResponseBrowserSSHApplicationTypeMcpPortal      AccessApplicationNewResponseBrowserSSHApplicationType = "mcp_portal"
	AccessApplicationNewResponseBrowserSSHApplicationTypeProxyEndpoint  AccessApplicationNewResponseBrowserSSHApplicationType = "proxy_endpoint"
)

func (r AccessApplicationNewResponseBrowserSSHApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserSSHApplicationTypeSelfHosted, AccessApplicationNewResponseBrowserSSHApplicationTypeSaaS, AccessApplicationNewResponseBrowserSSHApplicationTypeSSH, AccessApplicationNewResponseBrowserSSHApplicationTypeVNC, AccessApplicationNewResponseBrowserSSHApplicationTypeAppLauncher, AccessApplicationNewResponseBrowserSSHApplicationTypeWARP, AccessApplicationNewResponseBrowserSSHApplicationTypeBISO, AccessApplicationNewResponseBrowserSSHApplicationTypeBookmark, AccessApplicationNewResponseBrowserSSHApplicationTypeDashSSO, AccessApplicationNewResponseBrowserSSHApplicationTypeInfrastructure, AccessApplicationNewResponseBrowserSSHApplicationTypeRdp, AccessApplicationNewResponseBrowserSSHApplicationTypeMcp, AccessApplicationNewResponseBrowserSSHApplicationTypeMcpPortal, AccessApplicationNewResponseBrowserSSHApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewResponseBrowserSSHApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationNewResponseBrowserSSHApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                            `json:"port_range"`
	Type      AccessApplicationNewResponseBrowserSSHApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                           `json:"vnet_id"`
	JSON   accessApplicationNewResponseBrowserSSHApplicationDestinationJSON `json:"-"`
	union  AccessApplicationNewResponseBrowserSSHApplicationDestinationsUnion
}

// accessApplicationNewResponseBrowserSSHApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationNewResponseBrowserSSHApplicationDestination]
type accessApplicationNewResponseBrowserSSHApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationNewResponseBrowserSSHApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationNewResponseBrowserSSHApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationNewResponseBrowserSSHApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationNewResponseBrowserSSHApplicationDestinationsUnion] interface
// which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestination],
// [AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestination],
// [AccessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationNewResponseBrowserSSHApplicationDestination) AsUnion() AccessApplicationNewResponseBrowserSSHApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestination],
// [AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationNewResponseBrowserSSHApplicationDestinationsUnion interface {
	implementsAccessApplicationNewResponseBrowserSSHApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseBrowserSSHApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestination struct {
	Type AccessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                             `json:"uri"`
	JSON accessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestination]
type accessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestination) implementsAccessApplicationNewResponseBrowserSSHApplicationDestination() {
}

type AccessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestinationTypePublic AccessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserSSHApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                              `json:"port_range"`
	Type      AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                              `json:"vnet_id"`
	JSON   accessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestination]
type accessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestination) implementsAccessApplicationNewResponseBrowserSSHApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserSSHApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                         `json:"mcp_server_id"`
	Type        AccessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationNewResponseBrowserSSHApplicationDestination() {
}

type AccessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewResponseBrowserSSHApplicationDestinationsL4Protocol string

const (
	AccessApplicationNewResponseBrowserSSHApplicationDestinationsL4ProtocolTCP AccessApplicationNewResponseBrowserSSHApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationNewResponseBrowserSSHApplicationDestinationsL4ProtocolUdp AccessApplicationNewResponseBrowserSSHApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationNewResponseBrowserSSHApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserSSHApplicationDestinationsL4ProtocolTCP, AccessApplicationNewResponseBrowserSSHApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserSSHApplicationDestinationsType string

const (
	AccessApplicationNewResponseBrowserSSHApplicationDestinationsTypePublic             AccessApplicationNewResponseBrowserSSHApplicationDestinationsType = "public"
	AccessApplicationNewResponseBrowserSSHApplicationDestinationsTypePrivate            AccessApplicationNewResponseBrowserSSHApplicationDestinationsType = "private"
	AccessApplicationNewResponseBrowserSSHApplicationDestinationsTypeViaMcpServerPortal AccessApplicationNewResponseBrowserSSHApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationNewResponseBrowserSSHApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserSSHApplicationDestinationsTypePublic, AccessApplicationNewResponseBrowserSSHApplicationDestinationsTypePrivate, AccessApplicationNewResponseBrowserSSHApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserSSHApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                      `json:"session_duration"`
	UpdatedAt       time.Time                                                   `json:"updated_at" format:"date-time"`
	JSON            accessApplicationNewResponseBrowserSSHApplicationPolicyJSON `json:"-"`
}

// accessApplicationNewResponseBrowserSSHApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationNewResponseBrowserSSHApplicationPolicy]
type accessApplicationNewResponseBrowserSSHApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserSSHApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserSSHApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationNewResponseBrowserSSHApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                             `json:"mappings"`
	JSON     accessApplicationNewResponseBrowserSSHApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationNewResponseBrowserSSHApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationNewResponseBrowserSSHApplicationSCIMConfig]
type accessApplicationNewResponseBrowserSSHApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserSSHApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserSSHApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                               `json:"user"`
	JSON  accessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationNewResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserVNCApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain,required"`
	// The application type.
	Type AccessApplicationNewResponseBrowserVNCApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationNewResponseBrowserVNCApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                      `json:"path_cookie_attribute"`
	Policies            []AccessApplicationNewResponseBrowserVNCApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationNewResponseBrowserVNCApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                  `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationNewResponseBrowserVNCApplicationJSON `json:"-"`
}

// accessApplicationNewResponseBrowserVNCApplicationJSON contains the JSON metadata
// for the struct [AccessApplicationNewResponseBrowserVNCApplication]
type accessApplicationNewResponseBrowserVNCApplicationJSON struct {
	Domain                               apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserVNCApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserVNCApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserVNCApplication) implementsAccessApplicationNewResponse() {}

// The application type.
type AccessApplicationNewResponseBrowserVNCApplicationType string

const (
	AccessApplicationNewResponseBrowserVNCApplicationTypeSelfHosted     AccessApplicationNewResponseBrowserVNCApplicationType = "self_hosted"
	AccessApplicationNewResponseBrowserVNCApplicationTypeSaaS           AccessApplicationNewResponseBrowserVNCApplicationType = "saas"
	AccessApplicationNewResponseBrowserVNCApplicationTypeSSH            AccessApplicationNewResponseBrowserVNCApplicationType = "ssh"
	AccessApplicationNewResponseBrowserVNCApplicationTypeVNC            AccessApplicationNewResponseBrowserVNCApplicationType = "vnc"
	AccessApplicationNewResponseBrowserVNCApplicationTypeAppLauncher    AccessApplicationNewResponseBrowserVNCApplicationType = "app_launcher"
	AccessApplicationNewResponseBrowserVNCApplicationTypeWARP           AccessApplicationNewResponseBrowserVNCApplicationType = "warp"
	AccessApplicationNewResponseBrowserVNCApplicationTypeBISO           AccessApplicationNewResponseBrowserVNCApplicationType = "biso"
	AccessApplicationNewResponseBrowserVNCApplicationTypeBookmark       AccessApplicationNewResponseBrowserVNCApplicationType = "bookmark"
	AccessApplicationNewResponseBrowserVNCApplicationTypeDashSSO        AccessApplicationNewResponseBrowserVNCApplicationType = "dash_sso"
	AccessApplicationNewResponseBrowserVNCApplicationTypeInfrastructure AccessApplicationNewResponseBrowserVNCApplicationType = "infrastructure"
	AccessApplicationNewResponseBrowserVNCApplicationTypeRdp            AccessApplicationNewResponseBrowserVNCApplicationType = "rdp"
	AccessApplicationNewResponseBrowserVNCApplicationTypeMcp            AccessApplicationNewResponseBrowserVNCApplicationType = "mcp"
	AccessApplicationNewResponseBrowserVNCApplicationTypeMcpPortal      AccessApplicationNewResponseBrowserVNCApplicationType = "mcp_portal"
	AccessApplicationNewResponseBrowserVNCApplicationTypeProxyEndpoint  AccessApplicationNewResponseBrowserVNCApplicationType = "proxy_endpoint"
)

func (r AccessApplicationNewResponseBrowserVNCApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserVNCApplicationTypeSelfHosted, AccessApplicationNewResponseBrowserVNCApplicationTypeSaaS, AccessApplicationNewResponseBrowserVNCApplicationTypeSSH, AccessApplicationNewResponseBrowserVNCApplicationTypeVNC, AccessApplicationNewResponseBrowserVNCApplicationTypeAppLauncher, AccessApplicationNewResponseBrowserVNCApplicationTypeWARP, AccessApplicationNewResponseBrowserVNCApplicationTypeBISO, AccessApplicationNewResponseBrowserVNCApplicationTypeBookmark, AccessApplicationNewResponseBrowserVNCApplicationTypeDashSSO, AccessApplicationNewResponseBrowserVNCApplicationTypeInfrastructure, AccessApplicationNewResponseBrowserVNCApplicationTypeRdp, AccessApplicationNewResponseBrowserVNCApplicationTypeMcp, AccessApplicationNewResponseBrowserVNCApplicationTypeMcpPortal, AccessApplicationNewResponseBrowserVNCApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewResponseBrowserVNCApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationNewResponseBrowserVNCApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                            `json:"port_range"`
	Type      AccessApplicationNewResponseBrowserVNCApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                           `json:"vnet_id"`
	JSON   accessApplicationNewResponseBrowserVNCApplicationDestinationJSON `json:"-"`
	union  AccessApplicationNewResponseBrowserVNCApplicationDestinationsUnion
}

// accessApplicationNewResponseBrowserVNCApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationNewResponseBrowserVNCApplicationDestination]
type accessApplicationNewResponseBrowserVNCApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationNewResponseBrowserVNCApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationNewResponseBrowserVNCApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationNewResponseBrowserVNCApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationNewResponseBrowserVNCApplicationDestinationsUnion] interface
// which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestination],
// [AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestination],
// [AccessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationNewResponseBrowserVNCApplicationDestination) AsUnion() AccessApplicationNewResponseBrowserVNCApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestination],
// [AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationNewResponseBrowserVNCApplicationDestinationsUnion interface {
	implementsAccessApplicationNewResponseBrowserVNCApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseBrowserVNCApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestination struct {
	Type AccessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                             `json:"uri"`
	JSON accessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestination]
type accessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestination) implementsAccessApplicationNewResponseBrowserVNCApplicationDestination() {
}

type AccessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestinationTypePublic AccessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserVNCApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                              `json:"port_range"`
	Type      AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                              `json:"vnet_id"`
	JSON   accessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestination]
type accessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestination) implementsAccessApplicationNewResponseBrowserVNCApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserVNCApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                         `json:"mcp_server_id"`
	Type        AccessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationNewResponseBrowserVNCApplicationDestination() {
}

type AccessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewResponseBrowserVNCApplicationDestinationsL4Protocol string

const (
	AccessApplicationNewResponseBrowserVNCApplicationDestinationsL4ProtocolTCP AccessApplicationNewResponseBrowserVNCApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationNewResponseBrowserVNCApplicationDestinationsL4ProtocolUdp AccessApplicationNewResponseBrowserVNCApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationNewResponseBrowserVNCApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserVNCApplicationDestinationsL4ProtocolTCP, AccessApplicationNewResponseBrowserVNCApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserVNCApplicationDestinationsType string

const (
	AccessApplicationNewResponseBrowserVNCApplicationDestinationsTypePublic             AccessApplicationNewResponseBrowserVNCApplicationDestinationsType = "public"
	AccessApplicationNewResponseBrowserVNCApplicationDestinationsTypePrivate            AccessApplicationNewResponseBrowserVNCApplicationDestinationsType = "private"
	AccessApplicationNewResponseBrowserVNCApplicationDestinationsTypeViaMcpServerPortal AccessApplicationNewResponseBrowserVNCApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationNewResponseBrowserVNCApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserVNCApplicationDestinationsTypePublic, AccessApplicationNewResponseBrowserVNCApplicationDestinationsTypePrivate, AccessApplicationNewResponseBrowserVNCApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserVNCApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                      `json:"session_duration"`
	UpdatedAt       time.Time                                                   `json:"updated_at" format:"date-time"`
	JSON            accessApplicationNewResponseBrowserVNCApplicationPolicyJSON `json:"-"`
}

// accessApplicationNewResponseBrowserVNCApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationNewResponseBrowserVNCApplicationPolicy]
type accessApplicationNewResponseBrowserVNCApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserVNCApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserVNCApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationNewResponseBrowserVNCApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                             `json:"mappings"`
	JSON     accessApplicationNewResponseBrowserVNCApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationNewResponseBrowserVNCApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationNewResponseBrowserVNCApplicationSCIMConfig]
type accessApplicationNewResponseBrowserVNCApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserVNCApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserVNCApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                               `json:"user"`
	JSON  accessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationNewResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewResponseAppLauncherApplication struct {
	// The application type.
	Type AccessApplicationNewResponseAppLauncherApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// The image URL of the logo shown in the App Launcher header.
	AppLauncherLogoURL string `json:"app_launcher_logo_url"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The background color of the App Launcher page.
	BgColor string `json:"bg_color"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// The links in the App Launcher footer.
	FooterLinks []AccessApplicationNewResponseAppLauncherApplicationFooterLink `json:"footer_links"`
	// The background color of the App Launcher header.
	HeaderBgColor string `json:"header_bg_color"`
	// The design of the App Launcher landing page shown to users when they log in.
	LandingPageDesign AccessApplicationNewResponseAppLauncherApplicationLandingPageDesign `json:"landing_page_design"`
	// The name of the application.
	Name     string                                                     `json:"name"`
	Policies []AccessApplicationNewResponseAppLauncherApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Determines when to skip the App Launcher landing page.
	SkipAppLauncherLoginPage bool                                                   `json:"skip_app_launcher_login_page"`
	JSON                     accessApplicationNewResponseAppLauncherApplicationJSON `json:"-"`
}

// accessApplicationNewResponseAppLauncherApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationNewResponseAppLauncherApplication]
type accessApplicationNewResponseAppLauncherApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AppLauncherLogoURL       apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	BgColor                  apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	FooterLinks              apijson.Field
	HeaderBgColor            apijson.Field
	LandingPageDesign        apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	SkipAppLauncherLoginPage apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationNewResponseAppLauncherApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseAppLauncherApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseAppLauncherApplication) implementsAccessApplicationNewResponse() {
}

// The application type.
type AccessApplicationNewResponseAppLauncherApplicationType string

const (
	AccessApplicationNewResponseAppLauncherApplicationTypeSelfHosted     AccessApplicationNewResponseAppLauncherApplicationType = "self_hosted"
	AccessApplicationNewResponseAppLauncherApplicationTypeSaaS           AccessApplicationNewResponseAppLauncherApplicationType = "saas"
	AccessApplicationNewResponseAppLauncherApplicationTypeSSH            AccessApplicationNewResponseAppLauncherApplicationType = "ssh"
	AccessApplicationNewResponseAppLauncherApplicationTypeVNC            AccessApplicationNewResponseAppLauncherApplicationType = "vnc"
	AccessApplicationNewResponseAppLauncherApplicationTypeAppLauncher    AccessApplicationNewResponseAppLauncherApplicationType = "app_launcher"
	AccessApplicationNewResponseAppLauncherApplicationTypeWARP           AccessApplicationNewResponseAppLauncherApplicationType = "warp"
	AccessApplicationNewResponseAppLauncherApplicationTypeBISO           AccessApplicationNewResponseAppLauncherApplicationType = "biso"
	AccessApplicationNewResponseAppLauncherApplicationTypeBookmark       AccessApplicationNewResponseAppLauncherApplicationType = "bookmark"
	AccessApplicationNewResponseAppLauncherApplicationTypeDashSSO        AccessApplicationNewResponseAppLauncherApplicationType = "dash_sso"
	AccessApplicationNewResponseAppLauncherApplicationTypeInfrastructure AccessApplicationNewResponseAppLauncherApplicationType = "infrastructure"
	AccessApplicationNewResponseAppLauncherApplicationTypeRdp            AccessApplicationNewResponseAppLauncherApplicationType = "rdp"
	AccessApplicationNewResponseAppLauncherApplicationTypeMcp            AccessApplicationNewResponseAppLauncherApplicationType = "mcp"
	AccessApplicationNewResponseAppLauncherApplicationTypeMcpPortal      AccessApplicationNewResponseAppLauncherApplicationType = "mcp_portal"
	AccessApplicationNewResponseAppLauncherApplicationTypeProxyEndpoint  AccessApplicationNewResponseAppLauncherApplicationType = "proxy_endpoint"
)

func (r AccessApplicationNewResponseAppLauncherApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseAppLauncherApplicationTypeSelfHosted, AccessApplicationNewResponseAppLauncherApplicationTypeSaaS, AccessApplicationNewResponseAppLauncherApplicationTypeSSH, AccessApplicationNewResponseAppLauncherApplicationTypeVNC, AccessApplicationNewResponseAppLauncherApplicationTypeAppLauncher, AccessApplicationNewResponseAppLauncherApplicationTypeWARP, AccessApplicationNewResponseAppLauncherApplicationTypeBISO, AccessApplicationNewResponseAppLauncherApplicationTypeBookmark, AccessApplicationNewResponseAppLauncherApplicationTypeDashSSO, AccessApplicationNewResponseAppLauncherApplicationTypeInfrastructure, AccessApplicationNewResponseAppLauncherApplicationTypeRdp, AccessApplicationNewResponseAppLauncherApplicationTypeMcp, AccessApplicationNewResponseAppLauncherApplicationTypeMcpPortal, AccessApplicationNewResponseAppLauncherApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

type AccessApplicationNewResponseAppLauncherApplicationFooterLink struct {
	// The hypertext in the footer link.
	Name string `json:"name,required"`
	// the hyperlink in the footer link.
	URL  string                                                           `json:"url,required"`
	JSON accessApplicationNewResponseAppLauncherApplicationFooterLinkJSON `json:"-"`
}

// accessApplicationNewResponseAppLauncherApplicationFooterLinkJSON contains the
// JSON metadata for the struct
// [AccessApplicationNewResponseAppLauncherApplicationFooterLink]
type accessApplicationNewResponseAppLauncherApplicationFooterLinkJSON struct {
	Name        apijson.Field
	URL         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseAppLauncherApplicationFooterLink) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseAppLauncherApplicationFooterLinkJSON) RawJSON() string {
	return r.raw
}

// The design of the App Launcher landing page shown to users when they log in.
type AccessApplicationNewResponseAppLauncherApplicationLandingPageDesign struct {
	// The background color of the log in button on the landing page.
	ButtonColor string `json:"button_color"`
	// The color of the text in the log in button on the landing page.
	ButtonTextColor string `json:"button_text_color"`
	// The URL of the image shown on the landing page.
	ImageURL string `json:"image_url"`
	// The message shown on the landing page.
	Message string `json:"message"`
	// The title shown on the landing page.
	Title string                                                                  `json:"title"`
	JSON  accessApplicationNewResponseAppLauncherApplicationLandingPageDesignJSON `json:"-"`
}

// accessApplicationNewResponseAppLauncherApplicationLandingPageDesignJSON contains
// the JSON metadata for the struct
// [AccessApplicationNewResponseAppLauncherApplicationLandingPageDesign]
type accessApplicationNewResponseAppLauncherApplicationLandingPageDesignJSON struct {
	ButtonColor     apijson.Field
	ButtonTextColor apijson.Field
	ImageURL        apijson.Field
	Message         apijson.Field
	Title           apijson.Field
	raw             string
	ExtraFields     map[string]apijson.Field
}

func (r *AccessApplicationNewResponseAppLauncherApplicationLandingPageDesign) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseAppLauncherApplicationLandingPageDesignJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationNewResponseAppLauncherApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                       `json:"session_duration"`
	UpdatedAt       time.Time                                                    `json:"updated_at" format:"date-time"`
	JSON            accessApplicationNewResponseAppLauncherApplicationPolicyJSON `json:"-"`
}

// accessApplicationNewResponseAppLauncherApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationNewResponseAppLauncherApplicationPolicy]
type accessApplicationNewResponseAppLauncherApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseAppLauncherApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseAppLauncherApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationNewResponseDeviceEnrollmentPermissionsApplication struct {
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// The name of the application.
	Name     string                                                                     `json:"name"`
	Policies []AccessApplicationNewResponseDeviceEnrollmentPermissionsApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string                                                                 `json:"session_duration"`
	JSON            accessApplicationNewResponseDeviceEnrollmentPermissionsApplicationJSON `json:"-"`
}

// accessApplicationNewResponseDeviceEnrollmentPermissionsApplicationJSON contains
// the JSON metadata for the struct
// [AccessApplicationNewResponseDeviceEnrollmentPermissionsApplication]
type accessApplicationNewResponseDeviceEnrollmentPermissionsApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationNewResponseDeviceEnrollmentPermissionsApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseDeviceEnrollmentPermissionsApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseDeviceEnrollmentPermissionsApplication) implementsAccessApplicationNewResponse() {
}

type AccessApplicationNewResponseDeviceEnrollmentPermissionsApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                                       `json:"session_duration"`
	UpdatedAt       time.Time                                                                    `json:"updated_at" format:"date-time"`
	JSON            accessApplicationNewResponseDeviceEnrollmentPermissionsApplicationPolicyJSON `json:"-"`
}

// accessApplicationNewResponseDeviceEnrollmentPermissionsApplicationPolicyJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseDeviceEnrollmentPermissionsApplicationPolicy]
type accessApplicationNewResponseDeviceEnrollmentPermissionsApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseDeviceEnrollmentPermissionsApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseDeviceEnrollmentPermissionsApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationNewResponseBrowserIsolationPermissionsApplication struct {
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// The name of the application.
	Name     string                                                                     `json:"name"`
	Policies []AccessApplicationNewResponseBrowserIsolationPermissionsApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string                                                                 `json:"session_duration"`
	JSON            accessApplicationNewResponseBrowserIsolationPermissionsApplicationJSON `json:"-"`
}

// accessApplicationNewResponseBrowserIsolationPermissionsApplicationJSON contains
// the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserIsolationPermissionsApplication]
type accessApplicationNewResponseBrowserIsolationPermissionsApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserIsolationPermissionsApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserIsolationPermissionsApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserIsolationPermissionsApplication) implementsAccessApplicationNewResponse() {
}

type AccessApplicationNewResponseBrowserIsolationPermissionsApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                                       `json:"session_duration"`
	UpdatedAt       time.Time                                                                    `json:"updated_at" format:"date-time"`
	JSON            accessApplicationNewResponseBrowserIsolationPermissionsApplicationPolicyJSON `json:"-"`
}

// accessApplicationNewResponseBrowserIsolationPermissionsApplicationPolicyJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserIsolationPermissionsApplicationPolicy]
type accessApplicationNewResponseBrowserIsolationPermissionsApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserIsolationPermissionsApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserIsolationPermissionsApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationNewResponseGatewayIdentityProxyEndpointApplication struct {
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The proxy endpoint domain in the format: 10 alphanumeric characters followed by
	// .proxy.cloudflare-gateway.com
	Domain string `json:"domain"`
	// The name of the application.
	Name     string                                                                      `json:"name"`
	Policies []AccessApplicationNewResponseGatewayIdentityProxyEndpointApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string                                                                  `json:"session_duration"`
	JSON            accessApplicationNewResponseGatewayIdentityProxyEndpointApplicationJSON `json:"-"`
}

// accessApplicationNewResponseGatewayIdentityProxyEndpointApplicationJSON contains
// the JSON metadata for the struct
// [AccessApplicationNewResponseGatewayIdentityProxyEndpointApplication]
type accessApplicationNewResponseGatewayIdentityProxyEndpointApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationNewResponseGatewayIdentityProxyEndpointApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseGatewayIdentityProxyEndpointApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseGatewayIdentityProxyEndpointApplication) implementsAccessApplicationNewResponse() {
}

type AccessApplicationNewResponseGatewayIdentityProxyEndpointApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                                        `json:"session_duration"`
	UpdatedAt       time.Time                                                                     `json:"updated_at" format:"date-time"`
	JSON            accessApplicationNewResponseGatewayIdentityProxyEndpointApplicationPolicyJSON `json:"-"`
}

// accessApplicationNewResponseGatewayIdentityProxyEndpointApplicationPolicyJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseGatewayIdentityProxyEndpointApplicationPolicy]
type accessApplicationNewResponseGatewayIdentityProxyEndpointApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseGatewayIdentityProxyEndpointApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseGatewayIdentityProxyEndpointApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationNewResponseBookmarkApplication struct {
	// UUID.
	ID string `json:"id"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// The URL or domain of the bookmark.
	Domain string `json:"domain"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name     string                                                  `json:"name"`
	Policies []AccessApplicationNewResponseBookmarkApplicationPolicy `json:"policies"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// The application type.
	Type ApplicationType                                     `json:"type"`
	JSON accessApplicationNewResponseBookmarkApplicationJSON `json:"-"`
}

// accessApplicationNewResponseBookmarkApplicationJSON contains the JSON metadata
// for the struct [AccessApplicationNewResponseBookmarkApplication]
type accessApplicationNewResponseBookmarkApplicationJSON struct {
	ID                 apijson.Field
	AppLauncherVisible apijson.Field
	AUD                apijson.Field
	Domain             apijson.Field
	LogoURL            apijson.Field
	Name               apijson.Field
	Policies           apijson.Field
	Tags               apijson.Field
	Type               apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBookmarkApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBookmarkApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBookmarkApplication) implementsAccessApplicationNewResponse() {}

type AccessApplicationNewResponseBookmarkApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                    `json:"session_duration"`
	UpdatedAt       time.Time                                                 `json:"updated_at" format:"date-time"`
	JSON            accessApplicationNewResponseBookmarkApplicationPolicyJSON `json:"-"`
}

// accessApplicationNewResponseBookmarkApplicationPolicyJSON contains the JSON
// metadata for the struct [AccessApplicationNewResponseBookmarkApplicationPolicy]
type accessApplicationNewResponseBookmarkApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBookmarkApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBookmarkApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationNewResponseInfrastructureApplication struct {
	TargetCriteria []AccessApplicationNewResponseInfrastructureApplicationTargetCriterion `json:"target_criteria,required"`
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// Audience tag.
	AUD string `json:"aud"`
	// The name of the application.
	Name     string                                                        `json:"name"`
	Policies []AccessApplicationNewResponseInfrastructureApplicationPolicy `json:"policies"`
	JSON     accessApplicationNewResponseInfrastructureApplicationJSON     `json:"-"`
}

// accessApplicationNewResponseInfrastructureApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationNewResponseInfrastructureApplication]
type accessApplicationNewResponseInfrastructureApplicationJSON struct {
	TargetCriteria apijson.Field
	Type           apijson.Field
	ID             apijson.Field
	AUD            apijson.Field
	Name           apijson.Field
	Policies       apijson.Field
	raw            string
	ExtraFields    map[string]apijson.Field
}

func (r *AccessApplicationNewResponseInfrastructureApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseInfrastructureApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseInfrastructureApplication) implementsAccessApplicationNewResponse() {
}

type AccessApplicationNewResponseInfrastructureApplicationTargetCriterion struct {
	// The port that the targets use for the chosen communication protocol. A port
	// cannot be assigned to multiple protocols.
	Port int64 `json:"port,required"`
	// The communication protocol your application secures.
	Protocol AccessApplicationNewResponseInfrastructureApplicationTargetCriteriaProtocol `json:"protocol,required"`
	// Contains a map of target attribute keys to target attribute values.
	TargetAttributes map[string][]string                                                      `json:"target_attributes,required"`
	JSON             accessApplicationNewResponseInfrastructureApplicationTargetCriterionJSON `json:"-"`
}

// accessApplicationNewResponseInfrastructureApplicationTargetCriterionJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseInfrastructureApplicationTargetCriterion]
type accessApplicationNewResponseInfrastructureApplicationTargetCriterionJSON struct {
	Port             apijson.Field
	Protocol         apijson.Field
	TargetAttributes apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationNewResponseInfrastructureApplicationTargetCriterion) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseInfrastructureApplicationTargetCriterionJSON) RawJSON() string {
	return r.raw
}

// The communication protocol your application secures.
type AccessApplicationNewResponseInfrastructureApplicationTargetCriteriaProtocol string

const (
	AccessApplicationNewResponseInfrastructureApplicationTargetCriteriaProtocolSSH AccessApplicationNewResponseInfrastructureApplicationTargetCriteriaProtocol = "SSH"
)

func (r AccessApplicationNewResponseInfrastructureApplicationTargetCriteriaProtocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseInfrastructureApplicationTargetCriteriaProtocolSSH:
		return true
	}
	return false
}

type AccessApplicationNewResponseInfrastructureApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// The rules that define how users may connect to the targets secured by your
	// application.
	ConnectionRules AccessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRules `json:"connection_rules"`
	CreatedAt       time.Time                                                                    `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// The name of the Access policy.
	Name string `json:"name"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require   []AccessRule                                                    `json:"require"`
	UpdatedAt time.Time                                                       `json:"updated_at" format:"date-time"`
	JSON      accessApplicationNewResponseInfrastructureApplicationPolicyJSON `json:"-"`
}

// accessApplicationNewResponseInfrastructureApplicationPolicyJSON contains the
// JSON metadata for the struct
// [AccessApplicationNewResponseInfrastructureApplicationPolicy]
type accessApplicationNewResponseInfrastructureApplicationPolicyJSON struct {
	ID              apijson.Field
	ConnectionRules apijson.Field
	CreatedAt       apijson.Field
	Decision        apijson.Field
	Exclude         apijson.Field
	Include         apijson.Field
	Name            apijson.Field
	Require         apijson.Field
	UpdatedAt       apijson.Field
	raw             string
	ExtraFields     map[string]apijson.Field
}

func (r *AccessApplicationNewResponseInfrastructureApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseInfrastructureApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// The rules that define how users may connect to the targets secured by your
// application.
type AccessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRules struct {
	// The SSH-specific rules that define how users may connect to the targets secured
	// by your application.
	SSH  AccessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRulesSSH  `json:"ssh"`
	JSON accessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRulesJSON `json:"-"`
}

// accessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRulesJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRules]
type accessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRulesJSON struct {
	SSH         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRules) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRulesJSON) RawJSON() string {
	return r.raw
}

// The SSH-specific rules that define how users may connect to the targets secured
// by your application.
type AccessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRulesSSH struct {
	// Contains the Unix usernames that may be used when connecting over SSH.
	Usernames []string `json:"usernames,required"`
	// Enables using Identity Provider email alias as SSH username.
	AllowEmailAlias bool                                                                                `json:"allow_email_alias"`
	JSON            accessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON `json:"-"`
}

// accessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRulesSSH]
type accessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON struct {
	Usernames       apijson.Field
	AllowEmailAlias apijson.Field
	raw             string
	ExtraFields     map[string]apijson.Field
}

func (r *AccessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRulesSSH) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationNewResponseBrowserRdpApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain         string                                                             `json:"domain,required"`
	TargetCriteria []AccessApplicationNewResponseBrowserRdpApplicationTargetCriterion `json:"target_criteria,required"`
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationNewResponseBrowserRdpApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                      `json:"path_cookie_attribute"`
	Policies            []AccessApplicationNewResponseBrowserRdpApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationNewResponseBrowserRdpApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                  `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationNewResponseBrowserRdpApplicationJSON `json:"-"`
}

// accessApplicationNewResponseBrowserRdpApplicationJSON contains the JSON metadata
// for the struct [AccessApplicationNewResponseBrowserRdpApplication]
type accessApplicationNewResponseBrowserRdpApplicationJSON struct {
	Domain                               apijson.Field
	TargetCriteria                       apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserRdpApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserRdpApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserRdpApplication) implementsAccessApplicationNewResponse() {}

type AccessApplicationNewResponseBrowserRdpApplicationTargetCriterion struct {
	// The port that the targets use for the chosen communication protocol. A port
	// cannot be assigned to multiple protocols.
	Port int64 `json:"port,required"`
	// The communication protocol your application secures.
	Protocol AccessApplicationNewResponseBrowserRdpApplicationTargetCriteriaProtocol `json:"protocol,required"`
	// Contains a map of target attribute keys to target attribute values.
	TargetAttributes map[string][]string                                                  `json:"target_attributes,required"`
	JSON             accessApplicationNewResponseBrowserRdpApplicationTargetCriterionJSON `json:"-"`
}

// accessApplicationNewResponseBrowserRdpApplicationTargetCriterionJSON contains
// the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserRdpApplicationTargetCriterion]
type accessApplicationNewResponseBrowserRdpApplicationTargetCriterionJSON struct {
	Port             apijson.Field
	Protocol         apijson.Field
	TargetAttributes apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserRdpApplicationTargetCriterion) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserRdpApplicationTargetCriterionJSON) RawJSON() string {
	return r.raw
}

// The communication protocol your application secures.
type AccessApplicationNewResponseBrowserRdpApplicationTargetCriteriaProtocol string

const (
	AccessApplicationNewResponseBrowserRdpApplicationTargetCriteriaProtocolRdp AccessApplicationNewResponseBrowserRdpApplicationTargetCriteriaProtocol = "RDP"
)

func (r AccessApplicationNewResponseBrowserRdpApplicationTargetCriteriaProtocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserRdpApplicationTargetCriteriaProtocolRdp:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewResponseBrowserRdpApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationNewResponseBrowserRdpApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                            `json:"port_range"`
	Type      AccessApplicationNewResponseBrowserRdpApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                           `json:"vnet_id"`
	JSON   accessApplicationNewResponseBrowserRdpApplicationDestinationJSON `json:"-"`
	union  AccessApplicationNewResponseBrowserRdpApplicationDestinationsUnion
}

// accessApplicationNewResponseBrowserRdpApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationNewResponseBrowserRdpApplicationDestination]
type accessApplicationNewResponseBrowserRdpApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationNewResponseBrowserRdpApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationNewResponseBrowserRdpApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationNewResponseBrowserRdpApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationNewResponseBrowserRdpApplicationDestinationsUnion] interface
// which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestination],
// [AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestination],
// [AccessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationNewResponseBrowserRdpApplicationDestination) AsUnion() AccessApplicationNewResponseBrowserRdpApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestination],
// [AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationNewResponseBrowserRdpApplicationDestinationsUnion interface {
	implementsAccessApplicationNewResponseBrowserRdpApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseBrowserRdpApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestination struct {
	Type AccessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                             `json:"uri"`
	JSON accessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestination]
type accessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestination) implementsAccessApplicationNewResponseBrowserRdpApplicationDestination() {
}

type AccessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestinationTypePublic AccessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserRdpApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                              `json:"port_range"`
	Type      AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                              `json:"vnet_id"`
	JSON   accessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestination]
type accessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestination) implementsAccessApplicationNewResponseBrowserRdpApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserRdpApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                         `json:"mcp_server_id"`
	Type        AccessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationNewResponseBrowserRdpApplicationDestination() {
}

type AccessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewResponseBrowserRdpApplicationDestinationsL4Protocol string

const (
	AccessApplicationNewResponseBrowserRdpApplicationDestinationsL4ProtocolTCP AccessApplicationNewResponseBrowserRdpApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationNewResponseBrowserRdpApplicationDestinationsL4ProtocolUdp AccessApplicationNewResponseBrowserRdpApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationNewResponseBrowserRdpApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserRdpApplicationDestinationsL4ProtocolTCP, AccessApplicationNewResponseBrowserRdpApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserRdpApplicationDestinationsType string

const (
	AccessApplicationNewResponseBrowserRdpApplicationDestinationsTypePublic             AccessApplicationNewResponseBrowserRdpApplicationDestinationsType = "public"
	AccessApplicationNewResponseBrowserRdpApplicationDestinationsTypePrivate            AccessApplicationNewResponseBrowserRdpApplicationDestinationsType = "private"
	AccessApplicationNewResponseBrowserRdpApplicationDestinationsTypeViaMcpServerPortal AccessApplicationNewResponseBrowserRdpApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationNewResponseBrowserRdpApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserRdpApplicationDestinationsTypePublic, AccessApplicationNewResponseBrowserRdpApplicationDestinationsTypePrivate, AccessApplicationNewResponseBrowserRdpApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserRdpApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                      `json:"session_duration"`
	UpdatedAt       time.Time                                                   `json:"updated_at" format:"date-time"`
	JSON            accessApplicationNewResponseBrowserRdpApplicationPolicyJSON `json:"-"`
}

// accessApplicationNewResponseBrowserRdpApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationNewResponseBrowserRdpApplicationPolicy]
type accessApplicationNewResponseBrowserRdpApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserRdpApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserRdpApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationNewResponseBrowserRdpApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                             `json:"mappings"`
	JSON     accessApplicationNewResponseBrowserRdpApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationNewResponseBrowserRdpApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationNewResponseBrowserRdpApplicationSCIMConfig]
type accessApplicationNewResponseBrowserRdpApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserRdpApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserRdpApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                               `json:"user"`
	JSON  accessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationNewResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateResponse struct {
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// This field can have the runtime type of [[]AllowedIdPs].
	AllowedIdPs interface{} `json:"allowed_idps"`
	// The image URL of the logo shown in the App Launcher header.
	AppLauncherLogoURL string `json:"app_launcher_logo_url"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The background color of the App Launcher page.
	BgColor     string      `json:"bg_color"`
	CORSHeaders CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// This field can have the runtime type of [[]string].
	CustomPages interface{} `json:"custom_pages"`
	// This field can have the runtime type of
	// [[]AccessApplicationUpdateResponseSelfHostedApplicationDestination],
	// [[]AccessApplicationUpdateResponseBrowserSSHApplicationDestination],
	// [[]AccessApplicationUpdateResponseBrowserVNCApplicationDestination],
	// [[]AccessApplicationUpdateResponseBrowserRdpApplicationDestination].
	Destinations interface{} `json:"destinations"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// This field can have the runtime type of
	// [[]AccessApplicationUpdateResponseAppLauncherApplicationFooterLink].
	FooterLinks interface{} `json:"footer_links"`
	// The background color of the App Launcher header.
	HeaderBgColor string `json:"header_bg_color"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// This field can have the runtime type of
	// [AccessApplicationUpdateResponseAppLauncherApplicationLandingPageDesign].
	LandingPageDesign interface{} `json:"landing_page_design"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool `json:"path_cookie_attribute"`
	// This field can have the runtime type of
	// [[]AccessApplicationUpdateResponseSelfHostedApplicationPolicy],
	// [[]AccessApplicationUpdateResponseSaaSApplicationPolicy],
	// [[]AccessApplicationUpdateResponseBrowserSSHApplicationPolicy],
	// [[]AccessApplicationUpdateResponseBrowserVNCApplicationPolicy],
	// [[]AccessApplicationUpdateResponseAppLauncherApplicationPolicy],
	// [[]AccessApplicationUpdateResponseDeviceEnrollmentPermissionsApplicationPolicy],
	// [[]AccessApplicationUpdateResponseBrowserIsolationPermissionsApplicationPolicy],
	// [[]AccessApplicationUpdateResponseGatewayIdentityProxyEndpointApplicationPolicy],
	// [[]AccessApplicationUpdateResponseBookmarkApplicationPolicy],
	// [[]AccessApplicationUpdateResponseInfrastructureApplicationPolicy],
	// [[]AccessApplicationUpdateResponseBrowserRdpApplicationPolicy].
	Policies interface{} `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// This field can have the runtime type of
	// [AccessApplicationUpdateResponseSaaSApplicationSaaSApp].
	SaaSApp interface{} `json:"saas_app"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// This field can have the runtime type of
	// [AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfig],
	// [AccessApplicationUpdateResponseSaaSApplicationSCIMConfig],
	// [AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfig],
	// [AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfig],
	// [AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfig].
	SCIMConfig interface{} `json:"scim_config"`
	// This field can have the runtime type of [[]SelfHostedDomains].
	SelfHostedDomains interface{} `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Determines when to skip the App Launcher landing page.
	SkipAppLauncherLoginPage bool `json:"skip_app_launcher_login_page"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// This field can have the runtime type of [[]string].
	Tags interface{} `json:"tags"`
	// This field can have the runtime type of
	// [[]AccessApplicationUpdateResponseInfrastructureApplicationTargetCriterion],
	// [[]AccessApplicationUpdateResponseBrowserRdpApplicationTargetCriterion].
	TargetCriteria interface{} `json:"target_criteria"`
	// The application type.
	Type ApplicationType `json:"type"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationUpdateResponseJSON `json:"-"`
	union                                AccessApplicationUpdateResponseUnion
}

// accessApplicationUpdateResponseJSON contains the JSON metadata for the struct
// [AccessApplicationUpdateResponse]
type accessApplicationUpdateResponseJSON struct {
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherLogoURL                   apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	BgColor                              apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	Domain                               apijson.Field
	EnableBindingCookie                  apijson.Field
	FooterLinks                          apijson.Field
	HeaderBgColor                        apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LandingPageDesign                    apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SaaSApp                              apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipAppLauncherLoginPage             apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	TargetCriteria                       apijson.Field
	Type                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r accessApplicationUpdateResponseJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationUpdateResponse) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationUpdateResponse{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a [AccessApplicationUpdateResponseUnion] interface which you can
// cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationUpdateResponseSelfHostedApplication],
// [AccessApplicationUpdateResponseSaaSApplication],
// [AccessApplicationUpdateResponseBrowserSSHApplication],
// [AccessApplicationUpdateResponseBrowserVNCApplication],
// [AccessApplicationUpdateResponseAppLauncherApplication],
// [AccessApplicationUpdateResponseDeviceEnrollmentPermissionsApplication],
// [AccessApplicationUpdateResponseBrowserIsolationPermissionsApplication],
// [AccessApplicationUpdateResponseGatewayIdentityProxyEndpointApplication],
// [AccessApplicationUpdateResponseBookmarkApplication],
// [AccessApplicationUpdateResponseInfrastructureApplication],
// [AccessApplicationUpdateResponseBrowserRdpApplication].
func (r AccessApplicationUpdateResponse) AsUnion() AccessApplicationUpdateResponseUnion {
	return r.union
}

// Union satisfied by [AccessApplicationUpdateResponseSelfHostedApplication],
// [AccessApplicationUpdateResponseSaaSApplication],
// [AccessApplicationUpdateResponseBrowserSSHApplication],
// [AccessApplicationUpdateResponseBrowserVNCApplication],
// [AccessApplicationUpdateResponseAppLauncherApplication],
// [AccessApplicationUpdateResponseDeviceEnrollmentPermissionsApplication],
// [AccessApplicationUpdateResponseBrowserIsolationPermissionsApplication],
// [AccessApplicationUpdateResponseGatewayIdentityProxyEndpointApplication],
// [AccessApplicationUpdateResponseBookmarkApplication],
// [AccessApplicationUpdateResponseInfrastructureApplication] or
// [AccessApplicationUpdateResponseBrowserRdpApplication].
type AccessApplicationUpdateResponseUnion interface {
	implementsAccessApplicationUpdateResponse()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseSelfHostedApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseSaaSApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserSSHApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserVNCApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseAppLauncherApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseDeviceEnrollmentPermissionsApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserIsolationPermissionsApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseGatewayIdentityProxyEndpointApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBookmarkApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseInfrastructureApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserRdpApplication{}),
		},
	)
}

type AccessApplicationUpdateResponseSelfHostedApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain,required"`
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationUpdateResponseSelfHostedApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                         `json:"path_cookie_attribute"`
	Policies            []AccessApplicationUpdateResponseSelfHostedApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                     `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationUpdateResponseSelfHostedApplicationJSON `json:"-"`
}

// accessApplicationUpdateResponseSelfHostedApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationUpdateResponseSelfHostedApplication]
type accessApplicationUpdateResponseSelfHostedApplicationJSON struct {
	Domain                               apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseSelfHostedApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseSelfHostedApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseSelfHostedApplication) implementsAccessApplicationUpdateResponse() {
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateResponseSelfHostedApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationUpdateResponseSelfHostedApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                               `json:"port_range"`
	Type      AccessApplicationUpdateResponseSelfHostedApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                              `json:"vnet_id"`
	JSON   accessApplicationUpdateResponseSelfHostedApplicationDestinationJSON `json:"-"`
	union  AccessApplicationUpdateResponseSelfHostedApplicationDestinationsUnion
}

// accessApplicationUpdateResponseSelfHostedApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationUpdateResponseSelfHostedApplicationDestination]
type accessApplicationUpdateResponseSelfHostedApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationUpdateResponseSelfHostedApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationUpdateResponseSelfHostedApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationUpdateResponseSelfHostedApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationUpdateResponseSelfHostedApplicationDestinationsUnion]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestination],
// [AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestination],
// [AccessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationUpdateResponseSelfHostedApplicationDestination) AsUnion() AccessApplicationUpdateResponseSelfHostedApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestination],
// [AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationUpdateResponseSelfHostedApplicationDestinationsUnion interface {
	implementsAccessApplicationUpdateResponseSelfHostedApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseSelfHostedApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestination struct {
	Type AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                                `json:"uri"`
	JSON accessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestination]
type accessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestination) implementsAccessApplicationUpdateResponseSelfHostedApplicationDestination() {
}

type AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestinationTypePublic AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                                 `json:"port_range"`
	Type      AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                                 `json:"vnet_id"`
	JSON   accessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestination]
type accessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestination) implementsAccessApplicationUpdateResponseSelfHostedApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseSelfHostedApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                            `json:"mcp_server_id"`
	Type        AccessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationUpdateResponseSelfHostedApplicationDestination() {
}

type AccessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateResponseSelfHostedApplicationDestinationsL4Protocol string

const (
	AccessApplicationUpdateResponseSelfHostedApplicationDestinationsL4ProtocolTCP AccessApplicationUpdateResponseSelfHostedApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationUpdateResponseSelfHostedApplicationDestinationsL4ProtocolUdp AccessApplicationUpdateResponseSelfHostedApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationUpdateResponseSelfHostedApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseSelfHostedApplicationDestinationsL4ProtocolTCP, AccessApplicationUpdateResponseSelfHostedApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseSelfHostedApplicationDestinationsType string

const (
	AccessApplicationUpdateResponseSelfHostedApplicationDestinationsTypePublic             AccessApplicationUpdateResponseSelfHostedApplicationDestinationsType = "public"
	AccessApplicationUpdateResponseSelfHostedApplicationDestinationsTypePrivate            AccessApplicationUpdateResponseSelfHostedApplicationDestinationsType = "private"
	AccessApplicationUpdateResponseSelfHostedApplicationDestinationsTypeViaMcpServerPortal AccessApplicationUpdateResponseSelfHostedApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateResponseSelfHostedApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseSelfHostedApplicationDestinationsTypePublic, AccessApplicationUpdateResponseSelfHostedApplicationDestinationsTypePrivate, AccessApplicationUpdateResponseSelfHostedApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseSelfHostedApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                         `json:"session_duration"`
	UpdatedAt       time.Time                                                      `json:"updated_at" format:"date-time"`
	JSON            accessApplicationUpdateResponseSelfHostedApplicationPolicyJSON `json:"-"`
}

// accessApplicationUpdateResponseSelfHostedApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationUpdateResponseSelfHostedApplicationPolicy]
type accessApplicationUpdateResponseSelfHostedApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseSelfHostedApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseSelfHostedApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                                `json:"mappings"`
	JSON     accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfig]
type accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                                  `json:"user"`
	JSON  accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationUpdateResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseSaaSApplication struct {
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name     string                                                 `json:"name"`
	Policies []AccessApplicationUpdateResponseSaaSApplicationPolicy `json:"policies"`
	SaaSApp  AccessApplicationUpdateResponseSaaSApplicationSaaSApp  `json:"saas_app"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationUpdateResponseSaaSApplicationSCIMConfig `json:"scim_config"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// The application type.
	Type ApplicationType                                    `json:"type"`
	JSON accessApplicationUpdateResponseSaaSApplicationJSON `json:"-"`
}

// accessApplicationUpdateResponseSaaSApplicationJSON contains the JSON metadata
// for the struct [AccessApplicationUpdateResponseSaaSApplication]
type accessApplicationUpdateResponseSaaSApplicationJSON struct {
	ID                     apijson.Field
	AllowedIdPs            apijson.Field
	AppLauncherVisible     apijson.Field
	AUD                    apijson.Field
	AutoRedirectToIdentity apijson.Field
	CustomPages            apijson.Field
	LogoURL                apijson.Field
	Name                   apijson.Field
	Policies               apijson.Field
	SaaSApp                apijson.Field
	SCIMConfig             apijson.Field
	Tags                   apijson.Field
	Type                   apijson.Field
	raw                    string
	ExtraFields            map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseSaaSApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseSaaSApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseSaaSApplication) implementsAccessApplicationUpdateResponse() {}

type AccessApplicationUpdateResponseSaaSApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                   `json:"session_duration"`
	UpdatedAt       time.Time                                                `json:"updated_at" format:"date-time"`
	JSON            accessApplicationUpdateResponseSaaSApplicationPolicyJSON `json:"-"`
}

// accessApplicationUpdateResponseSaaSApplicationPolicyJSON contains the JSON
// metadata for the struct [AccessApplicationUpdateResponseSaaSApplicationPolicy]
type accessApplicationUpdateResponseSaaSApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseSaaSApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseSaaSApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationUpdateResponseSaaSApplicationSaaSApp struct {
	// The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must
	// be greater than or equal to 1m and less than or equal to 24h.
	AccessTokenLifetime string `json:"access_token_lifetime"`
	// If client secret should be required on the token endpoint when
	// authorization_code_with_pkce grant is used.
	AllowPKCEWithoutClientSecret bool `json:"allow_pkce_without_client_secret"`
	// The URL where this applications tile redirects users
	AppLauncherURL string `json:"app_launcher_url"`
	// Optional identifier indicating the authentication protocol used for the saas
	// app. Required for OIDC. Default if unset is "saml"
	AuthType AccessApplicationUpdateResponseSaaSApplicationSaaSAppAuthType `json:"auth_type"`
	// The application client id
	ClientID string `json:"client_id"`
	// The application client secret, only returned on POST request.
	ClientSecret string `json:"client_secret"`
	// The service provider's endpoint that is responsible for receiving and parsing a
	// SAML assertion.
	ConsumerServiceURL string `json:"consumer_service_url"`
	// This field can have the runtime type of [[]SAMLSaaSAppCustomAttribute].
	CustomAttributes interface{} `json:"custom_attributes"`
	// This field can have the runtime type of [[]OIDCSaaSAppCustomClaim].
	CustomClaims interface{} `json:"custom_claims"`
	// The URL that the user will be redirected to after a successful login for IDP
	// initiated logins.
	DefaultRelayState string `json:"default_relay_state"`
	// This field can have the runtime type of [[]OIDCSaaSAppGrantType].
	GrantTypes interface{} `json:"grant_types"`
	// A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
	GroupFilterRegex string `json:"group_filter_regex"`
	// This field can have the runtime type of [OIDCSaaSAppHybridAndImplicitOptions].
	HybridAndImplicitOptions interface{} `json:"hybrid_and_implicit_options"`
	// The unique identifier for your SaaS application.
	IdPEntityID string `json:"idp_entity_id"`
	// The format of the name identifier sent to the SaaS application.
	NameIDFormat SaaSAppNameIDFormat `json:"name_id_format"`
	// A [JSONata](https://jsonata.org/) expression that transforms an application's
	// user identities into a NameID value for its SAML assertion. This expression
	// should evaluate to a singular string. The output of this expression can override
	// the `name_id_format` setting.
	NameIDTransformJsonata string `json:"name_id_transform_jsonata"`
	// The Access public certificate that will be used to verify your identity.
	PublicKey string `json:"public_key"`
	// This field can have the runtime type of [[]string].
	RedirectURIs interface{} `json:"redirect_uris"`
	// This field can have the runtime type of [OIDCSaaSAppRefreshTokenOptions].
	RefreshTokenOptions interface{} `json:"refresh_token_options"`
	// A [JSONata] (https://jsonata.org/) expression that transforms an application's
	// user identities into attribute assertions in the SAML response. The expression
	// can transform id, email, name, and groups values. It can also transform fields
	// listed in the saml_attributes or oidc_fields of the identity provider used to
	// authenticate. The output of this expression must be a JSON object.
	SAMLAttributeTransformJsonata string `json:"saml_attribute_transform_jsonata"`
	// This field can have the runtime type of [[]OIDCSaaSAppScope].
	Scopes interface{} `json:"scopes"`
	// A globally unique name for an identity or service provider.
	SPEntityID string `json:"sp_entity_id"`
	// The endpoint where your SaaS application will send login requests.
	SSOEndpoint string                                                    `json:"sso_endpoint"`
	JSON        accessApplicationUpdateResponseSaaSApplicationSaaSAppJSON `json:"-"`
	union       AccessApplicationUpdateResponseSaaSApplicationSaaSAppUnion
}

// accessApplicationUpdateResponseSaaSApplicationSaaSAppJSON contains the JSON
// metadata for the struct [AccessApplicationUpdateResponseSaaSApplicationSaaSApp]
type accessApplicationUpdateResponseSaaSApplicationSaaSAppJSON struct {
	AccessTokenLifetime           apijson.Field
	AllowPKCEWithoutClientSecret  apijson.Field
	AppLauncherURL                apijson.Field
	AuthType                      apijson.Field
	ClientID                      apijson.Field
	ClientSecret                  apijson.Field
	ConsumerServiceURL            apijson.Field
	CustomAttributes              apijson.Field
	CustomClaims                  apijson.Field
	DefaultRelayState             apijson.Field
	GrantTypes                    apijson.Field
	GroupFilterRegex              apijson.Field
	HybridAndImplicitOptions      apijson.Field
	IdPEntityID                   apijson.Field
	NameIDFormat                  apijson.Field
	NameIDTransformJsonata        apijson.Field
	PublicKey                     apijson.Field
	RedirectURIs                  apijson.Field
	RefreshTokenOptions           apijson.Field
	SAMLAttributeTransformJsonata apijson.Field
	Scopes                        apijson.Field
	SPEntityID                    apijson.Field
	SSOEndpoint                   apijson.Field
	raw                           string
	ExtraFields                   map[string]apijson.Field
}

func (r accessApplicationUpdateResponseSaaSApplicationSaaSAppJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationUpdateResponseSaaSApplicationSaaSApp) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationUpdateResponseSaaSApplicationSaaSApp{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a [AccessApplicationUpdateResponseSaaSApplicationSaaSAppUnion]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SAMLSaaSApp], [OIDCSaaSApp].
func (r AccessApplicationUpdateResponseSaaSApplicationSaaSApp) AsUnion() AccessApplicationUpdateResponseSaaSApplicationSaaSAppUnion {
	return r.union
}

// Union satisfied by [SAMLSaaSApp] or [OIDCSaaSApp].
type AccessApplicationUpdateResponseSaaSApplicationSaaSAppUnion interface {
	implementsAccessApplicationUpdateResponseSaaSApplicationSaaSApp()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseSaaSApplicationSaaSAppUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SAMLSaaSApp{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(OIDCSaaSApp{}),
		},
	)
}

// Optional identifier indicating the authentication protocol used for the saas
// app. Required for OIDC. Default if unset is "saml"
type AccessApplicationUpdateResponseSaaSApplicationSaaSAppAuthType string

const (
	AccessApplicationUpdateResponseSaaSApplicationSaaSAppAuthTypeSAML AccessApplicationUpdateResponseSaaSApplicationSaaSAppAuthType = "saml"
	AccessApplicationUpdateResponseSaaSApplicationSaaSAppAuthTypeOIDC AccessApplicationUpdateResponseSaaSApplicationSaaSAppAuthType = "oidc"
)

func (r AccessApplicationUpdateResponseSaaSApplicationSaaSAppAuthType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseSaaSApplicationSaaSAppAuthTypeSAML, AccessApplicationUpdateResponseSaaSApplicationSaaSAppAuthTypeOIDC:
		return true
	}
	return false
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationUpdateResponseSaaSApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                          `json:"mappings"`
	JSON     accessApplicationUpdateResponseSaaSApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationUpdateResponseSaaSApplicationSCIMConfigJSON contains the JSON
// metadata for the struct
// [AccessApplicationUpdateResponseSaaSApplicationSCIMConfig]
type accessApplicationUpdateResponseSaaSApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseSaaSApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseSaaSApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                            `json:"user"`
	JSON  accessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationUpdateResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserSSHApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain,required"`
	// The application type.
	Type AccessApplicationUpdateResponseBrowserSSHApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationUpdateResponseBrowserSSHApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                         `json:"path_cookie_attribute"`
	Policies            []AccessApplicationUpdateResponseBrowserSSHApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                     `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationUpdateResponseBrowserSSHApplicationJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserSSHApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationUpdateResponseBrowserSSHApplication]
type accessApplicationUpdateResponseBrowserSSHApplicationJSON struct {
	Domain                               apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserSSHApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserSSHApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserSSHApplication) implementsAccessApplicationUpdateResponse() {
}

// The application type.
type AccessApplicationUpdateResponseBrowserSSHApplicationType string

const (
	AccessApplicationUpdateResponseBrowserSSHApplicationTypeSelfHosted     AccessApplicationUpdateResponseBrowserSSHApplicationType = "self_hosted"
	AccessApplicationUpdateResponseBrowserSSHApplicationTypeSaaS           AccessApplicationUpdateResponseBrowserSSHApplicationType = "saas"
	AccessApplicationUpdateResponseBrowserSSHApplicationTypeSSH            AccessApplicationUpdateResponseBrowserSSHApplicationType = "ssh"
	AccessApplicationUpdateResponseBrowserSSHApplicationTypeVNC            AccessApplicationUpdateResponseBrowserSSHApplicationType = "vnc"
	AccessApplicationUpdateResponseBrowserSSHApplicationTypeAppLauncher    AccessApplicationUpdateResponseBrowserSSHApplicationType = "app_launcher"
	AccessApplicationUpdateResponseBrowserSSHApplicationTypeWARP           AccessApplicationUpdateResponseBrowserSSHApplicationType = "warp"
	AccessApplicationUpdateResponseBrowserSSHApplicationTypeBISO           AccessApplicationUpdateResponseBrowserSSHApplicationType = "biso"
	AccessApplicationUpdateResponseBrowserSSHApplicationTypeBookmark       AccessApplicationUpdateResponseBrowserSSHApplicationType = "bookmark"
	AccessApplicationUpdateResponseBrowserSSHApplicationTypeDashSSO        AccessApplicationUpdateResponseBrowserSSHApplicationType = "dash_sso"
	AccessApplicationUpdateResponseBrowserSSHApplicationTypeInfrastructure AccessApplicationUpdateResponseBrowserSSHApplicationType = "infrastructure"
	AccessApplicationUpdateResponseBrowserSSHApplicationTypeRdp            AccessApplicationUpdateResponseBrowserSSHApplicationType = "rdp"
	AccessApplicationUpdateResponseBrowserSSHApplicationTypeMcp            AccessApplicationUpdateResponseBrowserSSHApplicationType = "mcp"
	AccessApplicationUpdateResponseBrowserSSHApplicationTypeMcpPortal      AccessApplicationUpdateResponseBrowserSSHApplicationType = "mcp_portal"
	AccessApplicationUpdateResponseBrowserSSHApplicationTypeProxyEndpoint  AccessApplicationUpdateResponseBrowserSSHApplicationType = "proxy_endpoint"
)

func (r AccessApplicationUpdateResponseBrowserSSHApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserSSHApplicationTypeSelfHosted, AccessApplicationUpdateResponseBrowserSSHApplicationTypeSaaS, AccessApplicationUpdateResponseBrowserSSHApplicationTypeSSH, AccessApplicationUpdateResponseBrowserSSHApplicationTypeVNC, AccessApplicationUpdateResponseBrowserSSHApplicationTypeAppLauncher, AccessApplicationUpdateResponseBrowserSSHApplicationTypeWARP, AccessApplicationUpdateResponseBrowserSSHApplicationTypeBISO, AccessApplicationUpdateResponseBrowserSSHApplicationTypeBookmark, AccessApplicationUpdateResponseBrowserSSHApplicationTypeDashSSO, AccessApplicationUpdateResponseBrowserSSHApplicationTypeInfrastructure, AccessApplicationUpdateResponseBrowserSSHApplicationTypeRdp, AccessApplicationUpdateResponseBrowserSSHApplicationTypeMcp, AccessApplicationUpdateResponseBrowserSSHApplicationTypeMcpPortal, AccessApplicationUpdateResponseBrowserSSHApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateResponseBrowserSSHApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                               `json:"port_range"`
	Type      AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                              `json:"vnet_id"`
	JSON   accessApplicationUpdateResponseBrowserSSHApplicationDestinationJSON `json:"-"`
	union  AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsUnion
}

// accessApplicationUpdateResponseBrowserSSHApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserSSHApplicationDestination]
type accessApplicationUpdateResponseBrowserSSHApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationUpdateResponseBrowserSSHApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationUpdateResponseBrowserSSHApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationUpdateResponseBrowserSSHApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsUnion]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestination],
// [AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestination],
// [AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationUpdateResponseBrowserSSHApplicationDestination) AsUnion() AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestination],
// [AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsUnion interface {
	implementsAccessApplicationUpdateResponseBrowserSSHApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestination struct {
	Type AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                                `json:"uri"`
	JSON accessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestination]
type accessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestination) implementsAccessApplicationUpdateResponseBrowserSSHApplicationDestination() {
}

type AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestinationTypePublic AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                                 `json:"port_range"`
	Type      AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                                 `json:"vnet_id"`
	JSON   accessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestination]
type accessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestination) implementsAccessApplicationUpdateResponseBrowserSSHApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                            `json:"mcp_server_id"`
	Type        AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationUpdateResponseBrowserSSHApplicationDestination() {
}

type AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsL4Protocol string

const (
	AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsL4ProtocolTCP AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsL4ProtocolUdp AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsL4ProtocolTCP, AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsType string

const (
	AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsTypePublic             AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsType = "public"
	AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsTypePrivate            AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsType = "private"
	AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsTypeViaMcpServerPortal AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsTypePublic, AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsTypePrivate, AccessApplicationUpdateResponseBrowserSSHApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserSSHApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                         `json:"session_duration"`
	UpdatedAt       time.Time                                                      `json:"updated_at" format:"date-time"`
	JSON            accessApplicationUpdateResponseBrowserSSHApplicationPolicyJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserSSHApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationUpdateResponseBrowserSSHApplicationPolicy]
type accessApplicationUpdateResponseBrowserSSHApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserSSHApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserSSHApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                                `json:"mappings"`
	JSON     accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfig]
type accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                                  `json:"user"`
	JSON  accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationUpdateResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserVNCApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain,required"`
	// The application type.
	Type AccessApplicationUpdateResponseBrowserVNCApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationUpdateResponseBrowserVNCApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                         `json:"path_cookie_attribute"`
	Policies            []AccessApplicationUpdateResponseBrowserVNCApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                     `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationUpdateResponseBrowserVNCApplicationJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserVNCApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationUpdateResponseBrowserVNCApplication]
type accessApplicationUpdateResponseBrowserVNCApplicationJSON struct {
	Domain                               apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserVNCApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserVNCApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserVNCApplication) implementsAccessApplicationUpdateResponse() {
}

// The application type.
type AccessApplicationUpdateResponseBrowserVNCApplicationType string

const (
	AccessApplicationUpdateResponseBrowserVNCApplicationTypeSelfHosted     AccessApplicationUpdateResponseBrowserVNCApplicationType = "self_hosted"
	AccessApplicationUpdateResponseBrowserVNCApplicationTypeSaaS           AccessApplicationUpdateResponseBrowserVNCApplicationType = "saas"
	AccessApplicationUpdateResponseBrowserVNCApplicationTypeSSH            AccessApplicationUpdateResponseBrowserVNCApplicationType = "ssh"
	AccessApplicationUpdateResponseBrowserVNCApplicationTypeVNC            AccessApplicationUpdateResponseBrowserVNCApplicationType = "vnc"
	AccessApplicationUpdateResponseBrowserVNCApplicationTypeAppLauncher    AccessApplicationUpdateResponseBrowserVNCApplicationType = "app_launcher"
	AccessApplicationUpdateResponseBrowserVNCApplicationTypeWARP           AccessApplicationUpdateResponseBrowserVNCApplicationType = "warp"
	AccessApplicationUpdateResponseBrowserVNCApplicationTypeBISO           AccessApplicationUpdateResponseBrowserVNCApplicationType = "biso"
	AccessApplicationUpdateResponseBrowserVNCApplicationTypeBookmark       AccessApplicationUpdateResponseBrowserVNCApplicationType = "bookmark"
	AccessApplicationUpdateResponseBrowserVNCApplicationTypeDashSSO        AccessApplicationUpdateResponseBrowserVNCApplicationType = "dash_sso"
	AccessApplicationUpdateResponseBrowserVNCApplicationTypeInfrastructure AccessApplicationUpdateResponseBrowserVNCApplicationType = "infrastructure"
	AccessApplicationUpdateResponseBrowserVNCApplicationTypeRdp            AccessApplicationUpdateResponseBrowserVNCApplicationType = "rdp"
	AccessApplicationUpdateResponseBrowserVNCApplicationTypeMcp            AccessApplicationUpdateResponseBrowserVNCApplicationType = "mcp"
	AccessApplicationUpdateResponseBrowserVNCApplicationTypeMcpPortal      AccessApplicationUpdateResponseBrowserVNCApplicationType = "mcp_portal"
	AccessApplicationUpdateResponseBrowserVNCApplicationTypeProxyEndpoint  AccessApplicationUpdateResponseBrowserVNCApplicationType = "proxy_endpoint"
)

func (r AccessApplicationUpdateResponseBrowserVNCApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserVNCApplicationTypeSelfHosted, AccessApplicationUpdateResponseBrowserVNCApplicationTypeSaaS, AccessApplicationUpdateResponseBrowserVNCApplicationTypeSSH, AccessApplicationUpdateResponseBrowserVNCApplicationTypeVNC, AccessApplicationUpdateResponseBrowserVNCApplicationTypeAppLauncher, AccessApplicationUpdateResponseBrowserVNCApplicationTypeWARP, AccessApplicationUpdateResponseBrowserVNCApplicationTypeBISO, AccessApplicationUpdateResponseBrowserVNCApplicationTypeBookmark, AccessApplicationUpdateResponseBrowserVNCApplicationTypeDashSSO, AccessApplicationUpdateResponseBrowserVNCApplicationTypeInfrastructure, AccessApplicationUpdateResponseBrowserVNCApplicationTypeRdp, AccessApplicationUpdateResponseBrowserVNCApplicationTypeMcp, AccessApplicationUpdateResponseBrowserVNCApplicationTypeMcpPortal, AccessApplicationUpdateResponseBrowserVNCApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateResponseBrowserVNCApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                               `json:"port_range"`
	Type      AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                              `json:"vnet_id"`
	JSON   accessApplicationUpdateResponseBrowserVNCApplicationDestinationJSON `json:"-"`
	union  AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsUnion
}

// accessApplicationUpdateResponseBrowserVNCApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserVNCApplicationDestination]
type accessApplicationUpdateResponseBrowserVNCApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationUpdateResponseBrowserVNCApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationUpdateResponseBrowserVNCApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationUpdateResponseBrowserVNCApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsUnion]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestination],
// [AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestination],
// [AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationUpdateResponseBrowserVNCApplicationDestination) AsUnion() AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestination],
// [AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsUnion interface {
	implementsAccessApplicationUpdateResponseBrowserVNCApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestination struct {
	Type AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                                `json:"uri"`
	JSON accessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestination]
type accessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestination) implementsAccessApplicationUpdateResponseBrowserVNCApplicationDestination() {
}

type AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestinationTypePublic AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                                 `json:"port_range"`
	Type      AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                                 `json:"vnet_id"`
	JSON   accessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestination]
type accessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestination) implementsAccessApplicationUpdateResponseBrowserVNCApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                            `json:"mcp_server_id"`
	Type        AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationUpdateResponseBrowserVNCApplicationDestination() {
}

type AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsL4Protocol string

const (
	AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsL4ProtocolTCP AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsL4ProtocolUdp AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsL4ProtocolTCP, AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsType string

const (
	AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsTypePublic             AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsType = "public"
	AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsTypePrivate            AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsType = "private"
	AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsTypeViaMcpServerPortal AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsTypePublic, AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsTypePrivate, AccessApplicationUpdateResponseBrowserVNCApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserVNCApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                         `json:"session_duration"`
	UpdatedAt       time.Time                                                      `json:"updated_at" format:"date-time"`
	JSON            accessApplicationUpdateResponseBrowserVNCApplicationPolicyJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserVNCApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationUpdateResponseBrowserVNCApplicationPolicy]
type accessApplicationUpdateResponseBrowserVNCApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserVNCApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserVNCApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                                `json:"mappings"`
	JSON     accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfig]
type accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                                  `json:"user"`
	JSON  accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationUpdateResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseAppLauncherApplication struct {
	// The application type.
	Type AccessApplicationUpdateResponseAppLauncherApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// The image URL of the logo shown in the App Launcher header.
	AppLauncherLogoURL string `json:"app_launcher_logo_url"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The background color of the App Launcher page.
	BgColor string `json:"bg_color"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// The links in the App Launcher footer.
	FooterLinks []AccessApplicationUpdateResponseAppLauncherApplicationFooterLink `json:"footer_links"`
	// The background color of the App Launcher header.
	HeaderBgColor string `json:"header_bg_color"`
	// The design of the App Launcher landing page shown to users when they log in.
	LandingPageDesign AccessApplicationUpdateResponseAppLauncherApplicationLandingPageDesign `json:"landing_page_design"`
	// The name of the application.
	Name     string                                                        `json:"name"`
	Policies []AccessApplicationUpdateResponseAppLauncherApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Determines when to skip the App Launcher landing page.
	SkipAppLauncherLoginPage bool                                                      `json:"skip_app_launcher_login_page"`
	JSON                     accessApplicationUpdateResponseAppLauncherApplicationJSON `json:"-"`
}

// accessApplicationUpdateResponseAppLauncherApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationUpdateResponseAppLauncherApplication]
type accessApplicationUpdateResponseAppLauncherApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AppLauncherLogoURL       apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	BgColor                  apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	FooterLinks              apijson.Field
	HeaderBgColor            apijson.Field
	LandingPageDesign        apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	SkipAppLauncherLoginPage apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseAppLauncherApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseAppLauncherApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseAppLauncherApplication) implementsAccessApplicationUpdateResponse() {
}

// The application type.
type AccessApplicationUpdateResponseAppLauncherApplicationType string

const (
	AccessApplicationUpdateResponseAppLauncherApplicationTypeSelfHosted     AccessApplicationUpdateResponseAppLauncherApplicationType = "self_hosted"
	AccessApplicationUpdateResponseAppLauncherApplicationTypeSaaS           AccessApplicationUpdateResponseAppLauncherApplicationType = "saas"
	AccessApplicationUpdateResponseAppLauncherApplicationTypeSSH            AccessApplicationUpdateResponseAppLauncherApplicationType = "ssh"
	AccessApplicationUpdateResponseAppLauncherApplicationTypeVNC            AccessApplicationUpdateResponseAppLauncherApplicationType = "vnc"
	AccessApplicationUpdateResponseAppLauncherApplicationTypeAppLauncher    AccessApplicationUpdateResponseAppLauncherApplicationType = "app_launcher"
	AccessApplicationUpdateResponseAppLauncherApplicationTypeWARP           AccessApplicationUpdateResponseAppLauncherApplicationType = "warp"
	AccessApplicationUpdateResponseAppLauncherApplicationTypeBISO           AccessApplicationUpdateResponseAppLauncherApplicationType = "biso"
	AccessApplicationUpdateResponseAppLauncherApplicationTypeBookmark       AccessApplicationUpdateResponseAppLauncherApplicationType = "bookmark"
	AccessApplicationUpdateResponseAppLauncherApplicationTypeDashSSO        AccessApplicationUpdateResponseAppLauncherApplicationType = "dash_sso"
	AccessApplicationUpdateResponseAppLauncherApplicationTypeInfrastructure AccessApplicationUpdateResponseAppLauncherApplicationType = "infrastructure"
	AccessApplicationUpdateResponseAppLauncherApplicationTypeRdp            AccessApplicationUpdateResponseAppLauncherApplicationType = "rdp"
	AccessApplicationUpdateResponseAppLauncherApplicationTypeMcp            AccessApplicationUpdateResponseAppLauncherApplicationType = "mcp"
	AccessApplicationUpdateResponseAppLauncherApplicationTypeMcpPortal      AccessApplicationUpdateResponseAppLauncherApplicationType = "mcp_portal"
	AccessApplicationUpdateResponseAppLauncherApplicationTypeProxyEndpoint  AccessApplicationUpdateResponseAppLauncherApplicationType = "proxy_endpoint"
)

func (r AccessApplicationUpdateResponseAppLauncherApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseAppLauncherApplicationTypeSelfHosted, AccessApplicationUpdateResponseAppLauncherApplicationTypeSaaS, AccessApplicationUpdateResponseAppLauncherApplicationTypeSSH, AccessApplicationUpdateResponseAppLauncherApplicationTypeVNC, AccessApplicationUpdateResponseAppLauncherApplicationTypeAppLauncher, AccessApplicationUpdateResponseAppLauncherApplicationTypeWARP, AccessApplicationUpdateResponseAppLauncherApplicationTypeBISO, AccessApplicationUpdateResponseAppLauncherApplicationTypeBookmark, AccessApplicationUpdateResponseAppLauncherApplicationTypeDashSSO, AccessApplicationUpdateResponseAppLauncherApplicationTypeInfrastructure, AccessApplicationUpdateResponseAppLauncherApplicationTypeRdp, AccessApplicationUpdateResponseAppLauncherApplicationTypeMcp, AccessApplicationUpdateResponseAppLauncherApplicationTypeMcpPortal, AccessApplicationUpdateResponseAppLauncherApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseAppLauncherApplicationFooterLink struct {
	// The hypertext in the footer link.
	Name string `json:"name,required"`
	// the hyperlink in the footer link.
	URL  string                                                              `json:"url,required"`
	JSON accessApplicationUpdateResponseAppLauncherApplicationFooterLinkJSON `json:"-"`
}

// accessApplicationUpdateResponseAppLauncherApplicationFooterLinkJSON contains the
// JSON metadata for the struct
// [AccessApplicationUpdateResponseAppLauncherApplicationFooterLink]
type accessApplicationUpdateResponseAppLauncherApplicationFooterLinkJSON struct {
	Name        apijson.Field
	URL         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseAppLauncherApplicationFooterLink) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseAppLauncherApplicationFooterLinkJSON) RawJSON() string {
	return r.raw
}

// The design of the App Launcher landing page shown to users when they log in.
type AccessApplicationUpdateResponseAppLauncherApplicationLandingPageDesign struct {
	// The background color of the log in button on the landing page.
	ButtonColor string `json:"button_color"`
	// The color of the text in the log in button on the landing page.
	ButtonTextColor string `json:"button_text_color"`
	// The URL of the image shown on the landing page.
	ImageURL string `json:"image_url"`
	// The message shown on the landing page.
	Message string `json:"message"`
	// The title shown on the landing page.
	Title string                                                                     `json:"title"`
	JSON  accessApplicationUpdateResponseAppLauncherApplicationLandingPageDesignJSON `json:"-"`
}

// accessApplicationUpdateResponseAppLauncherApplicationLandingPageDesignJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseAppLauncherApplicationLandingPageDesign]
type accessApplicationUpdateResponseAppLauncherApplicationLandingPageDesignJSON struct {
	ButtonColor     apijson.Field
	ButtonTextColor apijson.Field
	ImageURL        apijson.Field
	Message         apijson.Field
	Title           apijson.Field
	raw             string
	ExtraFields     map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseAppLauncherApplicationLandingPageDesign) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseAppLauncherApplicationLandingPageDesignJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationUpdateResponseAppLauncherApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                          `json:"session_duration"`
	UpdatedAt       time.Time                                                       `json:"updated_at" format:"date-time"`
	JSON            accessApplicationUpdateResponseAppLauncherApplicationPolicyJSON `json:"-"`
}

// accessApplicationUpdateResponseAppLauncherApplicationPolicyJSON contains the
// JSON metadata for the struct
// [AccessApplicationUpdateResponseAppLauncherApplicationPolicy]
type accessApplicationUpdateResponseAppLauncherApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseAppLauncherApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseAppLauncherApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationUpdateResponseDeviceEnrollmentPermissionsApplication struct {
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// The name of the application.
	Name     string                                                                        `json:"name"`
	Policies []AccessApplicationUpdateResponseDeviceEnrollmentPermissionsApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string                                                                    `json:"session_duration"`
	JSON            accessApplicationUpdateResponseDeviceEnrollmentPermissionsApplicationJSON `json:"-"`
}

// accessApplicationUpdateResponseDeviceEnrollmentPermissionsApplicationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseDeviceEnrollmentPermissionsApplication]
type accessApplicationUpdateResponseDeviceEnrollmentPermissionsApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseDeviceEnrollmentPermissionsApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseDeviceEnrollmentPermissionsApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseDeviceEnrollmentPermissionsApplication) implementsAccessApplicationUpdateResponse() {
}

type AccessApplicationUpdateResponseDeviceEnrollmentPermissionsApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                                          `json:"session_duration"`
	UpdatedAt       time.Time                                                                       `json:"updated_at" format:"date-time"`
	JSON            accessApplicationUpdateResponseDeviceEnrollmentPermissionsApplicationPolicyJSON `json:"-"`
}

// accessApplicationUpdateResponseDeviceEnrollmentPermissionsApplicationPolicyJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseDeviceEnrollmentPermissionsApplicationPolicy]
type accessApplicationUpdateResponseDeviceEnrollmentPermissionsApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseDeviceEnrollmentPermissionsApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseDeviceEnrollmentPermissionsApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationUpdateResponseBrowserIsolationPermissionsApplication struct {
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// The name of the application.
	Name     string                                                                        `json:"name"`
	Policies []AccessApplicationUpdateResponseBrowserIsolationPermissionsApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string                                                                    `json:"session_duration"`
	JSON            accessApplicationUpdateResponseBrowserIsolationPermissionsApplicationJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserIsolationPermissionsApplicationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserIsolationPermissionsApplication]
type accessApplicationUpdateResponseBrowserIsolationPermissionsApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserIsolationPermissionsApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserIsolationPermissionsApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserIsolationPermissionsApplication) implementsAccessApplicationUpdateResponse() {
}

type AccessApplicationUpdateResponseBrowserIsolationPermissionsApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                                          `json:"session_duration"`
	UpdatedAt       time.Time                                                                       `json:"updated_at" format:"date-time"`
	JSON            accessApplicationUpdateResponseBrowserIsolationPermissionsApplicationPolicyJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserIsolationPermissionsApplicationPolicyJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserIsolationPermissionsApplicationPolicy]
type accessApplicationUpdateResponseBrowserIsolationPermissionsApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserIsolationPermissionsApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserIsolationPermissionsApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationUpdateResponseGatewayIdentityProxyEndpointApplication struct {
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The proxy endpoint domain in the format: 10 alphanumeric characters followed by
	// .proxy.cloudflare-gateway.com
	Domain string `json:"domain"`
	// The name of the application.
	Name     string                                                                         `json:"name"`
	Policies []AccessApplicationUpdateResponseGatewayIdentityProxyEndpointApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string                                                                     `json:"session_duration"`
	JSON            accessApplicationUpdateResponseGatewayIdentityProxyEndpointApplicationJSON `json:"-"`
}

// accessApplicationUpdateResponseGatewayIdentityProxyEndpointApplicationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseGatewayIdentityProxyEndpointApplication]
type accessApplicationUpdateResponseGatewayIdentityProxyEndpointApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseGatewayIdentityProxyEndpointApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseGatewayIdentityProxyEndpointApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseGatewayIdentityProxyEndpointApplication) implementsAccessApplicationUpdateResponse() {
}

type AccessApplicationUpdateResponseGatewayIdentityProxyEndpointApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                                           `json:"session_duration"`
	UpdatedAt       time.Time                                                                        `json:"updated_at" format:"date-time"`
	JSON            accessApplicationUpdateResponseGatewayIdentityProxyEndpointApplicationPolicyJSON `json:"-"`
}

// accessApplicationUpdateResponseGatewayIdentityProxyEndpointApplicationPolicyJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseGatewayIdentityProxyEndpointApplicationPolicy]
type accessApplicationUpdateResponseGatewayIdentityProxyEndpointApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseGatewayIdentityProxyEndpointApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseGatewayIdentityProxyEndpointApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationUpdateResponseBookmarkApplication struct {
	// UUID.
	ID string `json:"id"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// The URL or domain of the bookmark.
	Domain string `json:"domain"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name     string                                                     `json:"name"`
	Policies []AccessApplicationUpdateResponseBookmarkApplicationPolicy `json:"policies"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// The application type.
	Type ApplicationType                                        `json:"type"`
	JSON accessApplicationUpdateResponseBookmarkApplicationJSON `json:"-"`
}

// accessApplicationUpdateResponseBookmarkApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationUpdateResponseBookmarkApplication]
type accessApplicationUpdateResponseBookmarkApplicationJSON struct {
	ID                 apijson.Field
	AppLauncherVisible apijson.Field
	AUD                apijson.Field
	Domain             apijson.Field
	LogoURL            apijson.Field
	Name               apijson.Field
	Policies           apijson.Field
	Tags               apijson.Field
	Type               apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBookmarkApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBookmarkApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBookmarkApplication) implementsAccessApplicationUpdateResponse() {
}

type AccessApplicationUpdateResponseBookmarkApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                       `json:"session_duration"`
	UpdatedAt       time.Time                                                    `json:"updated_at" format:"date-time"`
	JSON            accessApplicationUpdateResponseBookmarkApplicationPolicyJSON `json:"-"`
}

// accessApplicationUpdateResponseBookmarkApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationUpdateResponseBookmarkApplicationPolicy]
type accessApplicationUpdateResponseBookmarkApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBookmarkApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBookmarkApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationUpdateResponseInfrastructureApplication struct {
	TargetCriteria []AccessApplicationUpdateResponseInfrastructureApplicationTargetCriterion `json:"target_criteria,required"`
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// Audience tag.
	AUD string `json:"aud"`
	// The name of the application.
	Name     string                                                           `json:"name"`
	Policies []AccessApplicationUpdateResponseInfrastructureApplicationPolicy `json:"policies"`
	JSON     accessApplicationUpdateResponseInfrastructureApplicationJSON     `json:"-"`
}

// accessApplicationUpdateResponseInfrastructureApplicationJSON contains the JSON
// metadata for the struct
// [AccessApplicationUpdateResponseInfrastructureApplication]
type accessApplicationUpdateResponseInfrastructureApplicationJSON struct {
	TargetCriteria apijson.Field
	Type           apijson.Field
	ID             apijson.Field
	AUD            apijson.Field
	Name           apijson.Field
	Policies       apijson.Field
	raw            string
	ExtraFields    map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseInfrastructureApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseInfrastructureApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseInfrastructureApplication) implementsAccessApplicationUpdateResponse() {
}

type AccessApplicationUpdateResponseInfrastructureApplicationTargetCriterion struct {
	// The port that the targets use for the chosen communication protocol. A port
	// cannot be assigned to multiple protocols.
	Port int64 `json:"port,required"`
	// The communication protocol your application secures.
	Protocol AccessApplicationUpdateResponseInfrastructureApplicationTargetCriteriaProtocol `json:"protocol,required"`
	// Contains a map of target attribute keys to target attribute values.
	TargetAttributes map[string][]string                                                         `json:"target_attributes,required"`
	JSON             accessApplicationUpdateResponseInfrastructureApplicationTargetCriterionJSON `json:"-"`
}

// accessApplicationUpdateResponseInfrastructureApplicationTargetCriterionJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseInfrastructureApplicationTargetCriterion]
type accessApplicationUpdateResponseInfrastructureApplicationTargetCriterionJSON struct {
	Port             apijson.Field
	Protocol         apijson.Field
	TargetAttributes apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseInfrastructureApplicationTargetCriterion) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseInfrastructureApplicationTargetCriterionJSON) RawJSON() string {
	return r.raw
}

// The communication protocol your application secures.
type AccessApplicationUpdateResponseInfrastructureApplicationTargetCriteriaProtocol string

const (
	AccessApplicationUpdateResponseInfrastructureApplicationTargetCriteriaProtocolSSH AccessApplicationUpdateResponseInfrastructureApplicationTargetCriteriaProtocol = "SSH"
)

func (r AccessApplicationUpdateResponseInfrastructureApplicationTargetCriteriaProtocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseInfrastructureApplicationTargetCriteriaProtocolSSH:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseInfrastructureApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// The rules that define how users may connect to the targets secured by your
	// application.
	ConnectionRules AccessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRules `json:"connection_rules"`
	CreatedAt       time.Time                                                                       `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// The name of the Access policy.
	Name string `json:"name"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require   []AccessRule                                                       `json:"require"`
	UpdatedAt time.Time                                                          `json:"updated_at" format:"date-time"`
	JSON      accessApplicationUpdateResponseInfrastructureApplicationPolicyJSON `json:"-"`
}

// accessApplicationUpdateResponseInfrastructureApplicationPolicyJSON contains the
// JSON metadata for the struct
// [AccessApplicationUpdateResponseInfrastructureApplicationPolicy]
type accessApplicationUpdateResponseInfrastructureApplicationPolicyJSON struct {
	ID              apijson.Field
	ConnectionRules apijson.Field
	CreatedAt       apijson.Field
	Decision        apijson.Field
	Exclude         apijson.Field
	Include         apijson.Field
	Name            apijson.Field
	Require         apijson.Field
	UpdatedAt       apijson.Field
	raw             string
	ExtraFields     map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseInfrastructureApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseInfrastructureApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// The rules that define how users may connect to the targets secured by your
// application.
type AccessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRules struct {
	// The SSH-specific rules that define how users may connect to the targets secured
	// by your application.
	SSH  AccessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRulesSSH  `json:"ssh"`
	JSON accessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRulesJSON `json:"-"`
}

// accessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRulesJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRules]
type accessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRulesJSON struct {
	SSH         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRules) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRulesJSON) RawJSON() string {
	return r.raw
}

// The SSH-specific rules that define how users may connect to the targets secured
// by your application.
type AccessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRulesSSH struct {
	// Contains the Unix usernames that may be used when connecting over SSH.
	Usernames []string `json:"usernames,required"`
	// Enables using Identity Provider email alias as SSH username.
	AllowEmailAlias bool                                                                                   `json:"allow_email_alias"`
	JSON            accessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON `json:"-"`
}

// accessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRulesSSH]
type accessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON struct {
	Usernames       apijson.Field
	AllowEmailAlias apijson.Field
	raw             string
	ExtraFields     map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRulesSSH) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationUpdateResponseBrowserRdpApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain         string                                                                `json:"domain,required"`
	TargetCriteria []AccessApplicationUpdateResponseBrowserRdpApplicationTargetCriterion `json:"target_criteria,required"`
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationUpdateResponseBrowserRdpApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                         `json:"path_cookie_attribute"`
	Policies            []AccessApplicationUpdateResponseBrowserRdpApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                     `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationUpdateResponseBrowserRdpApplicationJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserRdpApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationUpdateResponseBrowserRdpApplication]
type accessApplicationUpdateResponseBrowserRdpApplicationJSON struct {
	Domain                               apijson.Field
	TargetCriteria                       apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserRdpApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserRdpApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserRdpApplication) implementsAccessApplicationUpdateResponse() {
}

type AccessApplicationUpdateResponseBrowserRdpApplicationTargetCriterion struct {
	// The port that the targets use for the chosen communication protocol. A port
	// cannot be assigned to multiple protocols.
	Port int64 `json:"port,required"`
	// The communication protocol your application secures.
	Protocol AccessApplicationUpdateResponseBrowserRdpApplicationTargetCriteriaProtocol `json:"protocol,required"`
	// Contains a map of target attribute keys to target attribute values.
	TargetAttributes map[string][]string                                                     `json:"target_attributes,required"`
	JSON             accessApplicationUpdateResponseBrowserRdpApplicationTargetCriterionJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserRdpApplicationTargetCriterionJSON contains
// the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserRdpApplicationTargetCriterion]
type accessApplicationUpdateResponseBrowserRdpApplicationTargetCriterionJSON struct {
	Port             apijson.Field
	Protocol         apijson.Field
	TargetAttributes apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserRdpApplicationTargetCriterion) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserRdpApplicationTargetCriterionJSON) RawJSON() string {
	return r.raw
}

// The communication protocol your application secures.
type AccessApplicationUpdateResponseBrowserRdpApplicationTargetCriteriaProtocol string

const (
	AccessApplicationUpdateResponseBrowserRdpApplicationTargetCriteriaProtocolRdp AccessApplicationUpdateResponseBrowserRdpApplicationTargetCriteriaProtocol = "RDP"
)

func (r AccessApplicationUpdateResponseBrowserRdpApplicationTargetCriteriaProtocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserRdpApplicationTargetCriteriaProtocolRdp:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateResponseBrowserRdpApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                               `json:"port_range"`
	Type      AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                              `json:"vnet_id"`
	JSON   accessApplicationUpdateResponseBrowserRdpApplicationDestinationJSON `json:"-"`
	union  AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsUnion
}

// accessApplicationUpdateResponseBrowserRdpApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserRdpApplicationDestination]
type accessApplicationUpdateResponseBrowserRdpApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationUpdateResponseBrowserRdpApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationUpdateResponseBrowserRdpApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationUpdateResponseBrowserRdpApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsUnion]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestination],
// [AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestination],
// [AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationUpdateResponseBrowserRdpApplicationDestination) AsUnion() AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestination],
// [AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsUnion interface {
	implementsAccessApplicationUpdateResponseBrowserRdpApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestination struct {
	Type AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                                `json:"uri"`
	JSON accessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestination]
type accessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestination) implementsAccessApplicationUpdateResponseBrowserRdpApplicationDestination() {
}

type AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestinationTypePublic AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                                 `json:"port_range"`
	Type      AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                                 `json:"vnet_id"`
	JSON   accessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestination]
type accessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestination) implementsAccessApplicationUpdateResponseBrowserRdpApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                            `json:"mcp_server_id"`
	Type        AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationUpdateResponseBrowserRdpApplicationDestination() {
}

type AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsL4Protocol string

const (
	AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsL4ProtocolTCP AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsL4ProtocolUdp AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsL4ProtocolTCP, AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsType string

const (
	AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsTypePublic             AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsType = "public"
	AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsTypePrivate            AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsType = "private"
	AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsTypeViaMcpServerPortal AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsTypePublic, AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsTypePrivate, AccessApplicationUpdateResponseBrowserRdpApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserRdpApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                         `json:"session_duration"`
	UpdatedAt       time.Time                                                      `json:"updated_at" format:"date-time"`
	JSON            accessApplicationUpdateResponseBrowserRdpApplicationPolicyJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserRdpApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationUpdateResponseBrowserRdpApplicationPolicy]
type accessApplicationUpdateResponseBrowserRdpApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserRdpApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserRdpApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                                `json:"mappings"`
	JSON     accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfig]
type accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                                  `json:"user"`
	JSON  accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationUpdateResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationListResponse struct {
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// This field can have the runtime type of [[]AllowedIdPs].
	AllowedIdPs interface{} `json:"allowed_idps"`
	// The image URL of the logo shown in the App Launcher header.
	AppLauncherLogoURL string `json:"app_launcher_logo_url"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The background color of the App Launcher page.
	BgColor     string      `json:"bg_color"`
	CORSHeaders CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// This field can have the runtime type of [[]string].
	CustomPages interface{} `json:"custom_pages"`
	// This field can have the runtime type of
	// [[]AccessApplicationListResponseSelfHostedApplicationDestination],
	// [[]AccessApplicationListResponseBrowserSSHApplicationDestination],
	// [[]AccessApplicationListResponseBrowserVNCApplicationDestination],
	// [[]AccessApplicationListResponseBrowserRdpApplicationDestination].
	Destinations interface{} `json:"destinations"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// This field can have the runtime type of
	// [[]AccessApplicationListResponseAppLauncherApplicationFooterLink].
	FooterLinks interface{} `json:"footer_links"`
	// The background color of the App Launcher header.
	HeaderBgColor string `json:"header_bg_color"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// This field can have the runtime type of
	// [AccessApplicationListResponseAppLauncherApplicationLandingPageDesign].
	LandingPageDesign interface{} `json:"landing_page_design"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool `json:"path_cookie_attribute"`
	// This field can have the runtime type of
	// [[]AccessApplicationListResponseSelfHostedApplicationPolicy],
	// [[]AccessApplicationListResponseSaaSApplicationPolicy],
	// [[]AccessApplicationListResponseBrowserSSHApplicationPolicy],
	// [[]AccessApplicationListResponseBrowserVNCApplicationPolicy],
	// [[]AccessApplicationListResponseAppLauncherApplicationPolicy],
	// [[]AccessApplicationListResponseDeviceEnrollmentPermissionsApplicationPolicy],
	// [[]AccessApplicationListResponseBrowserIsolationPermissionsApplicationPolicy],
	// [[]AccessApplicationListResponseGatewayIdentityProxyEndpointApplicationPolicy],
	// [[]AccessApplicationListResponseBookmarkApplicationPolicy],
	// [[]AccessApplicationListResponseInfrastructureApplicationPolicy],
	// [[]AccessApplicationListResponseBrowserRdpApplicationPolicy].
	Policies interface{} `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// This field can have the runtime type of
	// [AccessApplicationListResponseSaaSApplicationSaaSApp].
	SaaSApp interface{} `json:"saas_app"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// This field can have the runtime type of
	// [AccessApplicationListResponseSelfHostedApplicationSCIMConfig],
	// [AccessApplicationListResponseSaaSApplicationSCIMConfig],
	// [AccessApplicationListResponseBrowserSSHApplicationSCIMConfig],
	// [AccessApplicationListResponseBrowserVNCApplicationSCIMConfig],
	// [AccessApplicationListResponseBrowserRdpApplicationSCIMConfig].
	SCIMConfig interface{} `json:"scim_config"`
	// This field can have the runtime type of [[]SelfHostedDomains].
	SelfHostedDomains interface{} `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Determines when to skip the App Launcher landing page.
	SkipAppLauncherLoginPage bool `json:"skip_app_launcher_login_page"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// This field can have the runtime type of [[]string].
	Tags interface{} `json:"tags"`
	// This field can have the runtime type of
	// [[]AccessApplicationListResponseInfrastructureApplicationTargetCriterion],
	// [[]AccessApplicationListResponseBrowserRdpApplicationTargetCriterion].
	TargetCriteria interface{} `json:"target_criteria"`
	// The application type.
	Type ApplicationType `json:"type"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                              `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationListResponseJSON `json:"-"`
	union                                AccessApplicationListResponseUnion
}

// accessApplicationListResponseJSON contains the JSON metadata for the struct
// [AccessApplicationListResponse]
type accessApplicationListResponseJSON struct {
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherLogoURL                   apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	BgColor                              apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	Domain                               apijson.Field
	EnableBindingCookie                  apijson.Field
	FooterLinks                          apijson.Field
	HeaderBgColor                        apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LandingPageDesign                    apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SaaSApp                              apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipAppLauncherLoginPage             apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	TargetCriteria                       apijson.Field
	Type                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r accessApplicationListResponseJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationListResponse) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationListResponse{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a [AccessApplicationListResponseUnion] interface which you can
// cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationListResponseSelfHostedApplication],
// [AccessApplicationListResponseSaaSApplication],
// [AccessApplicationListResponseBrowserSSHApplication],
// [AccessApplicationListResponseBrowserVNCApplication],
// [AccessApplicationListResponseAppLauncherApplication],
// [AccessApplicationListResponseDeviceEnrollmentPermissionsApplication],
// [AccessApplicationListResponseBrowserIsolationPermissionsApplication],
// [AccessApplicationListResponseGatewayIdentityProxyEndpointApplication],
// [AccessApplicationListResponseBookmarkApplication],
// [AccessApplicationListResponseInfrastructureApplication],
// [AccessApplicationListResponseBrowserRdpApplication].
func (r AccessApplicationListResponse) AsUnion() AccessApplicationListResponseUnion {
	return r.union
}

// Union satisfied by [AccessApplicationListResponseSelfHostedApplication],
// [AccessApplicationListResponseSaaSApplication],
// [AccessApplicationListResponseBrowserSSHApplication],
// [AccessApplicationListResponseBrowserVNCApplication],
// [AccessApplicationListResponseAppLauncherApplication],
// [AccessApplicationListResponseDeviceEnrollmentPermissionsApplication],
// [AccessApplicationListResponseBrowserIsolationPermissionsApplication],
// [AccessApplicationListResponseGatewayIdentityProxyEndpointApplication],
// [AccessApplicationListResponseBookmarkApplication],
// [AccessApplicationListResponseInfrastructureApplication] or
// [AccessApplicationListResponseBrowserRdpApplication].
type AccessApplicationListResponseUnion interface {
	implementsAccessApplicationListResponse()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseSelfHostedApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseSaaSApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserSSHApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserVNCApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseAppLauncherApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseDeviceEnrollmentPermissionsApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserIsolationPermissionsApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseGatewayIdentityProxyEndpointApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBookmarkApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseInfrastructureApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserRdpApplication{}),
		},
	)
}

type AccessApplicationListResponseSelfHostedApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain,required"`
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationListResponseSelfHostedApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                       `json:"path_cookie_attribute"`
	Policies            []AccessApplicationListResponseSelfHostedApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationListResponseSelfHostedApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                   `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationListResponseSelfHostedApplicationJSON `json:"-"`
}

// accessApplicationListResponseSelfHostedApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationListResponseSelfHostedApplication]
type accessApplicationListResponseSelfHostedApplicationJSON struct {
	Domain                               apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationListResponseSelfHostedApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseSelfHostedApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseSelfHostedApplication) implementsAccessApplicationListResponse() {
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationListResponseSelfHostedApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationListResponseSelfHostedApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                             `json:"port_range"`
	Type      AccessApplicationListResponseSelfHostedApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                            `json:"vnet_id"`
	JSON   accessApplicationListResponseSelfHostedApplicationDestinationJSON `json:"-"`
	union  AccessApplicationListResponseSelfHostedApplicationDestinationsUnion
}

// accessApplicationListResponseSelfHostedApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationListResponseSelfHostedApplicationDestination]
type accessApplicationListResponseSelfHostedApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationListResponseSelfHostedApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationListResponseSelfHostedApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationListResponseSelfHostedApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationListResponseSelfHostedApplicationDestinationsUnion] interface
// which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationListResponseSelfHostedApplicationDestinationsPublicDestination],
// [AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestination],
// [AccessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationListResponseSelfHostedApplicationDestination) AsUnion() AccessApplicationListResponseSelfHostedApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationListResponseSelfHostedApplicationDestinationsPublicDestination],
// [AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationListResponseSelfHostedApplicationDestinationsUnion interface {
	implementsAccessApplicationListResponseSelfHostedApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseSelfHostedApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseSelfHostedApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationListResponseSelfHostedApplicationDestinationsPublicDestination struct {
	Type AccessApplicationListResponseSelfHostedApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                              `json:"uri"`
	JSON accessApplicationListResponseSelfHostedApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationListResponseSelfHostedApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseSelfHostedApplicationDestinationsPublicDestination]
type accessApplicationListResponseSelfHostedApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationListResponseSelfHostedApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseSelfHostedApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseSelfHostedApplicationDestinationsPublicDestination) implementsAccessApplicationListResponseSelfHostedApplicationDestination() {
}

type AccessApplicationListResponseSelfHostedApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationListResponseSelfHostedApplicationDestinationsPublicDestinationTypePublic AccessApplicationListResponseSelfHostedApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationListResponseSelfHostedApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseSelfHostedApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                               `json:"port_range"`
	Type      AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                               `json:"vnet_id"`
	JSON   accessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestination]
type accessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestination) implementsAccessApplicationListResponseSelfHostedApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseSelfHostedApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                          `json:"mcp_server_id"`
	Type        AccessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationListResponseSelfHostedApplicationDestination() {
}

type AccessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationListResponseSelfHostedApplicationDestinationsL4Protocol string

const (
	AccessApplicationListResponseSelfHostedApplicationDestinationsL4ProtocolTCP AccessApplicationListResponseSelfHostedApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationListResponseSelfHostedApplicationDestinationsL4ProtocolUdp AccessApplicationListResponseSelfHostedApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationListResponseSelfHostedApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseSelfHostedApplicationDestinationsL4ProtocolTCP, AccessApplicationListResponseSelfHostedApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationListResponseSelfHostedApplicationDestinationsType string

const (
	AccessApplicationListResponseSelfHostedApplicationDestinationsTypePublic             AccessApplicationListResponseSelfHostedApplicationDestinationsType = "public"
	AccessApplicationListResponseSelfHostedApplicationDestinationsTypePrivate            AccessApplicationListResponseSelfHostedApplicationDestinationsType = "private"
	AccessApplicationListResponseSelfHostedApplicationDestinationsTypeViaMcpServerPortal AccessApplicationListResponseSelfHostedApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationListResponseSelfHostedApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseSelfHostedApplicationDestinationsTypePublic, AccessApplicationListResponseSelfHostedApplicationDestinationsTypePrivate, AccessApplicationListResponseSelfHostedApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationListResponseSelfHostedApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                       `json:"session_duration"`
	UpdatedAt       time.Time                                                    `json:"updated_at" format:"date-time"`
	JSON            accessApplicationListResponseSelfHostedApplicationPolicyJSON `json:"-"`
}

// accessApplicationListResponseSelfHostedApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationListResponseSelfHostedApplicationPolicy]
type accessApplicationListResponseSelfHostedApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationListResponseSelfHostedApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseSelfHostedApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationListResponseSelfHostedApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                              `json:"mappings"`
	JSON     accessApplicationListResponseSelfHostedApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationListResponseSelfHostedApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationListResponseSelfHostedApplicationSCIMConfig]
type accessApplicationListResponseSelfHostedApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationListResponseSelfHostedApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseSelfHostedApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                                `json:"user"`
	JSON  accessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationListResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationListResponseSaaSApplication struct {
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name     string                                               `json:"name"`
	Policies []AccessApplicationListResponseSaaSApplicationPolicy `json:"policies"`
	SaaSApp  AccessApplicationListResponseSaaSApplicationSaaSApp  `json:"saas_app"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationListResponseSaaSApplicationSCIMConfig `json:"scim_config"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// The application type.
	Type ApplicationType                                  `json:"type"`
	JSON accessApplicationListResponseSaaSApplicationJSON `json:"-"`
}

// accessApplicationListResponseSaaSApplicationJSON contains the JSON metadata for
// the struct [AccessApplicationListResponseSaaSApplication]
type accessApplicationListResponseSaaSApplicationJSON struct {
	ID                     apijson.Field
	AllowedIdPs            apijson.Field
	AppLauncherVisible     apijson.Field
	AUD                    apijson.Field
	AutoRedirectToIdentity apijson.Field
	CustomPages            apijson.Field
	LogoURL                apijson.Field
	Name                   apijson.Field
	Policies               apijson.Field
	SaaSApp                apijson.Field
	SCIMConfig             apijson.Field
	Tags                   apijson.Field
	Type                   apijson.Field
	raw                    string
	ExtraFields            map[string]apijson.Field
}

func (r *AccessApplicationListResponseSaaSApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseSaaSApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseSaaSApplication) implementsAccessApplicationListResponse() {}

type AccessApplicationListResponseSaaSApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                 `json:"session_duration"`
	UpdatedAt       time.Time                                              `json:"updated_at" format:"date-time"`
	JSON            accessApplicationListResponseSaaSApplicationPolicyJSON `json:"-"`
}

// accessApplicationListResponseSaaSApplicationPolicyJSON contains the JSON
// metadata for the struct [AccessApplicationListResponseSaaSApplicationPolicy]
type accessApplicationListResponseSaaSApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationListResponseSaaSApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseSaaSApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationListResponseSaaSApplicationSaaSApp struct {
	// The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must
	// be greater than or equal to 1m and less than or equal to 24h.
	AccessTokenLifetime string `json:"access_token_lifetime"`
	// If client secret should be required on the token endpoint when
	// authorization_code_with_pkce grant is used.
	AllowPKCEWithoutClientSecret bool `json:"allow_pkce_without_client_secret"`
	// The URL where this applications tile redirects users
	AppLauncherURL string `json:"app_launcher_url"`
	// Optional identifier indicating the authentication protocol used for the saas
	// app. Required for OIDC. Default if unset is "saml"
	AuthType AccessApplicationListResponseSaaSApplicationSaaSAppAuthType `json:"auth_type"`
	// The application client id
	ClientID string `json:"client_id"`
	// The application client secret, only returned on POST request.
	ClientSecret string `json:"client_secret"`
	// The service provider's endpoint that is responsible for receiving and parsing a
	// SAML assertion.
	ConsumerServiceURL string `json:"consumer_service_url"`
	// This field can have the runtime type of [[]SAMLSaaSAppCustomAttribute].
	CustomAttributes interface{} `json:"custom_attributes"`
	// This field can have the runtime type of [[]OIDCSaaSAppCustomClaim].
	CustomClaims interface{} `json:"custom_claims"`
	// The URL that the user will be redirected to after a successful login for IDP
	// initiated logins.
	DefaultRelayState string `json:"default_relay_state"`
	// This field can have the runtime type of [[]OIDCSaaSAppGrantType].
	GrantTypes interface{} `json:"grant_types"`
	// A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
	GroupFilterRegex string `json:"group_filter_regex"`
	// This field can have the runtime type of [OIDCSaaSAppHybridAndImplicitOptions].
	HybridAndImplicitOptions interface{} `json:"hybrid_and_implicit_options"`
	// The unique identifier for your SaaS application.
	IdPEntityID string `json:"idp_entity_id"`
	// The format of the name identifier sent to the SaaS application.
	NameIDFormat SaaSAppNameIDFormat `json:"name_id_format"`
	// A [JSONata](https://jsonata.org/) expression that transforms an application's
	// user identities into a NameID value for its SAML assertion. This expression
	// should evaluate to a singular string. The output of this expression can override
	// the `name_id_format` setting.
	NameIDTransformJsonata string `json:"name_id_transform_jsonata"`
	// The Access public certificate that will be used to verify your identity.
	PublicKey string `json:"public_key"`
	// This field can have the runtime type of [[]string].
	RedirectURIs interface{} `json:"redirect_uris"`
	// This field can have the runtime type of [OIDCSaaSAppRefreshTokenOptions].
	RefreshTokenOptions interface{} `json:"refresh_token_options"`
	// A [JSONata] (https://jsonata.org/) expression that transforms an application's
	// user identities into attribute assertions in the SAML response. The expression
	// can transform id, email, name, and groups values. It can also transform fields
	// listed in the saml_attributes or oidc_fields of the identity provider used to
	// authenticate. The output of this expression must be a JSON object.
	SAMLAttributeTransformJsonata string `json:"saml_attribute_transform_jsonata"`
	// This field can have the runtime type of [[]OIDCSaaSAppScope].
	Scopes interface{} `json:"scopes"`
	// A globally unique name for an identity or service provider.
	SPEntityID string `json:"sp_entity_id"`
	// The endpoint where your SaaS application will send login requests.
	SSOEndpoint string                                                  `json:"sso_endpoint"`
	JSON        accessApplicationListResponseSaaSApplicationSaaSAppJSON `json:"-"`
	union       AccessApplicationListResponseSaaSApplicationSaaSAppUnion
}

// accessApplicationListResponseSaaSApplicationSaaSAppJSON contains the JSON
// metadata for the struct [AccessApplicationListResponseSaaSApplicationSaaSApp]
type accessApplicationListResponseSaaSApplicationSaaSAppJSON struct {
	AccessTokenLifetime           apijson.Field
	AllowPKCEWithoutClientSecret  apijson.Field
	AppLauncherURL                apijson.Field
	AuthType                      apijson.Field
	ClientID                      apijson.Field
	ClientSecret                  apijson.Field
	ConsumerServiceURL            apijson.Field
	CustomAttributes              apijson.Field
	CustomClaims                  apijson.Field
	DefaultRelayState             apijson.Field
	GrantTypes                    apijson.Field
	GroupFilterRegex              apijson.Field
	HybridAndImplicitOptions      apijson.Field
	IdPEntityID                   apijson.Field
	NameIDFormat                  apijson.Field
	NameIDTransformJsonata        apijson.Field
	PublicKey                     apijson.Field
	RedirectURIs                  apijson.Field
	RefreshTokenOptions           apijson.Field
	SAMLAttributeTransformJsonata apijson.Field
	Scopes                        apijson.Field
	SPEntityID                    apijson.Field
	SSOEndpoint                   apijson.Field
	raw                           string
	ExtraFields                   map[string]apijson.Field
}

func (r accessApplicationListResponseSaaSApplicationSaaSAppJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationListResponseSaaSApplicationSaaSApp) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationListResponseSaaSApplicationSaaSApp{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a [AccessApplicationListResponseSaaSApplicationSaaSAppUnion]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SAMLSaaSApp], [OIDCSaaSApp].
func (r AccessApplicationListResponseSaaSApplicationSaaSApp) AsUnion() AccessApplicationListResponseSaaSApplicationSaaSAppUnion {
	return r.union
}

// Union satisfied by [SAMLSaaSApp] or [OIDCSaaSApp].
type AccessApplicationListResponseSaaSApplicationSaaSAppUnion interface {
	implementsAccessApplicationListResponseSaaSApplicationSaaSApp()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseSaaSApplicationSaaSAppUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SAMLSaaSApp{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(OIDCSaaSApp{}),
		},
	)
}

// Optional identifier indicating the authentication protocol used for the saas
// app. Required for OIDC. Default if unset is "saml"
type AccessApplicationListResponseSaaSApplicationSaaSAppAuthType string

const (
	AccessApplicationListResponseSaaSApplicationSaaSAppAuthTypeSAML AccessApplicationListResponseSaaSApplicationSaaSAppAuthType = "saml"
	AccessApplicationListResponseSaaSApplicationSaaSAppAuthTypeOIDC AccessApplicationListResponseSaaSApplicationSaaSAppAuthType = "oidc"
)

func (r AccessApplicationListResponseSaaSApplicationSaaSAppAuthType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseSaaSApplicationSaaSAppAuthTypeSAML, AccessApplicationListResponseSaaSApplicationSaaSAppAuthTypeOIDC:
		return true
	}
	return false
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationListResponseSaaSApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                        `json:"mappings"`
	JSON     accessApplicationListResponseSaaSApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationListResponseSaaSApplicationSCIMConfigJSON contains the JSON
// metadata for the struct [AccessApplicationListResponseSaaSApplicationSCIMConfig]
type accessApplicationListResponseSaaSApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationListResponseSaaSApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseSaaSApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                          `json:"user"`
	JSON  accessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationListResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserSSHApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain,required"`
	// The application type.
	Type AccessApplicationListResponseBrowserSSHApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationListResponseBrowserSSHApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                       `json:"path_cookie_attribute"`
	Policies            []AccessApplicationListResponseBrowserSSHApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationListResponseBrowserSSHApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                   `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationListResponseBrowserSSHApplicationJSON `json:"-"`
}

// accessApplicationListResponseBrowserSSHApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationListResponseBrowserSSHApplication]
type accessApplicationListResponseBrowserSSHApplicationJSON struct {
	Domain                               apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserSSHApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserSSHApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserSSHApplication) implementsAccessApplicationListResponse() {
}

// The application type.
type AccessApplicationListResponseBrowserSSHApplicationType string

const (
	AccessApplicationListResponseBrowserSSHApplicationTypeSelfHosted     AccessApplicationListResponseBrowserSSHApplicationType = "self_hosted"
	AccessApplicationListResponseBrowserSSHApplicationTypeSaaS           AccessApplicationListResponseBrowserSSHApplicationType = "saas"
	AccessApplicationListResponseBrowserSSHApplicationTypeSSH            AccessApplicationListResponseBrowserSSHApplicationType = "ssh"
	AccessApplicationListResponseBrowserSSHApplicationTypeVNC            AccessApplicationListResponseBrowserSSHApplicationType = "vnc"
	AccessApplicationListResponseBrowserSSHApplicationTypeAppLauncher    AccessApplicationListResponseBrowserSSHApplicationType = "app_launcher"
	AccessApplicationListResponseBrowserSSHApplicationTypeWARP           AccessApplicationListResponseBrowserSSHApplicationType = "warp"
	AccessApplicationListResponseBrowserSSHApplicationTypeBISO           AccessApplicationListResponseBrowserSSHApplicationType = "biso"
	AccessApplicationListResponseBrowserSSHApplicationTypeBookmark       AccessApplicationListResponseBrowserSSHApplicationType = "bookmark"
	AccessApplicationListResponseBrowserSSHApplicationTypeDashSSO        AccessApplicationListResponseBrowserSSHApplicationType = "dash_sso"
	AccessApplicationListResponseBrowserSSHApplicationTypeInfrastructure AccessApplicationListResponseBrowserSSHApplicationType = "infrastructure"
	AccessApplicationListResponseBrowserSSHApplicationTypeRdp            AccessApplicationListResponseBrowserSSHApplicationType = "rdp"
	AccessApplicationListResponseBrowserSSHApplicationTypeMcp            AccessApplicationListResponseBrowserSSHApplicationType = "mcp"
	AccessApplicationListResponseBrowserSSHApplicationTypeMcpPortal      AccessApplicationListResponseBrowserSSHApplicationType = "mcp_portal"
	AccessApplicationListResponseBrowserSSHApplicationTypeProxyEndpoint  AccessApplicationListResponseBrowserSSHApplicationType = "proxy_endpoint"
)

func (r AccessApplicationListResponseBrowserSSHApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserSSHApplicationTypeSelfHosted, AccessApplicationListResponseBrowserSSHApplicationTypeSaaS, AccessApplicationListResponseBrowserSSHApplicationTypeSSH, AccessApplicationListResponseBrowserSSHApplicationTypeVNC, AccessApplicationListResponseBrowserSSHApplicationTypeAppLauncher, AccessApplicationListResponseBrowserSSHApplicationTypeWARP, AccessApplicationListResponseBrowserSSHApplicationTypeBISO, AccessApplicationListResponseBrowserSSHApplicationTypeBookmark, AccessApplicationListResponseBrowserSSHApplicationTypeDashSSO, AccessApplicationListResponseBrowserSSHApplicationTypeInfrastructure, AccessApplicationListResponseBrowserSSHApplicationTypeRdp, AccessApplicationListResponseBrowserSSHApplicationTypeMcp, AccessApplicationListResponseBrowserSSHApplicationTypeMcpPortal, AccessApplicationListResponseBrowserSSHApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationListResponseBrowserSSHApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationListResponseBrowserSSHApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                             `json:"port_range"`
	Type      AccessApplicationListResponseBrowserSSHApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                            `json:"vnet_id"`
	JSON   accessApplicationListResponseBrowserSSHApplicationDestinationJSON `json:"-"`
	union  AccessApplicationListResponseBrowserSSHApplicationDestinationsUnion
}

// accessApplicationListResponseBrowserSSHApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationListResponseBrowserSSHApplicationDestination]
type accessApplicationListResponseBrowserSSHApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationListResponseBrowserSSHApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationListResponseBrowserSSHApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationListResponseBrowserSSHApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationListResponseBrowserSSHApplicationDestinationsUnion] interface
// which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestination],
// [AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestination],
// [AccessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationListResponseBrowserSSHApplicationDestination) AsUnion() AccessApplicationListResponseBrowserSSHApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestination],
// [AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationListResponseBrowserSSHApplicationDestinationsUnion interface {
	implementsAccessApplicationListResponseBrowserSSHApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseBrowserSSHApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestination struct {
	Type AccessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                              `json:"uri"`
	JSON accessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestination]
type accessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestination) implementsAccessApplicationListResponseBrowserSSHApplicationDestination() {
}

type AccessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestinationTypePublic AccessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserSSHApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                               `json:"port_range"`
	Type      AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                               `json:"vnet_id"`
	JSON   accessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestination]
type accessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestination) implementsAccessApplicationListResponseBrowserSSHApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserSSHApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                          `json:"mcp_server_id"`
	Type        AccessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationListResponseBrowserSSHApplicationDestination() {
}

type AccessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationListResponseBrowserSSHApplicationDestinationsL4Protocol string

const (
	AccessApplicationListResponseBrowserSSHApplicationDestinationsL4ProtocolTCP AccessApplicationListResponseBrowserSSHApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationListResponseBrowserSSHApplicationDestinationsL4ProtocolUdp AccessApplicationListResponseBrowserSSHApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationListResponseBrowserSSHApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserSSHApplicationDestinationsL4ProtocolTCP, AccessApplicationListResponseBrowserSSHApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserSSHApplicationDestinationsType string

const (
	AccessApplicationListResponseBrowserSSHApplicationDestinationsTypePublic             AccessApplicationListResponseBrowserSSHApplicationDestinationsType = "public"
	AccessApplicationListResponseBrowserSSHApplicationDestinationsTypePrivate            AccessApplicationListResponseBrowserSSHApplicationDestinationsType = "private"
	AccessApplicationListResponseBrowserSSHApplicationDestinationsTypeViaMcpServerPortal AccessApplicationListResponseBrowserSSHApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationListResponseBrowserSSHApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserSSHApplicationDestinationsTypePublic, AccessApplicationListResponseBrowserSSHApplicationDestinationsTypePrivate, AccessApplicationListResponseBrowserSSHApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserSSHApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                       `json:"session_duration"`
	UpdatedAt       time.Time                                                    `json:"updated_at" format:"date-time"`
	JSON            accessApplicationListResponseBrowserSSHApplicationPolicyJSON `json:"-"`
}

// accessApplicationListResponseBrowserSSHApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationListResponseBrowserSSHApplicationPolicy]
type accessApplicationListResponseBrowserSSHApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserSSHApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserSSHApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationListResponseBrowserSSHApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                              `json:"mappings"`
	JSON     accessApplicationListResponseBrowserSSHApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationListResponseBrowserSSHApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationListResponseBrowserSSHApplicationSCIMConfig]
type accessApplicationListResponseBrowserSSHApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserSSHApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserSSHApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                                `json:"user"`
	JSON  accessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationListResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserVNCApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain,required"`
	// The application type.
	Type AccessApplicationListResponseBrowserVNCApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationListResponseBrowserVNCApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                       `json:"path_cookie_attribute"`
	Policies            []AccessApplicationListResponseBrowserVNCApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationListResponseBrowserVNCApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                   `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationListResponseBrowserVNCApplicationJSON `json:"-"`
}

// accessApplicationListResponseBrowserVNCApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationListResponseBrowserVNCApplication]
type accessApplicationListResponseBrowserVNCApplicationJSON struct {
	Domain                               apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserVNCApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserVNCApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserVNCApplication) implementsAccessApplicationListResponse() {
}

// The application type.
type AccessApplicationListResponseBrowserVNCApplicationType string

const (
	AccessApplicationListResponseBrowserVNCApplicationTypeSelfHosted     AccessApplicationListResponseBrowserVNCApplicationType = "self_hosted"
	AccessApplicationListResponseBrowserVNCApplicationTypeSaaS           AccessApplicationListResponseBrowserVNCApplicationType = "saas"
	AccessApplicationListResponseBrowserVNCApplicationTypeSSH            AccessApplicationListResponseBrowserVNCApplicationType = "ssh"
	AccessApplicationListResponseBrowserVNCApplicationTypeVNC            AccessApplicationListResponseBrowserVNCApplicationType = "vnc"
	AccessApplicationListResponseBrowserVNCApplicationTypeAppLauncher    AccessApplicationListResponseBrowserVNCApplicationType = "app_launcher"
	AccessApplicationListResponseBrowserVNCApplicationTypeWARP           AccessApplicationListResponseBrowserVNCApplicationType = "warp"
	AccessApplicationListResponseBrowserVNCApplicationTypeBISO           AccessApplicationListResponseBrowserVNCApplicationType = "biso"
	AccessApplicationListResponseBrowserVNCApplicationTypeBookmark       AccessApplicationListResponseBrowserVNCApplicationType = "bookmark"
	AccessApplicationListResponseBrowserVNCApplicationTypeDashSSO        AccessApplicationListResponseBrowserVNCApplicationType = "dash_sso"
	AccessApplicationListResponseBrowserVNCApplicationTypeInfrastructure AccessApplicationListResponseBrowserVNCApplicationType = "infrastructure"
	AccessApplicationListResponseBrowserVNCApplicationTypeRdp            AccessApplicationListResponseBrowserVNCApplicationType = "rdp"
	AccessApplicationListResponseBrowserVNCApplicationTypeMcp            AccessApplicationListResponseBrowserVNCApplicationType = "mcp"
	AccessApplicationListResponseBrowserVNCApplicationTypeMcpPortal      AccessApplicationListResponseBrowserVNCApplicationType = "mcp_portal"
	AccessApplicationListResponseBrowserVNCApplicationTypeProxyEndpoint  AccessApplicationListResponseBrowserVNCApplicationType = "proxy_endpoint"
)

func (r AccessApplicationListResponseBrowserVNCApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserVNCApplicationTypeSelfHosted, AccessApplicationListResponseBrowserVNCApplicationTypeSaaS, AccessApplicationListResponseBrowserVNCApplicationTypeSSH, AccessApplicationListResponseBrowserVNCApplicationTypeVNC, AccessApplicationListResponseBrowserVNCApplicationTypeAppLauncher, AccessApplicationListResponseBrowserVNCApplicationTypeWARP, AccessApplicationListResponseBrowserVNCApplicationTypeBISO, AccessApplicationListResponseBrowserVNCApplicationTypeBookmark, AccessApplicationListResponseBrowserVNCApplicationTypeDashSSO, AccessApplicationListResponseBrowserVNCApplicationTypeInfrastructure, AccessApplicationListResponseBrowserVNCApplicationTypeRdp, AccessApplicationListResponseBrowserVNCApplicationTypeMcp, AccessApplicationListResponseBrowserVNCApplicationTypeMcpPortal, AccessApplicationListResponseBrowserVNCApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationListResponseBrowserVNCApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationListResponseBrowserVNCApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                             `json:"port_range"`
	Type      AccessApplicationListResponseBrowserVNCApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                            `json:"vnet_id"`
	JSON   accessApplicationListResponseBrowserVNCApplicationDestinationJSON `json:"-"`
	union  AccessApplicationListResponseBrowserVNCApplicationDestinationsUnion
}

// accessApplicationListResponseBrowserVNCApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationListResponseBrowserVNCApplicationDestination]
type accessApplicationListResponseBrowserVNCApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationListResponseBrowserVNCApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationListResponseBrowserVNCApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationListResponseBrowserVNCApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationListResponseBrowserVNCApplicationDestinationsUnion] interface
// which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestination],
// [AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestination],
// [AccessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationListResponseBrowserVNCApplicationDestination) AsUnion() AccessApplicationListResponseBrowserVNCApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestination],
// [AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationListResponseBrowserVNCApplicationDestinationsUnion interface {
	implementsAccessApplicationListResponseBrowserVNCApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseBrowserVNCApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestination struct {
	Type AccessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                              `json:"uri"`
	JSON accessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestination]
type accessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestination) implementsAccessApplicationListResponseBrowserVNCApplicationDestination() {
}

type AccessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestinationTypePublic AccessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserVNCApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                               `json:"port_range"`
	Type      AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                               `json:"vnet_id"`
	JSON   accessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestination]
type accessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestination) implementsAccessApplicationListResponseBrowserVNCApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserVNCApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                          `json:"mcp_server_id"`
	Type        AccessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationListResponseBrowserVNCApplicationDestination() {
}

type AccessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationListResponseBrowserVNCApplicationDestinationsL4Protocol string

const (
	AccessApplicationListResponseBrowserVNCApplicationDestinationsL4ProtocolTCP AccessApplicationListResponseBrowserVNCApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationListResponseBrowserVNCApplicationDestinationsL4ProtocolUdp AccessApplicationListResponseBrowserVNCApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationListResponseBrowserVNCApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserVNCApplicationDestinationsL4ProtocolTCP, AccessApplicationListResponseBrowserVNCApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserVNCApplicationDestinationsType string

const (
	AccessApplicationListResponseBrowserVNCApplicationDestinationsTypePublic             AccessApplicationListResponseBrowserVNCApplicationDestinationsType = "public"
	AccessApplicationListResponseBrowserVNCApplicationDestinationsTypePrivate            AccessApplicationListResponseBrowserVNCApplicationDestinationsType = "private"
	AccessApplicationListResponseBrowserVNCApplicationDestinationsTypeViaMcpServerPortal AccessApplicationListResponseBrowserVNCApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationListResponseBrowserVNCApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserVNCApplicationDestinationsTypePublic, AccessApplicationListResponseBrowserVNCApplicationDestinationsTypePrivate, AccessApplicationListResponseBrowserVNCApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserVNCApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                       `json:"session_duration"`
	UpdatedAt       time.Time                                                    `json:"updated_at" format:"date-time"`
	JSON            accessApplicationListResponseBrowserVNCApplicationPolicyJSON `json:"-"`
}

// accessApplicationListResponseBrowserVNCApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationListResponseBrowserVNCApplicationPolicy]
type accessApplicationListResponseBrowserVNCApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserVNCApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserVNCApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationListResponseBrowserVNCApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                              `json:"mappings"`
	JSON     accessApplicationListResponseBrowserVNCApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationListResponseBrowserVNCApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationListResponseBrowserVNCApplicationSCIMConfig]
type accessApplicationListResponseBrowserVNCApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserVNCApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserVNCApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                                `json:"user"`
	JSON  accessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationListResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationListResponseAppLauncherApplication struct {
	// The application type.
	Type AccessApplicationListResponseAppLauncherApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// The image URL of the logo shown in the App Launcher header.
	AppLauncherLogoURL string `json:"app_launcher_logo_url"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The background color of the App Launcher page.
	BgColor string `json:"bg_color"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// The links in the App Launcher footer.
	FooterLinks []AccessApplicationListResponseAppLauncherApplicationFooterLink `json:"footer_links"`
	// The background color of the App Launcher header.
	HeaderBgColor string `json:"header_bg_color"`
	// The design of the App Launcher landing page shown to users when they log in.
	LandingPageDesign AccessApplicationListResponseAppLauncherApplicationLandingPageDesign `json:"landing_page_design"`
	// The name of the application.
	Name     string                                                      `json:"name"`
	Policies []AccessApplicationListResponseAppLauncherApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Determines when to skip the App Launcher landing page.
	SkipAppLauncherLoginPage bool                                                    `json:"skip_app_launcher_login_page"`
	JSON                     accessApplicationListResponseAppLauncherApplicationJSON `json:"-"`
}

// accessApplicationListResponseAppLauncherApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationListResponseAppLauncherApplication]
type accessApplicationListResponseAppLauncherApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AppLauncherLogoURL       apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	BgColor                  apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	FooterLinks              apijson.Field
	HeaderBgColor            apijson.Field
	LandingPageDesign        apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	SkipAppLauncherLoginPage apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationListResponseAppLauncherApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseAppLauncherApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseAppLauncherApplication) implementsAccessApplicationListResponse() {
}

// The application type.
type AccessApplicationListResponseAppLauncherApplicationType string

const (
	AccessApplicationListResponseAppLauncherApplicationTypeSelfHosted     AccessApplicationListResponseAppLauncherApplicationType = "self_hosted"
	AccessApplicationListResponseAppLauncherApplicationTypeSaaS           AccessApplicationListResponseAppLauncherApplicationType = "saas"
	AccessApplicationListResponseAppLauncherApplicationTypeSSH            AccessApplicationListResponseAppLauncherApplicationType = "ssh"
	AccessApplicationListResponseAppLauncherApplicationTypeVNC            AccessApplicationListResponseAppLauncherApplicationType = "vnc"
	AccessApplicationListResponseAppLauncherApplicationTypeAppLauncher    AccessApplicationListResponseAppLauncherApplicationType = "app_launcher"
	AccessApplicationListResponseAppLauncherApplicationTypeWARP           AccessApplicationListResponseAppLauncherApplicationType = "warp"
	AccessApplicationListResponseAppLauncherApplicationTypeBISO           AccessApplicationListResponseAppLauncherApplicationType = "biso"
	AccessApplicationListResponseAppLauncherApplicationTypeBookmark       AccessApplicationListResponseAppLauncherApplicationType = "bookmark"
	AccessApplicationListResponseAppLauncherApplicationTypeDashSSO        AccessApplicationListResponseAppLauncherApplicationType = "dash_sso"
	AccessApplicationListResponseAppLauncherApplicationTypeInfrastructure AccessApplicationListResponseAppLauncherApplicationType = "infrastructure"
	AccessApplicationListResponseAppLauncherApplicationTypeRdp            AccessApplicationListResponseAppLauncherApplicationType = "rdp"
	AccessApplicationListResponseAppLauncherApplicationTypeMcp            AccessApplicationListResponseAppLauncherApplicationType = "mcp"
	AccessApplicationListResponseAppLauncherApplicationTypeMcpPortal      AccessApplicationListResponseAppLauncherApplicationType = "mcp_portal"
	AccessApplicationListResponseAppLauncherApplicationTypeProxyEndpoint  AccessApplicationListResponseAppLauncherApplicationType = "proxy_endpoint"
)

func (r AccessApplicationListResponseAppLauncherApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseAppLauncherApplicationTypeSelfHosted, AccessApplicationListResponseAppLauncherApplicationTypeSaaS, AccessApplicationListResponseAppLauncherApplicationTypeSSH, AccessApplicationListResponseAppLauncherApplicationTypeVNC, AccessApplicationListResponseAppLauncherApplicationTypeAppLauncher, AccessApplicationListResponseAppLauncherApplicationTypeWARP, AccessApplicationListResponseAppLauncherApplicationTypeBISO, AccessApplicationListResponseAppLauncherApplicationTypeBookmark, AccessApplicationListResponseAppLauncherApplicationTypeDashSSO, AccessApplicationListResponseAppLauncherApplicationTypeInfrastructure, AccessApplicationListResponseAppLauncherApplicationTypeRdp, AccessApplicationListResponseAppLauncherApplicationTypeMcp, AccessApplicationListResponseAppLauncherApplicationTypeMcpPortal, AccessApplicationListResponseAppLauncherApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

type AccessApplicationListResponseAppLauncherApplicationFooterLink struct {
	// The hypertext in the footer link.
	Name string `json:"name,required"`
	// the hyperlink in the footer link.
	URL  string                                                            `json:"url,required"`
	JSON accessApplicationListResponseAppLauncherApplicationFooterLinkJSON `json:"-"`
}

// accessApplicationListResponseAppLauncherApplicationFooterLinkJSON contains the
// JSON metadata for the struct
// [AccessApplicationListResponseAppLauncherApplicationFooterLink]
type accessApplicationListResponseAppLauncherApplicationFooterLinkJSON struct {
	Name        apijson.Field
	URL         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationListResponseAppLauncherApplicationFooterLink) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseAppLauncherApplicationFooterLinkJSON) RawJSON() string {
	return r.raw
}

// The design of the App Launcher landing page shown to users when they log in.
type AccessApplicationListResponseAppLauncherApplicationLandingPageDesign struct {
	// The background color of the log in button on the landing page.
	ButtonColor string `json:"button_color"`
	// The color of the text in the log in button on the landing page.
	ButtonTextColor string `json:"button_text_color"`
	// The URL of the image shown on the landing page.
	ImageURL string `json:"image_url"`
	// The message shown on the landing page.
	Message string `json:"message"`
	// The title shown on the landing page.
	Title string                                                                   `json:"title"`
	JSON  accessApplicationListResponseAppLauncherApplicationLandingPageDesignJSON `json:"-"`
}

// accessApplicationListResponseAppLauncherApplicationLandingPageDesignJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseAppLauncherApplicationLandingPageDesign]
type accessApplicationListResponseAppLauncherApplicationLandingPageDesignJSON struct {
	ButtonColor     apijson.Field
	ButtonTextColor apijson.Field
	ImageURL        apijson.Field
	Message         apijson.Field
	Title           apijson.Field
	raw             string
	ExtraFields     map[string]apijson.Field
}

func (r *AccessApplicationListResponseAppLauncherApplicationLandingPageDesign) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseAppLauncherApplicationLandingPageDesignJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationListResponseAppLauncherApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                        `json:"session_duration"`
	UpdatedAt       time.Time                                                     `json:"updated_at" format:"date-time"`
	JSON            accessApplicationListResponseAppLauncherApplicationPolicyJSON `json:"-"`
}

// accessApplicationListResponseAppLauncherApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationListResponseAppLauncherApplicationPolicy]
type accessApplicationListResponseAppLauncherApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationListResponseAppLauncherApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseAppLauncherApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationListResponseDeviceEnrollmentPermissionsApplication struct {
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// The name of the application.
	Name     string                                                                      `json:"name"`
	Policies []AccessApplicationListResponseDeviceEnrollmentPermissionsApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string                                                                  `json:"session_duration"`
	JSON            accessApplicationListResponseDeviceEnrollmentPermissionsApplicationJSON `json:"-"`
}

// accessApplicationListResponseDeviceEnrollmentPermissionsApplicationJSON contains
// the JSON metadata for the struct
// [AccessApplicationListResponseDeviceEnrollmentPermissionsApplication]
type accessApplicationListResponseDeviceEnrollmentPermissionsApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationListResponseDeviceEnrollmentPermissionsApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseDeviceEnrollmentPermissionsApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseDeviceEnrollmentPermissionsApplication) implementsAccessApplicationListResponse() {
}

type AccessApplicationListResponseDeviceEnrollmentPermissionsApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                                        `json:"session_duration"`
	UpdatedAt       time.Time                                                                     `json:"updated_at" format:"date-time"`
	JSON            accessApplicationListResponseDeviceEnrollmentPermissionsApplicationPolicyJSON `json:"-"`
}

// accessApplicationListResponseDeviceEnrollmentPermissionsApplicationPolicyJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseDeviceEnrollmentPermissionsApplicationPolicy]
type accessApplicationListResponseDeviceEnrollmentPermissionsApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationListResponseDeviceEnrollmentPermissionsApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseDeviceEnrollmentPermissionsApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationListResponseBrowserIsolationPermissionsApplication struct {
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// The name of the application.
	Name     string                                                                      `json:"name"`
	Policies []AccessApplicationListResponseBrowserIsolationPermissionsApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string                                                                  `json:"session_duration"`
	JSON            accessApplicationListResponseBrowserIsolationPermissionsApplicationJSON `json:"-"`
}

// accessApplicationListResponseBrowserIsolationPermissionsApplicationJSON contains
// the JSON metadata for the struct
// [AccessApplicationListResponseBrowserIsolationPermissionsApplication]
type accessApplicationListResponseBrowserIsolationPermissionsApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserIsolationPermissionsApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserIsolationPermissionsApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserIsolationPermissionsApplication) implementsAccessApplicationListResponse() {
}

type AccessApplicationListResponseBrowserIsolationPermissionsApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                                        `json:"session_duration"`
	UpdatedAt       time.Time                                                                     `json:"updated_at" format:"date-time"`
	JSON            accessApplicationListResponseBrowserIsolationPermissionsApplicationPolicyJSON `json:"-"`
}

// accessApplicationListResponseBrowserIsolationPermissionsApplicationPolicyJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserIsolationPermissionsApplicationPolicy]
type accessApplicationListResponseBrowserIsolationPermissionsApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserIsolationPermissionsApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserIsolationPermissionsApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationListResponseGatewayIdentityProxyEndpointApplication struct {
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The proxy endpoint domain in the format: 10 alphanumeric characters followed by
	// .proxy.cloudflare-gateway.com
	Domain string `json:"domain"`
	// The name of the application.
	Name     string                                                                       `json:"name"`
	Policies []AccessApplicationListResponseGatewayIdentityProxyEndpointApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string                                                                   `json:"session_duration"`
	JSON            accessApplicationListResponseGatewayIdentityProxyEndpointApplicationJSON `json:"-"`
}

// accessApplicationListResponseGatewayIdentityProxyEndpointApplicationJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseGatewayIdentityProxyEndpointApplication]
type accessApplicationListResponseGatewayIdentityProxyEndpointApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationListResponseGatewayIdentityProxyEndpointApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseGatewayIdentityProxyEndpointApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseGatewayIdentityProxyEndpointApplication) implementsAccessApplicationListResponse() {
}

type AccessApplicationListResponseGatewayIdentityProxyEndpointApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                                         `json:"session_duration"`
	UpdatedAt       time.Time                                                                      `json:"updated_at" format:"date-time"`
	JSON            accessApplicationListResponseGatewayIdentityProxyEndpointApplicationPolicyJSON `json:"-"`
}

// accessApplicationListResponseGatewayIdentityProxyEndpointApplicationPolicyJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseGatewayIdentityProxyEndpointApplicationPolicy]
type accessApplicationListResponseGatewayIdentityProxyEndpointApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationListResponseGatewayIdentityProxyEndpointApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseGatewayIdentityProxyEndpointApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationListResponseBookmarkApplication struct {
	// UUID.
	ID string `json:"id"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// The URL or domain of the bookmark.
	Domain string `json:"domain"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name     string                                                   `json:"name"`
	Policies []AccessApplicationListResponseBookmarkApplicationPolicy `json:"policies"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// The application type.
	Type ApplicationType                                      `json:"type"`
	JSON accessApplicationListResponseBookmarkApplicationJSON `json:"-"`
}

// accessApplicationListResponseBookmarkApplicationJSON contains the JSON metadata
// for the struct [AccessApplicationListResponseBookmarkApplication]
type accessApplicationListResponseBookmarkApplicationJSON struct {
	ID                 apijson.Field
	AppLauncherVisible apijson.Field
	AUD                apijson.Field
	Domain             apijson.Field
	LogoURL            apijson.Field
	Name               apijson.Field
	Policies           apijson.Field
	Tags               apijson.Field
	Type               apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationListResponseBookmarkApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBookmarkApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBookmarkApplication) implementsAccessApplicationListResponse() {}

type AccessApplicationListResponseBookmarkApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                     `json:"session_duration"`
	UpdatedAt       time.Time                                                  `json:"updated_at" format:"date-time"`
	JSON            accessApplicationListResponseBookmarkApplicationPolicyJSON `json:"-"`
}

// accessApplicationListResponseBookmarkApplicationPolicyJSON contains the JSON
// metadata for the struct [AccessApplicationListResponseBookmarkApplicationPolicy]
type accessApplicationListResponseBookmarkApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationListResponseBookmarkApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBookmarkApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationListResponseInfrastructureApplication struct {
	TargetCriteria []AccessApplicationListResponseInfrastructureApplicationTargetCriterion `json:"target_criteria,required"`
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// Audience tag.
	AUD string `json:"aud"`
	// The name of the application.
	Name     string                                                         `json:"name"`
	Policies []AccessApplicationListResponseInfrastructureApplicationPolicy `json:"policies"`
	JSON     accessApplicationListResponseInfrastructureApplicationJSON     `json:"-"`
}

// accessApplicationListResponseInfrastructureApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationListResponseInfrastructureApplication]
type accessApplicationListResponseInfrastructureApplicationJSON struct {
	TargetCriteria apijson.Field
	Type           apijson.Field
	ID             apijson.Field
	AUD            apijson.Field
	Name           apijson.Field
	Policies       apijson.Field
	raw            string
	ExtraFields    map[string]apijson.Field
}

func (r *AccessApplicationListResponseInfrastructureApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseInfrastructureApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseInfrastructureApplication) implementsAccessApplicationListResponse() {
}

type AccessApplicationListResponseInfrastructureApplicationTargetCriterion struct {
	// The port that the targets use for the chosen communication protocol. A port
	// cannot be assigned to multiple protocols.
	Port int64 `json:"port,required"`
	// The communication protocol your application secures.
	Protocol AccessApplicationListResponseInfrastructureApplicationTargetCriteriaProtocol `json:"protocol,required"`
	// Contains a map of target attribute keys to target attribute values.
	TargetAttributes map[string][]string                                                       `json:"target_attributes,required"`
	JSON             accessApplicationListResponseInfrastructureApplicationTargetCriterionJSON `json:"-"`
}

// accessApplicationListResponseInfrastructureApplicationTargetCriterionJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseInfrastructureApplicationTargetCriterion]
type accessApplicationListResponseInfrastructureApplicationTargetCriterionJSON struct {
	Port             apijson.Field
	Protocol         apijson.Field
	TargetAttributes apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationListResponseInfrastructureApplicationTargetCriterion) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseInfrastructureApplicationTargetCriterionJSON) RawJSON() string {
	return r.raw
}

// The communication protocol your application secures.
type AccessApplicationListResponseInfrastructureApplicationTargetCriteriaProtocol string

const (
	AccessApplicationListResponseInfrastructureApplicationTargetCriteriaProtocolSSH AccessApplicationListResponseInfrastructureApplicationTargetCriteriaProtocol = "SSH"
)

func (r AccessApplicationListResponseInfrastructureApplicationTargetCriteriaProtocol) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseInfrastructureApplicationTargetCriteriaProtocolSSH:
		return true
	}
	return false
}

type AccessApplicationListResponseInfrastructureApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// The rules that define how users may connect to the targets secured by your
	// application.
	ConnectionRules AccessApplicationListResponseInfrastructureApplicationPoliciesConnectionRules `json:"connection_rules"`
	CreatedAt       time.Time                                                                     `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// The name of the Access policy.
	Name string `json:"name"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require   []AccessRule                                                     `json:"require"`
	UpdatedAt time.Time                                                        `json:"updated_at" format:"date-time"`
	JSON      accessApplicationListResponseInfrastructureApplicationPolicyJSON `json:"-"`
}

// accessApplicationListResponseInfrastructureApplicationPolicyJSON contains the
// JSON metadata for the struct
// [AccessApplicationListResponseInfrastructureApplicationPolicy]
type accessApplicationListResponseInfrastructureApplicationPolicyJSON struct {
	ID              apijson.Field
	ConnectionRules apijson.Field
	CreatedAt       apijson.Field
	Decision        apijson.Field
	Exclude         apijson.Field
	Include         apijson.Field
	Name            apijson.Field
	Require         apijson.Field
	UpdatedAt       apijson.Field
	raw             string
	ExtraFields     map[string]apijson.Field
}

func (r *AccessApplicationListResponseInfrastructureApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseInfrastructureApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// The rules that define how users may connect to the targets secured by your
// application.
type AccessApplicationListResponseInfrastructureApplicationPoliciesConnectionRules struct {
	// The SSH-specific rules that define how users may connect to the targets secured
	// by your application.
	SSH  AccessApplicationListResponseInfrastructureApplicationPoliciesConnectionRulesSSH  `json:"ssh"`
	JSON accessApplicationListResponseInfrastructureApplicationPoliciesConnectionRulesJSON `json:"-"`
}

// accessApplicationListResponseInfrastructureApplicationPoliciesConnectionRulesJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseInfrastructureApplicationPoliciesConnectionRules]
type accessApplicationListResponseInfrastructureApplicationPoliciesConnectionRulesJSON struct {
	SSH         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationListResponseInfrastructureApplicationPoliciesConnectionRules) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseInfrastructureApplicationPoliciesConnectionRulesJSON) RawJSON() string {
	return r.raw
}

// The SSH-specific rules that define how users may connect to the targets secured
// by your application.
type AccessApplicationListResponseInfrastructureApplicationPoliciesConnectionRulesSSH struct {
	// Contains the Unix usernames that may be used when connecting over SSH.
	Usernames []string `json:"usernames,required"`
	// Enables using Identity Provider email alias as SSH username.
	AllowEmailAlias bool                                                                                 `json:"allow_email_alias"`
	JSON            accessApplicationListResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON `json:"-"`
}

// accessApplicationListResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseInfrastructureApplicationPoliciesConnectionRulesSSH]
type accessApplicationListResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON struct {
	Usernames       apijson.Field
	AllowEmailAlias apijson.Field
	raw             string
	ExtraFields     map[string]apijson.Field
}

func (r *AccessApplicationListResponseInfrastructureApplicationPoliciesConnectionRulesSSH) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationListResponseBrowserRdpApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain         string                                                              `json:"domain,required"`
	TargetCriteria []AccessApplicationListResponseBrowserRdpApplicationTargetCriterion `json:"target_criteria,required"`
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationListResponseBrowserRdpApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                       `json:"path_cookie_attribute"`
	Policies            []AccessApplicationListResponseBrowserRdpApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationListResponseBrowserRdpApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                   `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationListResponseBrowserRdpApplicationJSON `json:"-"`
}

// accessApplicationListResponseBrowserRdpApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationListResponseBrowserRdpApplication]
type accessApplicationListResponseBrowserRdpApplicationJSON struct {
	Domain                               apijson.Field
	TargetCriteria                       apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserRdpApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserRdpApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserRdpApplication) implementsAccessApplicationListResponse() {
}

type AccessApplicationListResponseBrowserRdpApplicationTargetCriterion struct {
	// The port that the targets use for the chosen communication protocol. A port
	// cannot be assigned to multiple protocols.
	Port int64 `json:"port,required"`
	// The communication protocol your application secures.
	Protocol AccessApplicationListResponseBrowserRdpApplicationTargetCriteriaProtocol `json:"protocol,required"`
	// Contains a map of target attribute keys to target attribute values.
	TargetAttributes map[string][]string                                                   `json:"target_attributes,required"`
	JSON             accessApplicationListResponseBrowserRdpApplicationTargetCriterionJSON `json:"-"`
}

// accessApplicationListResponseBrowserRdpApplicationTargetCriterionJSON contains
// the JSON metadata for the struct
// [AccessApplicationListResponseBrowserRdpApplicationTargetCriterion]
type accessApplicationListResponseBrowserRdpApplicationTargetCriterionJSON struct {
	Port             apijson.Field
	Protocol         apijson.Field
	TargetAttributes apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserRdpApplicationTargetCriterion) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserRdpApplicationTargetCriterionJSON) RawJSON() string {
	return r.raw
}

// The communication protocol your application secures.
type AccessApplicationListResponseBrowserRdpApplicationTargetCriteriaProtocol string

const (
	AccessApplicationListResponseBrowserRdpApplicationTargetCriteriaProtocolRdp AccessApplicationListResponseBrowserRdpApplicationTargetCriteriaProtocol = "RDP"
)

func (r AccessApplicationListResponseBrowserRdpApplicationTargetCriteriaProtocol) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserRdpApplicationTargetCriteriaProtocolRdp:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationListResponseBrowserRdpApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationListResponseBrowserRdpApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                             `json:"port_range"`
	Type      AccessApplicationListResponseBrowserRdpApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                            `json:"vnet_id"`
	JSON   accessApplicationListResponseBrowserRdpApplicationDestinationJSON `json:"-"`
	union  AccessApplicationListResponseBrowserRdpApplicationDestinationsUnion
}

// accessApplicationListResponseBrowserRdpApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationListResponseBrowserRdpApplicationDestination]
type accessApplicationListResponseBrowserRdpApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationListResponseBrowserRdpApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationListResponseBrowserRdpApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationListResponseBrowserRdpApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationListResponseBrowserRdpApplicationDestinationsUnion] interface
// which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestination],
// [AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestination],
// [AccessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationListResponseBrowserRdpApplicationDestination) AsUnion() AccessApplicationListResponseBrowserRdpApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestination],
// [AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationListResponseBrowserRdpApplicationDestinationsUnion interface {
	implementsAccessApplicationListResponseBrowserRdpApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseBrowserRdpApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestination struct {
	Type AccessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                              `json:"uri"`
	JSON accessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestination]
type accessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestination) implementsAccessApplicationListResponseBrowserRdpApplicationDestination() {
}

type AccessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestinationTypePublic AccessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserRdpApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                               `json:"port_range"`
	Type      AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                               `json:"vnet_id"`
	JSON   accessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestination]
type accessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestination) implementsAccessApplicationListResponseBrowserRdpApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserRdpApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                          `json:"mcp_server_id"`
	Type        AccessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationListResponseBrowserRdpApplicationDestination() {
}

type AccessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationListResponseBrowserRdpApplicationDestinationsL4Protocol string

const (
	AccessApplicationListResponseBrowserRdpApplicationDestinationsL4ProtocolTCP AccessApplicationListResponseBrowserRdpApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationListResponseBrowserRdpApplicationDestinationsL4ProtocolUdp AccessApplicationListResponseBrowserRdpApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationListResponseBrowserRdpApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserRdpApplicationDestinationsL4ProtocolTCP, AccessApplicationListResponseBrowserRdpApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserRdpApplicationDestinationsType string

const (
	AccessApplicationListResponseBrowserRdpApplicationDestinationsTypePublic             AccessApplicationListResponseBrowserRdpApplicationDestinationsType = "public"
	AccessApplicationListResponseBrowserRdpApplicationDestinationsTypePrivate            AccessApplicationListResponseBrowserRdpApplicationDestinationsType = "private"
	AccessApplicationListResponseBrowserRdpApplicationDestinationsTypeViaMcpServerPortal AccessApplicationListResponseBrowserRdpApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationListResponseBrowserRdpApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserRdpApplicationDestinationsTypePublic, AccessApplicationListResponseBrowserRdpApplicationDestinationsTypePrivate, AccessApplicationListResponseBrowserRdpApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserRdpApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                       `json:"session_duration"`
	UpdatedAt       time.Time                                                    `json:"updated_at" format:"date-time"`
	JSON            accessApplicationListResponseBrowserRdpApplicationPolicyJSON `json:"-"`
}

// accessApplicationListResponseBrowserRdpApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationListResponseBrowserRdpApplicationPolicy]
type accessApplicationListResponseBrowserRdpApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserRdpApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserRdpApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationListResponseBrowserRdpApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                              `json:"mappings"`
	JSON     accessApplicationListResponseBrowserRdpApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationListResponseBrowserRdpApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationListResponseBrowserRdpApplicationSCIMConfig]
type accessApplicationListResponseBrowserRdpApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserRdpApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserRdpApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                                `json:"user"`
	JSON  accessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationListResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationDeleteResponse struct {
	// UUID.
	ID   string                              `json:"id"`
	JSON accessApplicationDeleteResponseJSON `json:"-"`
}

// accessApplicationDeleteResponseJSON contains the JSON metadata for the struct
// [AccessApplicationDeleteResponse]
type accessApplicationDeleteResponseJSON struct {
	ID          apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationDeleteResponse) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationDeleteResponseJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationGetResponse struct {
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// This field can have the runtime type of [[]AllowedIdPs].
	AllowedIdPs interface{} `json:"allowed_idps"`
	// The image URL of the logo shown in the App Launcher header.
	AppLauncherLogoURL string `json:"app_launcher_logo_url"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The background color of the App Launcher page.
	BgColor     string      `json:"bg_color"`
	CORSHeaders CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// This field can have the runtime type of [[]string].
	CustomPages interface{} `json:"custom_pages"`
	// This field can have the runtime type of
	// [[]AccessApplicationGetResponseSelfHostedApplicationDestination],
	// [[]AccessApplicationGetResponseBrowserSSHApplicationDestination],
	// [[]AccessApplicationGetResponseBrowserVNCApplicationDestination],
	// [[]AccessApplicationGetResponseBrowserRdpApplicationDestination].
	Destinations interface{} `json:"destinations"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// This field can have the runtime type of
	// [[]AccessApplicationGetResponseAppLauncherApplicationFooterLink].
	FooterLinks interface{} `json:"footer_links"`
	// The background color of the App Launcher header.
	HeaderBgColor string `json:"header_bg_color"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// This field can have the runtime type of
	// [AccessApplicationGetResponseAppLauncherApplicationLandingPageDesign].
	LandingPageDesign interface{} `json:"landing_page_design"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool `json:"path_cookie_attribute"`
	// This field can have the runtime type of
	// [[]AccessApplicationGetResponseSelfHostedApplicationPolicy],
	// [[]AccessApplicationGetResponseSaaSApplicationPolicy],
	// [[]AccessApplicationGetResponseBrowserSSHApplicationPolicy],
	// [[]AccessApplicationGetResponseBrowserVNCApplicationPolicy],
	// [[]AccessApplicationGetResponseAppLauncherApplicationPolicy],
	// [[]AccessApplicationGetResponseDeviceEnrollmentPermissionsApplicationPolicy],
	// [[]AccessApplicationGetResponseBrowserIsolationPermissionsApplicationPolicy],
	// [[]AccessApplicationGetResponseGatewayIdentityProxyEndpointApplicationPolicy],
	// [[]AccessApplicationGetResponseBookmarkApplicationPolicy],
	// [[]AccessApplicationGetResponseInfrastructureApplicationPolicy],
	// [[]AccessApplicationGetResponseBrowserRdpApplicationPolicy].
	Policies interface{} `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// This field can have the runtime type of
	// [AccessApplicationGetResponseSaaSApplicationSaaSApp].
	SaaSApp interface{} `json:"saas_app"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// This field can have the runtime type of
	// [AccessApplicationGetResponseSelfHostedApplicationSCIMConfig],
	// [AccessApplicationGetResponseSaaSApplicationSCIMConfig],
	// [AccessApplicationGetResponseBrowserSSHApplicationSCIMConfig],
	// [AccessApplicationGetResponseBrowserVNCApplicationSCIMConfig],
	// [AccessApplicationGetResponseBrowserRdpApplicationSCIMConfig].
	SCIMConfig interface{} `json:"scim_config"`
	// This field can have the runtime type of [[]SelfHostedDomains].
	SelfHostedDomains interface{} `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Determines when to skip the App Launcher landing page.
	SkipAppLauncherLoginPage bool `json:"skip_app_launcher_login_page"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// This field can have the runtime type of [[]string].
	Tags interface{} `json:"tags"`
	// This field can have the runtime type of
	// [[]AccessApplicationGetResponseInfrastructureApplicationTargetCriterion],
	// [[]AccessApplicationGetResponseBrowserRdpApplicationTargetCriterion].
	TargetCriteria interface{} `json:"target_criteria"`
	// The application type.
	Type ApplicationType `json:"type"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                             `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationGetResponseJSON `json:"-"`
	union                                AccessApplicationGetResponseUnion
}

// accessApplicationGetResponseJSON contains the JSON metadata for the struct
// [AccessApplicationGetResponse]
type accessApplicationGetResponseJSON struct {
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherLogoURL                   apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	BgColor                              apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	Domain                               apijson.Field
	EnableBindingCookie                  apijson.Field
	FooterLinks                          apijson.Field
	HeaderBgColor                        apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LandingPageDesign                    apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SaaSApp                              apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipAppLauncherLoginPage             apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	TargetCriteria                       apijson.Field
	Type                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r accessApplicationGetResponseJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationGetResponse) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationGetResponse{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a [AccessApplicationGetResponseUnion] interface which you can
// cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationGetResponseSelfHostedApplication],
// [AccessApplicationGetResponseSaaSApplication],
// [AccessApplicationGetResponseBrowserSSHApplication],
// [AccessApplicationGetResponseBrowserVNCApplication],
// [AccessApplicationGetResponseAppLauncherApplication],
// [AccessApplicationGetResponseDeviceEnrollmentPermissionsApplication],
// [AccessApplicationGetResponseBrowserIsolationPermissionsApplication],
// [AccessApplicationGetResponseGatewayIdentityProxyEndpointApplication],
// [AccessApplicationGetResponseBookmarkApplication],
// [AccessApplicationGetResponseInfrastructureApplication],
// [AccessApplicationGetResponseBrowserRdpApplication].
func (r AccessApplicationGetResponse) AsUnion() AccessApplicationGetResponseUnion {
	return r.union
}

// Union satisfied by [AccessApplicationGetResponseSelfHostedApplication],
// [AccessApplicationGetResponseSaaSApplication],
// [AccessApplicationGetResponseBrowserSSHApplication],
// [AccessApplicationGetResponseBrowserVNCApplication],
// [AccessApplicationGetResponseAppLauncherApplication],
// [AccessApplicationGetResponseDeviceEnrollmentPermissionsApplication],
// [AccessApplicationGetResponseBrowserIsolationPermissionsApplication],
// [AccessApplicationGetResponseGatewayIdentityProxyEndpointApplication],
// [AccessApplicationGetResponseBookmarkApplication],
// [AccessApplicationGetResponseInfrastructureApplication] or
// [AccessApplicationGetResponseBrowserRdpApplication].
type AccessApplicationGetResponseUnion interface {
	implementsAccessApplicationGetResponse()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseSelfHostedApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseSaaSApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserSSHApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserVNCApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseAppLauncherApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseDeviceEnrollmentPermissionsApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserIsolationPermissionsApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseGatewayIdentityProxyEndpointApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBookmarkApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseInfrastructureApplication{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserRdpApplication{}),
		},
	)
}

type AccessApplicationGetResponseSelfHostedApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain,required"`
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationGetResponseSelfHostedApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                      `json:"path_cookie_attribute"`
	Policies            []AccessApplicationGetResponseSelfHostedApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationGetResponseSelfHostedApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                  `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationGetResponseSelfHostedApplicationJSON `json:"-"`
}

// accessApplicationGetResponseSelfHostedApplicationJSON contains the JSON metadata
// for the struct [AccessApplicationGetResponseSelfHostedApplication]
type accessApplicationGetResponseSelfHostedApplicationJSON struct {
	Domain                               apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationGetResponseSelfHostedApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseSelfHostedApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseSelfHostedApplication) implementsAccessApplicationGetResponse() {}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationGetResponseSelfHostedApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationGetResponseSelfHostedApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                            `json:"port_range"`
	Type      AccessApplicationGetResponseSelfHostedApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                           `json:"vnet_id"`
	JSON   accessApplicationGetResponseSelfHostedApplicationDestinationJSON `json:"-"`
	union  AccessApplicationGetResponseSelfHostedApplicationDestinationsUnion
}

// accessApplicationGetResponseSelfHostedApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationGetResponseSelfHostedApplicationDestination]
type accessApplicationGetResponseSelfHostedApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationGetResponseSelfHostedApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationGetResponseSelfHostedApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationGetResponseSelfHostedApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationGetResponseSelfHostedApplicationDestinationsUnion] interface
// which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestination],
// [AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestination],
// [AccessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationGetResponseSelfHostedApplicationDestination) AsUnion() AccessApplicationGetResponseSelfHostedApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestination],
// [AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationGetResponseSelfHostedApplicationDestinationsUnion interface {
	implementsAccessApplicationGetResponseSelfHostedApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseSelfHostedApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestination struct {
	Type AccessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                             `json:"uri"`
	JSON accessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestination]
type accessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestination) implementsAccessApplicationGetResponseSelfHostedApplicationDestination() {
}

type AccessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestinationTypePublic AccessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseSelfHostedApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                              `json:"port_range"`
	Type      AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                              `json:"vnet_id"`
	JSON   accessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestination]
type accessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestination) implementsAccessApplicationGetResponseSelfHostedApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseSelfHostedApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                         `json:"mcp_server_id"`
	Type        AccessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationGetResponseSelfHostedApplicationDestination() {
}

type AccessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseSelfHostedApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationGetResponseSelfHostedApplicationDestinationsL4Protocol string

const (
	AccessApplicationGetResponseSelfHostedApplicationDestinationsL4ProtocolTCP AccessApplicationGetResponseSelfHostedApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationGetResponseSelfHostedApplicationDestinationsL4ProtocolUdp AccessApplicationGetResponseSelfHostedApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationGetResponseSelfHostedApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseSelfHostedApplicationDestinationsL4ProtocolTCP, AccessApplicationGetResponseSelfHostedApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationGetResponseSelfHostedApplicationDestinationsType string

const (
	AccessApplicationGetResponseSelfHostedApplicationDestinationsTypePublic             AccessApplicationGetResponseSelfHostedApplicationDestinationsType = "public"
	AccessApplicationGetResponseSelfHostedApplicationDestinationsTypePrivate            AccessApplicationGetResponseSelfHostedApplicationDestinationsType = "private"
	AccessApplicationGetResponseSelfHostedApplicationDestinationsTypeViaMcpServerPortal AccessApplicationGetResponseSelfHostedApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationGetResponseSelfHostedApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseSelfHostedApplicationDestinationsTypePublic, AccessApplicationGetResponseSelfHostedApplicationDestinationsTypePrivate, AccessApplicationGetResponseSelfHostedApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationGetResponseSelfHostedApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                      `json:"session_duration"`
	UpdatedAt       time.Time                                                   `json:"updated_at" format:"date-time"`
	JSON            accessApplicationGetResponseSelfHostedApplicationPolicyJSON `json:"-"`
}

// accessApplicationGetResponseSelfHostedApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationGetResponseSelfHostedApplicationPolicy]
type accessApplicationGetResponseSelfHostedApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseSelfHostedApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseSelfHostedApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationGetResponseSelfHostedApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                             `json:"mappings"`
	JSON     accessApplicationGetResponseSelfHostedApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationGetResponseSelfHostedApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationGetResponseSelfHostedApplicationSCIMConfig]
type accessApplicationGetResponseSelfHostedApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationGetResponseSelfHostedApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseSelfHostedApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                               `json:"user"`
	JSON  accessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationGetResponseSelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationGetResponseSaaSApplication struct {
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name     string                                              `json:"name"`
	Policies []AccessApplicationGetResponseSaaSApplicationPolicy `json:"policies"`
	SaaSApp  AccessApplicationGetResponseSaaSApplicationSaaSApp  `json:"saas_app"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationGetResponseSaaSApplicationSCIMConfig `json:"scim_config"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// The application type.
	Type ApplicationType                                 `json:"type"`
	JSON accessApplicationGetResponseSaaSApplicationJSON `json:"-"`
}

// accessApplicationGetResponseSaaSApplicationJSON contains the JSON metadata for
// the struct [AccessApplicationGetResponseSaaSApplication]
type accessApplicationGetResponseSaaSApplicationJSON struct {
	ID                     apijson.Field
	AllowedIdPs            apijson.Field
	AppLauncherVisible     apijson.Field
	AUD                    apijson.Field
	AutoRedirectToIdentity apijson.Field
	CustomPages            apijson.Field
	LogoURL                apijson.Field
	Name                   apijson.Field
	Policies               apijson.Field
	SaaSApp                apijson.Field
	SCIMConfig             apijson.Field
	Tags                   apijson.Field
	Type                   apijson.Field
	raw                    string
	ExtraFields            map[string]apijson.Field
}

func (r *AccessApplicationGetResponseSaaSApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseSaaSApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseSaaSApplication) implementsAccessApplicationGetResponse() {}

type AccessApplicationGetResponseSaaSApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                `json:"session_duration"`
	UpdatedAt       time.Time                                             `json:"updated_at" format:"date-time"`
	JSON            accessApplicationGetResponseSaaSApplicationPolicyJSON `json:"-"`
}

// accessApplicationGetResponseSaaSApplicationPolicyJSON contains the JSON metadata
// for the struct [AccessApplicationGetResponseSaaSApplicationPolicy]
type accessApplicationGetResponseSaaSApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseSaaSApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseSaaSApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationGetResponseSaaSApplicationSaaSApp struct {
	// The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must
	// be greater than or equal to 1m and less than or equal to 24h.
	AccessTokenLifetime string `json:"access_token_lifetime"`
	// If client secret should be required on the token endpoint when
	// authorization_code_with_pkce grant is used.
	AllowPKCEWithoutClientSecret bool `json:"allow_pkce_without_client_secret"`
	// The URL where this applications tile redirects users
	AppLauncherURL string `json:"app_launcher_url"`
	// Optional identifier indicating the authentication protocol used for the saas
	// app. Required for OIDC. Default if unset is "saml"
	AuthType AccessApplicationGetResponseSaaSApplicationSaaSAppAuthType `json:"auth_type"`
	// The application client id
	ClientID string `json:"client_id"`
	// The application client secret, only returned on POST request.
	ClientSecret string `json:"client_secret"`
	// The service provider's endpoint that is responsible for receiving and parsing a
	// SAML assertion.
	ConsumerServiceURL string `json:"consumer_service_url"`
	// This field can have the runtime type of [[]SAMLSaaSAppCustomAttribute].
	CustomAttributes interface{} `json:"custom_attributes"`
	// This field can have the runtime type of [[]OIDCSaaSAppCustomClaim].
	CustomClaims interface{} `json:"custom_claims"`
	// The URL that the user will be redirected to after a successful login for IDP
	// initiated logins.
	DefaultRelayState string `json:"default_relay_state"`
	// This field can have the runtime type of [[]OIDCSaaSAppGrantType].
	GrantTypes interface{} `json:"grant_types"`
	// A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
	GroupFilterRegex string `json:"group_filter_regex"`
	// This field can have the runtime type of [OIDCSaaSAppHybridAndImplicitOptions].
	HybridAndImplicitOptions interface{} `json:"hybrid_and_implicit_options"`
	// The unique identifier for your SaaS application.
	IdPEntityID string `json:"idp_entity_id"`
	// The format of the name identifier sent to the SaaS application.
	NameIDFormat SaaSAppNameIDFormat `json:"name_id_format"`
	// A [JSONata](https://jsonata.org/) expression that transforms an application's
	// user identities into a NameID value for its SAML assertion. This expression
	// should evaluate to a singular string. The output of this expression can override
	// the `name_id_format` setting.
	NameIDTransformJsonata string `json:"name_id_transform_jsonata"`
	// The Access public certificate that will be used to verify your identity.
	PublicKey string `json:"public_key"`
	// This field can have the runtime type of [[]string].
	RedirectURIs interface{} `json:"redirect_uris"`
	// This field can have the runtime type of [OIDCSaaSAppRefreshTokenOptions].
	RefreshTokenOptions interface{} `json:"refresh_token_options"`
	// A [JSONata] (https://jsonata.org/) expression that transforms an application's
	// user identities into attribute assertions in the SAML response. The expression
	// can transform id, email, name, and groups values. It can also transform fields
	// listed in the saml_attributes or oidc_fields of the identity provider used to
	// authenticate. The output of this expression must be a JSON object.
	SAMLAttributeTransformJsonata string `json:"saml_attribute_transform_jsonata"`
	// This field can have the runtime type of [[]OIDCSaaSAppScope].
	Scopes interface{} `json:"scopes"`
	// A globally unique name for an identity or service provider.
	SPEntityID string `json:"sp_entity_id"`
	// The endpoint where your SaaS application will send login requests.
	SSOEndpoint string                                                 `json:"sso_endpoint"`
	JSON        accessApplicationGetResponseSaaSApplicationSaaSAppJSON `json:"-"`
	union       AccessApplicationGetResponseSaaSApplicationSaaSAppUnion
}

// accessApplicationGetResponseSaaSApplicationSaaSAppJSON contains the JSON
// metadata for the struct [AccessApplicationGetResponseSaaSApplicationSaaSApp]
type accessApplicationGetResponseSaaSApplicationSaaSAppJSON struct {
	AccessTokenLifetime           apijson.Field
	AllowPKCEWithoutClientSecret  apijson.Field
	AppLauncherURL                apijson.Field
	AuthType                      apijson.Field
	ClientID                      apijson.Field
	ClientSecret                  apijson.Field
	ConsumerServiceURL            apijson.Field
	CustomAttributes              apijson.Field
	CustomClaims                  apijson.Field
	DefaultRelayState             apijson.Field
	GrantTypes                    apijson.Field
	GroupFilterRegex              apijson.Field
	HybridAndImplicitOptions      apijson.Field
	IdPEntityID                   apijson.Field
	NameIDFormat                  apijson.Field
	NameIDTransformJsonata        apijson.Field
	PublicKey                     apijson.Field
	RedirectURIs                  apijson.Field
	RefreshTokenOptions           apijson.Field
	SAMLAttributeTransformJsonata apijson.Field
	Scopes                        apijson.Field
	SPEntityID                    apijson.Field
	SSOEndpoint                   apijson.Field
	raw                           string
	ExtraFields                   map[string]apijson.Field
}

func (r accessApplicationGetResponseSaaSApplicationSaaSAppJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationGetResponseSaaSApplicationSaaSApp) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationGetResponseSaaSApplicationSaaSApp{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a [AccessApplicationGetResponseSaaSApplicationSaaSAppUnion]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SAMLSaaSApp], [OIDCSaaSApp].
func (r AccessApplicationGetResponseSaaSApplicationSaaSApp) AsUnion() AccessApplicationGetResponseSaaSApplicationSaaSAppUnion {
	return r.union
}

// Union satisfied by [SAMLSaaSApp] or [OIDCSaaSApp].
type AccessApplicationGetResponseSaaSApplicationSaaSAppUnion interface {
	implementsAccessApplicationGetResponseSaaSApplicationSaaSApp()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseSaaSApplicationSaaSAppUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SAMLSaaSApp{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(OIDCSaaSApp{}),
		},
	)
}

// Optional identifier indicating the authentication protocol used for the saas
// app. Required for OIDC. Default if unset is "saml"
type AccessApplicationGetResponseSaaSApplicationSaaSAppAuthType string

const (
	AccessApplicationGetResponseSaaSApplicationSaaSAppAuthTypeSAML AccessApplicationGetResponseSaaSApplicationSaaSAppAuthType = "saml"
	AccessApplicationGetResponseSaaSApplicationSaaSAppAuthTypeOIDC AccessApplicationGetResponseSaaSApplicationSaaSAppAuthType = "oidc"
)

func (r AccessApplicationGetResponseSaaSApplicationSaaSAppAuthType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseSaaSApplicationSaaSAppAuthTypeSAML, AccessApplicationGetResponseSaaSApplicationSaaSAppAuthTypeOIDC:
		return true
	}
	return false
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationGetResponseSaaSApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                       `json:"mappings"`
	JSON     accessApplicationGetResponseSaaSApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationGetResponseSaaSApplicationSCIMConfigJSON contains the JSON
// metadata for the struct [AccessApplicationGetResponseSaaSApplicationSCIMConfig]
type accessApplicationGetResponseSaaSApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationGetResponseSaaSApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseSaaSApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                         `json:"user"`
	JSON  accessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationGetResponseSaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserSSHApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain,required"`
	// The application type.
	Type AccessApplicationGetResponseBrowserSSHApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationGetResponseBrowserSSHApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                      `json:"path_cookie_attribute"`
	Policies            []AccessApplicationGetResponseBrowserSSHApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationGetResponseBrowserSSHApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                  `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationGetResponseBrowserSSHApplicationJSON `json:"-"`
}

// accessApplicationGetResponseBrowserSSHApplicationJSON contains the JSON metadata
// for the struct [AccessApplicationGetResponseBrowserSSHApplication]
type accessApplicationGetResponseBrowserSSHApplicationJSON struct {
	Domain                               apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserSSHApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserSSHApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserSSHApplication) implementsAccessApplicationGetResponse() {}

// The application type.
type AccessApplicationGetResponseBrowserSSHApplicationType string

const (
	AccessApplicationGetResponseBrowserSSHApplicationTypeSelfHosted     AccessApplicationGetResponseBrowserSSHApplicationType = "self_hosted"
	AccessApplicationGetResponseBrowserSSHApplicationTypeSaaS           AccessApplicationGetResponseBrowserSSHApplicationType = "saas"
	AccessApplicationGetResponseBrowserSSHApplicationTypeSSH            AccessApplicationGetResponseBrowserSSHApplicationType = "ssh"
	AccessApplicationGetResponseBrowserSSHApplicationTypeVNC            AccessApplicationGetResponseBrowserSSHApplicationType = "vnc"
	AccessApplicationGetResponseBrowserSSHApplicationTypeAppLauncher    AccessApplicationGetResponseBrowserSSHApplicationType = "app_launcher"
	AccessApplicationGetResponseBrowserSSHApplicationTypeWARP           AccessApplicationGetResponseBrowserSSHApplicationType = "warp"
	AccessApplicationGetResponseBrowserSSHApplicationTypeBISO           AccessApplicationGetResponseBrowserSSHApplicationType = "biso"
	AccessApplicationGetResponseBrowserSSHApplicationTypeBookmark       AccessApplicationGetResponseBrowserSSHApplicationType = "bookmark"
	AccessApplicationGetResponseBrowserSSHApplicationTypeDashSSO        AccessApplicationGetResponseBrowserSSHApplicationType = "dash_sso"
	AccessApplicationGetResponseBrowserSSHApplicationTypeInfrastructure AccessApplicationGetResponseBrowserSSHApplicationType = "infrastructure"
	AccessApplicationGetResponseBrowserSSHApplicationTypeRdp            AccessApplicationGetResponseBrowserSSHApplicationType = "rdp"
	AccessApplicationGetResponseBrowserSSHApplicationTypeMcp            AccessApplicationGetResponseBrowserSSHApplicationType = "mcp"
	AccessApplicationGetResponseBrowserSSHApplicationTypeMcpPortal      AccessApplicationGetResponseBrowserSSHApplicationType = "mcp_portal"
	AccessApplicationGetResponseBrowserSSHApplicationTypeProxyEndpoint  AccessApplicationGetResponseBrowserSSHApplicationType = "proxy_endpoint"
)

func (r AccessApplicationGetResponseBrowserSSHApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserSSHApplicationTypeSelfHosted, AccessApplicationGetResponseBrowserSSHApplicationTypeSaaS, AccessApplicationGetResponseBrowserSSHApplicationTypeSSH, AccessApplicationGetResponseBrowserSSHApplicationTypeVNC, AccessApplicationGetResponseBrowserSSHApplicationTypeAppLauncher, AccessApplicationGetResponseBrowserSSHApplicationTypeWARP, AccessApplicationGetResponseBrowserSSHApplicationTypeBISO, AccessApplicationGetResponseBrowserSSHApplicationTypeBookmark, AccessApplicationGetResponseBrowserSSHApplicationTypeDashSSO, AccessApplicationGetResponseBrowserSSHApplicationTypeInfrastructure, AccessApplicationGetResponseBrowserSSHApplicationTypeRdp, AccessApplicationGetResponseBrowserSSHApplicationTypeMcp, AccessApplicationGetResponseBrowserSSHApplicationTypeMcpPortal, AccessApplicationGetResponseBrowserSSHApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationGetResponseBrowserSSHApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationGetResponseBrowserSSHApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                            `json:"port_range"`
	Type      AccessApplicationGetResponseBrowserSSHApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                           `json:"vnet_id"`
	JSON   accessApplicationGetResponseBrowserSSHApplicationDestinationJSON `json:"-"`
	union  AccessApplicationGetResponseBrowserSSHApplicationDestinationsUnion
}

// accessApplicationGetResponseBrowserSSHApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationGetResponseBrowserSSHApplicationDestination]
type accessApplicationGetResponseBrowserSSHApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationGetResponseBrowserSSHApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationGetResponseBrowserSSHApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationGetResponseBrowserSSHApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationGetResponseBrowserSSHApplicationDestinationsUnion] interface
// which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestination],
// [AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestination],
// [AccessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationGetResponseBrowserSSHApplicationDestination) AsUnion() AccessApplicationGetResponseBrowserSSHApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestination],
// [AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationGetResponseBrowserSSHApplicationDestinationsUnion interface {
	implementsAccessApplicationGetResponseBrowserSSHApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseBrowserSSHApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestination struct {
	Type AccessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                             `json:"uri"`
	JSON accessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestination]
type accessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestination) implementsAccessApplicationGetResponseBrowserSSHApplicationDestination() {
}

type AccessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestinationTypePublic AccessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserSSHApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                              `json:"port_range"`
	Type      AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                              `json:"vnet_id"`
	JSON   accessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestination]
type accessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestination) implementsAccessApplicationGetResponseBrowserSSHApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserSSHApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                         `json:"mcp_server_id"`
	Type        AccessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationGetResponseBrowserSSHApplicationDestination() {
}

type AccessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationGetResponseBrowserSSHApplicationDestinationsL4Protocol string

const (
	AccessApplicationGetResponseBrowserSSHApplicationDestinationsL4ProtocolTCP AccessApplicationGetResponseBrowserSSHApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationGetResponseBrowserSSHApplicationDestinationsL4ProtocolUdp AccessApplicationGetResponseBrowserSSHApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationGetResponseBrowserSSHApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserSSHApplicationDestinationsL4ProtocolTCP, AccessApplicationGetResponseBrowserSSHApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserSSHApplicationDestinationsType string

const (
	AccessApplicationGetResponseBrowserSSHApplicationDestinationsTypePublic             AccessApplicationGetResponseBrowserSSHApplicationDestinationsType = "public"
	AccessApplicationGetResponseBrowserSSHApplicationDestinationsTypePrivate            AccessApplicationGetResponseBrowserSSHApplicationDestinationsType = "private"
	AccessApplicationGetResponseBrowserSSHApplicationDestinationsTypeViaMcpServerPortal AccessApplicationGetResponseBrowserSSHApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationGetResponseBrowserSSHApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserSSHApplicationDestinationsTypePublic, AccessApplicationGetResponseBrowserSSHApplicationDestinationsTypePrivate, AccessApplicationGetResponseBrowserSSHApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserSSHApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                      `json:"session_duration"`
	UpdatedAt       time.Time                                                   `json:"updated_at" format:"date-time"`
	JSON            accessApplicationGetResponseBrowserSSHApplicationPolicyJSON `json:"-"`
}

// accessApplicationGetResponseBrowserSSHApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationGetResponseBrowserSSHApplicationPolicy]
type accessApplicationGetResponseBrowserSSHApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserSSHApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserSSHApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationGetResponseBrowserSSHApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                             `json:"mappings"`
	JSON     accessApplicationGetResponseBrowserSSHApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationGetResponseBrowserSSHApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationGetResponseBrowserSSHApplicationSCIMConfig]
type accessApplicationGetResponseBrowserSSHApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserSSHApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserSSHApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                               `json:"user"`
	JSON  accessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationGetResponseBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserVNCApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain,required"`
	// The application type.
	Type AccessApplicationGetResponseBrowserVNCApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationGetResponseBrowserVNCApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                      `json:"path_cookie_attribute"`
	Policies            []AccessApplicationGetResponseBrowserVNCApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationGetResponseBrowserVNCApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                  `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationGetResponseBrowserVNCApplicationJSON `json:"-"`
}

// accessApplicationGetResponseBrowserVNCApplicationJSON contains the JSON metadata
// for the struct [AccessApplicationGetResponseBrowserVNCApplication]
type accessApplicationGetResponseBrowserVNCApplicationJSON struct {
	Domain                               apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserVNCApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserVNCApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserVNCApplication) implementsAccessApplicationGetResponse() {}

// The application type.
type AccessApplicationGetResponseBrowserVNCApplicationType string

const (
	AccessApplicationGetResponseBrowserVNCApplicationTypeSelfHosted     AccessApplicationGetResponseBrowserVNCApplicationType = "self_hosted"
	AccessApplicationGetResponseBrowserVNCApplicationTypeSaaS           AccessApplicationGetResponseBrowserVNCApplicationType = "saas"
	AccessApplicationGetResponseBrowserVNCApplicationTypeSSH            AccessApplicationGetResponseBrowserVNCApplicationType = "ssh"
	AccessApplicationGetResponseBrowserVNCApplicationTypeVNC            AccessApplicationGetResponseBrowserVNCApplicationType = "vnc"
	AccessApplicationGetResponseBrowserVNCApplicationTypeAppLauncher    AccessApplicationGetResponseBrowserVNCApplicationType = "app_launcher"
	AccessApplicationGetResponseBrowserVNCApplicationTypeWARP           AccessApplicationGetResponseBrowserVNCApplicationType = "warp"
	AccessApplicationGetResponseBrowserVNCApplicationTypeBISO           AccessApplicationGetResponseBrowserVNCApplicationType = "biso"
	AccessApplicationGetResponseBrowserVNCApplicationTypeBookmark       AccessApplicationGetResponseBrowserVNCApplicationType = "bookmark"
	AccessApplicationGetResponseBrowserVNCApplicationTypeDashSSO        AccessApplicationGetResponseBrowserVNCApplicationType = "dash_sso"
	AccessApplicationGetResponseBrowserVNCApplicationTypeInfrastructure AccessApplicationGetResponseBrowserVNCApplicationType = "infrastructure"
	AccessApplicationGetResponseBrowserVNCApplicationTypeRdp            AccessApplicationGetResponseBrowserVNCApplicationType = "rdp"
	AccessApplicationGetResponseBrowserVNCApplicationTypeMcp            AccessApplicationGetResponseBrowserVNCApplicationType = "mcp"
	AccessApplicationGetResponseBrowserVNCApplicationTypeMcpPortal      AccessApplicationGetResponseBrowserVNCApplicationType = "mcp_portal"
	AccessApplicationGetResponseBrowserVNCApplicationTypeProxyEndpoint  AccessApplicationGetResponseBrowserVNCApplicationType = "proxy_endpoint"
)

func (r AccessApplicationGetResponseBrowserVNCApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserVNCApplicationTypeSelfHosted, AccessApplicationGetResponseBrowserVNCApplicationTypeSaaS, AccessApplicationGetResponseBrowserVNCApplicationTypeSSH, AccessApplicationGetResponseBrowserVNCApplicationTypeVNC, AccessApplicationGetResponseBrowserVNCApplicationTypeAppLauncher, AccessApplicationGetResponseBrowserVNCApplicationTypeWARP, AccessApplicationGetResponseBrowserVNCApplicationTypeBISO, AccessApplicationGetResponseBrowserVNCApplicationTypeBookmark, AccessApplicationGetResponseBrowserVNCApplicationTypeDashSSO, AccessApplicationGetResponseBrowserVNCApplicationTypeInfrastructure, AccessApplicationGetResponseBrowserVNCApplicationTypeRdp, AccessApplicationGetResponseBrowserVNCApplicationTypeMcp, AccessApplicationGetResponseBrowserVNCApplicationTypeMcpPortal, AccessApplicationGetResponseBrowserVNCApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationGetResponseBrowserVNCApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationGetResponseBrowserVNCApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                            `json:"port_range"`
	Type      AccessApplicationGetResponseBrowserVNCApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                           `json:"vnet_id"`
	JSON   accessApplicationGetResponseBrowserVNCApplicationDestinationJSON `json:"-"`
	union  AccessApplicationGetResponseBrowserVNCApplicationDestinationsUnion
}

// accessApplicationGetResponseBrowserVNCApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationGetResponseBrowserVNCApplicationDestination]
type accessApplicationGetResponseBrowserVNCApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationGetResponseBrowserVNCApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationGetResponseBrowserVNCApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationGetResponseBrowserVNCApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationGetResponseBrowserVNCApplicationDestinationsUnion] interface
// which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestination],
// [AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestination],
// [AccessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationGetResponseBrowserVNCApplicationDestination) AsUnion() AccessApplicationGetResponseBrowserVNCApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestination],
// [AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationGetResponseBrowserVNCApplicationDestinationsUnion interface {
	implementsAccessApplicationGetResponseBrowserVNCApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseBrowserVNCApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestination struct {
	Type AccessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                             `json:"uri"`
	JSON accessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestination]
type accessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestination) implementsAccessApplicationGetResponseBrowserVNCApplicationDestination() {
}

type AccessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestinationTypePublic AccessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserVNCApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                              `json:"port_range"`
	Type      AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                              `json:"vnet_id"`
	JSON   accessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestination]
type accessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestination) implementsAccessApplicationGetResponseBrowserVNCApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserVNCApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                         `json:"mcp_server_id"`
	Type        AccessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationGetResponseBrowserVNCApplicationDestination() {
}

type AccessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationGetResponseBrowserVNCApplicationDestinationsL4Protocol string

const (
	AccessApplicationGetResponseBrowserVNCApplicationDestinationsL4ProtocolTCP AccessApplicationGetResponseBrowserVNCApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationGetResponseBrowserVNCApplicationDestinationsL4ProtocolUdp AccessApplicationGetResponseBrowserVNCApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationGetResponseBrowserVNCApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserVNCApplicationDestinationsL4ProtocolTCP, AccessApplicationGetResponseBrowserVNCApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserVNCApplicationDestinationsType string

const (
	AccessApplicationGetResponseBrowserVNCApplicationDestinationsTypePublic             AccessApplicationGetResponseBrowserVNCApplicationDestinationsType = "public"
	AccessApplicationGetResponseBrowserVNCApplicationDestinationsTypePrivate            AccessApplicationGetResponseBrowserVNCApplicationDestinationsType = "private"
	AccessApplicationGetResponseBrowserVNCApplicationDestinationsTypeViaMcpServerPortal AccessApplicationGetResponseBrowserVNCApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationGetResponseBrowserVNCApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserVNCApplicationDestinationsTypePublic, AccessApplicationGetResponseBrowserVNCApplicationDestinationsTypePrivate, AccessApplicationGetResponseBrowserVNCApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserVNCApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                      `json:"session_duration"`
	UpdatedAt       time.Time                                                   `json:"updated_at" format:"date-time"`
	JSON            accessApplicationGetResponseBrowserVNCApplicationPolicyJSON `json:"-"`
}

// accessApplicationGetResponseBrowserVNCApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationGetResponseBrowserVNCApplicationPolicy]
type accessApplicationGetResponseBrowserVNCApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserVNCApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserVNCApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationGetResponseBrowserVNCApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                             `json:"mappings"`
	JSON     accessApplicationGetResponseBrowserVNCApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationGetResponseBrowserVNCApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationGetResponseBrowserVNCApplicationSCIMConfig]
type accessApplicationGetResponseBrowserVNCApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserVNCApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserVNCApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                               `json:"user"`
	JSON  accessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationGetResponseBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationGetResponseAppLauncherApplication struct {
	// The application type.
	Type AccessApplicationGetResponseAppLauncherApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// The image URL of the logo shown in the App Launcher header.
	AppLauncherLogoURL string `json:"app_launcher_logo_url"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The background color of the App Launcher page.
	BgColor string `json:"bg_color"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// The links in the App Launcher footer.
	FooterLinks []AccessApplicationGetResponseAppLauncherApplicationFooterLink `json:"footer_links"`
	// The background color of the App Launcher header.
	HeaderBgColor string `json:"header_bg_color"`
	// The design of the App Launcher landing page shown to users when they log in.
	LandingPageDesign AccessApplicationGetResponseAppLauncherApplicationLandingPageDesign `json:"landing_page_design"`
	// The name of the application.
	Name     string                                                     `json:"name"`
	Policies []AccessApplicationGetResponseAppLauncherApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Determines when to skip the App Launcher landing page.
	SkipAppLauncherLoginPage bool                                                   `json:"skip_app_launcher_login_page"`
	JSON                     accessApplicationGetResponseAppLauncherApplicationJSON `json:"-"`
}

// accessApplicationGetResponseAppLauncherApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationGetResponseAppLauncherApplication]
type accessApplicationGetResponseAppLauncherApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AppLauncherLogoURL       apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	BgColor                  apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	FooterLinks              apijson.Field
	HeaderBgColor            apijson.Field
	LandingPageDesign        apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	SkipAppLauncherLoginPage apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationGetResponseAppLauncherApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseAppLauncherApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseAppLauncherApplication) implementsAccessApplicationGetResponse() {
}

// The application type.
type AccessApplicationGetResponseAppLauncherApplicationType string

const (
	AccessApplicationGetResponseAppLauncherApplicationTypeSelfHosted     AccessApplicationGetResponseAppLauncherApplicationType = "self_hosted"
	AccessApplicationGetResponseAppLauncherApplicationTypeSaaS           AccessApplicationGetResponseAppLauncherApplicationType = "saas"
	AccessApplicationGetResponseAppLauncherApplicationTypeSSH            AccessApplicationGetResponseAppLauncherApplicationType = "ssh"
	AccessApplicationGetResponseAppLauncherApplicationTypeVNC            AccessApplicationGetResponseAppLauncherApplicationType = "vnc"
	AccessApplicationGetResponseAppLauncherApplicationTypeAppLauncher    AccessApplicationGetResponseAppLauncherApplicationType = "app_launcher"
	AccessApplicationGetResponseAppLauncherApplicationTypeWARP           AccessApplicationGetResponseAppLauncherApplicationType = "warp"
	AccessApplicationGetResponseAppLauncherApplicationTypeBISO           AccessApplicationGetResponseAppLauncherApplicationType = "biso"
	AccessApplicationGetResponseAppLauncherApplicationTypeBookmark       AccessApplicationGetResponseAppLauncherApplicationType = "bookmark"
	AccessApplicationGetResponseAppLauncherApplicationTypeDashSSO        AccessApplicationGetResponseAppLauncherApplicationType = "dash_sso"
	AccessApplicationGetResponseAppLauncherApplicationTypeInfrastructure AccessApplicationGetResponseAppLauncherApplicationType = "infrastructure"
	AccessApplicationGetResponseAppLauncherApplicationTypeRdp            AccessApplicationGetResponseAppLauncherApplicationType = "rdp"
	AccessApplicationGetResponseAppLauncherApplicationTypeMcp            AccessApplicationGetResponseAppLauncherApplicationType = "mcp"
	AccessApplicationGetResponseAppLauncherApplicationTypeMcpPortal      AccessApplicationGetResponseAppLauncherApplicationType = "mcp_portal"
	AccessApplicationGetResponseAppLauncherApplicationTypeProxyEndpoint  AccessApplicationGetResponseAppLauncherApplicationType = "proxy_endpoint"
)

func (r AccessApplicationGetResponseAppLauncherApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseAppLauncherApplicationTypeSelfHosted, AccessApplicationGetResponseAppLauncherApplicationTypeSaaS, AccessApplicationGetResponseAppLauncherApplicationTypeSSH, AccessApplicationGetResponseAppLauncherApplicationTypeVNC, AccessApplicationGetResponseAppLauncherApplicationTypeAppLauncher, AccessApplicationGetResponseAppLauncherApplicationTypeWARP, AccessApplicationGetResponseAppLauncherApplicationTypeBISO, AccessApplicationGetResponseAppLauncherApplicationTypeBookmark, AccessApplicationGetResponseAppLauncherApplicationTypeDashSSO, AccessApplicationGetResponseAppLauncherApplicationTypeInfrastructure, AccessApplicationGetResponseAppLauncherApplicationTypeRdp, AccessApplicationGetResponseAppLauncherApplicationTypeMcp, AccessApplicationGetResponseAppLauncherApplicationTypeMcpPortal, AccessApplicationGetResponseAppLauncherApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

type AccessApplicationGetResponseAppLauncherApplicationFooterLink struct {
	// The hypertext in the footer link.
	Name string `json:"name,required"`
	// the hyperlink in the footer link.
	URL  string                                                           `json:"url,required"`
	JSON accessApplicationGetResponseAppLauncherApplicationFooterLinkJSON `json:"-"`
}

// accessApplicationGetResponseAppLauncherApplicationFooterLinkJSON contains the
// JSON metadata for the struct
// [AccessApplicationGetResponseAppLauncherApplicationFooterLink]
type accessApplicationGetResponseAppLauncherApplicationFooterLinkJSON struct {
	Name        apijson.Field
	URL         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseAppLauncherApplicationFooterLink) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseAppLauncherApplicationFooterLinkJSON) RawJSON() string {
	return r.raw
}

// The design of the App Launcher landing page shown to users when they log in.
type AccessApplicationGetResponseAppLauncherApplicationLandingPageDesign struct {
	// The background color of the log in button on the landing page.
	ButtonColor string `json:"button_color"`
	// The color of the text in the log in button on the landing page.
	ButtonTextColor string `json:"button_text_color"`
	// The URL of the image shown on the landing page.
	ImageURL string `json:"image_url"`
	// The message shown on the landing page.
	Message string `json:"message"`
	// The title shown on the landing page.
	Title string                                                                  `json:"title"`
	JSON  accessApplicationGetResponseAppLauncherApplicationLandingPageDesignJSON `json:"-"`
}

// accessApplicationGetResponseAppLauncherApplicationLandingPageDesignJSON contains
// the JSON metadata for the struct
// [AccessApplicationGetResponseAppLauncherApplicationLandingPageDesign]
type accessApplicationGetResponseAppLauncherApplicationLandingPageDesignJSON struct {
	ButtonColor     apijson.Field
	ButtonTextColor apijson.Field
	ImageURL        apijson.Field
	Message         apijson.Field
	Title           apijson.Field
	raw             string
	ExtraFields     map[string]apijson.Field
}

func (r *AccessApplicationGetResponseAppLauncherApplicationLandingPageDesign) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseAppLauncherApplicationLandingPageDesignJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationGetResponseAppLauncherApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                       `json:"session_duration"`
	UpdatedAt       time.Time                                                    `json:"updated_at" format:"date-time"`
	JSON            accessApplicationGetResponseAppLauncherApplicationPolicyJSON `json:"-"`
}

// accessApplicationGetResponseAppLauncherApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationGetResponseAppLauncherApplicationPolicy]
type accessApplicationGetResponseAppLauncherApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseAppLauncherApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseAppLauncherApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationGetResponseDeviceEnrollmentPermissionsApplication struct {
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// The name of the application.
	Name     string                                                                     `json:"name"`
	Policies []AccessApplicationGetResponseDeviceEnrollmentPermissionsApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string                                                                 `json:"session_duration"`
	JSON            accessApplicationGetResponseDeviceEnrollmentPermissionsApplicationJSON `json:"-"`
}

// accessApplicationGetResponseDeviceEnrollmentPermissionsApplicationJSON contains
// the JSON metadata for the struct
// [AccessApplicationGetResponseDeviceEnrollmentPermissionsApplication]
type accessApplicationGetResponseDeviceEnrollmentPermissionsApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationGetResponseDeviceEnrollmentPermissionsApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseDeviceEnrollmentPermissionsApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseDeviceEnrollmentPermissionsApplication) implementsAccessApplicationGetResponse() {
}

type AccessApplicationGetResponseDeviceEnrollmentPermissionsApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                                       `json:"session_duration"`
	UpdatedAt       time.Time                                                                    `json:"updated_at" format:"date-time"`
	JSON            accessApplicationGetResponseDeviceEnrollmentPermissionsApplicationPolicyJSON `json:"-"`
}

// accessApplicationGetResponseDeviceEnrollmentPermissionsApplicationPolicyJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseDeviceEnrollmentPermissionsApplicationPolicy]
type accessApplicationGetResponseDeviceEnrollmentPermissionsApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseDeviceEnrollmentPermissionsApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseDeviceEnrollmentPermissionsApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationGetResponseBrowserIsolationPermissionsApplication struct {
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain string `json:"domain"`
	// The name of the application.
	Name     string                                                                     `json:"name"`
	Policies []AccessApplicationGetResponseBrowserIsolationPermissionsApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string                                                                 `json:"session_duration"`
	JSON            accessApplicationGetResponseBrowserIsolationPermissionsApplicationJSON `json:"-"`
}

// accessApplicationGetResponseBrowserIsolationPermissionsApplicationJSON contains
// the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserIsolationPermissionsApplication]
type accessApplicationGetResponseBrowserIsolationPermissionsApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserIsolationPermissionsApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserIsolationPermissionsApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserIsolationPermissionsApplication) implementsAccessApplicationGetResponse() {
}

type AccessApplicationGetResponseBrowserIsolationPermissionsApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                                       `json:"session_duration"`
	UpdatedAt       time.Time                                                                    `json:"updated_at" format:"date-time"`
	JSON            accessApplicationGetResponseBrowserIsolationPermissionsApplicationPolicyJSON `json:"-"`
}

// accessApplicationGetResponseBrowserIsolationPermissionsApplicationPolicyJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserIsolationPermissionsApplicationPolicy]
type accessApplicationGetResponseBrowserIsolationPermissionsApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserIsolationPermissionsApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserIsolationPermissionsApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationGetResponseGatewayIdentityProxyEndpointApplication struct {
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// The proxy endpoint domain in the format: 10 alphanumeric characters followed by
	// .proxy.cloudflare-gateway.com
	Domain string `json:"domain"`
	// The name of the application.
	Name     string                                                                      `json:"name"`
	Policies []AccessApplicationGetResponseGatewayIdentityProxyEndpointApplicationPolicy `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string                                                                  `json:"session_duration"`
	JSON            accessApplicationGetResponseGatewayIdentityProxyEndpointApplicationJSON `json:"-"`
}

// accessApplicationGetResponseGatewayIdentityProxyEndpointApplicationJSON contains
// the JSON metadata for the struct
// [AccessApplicationGetResponseGatewayIdentityProxyEndpointApplication]
type accessApplicationGetResponseGatewayIdentityProxyEndpointApplicationJSON struct {
	Type                     apijson.Field
	ID                       apijson.Field
	AllowedIdPs              apijson.Field
	AUD                      apijson.Field
	AutoRedirectToIdentity   apijson.Field
	CustomDenyURL            apijson.Field
	CustomNonIdentityDenyURL apijson.Field
	CustomPages              apijson.Field
	Domain                   apijson.Field
	Name                     apijson.Field
	Policies                 apijson.Field
	SessionDuration          apijson.Field
	raw                      string
	ExtraFields              map[string]apijson.Field
}

func (r *AccessApplicationGetResponseGatewayIdentityProxyEndpointApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseGatewayIdentityProxyEndpointApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseGatewayIdentityProxyEndpointApplication) implementsAccessApplicationGetResponse() {
}

type AccessApplicationGetResponseGatewayIdentityProxyEndpointApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                                        `json:"session_duration"`
	UpdatedAt       time.Time                                                                     `json:"updated_at" format:"date-time"`
	JSON            accessApplicationGetResponseGatewayIdentityProxyEndpointApplicationPolicyJSON `json:"-"`
}

// accessApplicationGetResponseGatewayIdentityProxyEndpointApplicationPolicyJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseGatewayIdentityProxyEndpointApplicationPolicy]
type accessApplicationGetResponseGatewayIdentityProxyEndpointApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseGatewayIdentityProxyEndpointApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseGatewayIdentityProxyEndpointApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationGetResponseBookmarkApplication struct {
	// UUID.
	ID string `json:"id"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// The URL or domain of the bookmark.
	Domain string `json:"domain"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name     string                                                  `json:"name"`
	Policies []AccessApplicationGetResponseBookmarkApplicationPolicy `json:"policies"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// The application type.
	Type ApplicationType                                     `json:"type"`
	JSON accessApplicationGetResponseBookmarkApplicationJSON `json:"-"`
}

// accessApplicationGetResponseBookmarkApplicationJSON contains the JSON metadata
// for the struct [AccessApplicationGetResponseBookmarkApplication]
type accessApplicationGetResponseBookmarkApplicationJSON struct {
	ID                 apijson.Field
	AppLauncherVisible apijson.Field
	AUD                apijson.Field
	Domain             apijson.Field
	LogoURL            apijson.Field
	Name               apijson.Field
	Policies           apijson.Field
	Tags               apijson.Field
	Type               apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBookmarkApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBookmarkApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBookmarkApplication) implementsAccessApplicationGetResponse() {}

type AccessApplicationGetResponseBookmarkApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                    `json:"session_duration"`
	UpdatedAt       time.Time                                                 `json:"updated_at" format:"date-time"`
	JSON            accessApplicationGetResponseBookmarkApplicationPolicyJSON `json:"-"`
}

// accessApplicationGetResponseBookmarkApplicationPolicyJSON contains the JSON
// metadata for the struct [AccessApplicationGetResponseBookmarkApplicationPolicy]
type accessApplicationGetResponseBookmarkApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBookmarkApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBookmarkApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationGetResponseInfrastructureApplication struct {
	TargetCriteria []AccessApplicationGetResponseInfrastructureApplicationTargetCriterion `json:"target_criteria,required"`
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// Audience tag.
	AUD string `json:"aud"`
	// The name of the application.
	Name     string                                                        `json:"name"`
	Policies []AccessApplicationGetResponseInfrastructureApplicationPolicy `json:"policies"`
	JSON     accessApplicationGetResponseInfrastructureApplicationJSON     `json:"-"`
}

// accessApplicationGetResponseInfrastructureApplicationJSON contains the JSON
// metadata for the struct [AccessApplicationGetResponseInfrastructureApplication]
type accessApplicationGetResponseInfrastructureApplicationJSON struct {
	TargetCriteria apijson.Field
	Type           apijson.Field
	ID             apijson.Field
	AUD            apijson.Field
	Name           apijson.Field
	Policies       apijson.Field
	raw            string
	ExtraFields    map[string]apijson.Field
}

func (r *AccessApplicationGetResponseInfrastructureApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseInfrastructureApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseInfrastructureApplication) implementsAccessApplicationGetResponse() {
}

type AccessApplicationGetResponseInfrastructureApplicationTargetCriterion struct {
	// The port that the targets use for the chosen communication protocol. A port
	// cannot be assigned to multiple protocols.
	Port int64 `json:"port,required"`
	// The communication protocol your application secures.
	Protocol AccessApplicationGetResponseInfrastructureApplicationTargetCriteriaProtocol `json:"protocol,required"`
	// Contains a map of target attribute keys to target attribute values.
	TargetAttributes map[string][]string                                                      `json:"target_attributes,required"`
	JSON             accessApplicationGetResponseInfrastructureApplicationTargetCriterionJSON `json:"-"`
}

// accessApplicationGetResponseInfrastructureApplicationTargetCriterionJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseInfrastructureApplicationTargetCriterion]
type accessApplicationGetResponseInfrastructureApplicationTargetCriterionJSON struct {
	Port             apijson.Field
	Protocol         apijson.Field
	TargetAttributes apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationGetResponseInfrastructureApplicationTargetCriterion) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseInfrastructureApplicationTargetCriterionJSON) RawJSON() string {
	return r.raw
}

// The communication protocol your application secures.
type AccessApplicationGetResponseInfrastructureApplicationTargetCriteriaProtocol string

const (
	AccessApplicationGetResponseInfrastructureApplicationTargetCriteriaProtocolSSH AccessApplicationGetResponseInfrastructureApplicationTargetCriteriaProtocol = "SSH"
)

func (r AccessApplicationGetResponseInfrastructureApplicationTargetCriteriaProtocol) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseInfrastructureApplicationTargetCriteriaProtocolSSH:
		return true
	}
	return false
}

type AccessApplicationGetResponseInfrastructureApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// The rules that define how users may connect to the targets secured by your
	// application.
	ConnectionRules AccessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRules `json:"connection_rules"`
	CreatedAt       time.Time                                                                    `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// The name of the Access policy.
	Name string `json:"name"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require   []AccessRule                                                    `json:"require"`
	UpdatedAt time.Time                                                       `json:"updated_at" format:"date-time"`
	JSON      accessApplicationGetResponseInfrastructureApplicationPolicyJSON `json:"-"`
}

// accessApplicationGetResponseInfrastructureApplicationPolicyJSON contains the
// JSON metadata for the struct
// [AccessApplicationGetResponseInfrastructureApplicationPolicy]
type accessApplicationGetResponseInfrastructureApplicationPolicyJSON struct {
	ID              apijson.Field
	ConnectionRules apijson.Field
	CreatedAt       apijson.Field
	Decision        apijson.Field
	Exclude         apijson.Field
	Include         apijson.Field
	Name            apijson.Field
	Require         apijson.Field
	UpdatedAt       apijson.Field
	raw             string
	ExtraFields     map[string]apijson.Field
}

func (r *AccessApplicationGetResponseInfrastructureApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseInfrastructureApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// The rules that define how users may connect to the targets secured by your
// application.
type AccessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRules struct {
	// The SSH-specific rules that define how users may connect to the targets secured
	// by your application.
	SSH  AccessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRulesSSH  `json:"ssh"`
	JSON accessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRulesJSON `json:"-"`
}

// accessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRulesJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRules]
type accessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRulesJSON struct {
	SSH         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRules) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRulesJSON) RawJSON() string {
	return r.raw
}

// The SSH-specific rules that define how users may connect to the targets secured
// by your application.
type AccessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRulesSSH struct {
	// Contains the Unix usernames that may be used when connecting over SSH.
	Usernames []string `json:"usernames,required"`
	// Enables using Identity Provider email alias as SSH username.
	AllowEmailAlias bool                                                                                `json:"allow_email_alias"`
	JSON            accessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON `json:"-"`
}

// accessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRulesSSH]
type accessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON struct {
	Usernames       apijson.Field
	AllowEmailAlias apijson.Field
	raw             string
	ExtraFields     map[string]apijson.Field
}

func (r *AccessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRulesSSH) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseInfrastructureApplicationPoliciesConnectionRulesSSHJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationGetResponseBrowserRdpApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain         string                                                             `json:"domain,required"`
	TargetCriteria []AccessApplicationGetResponseBrowserRdpApplicationTargetCriterion `json:"target_criteria,required"`
	// The application type.
	Type ApplicationType `json:"type,required"`
	// UUID.
	ID string `json:"id"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP bool `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe bool `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs []AllowedIdPs `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible bool `json:"app_launcher_visible"`
	// Audience tag.
	AUD string `json:"aud"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity bool        `json:"auto_redirect_to_identity"`
	CORSHeaders            CORSHeaders `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage string `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL string `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL string `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages []string `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations []AccessApplicationGetResponseBrowserRdpApplicationDestination `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie bool `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute bool `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL string `json:"logo_url"`
	// The name of the application.
	Name string `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass bool `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute bool                                                      `json:"path_cookie_attribute"`
	Policies            []AccessApplicationGetResponseBrowserRdpApplicationPolicy `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader string `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute string `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig AccessApplicationGetResponseBrowserRdpApplicationSCIMConfig `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains []SelfHostedDomains `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect bool `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration string `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial bool `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags []string `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL bool                                                  `json:"use_clientless_isolation_app_launcher_url"`
	JSON                                 accessApplicationGetResponseBrowserRdpApplicationJSON `json:"-"`
}

// accessApplicationGetResponseBrowserRdpApplicationJSON contains the JSON metadata
// for the struct [AccessApplicationGetResponseBrowserRdpApplication]
type accessApplicationGetResponseBrowserRdpApplicationJSON struct {
	Domain                               apijson.Field
	TargetCriteria                       apijson.Field
	Type                                 apijson.Field
	ID                                   apijson.Field
	AllowAuthenticateViaWARP             apijson.Field
	AllowIframe                          apijson.Field
	AllowedIdPs                          apijson.Field
	AppLauncherVisible                   apijson.Field
	AUD                                  apijson.Field
	AutoRedirectToIdentity               apijson.Field
	CORSHeaders                          apijson.Field
	CustomDenyMessage                    apijson.Field
	CustomDenyURL                        apijson.Field
	CustomNonIdentityDenyURL             apijson.Field
	CustomPages                          apijson.Field
	Destinations                         apijson.Field
	EnableBindingCookie                  apijson.Field
	HTTPOnlyCookieAttribute              apijson.Field
	LogoURL                              apijson.Field
	Name                                 apijson.Field
	OptionsPreflightBypass               apijson.Field
	PathCookieAttribute                  apijson.Field
	Policies                             apijson.Field
	ReadServiceTokensFromHeader          apijson.Field
	SameSiteCookieAttribute              apijson.Field
	SCIMConfig                           apijson.Field
	SelfHostedDomains                    apijson.Field
	ServiceAuth401Redirect               apijson.Field
	SessionDuration                      apijson.Field
	SkipInterstitial                     apijson.Field
	Tags                                 apijson.Field
	UseClientlessIsolationAppLauncherURL apijson.Field
	raw                                  string
	ExtraFields                          map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserRdpApplication) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserRdpApplicationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserRdpApplication) implementsAccessApplicationGetResponse() {}

type AccessApplicationGetResponseBrowserRdpApplicationTargetCriterion struct {
	// The port that the targets use for the chosen communication protocol. A port
	// cannot be assigned to multiple protocols.
	Port int64 `json:"port,required"`
	// The communication protocol your application secures.
	Protocol AccessApplicationGetResponseBrowserRdpApplicationTargetCriteriaProtocol `json:"protocol,required"`
	// Contains a map of target attribute keys to target attribute values.
	TargetAttributes map[string][]string                                                  `json:"target_attributes,required"`
	JSON             accessApplicationGetResponseBrowserRdpApplicationTargetCriterionJSON `json:"-"`
}

// accessApplicationGetResponseBrowserRdpApplicationTargetCriterionJSON contains
// the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserRdpApplicationTargetCriterion]
type accessApplicationGetResponseBrowserRdpApplicationTargetCriterionJSON struct {
	Port             apijson.Field
	Protocol         apijson.Field
	TargetAttributes apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserRdpApplicationTargetCriterion) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserRdpApplicationTargetCriterionJSON) RawJSON() string {
	return r.raw
}

// The communication protocol your application secures.
type AccessApplicationGetResponseBrowserRdpApplicationTargetCriteriaProtocol string

const (
	AccessApplicationGetResponseBrowserRdpApplicationTargetCriteriaProtocolRdp AccessApplicationGetResponseBrowserRdpApplicationTargetCriteriaProtocol = "RDP"
)

func (r AccessApplicationGetResponseBrowserRdpApplicationTargetCriteriaProtocol) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserRdpApplicationTargetCriteriaProtocolRdp:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationGetResponseBrowserRdpApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationGetResponseBrowserRdpApplicationDestinationsL4Protocol `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID string `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                            `json:"port_range"`
	Type      AccessApplicationGetResponseBrowserRdpApplicationDestinationsType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI string `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                           `json:"vnet_id"`
	JSON   accessApplicationGetResponseBrowserRdpApplicationDestinationJSON `json:"-"`
	union  AccessApplicationGetResponseBrowserRdpApplicationDestinationsUnion
}

// accessApplicationGetResponseBrowserRdpApplicationDestinationJSON contains the
// JSON metadata for the struct
// [AccessApplicationGetResponseBrowserRdpApplicationDestination]
type accessApplicationGetResponseBrowserRdpApplicationDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	McpServerID apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	URI         apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r accessApplicationGetResponseBrowserRdpApplicationDestinationJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationGetResponseBrowserRdpApplicationDestination) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationGetResponseBrowserRdpApplicationDestination{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationGetResponseBrowserRdpApplicationDestinationsUnion] interface
// which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are
// [AccessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestination],
// [AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestination],
// [AccessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination].
func (r AccessApplicationGetResponseBrowserRdpApplicationDestination) AsUnion() AccessApplicationGetResponseBrowserRdpApplicationDestinationsUnion {
	return r.union
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Union satisfied by
// [AccessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestination],
// [AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestination]
// or
// [AccessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination].
type AccessApplicationGetResponseBrowserRdpApplicationDestinationsUnion interface {
	implementsAccessApplicationGetResponseBrowserRdpApplicationDestination()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseBrowserRdpApplicationDestinationsUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestination{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination{}),
		},
	)
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestination struct {
	Type AccessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestinationType `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI  string                                                                             `json:"uri"`
	JSON accessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestinationJSON `json:"-"`
}

// accessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestination]
type accessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestinationJSON struct {
	Type        apijson.Field
	URI         apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestination) implementsAccessApplicationGetResponseBrowserRdpApplicationDestination() {
}

type AccessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestinationTypePublic AccessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserRdpApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR string `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname string `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange string                                                                              `json:"port_range"`
	Type      AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationType `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID string                                                                              `json:"vnet_id"`
	JSON   accessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON `json:"-"`
}

// accessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestination]
type accessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON struct {
	CIDR        apijson.Field
	Hostname    apijson.Field
	L4Protocol  apijson.Field
	PortRange   apijson.Field
	Type        apijson.Field
	VnetID      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestination) implementsAccessApplicationGetResponseBrowserRdpApplicationDestination() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserRdpApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID string                                                                                         `json:"mcp_server_id"`
	Type        AccessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType `json:"type"`
	JSON        accessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON `json:"-"`
}

// accessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination]
type accessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON struct {
	McpServerID apijson.Field
	Type        apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationGetResponseBrowserRdpApplicationDestination() {
}

type AccessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationGetResponseBrowserRdpApplicationDestinationsL4Protocol string

const (
	AccessApplicationGetResponseBrowserRdpApplicationDestinationsL4ProtocolTCP AccessApplicationGetResponseBrowserRdpApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationGetResponseBrowserRdpApplicationDestinationsL4ProtocolUdp AccessApplicationGetResponseBrowserRdpApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationGetResponseBrowserRdpApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserRdpApplicationDestinationsL4ProtocolTCP, AccessApplicationGetResponseBrowserRdpApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserRdpApplicationDestinationsType string

const (
	AccessApplicationGetResponseBrowserRdpApplicationDestinationsTypePublic             AccessApplicationGetResponseBrowserRdpApplicationDestinationsType = "public"
	AccessApplicationGetResponseBrowserRdpApplicationDestinationsTypePrivate            AccessApplicationGetResponseBrowserRdpApplicationDestinationsType = "private"
	AccessApplicationGetResponseBrowserRdpApplicationDestinationsTypeViaMcpServerPortal AccessApplicationGetResponseBrowserRdpApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationGetResponseBrowserRdpApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserRdpApplicationDestinationsTypePublic, AccessApplicationGetResponseBrowserRdpApplicationDestinationsTypePrivate, AccessApplicationGetResponseBrowserRdpApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserRdpApplicationPolicy struct {
	// The UUID of the policy
	ID string `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups []ApprovalGroup `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired bool      `json:"approval_required"`
	CreatedAt        time.Time `json:"created_at" format:"date-time"`
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision Decision `json:"decision"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude []AccessRule `json:"exclude"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include []AccessRule `json:"include"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired bool `json:"isolation_required"`
	// The name of the Access policy.
	Name string `json:"name"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence int64 `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt string `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired bool `json:"purpose_justification_required"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require []AccessRule `json:"require"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration string                                                      `json:"session_duration"`
	UpdatedAt       time.Time                                                   `json:"updated_at" format:"date-time"`
	JSON            accessApplicationGetResponseBrowserRdpApplicationPolicyJSON `json:"-"`
}

// accessApplicationGetResponseBrowserRdpApplicationPolicyJSON contains the JSON
// metadata for the struct
// [AccessApplicationGetResponseBrowserRdpApplicationPolicy]
type accessApplicationGetResponseBrowserRdpApplicationPolicyJSON struct {
	ID                           apijson.Field
	ApprovalGroups               apijson.Field
	ApprovalRequired             apijson.Field
	CreatedAt                    apijson.Field
	Decision                     apijson.Field
	Exclude                      apijson.Field
	Include                      apijson.Field
	IsolationRequired            apijson.Field
	Name                         apijson.Field
	Precedence                   apijson.Field
	PurposeJustificationPrompt   apijson.Field
	PurposeJustificationRequired apijson.Field
	Require                      apijson.Field
	SessionDuration              apijson.Field
	UpdatedAt                    apijson.Field
	raw                          string
	ExtraFields                  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserRdpApplicationPolicy) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserRdpApplicationPolicyJSON) RawJSON() string {
	return r.raw
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationGetResponseBrowserRdpApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID string `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI string `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete bool `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled bool `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings []SCIMConfigMapping                                             `json:"mappings"`
	JSON     accessApplicationGetResponseBrowserRdpApplicationSCIMConfigJSON `json:"-"`
}

// accessApplicationGetResponseBrowserRdpApplicationSCIMConfigJSON contains the
// JSON metadata for the struct
// [AccessApplicationGetResponseBrowserRdpApplicationSCIMConfig]
type accessApplicationGetResponseBrowserRdpApplicationSCIMConfigJSON struct {
	IdPUID             apijson.Field
	RemoteURI          apijson.Field
	Authentication     apijson.Field
	DeactivateOnDelete apijson.Field
	Enabled            apijson.Field
	Mappings           apijson.Field
	raw                string
	ExtraFields        map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserRdpApplicationSCIMConfig) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserRdpApplicationSCIMConfigJSON) RawJSON() string {
	return r.raw
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
// or
// [AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication].
type AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem

func (r AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token string `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL string `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID string `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret string `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password string `json:"password"`
	// This field can have the runtime type of [[]string].
	Scopes interface{} `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL string `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User  string                                                                                                               `json:"user"`
	JSON  accessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON `json:"-"`
	union AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem
}

// accessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem]
type accessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON struct {
	Scheme           apijson.Field
	Token            apijson.Field
	AuthorizationURL apijson.Field
	ClientID         apijson.Field
	ClientSecret     apijson.Field
	Password         apijson.Field
	Scopes           apijson.Field
	TokenURL         apijson.Field
	User             apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r accessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemJSON) RawJSON() string {
	return r.raw
}

func (r *AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) UnmarshalJSON(data []byte) (err error) {
	*r = AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem{}
	err = apijson.UnmarshalRoot(data, &r.union)
	if err != nil {
		return err
	}
	return apijson.Port(r.union, &r)
}

// AsUnion returns a
// [AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem]
// interface which you can cast to the specific types for more type safety.
//
// Possible runtime types of the union are [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2],
// [AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
func (r AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) AsUnion() AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem {
	return r.union
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Union satisfied by [SCIMConfigAuthenticationHTTPBasic],
// [SCIMConfigAuthenticationOAuthBearerToken], [SCIMConfigAuthenticationOauth2] or
// [AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken].
type AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem interface {
	implementsAccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem()
}

func init() {
	apijson.RegisterUnion(
		reflect.TypeOf((*AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationUnionItem)(nil)).Elem(),
		"",
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationHTTPBasic{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOAuthBearerToken{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(SCIMConfigAuthenticationOauth2{}),
		},
		apijson.UnionVariant{
			TypeFilter: gjson.JSON,
			Type:       reflect.TypeOf(AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken{}),
		},
	)
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID string `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret string `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme `json:"scheme,required"`
	JSON   accessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON   `json:"-"`
}

// accessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON
// contains the JSON metadata for the struct
// [AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken]
type accessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON struct {
	ClientID     apijson.Field
	ClientSecret apijson.Field
	Scheme       apijson.Field
	raw          string
	ExtraFields  map[string]apijson.Field
}

func (r *AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenJSON) RawJSON() string {
	return r.raw
}

func (r AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationGetResponseBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationRevokeTokensResponse = interface{}

type AccessApplicationNewParams struct {
	// Contains the targets secured by the application.
	Body AccessApplicationNewParamsBodyUnion `json:"body,required"`
	// The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
	AccountID param.Field[string] `path:"account_id"`
	// The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
	ZoneID param.Field[string] `path:"zone_id"`
}

func (r AccessApplicationNewParams) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r.Body)
}

// Contains the targets secured by the application.
type AccessApplicationNewParamsBody struct {
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP param.Field[bool] `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe param.Field[bool]        `json:"allow_iframe"`
	AllowedIdPs param.Field[interface{}] `json:"allowed_idps"`
	// The image URL of the logo shown in the App Launcher header.
	AppLauncherLogoURL param.Field[string] `json:"app_launcher_logo_url"`
	// Displays the application in the App Launcher.
	AppLauncherVisible param.Field[bool] `json:"app_launcher_visible"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool] `json:"auto_redirect_to_identity"`
	// The background color of the App Launcher page.
	BgColor     param.Field[string]           `json:"bg_color"`
	CORSHeaders param.Field[CORSHeadersParam] `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage param.Field[string] `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string]      `json:"custom_non_identity_deny_url"`
	CustomPages              param.Field[interface{}] `json:"custom_pages"`
	Destinations             param.Field[interface{}] `json:"destinations"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain param.Field[string] `json:"domain"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie param.Field[bool]        `json:"enable_binding_cookie"`
	FooterLinks         param.Field[interface{}] `json:"footer_links"`
	// The background color of the App Launcher header.
	HeaderBgColor param.Field[string] `json:"header_bg_color"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute param.Field[bool]        `json:"http_only_cookie_attribute"`
	LandingPageDesign       param.Field[interface{}] `json:"landing_page_design"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL param.Field[string] `json:"logo_url"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass param.Field[bool] `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute param.Field[bool]        `json:"path_cookie_attribute"`
	Policies            param.Field[interface{}] `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader param.Field[string]      `json:"read_service_tokens_from_header"`
	SaaSApp                     param.Field[interface{}] `json:"saas_app"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute param.Field[string]      `json:"same_site_cookie_attribute"`
	SCIMConfig              param.Field[interface{}] `json:"scim_config"`
	SelfHostedDomains       param.Field[interface{}] `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect param.Field[bool] `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
	// Determines when to skip the App Launcher landing page.
	SkipAppLauncherLoginPage param.Field[bool] `json:"skip_app_launcher_login_page"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial param.Field[bool]        `json:"skip_interstitial"`
	Tags             param.Field[interface{}] `json:"tags"`
	TargetCriteria   param.Field[interface{}] `json:"target_criteria"`
	// The application type.
	Type param.Field[ApplicationType] `json:"type"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL param.Field[bool] `json:"use_clientless_isolation_app_launcher_url"`
}

func (r AccessApplicationNewParamsBody) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBody) implementsAccessApplicationNewParamsBodyUnion() {}

// Contains the targets secured by the application.
//
// Satisfied by [zero_trust.AccessApplicationNewParamsBodySelfHostedApplication],
// [zero_trust.AccessApplicationNewParamsBodySaaSApplication],
// [zero_trust.AccessApplicationNewParamsBodyBrowserSSHApplication],
// [zero_trust.AccessApplicationNewParamsBodyBrowserVNCApplication],
// [zero_trust.AccessApplicationNewParamsBodyAppLauncherApplication],
// [zero_trust.AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplication],
// [zero_trust.AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplication],
// [zero_trust.AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplication],
// [zero_trust.AccessApplicationNewParamsBodyBookmarkApplication],
// [zero_trust.AccessApplicationNewParamsBodyInfrastructureApplication],
// [zero_trust.AccessApplicationNewParamsBodyBrowserRdpApplication],
// [AccessApplicationNewParamsBody].
type AccessApplicationNewParamsBodyUnion interface {
	implementsAccessApplicationNewParamsBodyUnion()
}

type AccessApplicationNewParamsBodySelfHostedApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain param.Field[string] `json:"domain,required"`
	// The application type.
	Type param.Field[ApplicationType] `json:"type,required"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP param.Field[bool] `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe param.Field[bool] `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible param.Field[bool] `json:"app_launcher_visible"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool]             `json:"auto_redirect_to_identity"`
	CORSHeaders            param.Field[CORSHeadersParam] `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage param.Field[string] `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations param.Field[[]AccessApplicationNewParamsBodySelfHostedApplicationDestinationUnion] `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie param.Field[bool] `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute param.Field[bool] `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL param.Field[string] `json:"logo_url"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass param.Field[bool] `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute param.Field[bool] `json:"path_cookie_attribute"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationNewParamsBodySelfHostedApplicationPolicyUnion] `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader param.Field[string] `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute param.Field[string] `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig param.Field[AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfig] `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains param.Field[[]SelfHostedDomainsParam] `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect param.Field[bool] `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial param.Field[bool] `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags param.Field[[]string] `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL param.Field[bool] `json:"use_clientless_isolation_app_launcher_url"`
}

func (r AccessApplicationNewParamsBodySelfHostedApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySelfHostedApplication) implementsAccessApplicationNewParamsBodyUnion() {
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewParamsBodySelfHostedApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationNewParamsBodySelfHostedApplicationDestinationsL4Protocol] `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string] `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                              `json:"port_range"`
	Type      param.Field[AccessApplicationNewParamsBodySelfHostedApplicationDestinationsType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationDestination) implementsAccessApplicationNewParamsBodySelfHostedApplicationDestinationUnion() {
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Satisfied by
// [zero_trust.AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPublicDestination],
// [zero_trust.AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestination],
// [zero_trust.AccessApplicationNewParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestination],
// [AccessApplicationNewParamsBodySelfHostedApplicationDestination].
type AccessApplicationNewParamsBodySelfHostedApplicationDestinationUnion interface {
	implementsAccessApplicationNewParamsBodySelfHostedApplicationDestinationUnion()
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPublicDestination struct {
	Type param.Field[AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPublicDestinationType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPublicDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPublicDestination) implementsAccessApplicationNewParamsBodySelfHostedApplicationDestinationUnion() {
}

type AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPublicDestinationTypePublic AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4Protocol] `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                                                `json:"port_range"`
	Type      param.Field[AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationType] `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestination) implementsAccessApplicationNewParamsBodySelfHostedApplicationDestinationUnion() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySelfHostedApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationNewParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string]                                                                                           `json:"mcp_server_id"`
	Type        param.Field[AccessApplicationNewParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestinationType] `json:"type"`
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationNewParamsBodySelfHostedApplicationDestinationUnion() {
}

type AccessApplicationNewParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationNewParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationNewParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationNewParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewParamsBodySelfHostedApplicationDestinationsL4Protocol string

const (
	AccessApplicationNewParamsBodySelfHostedApplicationDestinationsL4ProtocolTCP AccessApplicationNewParamsBodySelfHostedApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationNewParamsBodySelfHostedApplicationDestinationsL4ProtocolUdp AccessApplicationNewParamsBodySelfHostedApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationNewParamsBodySelfHostedApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySelfHostedApplicationDestinationsL4ProtocolTCP, AccessApplicationNewParamsBodySelfHostedApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodySelfHostedApplicationDestinationsType string

const (
	AccessApplicationNewParamsBodySelfHostedApplicationDestinationsTypePublic             AccessApplicationNewParamsBodySelfHostedApplicationDestinationsType = "public"
	AccessApplicationNewParamsBodySelfHostedApplicationDestinationsTypePrivate            AccessApplicationNewParamsBodySelfHostedApplicationDestinationsType = "private"
	AccessApplicationNewParamsBodySelfHostedApplicationDestinationsTypeViaMcpServerPortal AccessApplicationNewParamsBodySelfHostedApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationNewParamsBodySelfHostedApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySelfHostedApplicationDestinationsTypePublic, AccessApplicationNewParamsBodySelfHostedApplicationDestinationsTypePrivate, AccessApplicationNewParamsBodySelfHostedApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodySelfHostedApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationPolicy) ImplementsAccessApplicationNewParamsBodySelfHostedApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationNewParamsBodySelfHostedApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationNewParamsBodySelfHostedApplicationPoliciesObject],
// [AccessApplicationNewParamsBodySelfHostedApplicationPolicy].
type AccessApplicationNewParamsBodySelfHostedApplicationPolicyUnion interface {
	ImplementsAccessApplicationNewParamsBodySelfHostedApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodySelfHostedApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationNewParamsBodySelfHostedApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodySelfHostedApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationPoliciesObject) ImplementsAccessApplicationNewParamsBodySelfHostedApplicationPolicyUnion() {
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID param.Field[string] `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI param.Field[string] `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication param.Field[AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion] `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete param.Field[bool] `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled param.Field[bool] `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings param.Field[[]SCIMConfigMappingParam] `json:"mappings"`
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfig) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthentication struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthentication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthentication) implementsAccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [zero_trust.AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication],
// [AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthentication].
type AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion

func (r AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) implementsAccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem].
type AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion interface {
	implementsAccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationScheme string

const (
	AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeHttpbasic          AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationScheme = "httpbasic"
	AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeOauthbearertoken   AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeOauth2             AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationScheme = "oauth2"
	AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeAccessServiceToken AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeHttpbasic, AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeOauthbearertoken, AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeOauth2, AccessApplicationNewParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodySaaSApplication struct {
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible param.Field[bool] `json:"app_launcher_visible"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool] `json:"auto_redirect_to_identity"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL param.Field[string] `json:"logo_url"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationNewParamsBodySaaSApplicationPolicyUnion] `json:"policies"`
	SaaSApp  param.Field[AccessApplicationNewParamsBodySaaSApplicationSaaSAppUnion]  `json:"saas_app"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig param.Field[AccessApplicationNewParamsBodySaaSApplicationSCIMConfig] `json:"scim_config"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags param.Field[[]string] `json:"tags"`
	// The application type.
	Type param.Field[ApplicationType] `json:"type"`
}

func (r AccessApplicationNewParamsBodySaaSApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySaaSApplication) implementsAccessApplicationNewParamsBodyUnion() {
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodySaaSApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodySaaSApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySaaSApplicationPolicy) ImplementsAccessApplicationNewParamsBodySaaSApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationNewParamsBodySaaSApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationNewParamsBodySaaSApplicationPoliciesObject],
// [AccessApplicationNewParamsBodySaaSApplicationPolicy].
type AccessApplicationNewParamsBodySaaSApplicationPolicyUnion interface {
	ImplementsAccessApplicationNewParamsBodySaaSApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodySaaSApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationNewParamsBodySaaSApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySaaSApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationNewParamsBodySaaSApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodySaaSApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodySaaSApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySaaSApplicationPoliciesObject) ImplementsAccessApplicationNewParamsBodySaaSApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodySaaSApplicationSaaSApp struct {
	// The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must
	// be greater than or equal to 1m and less than or equal to 24h.
	AccessTokenLifetime param.Field[string] `json:"access_token_lifetime"`
	// If client secret should be required on the token endpoint when
	// authorization_code_with_pkce grant is used.
	AllowPKCEWithoutClientSecret param.Field[bool] `json:"allow_pkce_without_client_secret"`
	// The URL where this applications tile redirects users
	AppLauncherURL param.Field[string] `json:"app_launcher_url"`
	// Optional identifier indicating the authentication protocol used for the saas
	// app. Required for OIDC. Default if unset is "saml"
	AuthType param.Field[AccessApplicationNewParamsBodySaaSApplicationSaaSAppAuthType] `json:"auth_type"`
	// The application client id
	ClientID param.Field[string] `json:"client_id"`
	// The application client secret, only returned on POST request.
	ClientSecret param.Field[string] `json:"client_secret"`
	// The service provider's endpoint that is responsible for receiving and parsing a
	// SAML assertion.
	ConsumerServiceURL param.Field[string]      `json:"consumer_service_url"`
	CustomAttributes   param.Field[interface{}] `json:"custom_attributes"`
	CustomClaims       param.Field[interface{}] `json:"custom_claims"`
	// The URL that the user will be redirected to after a successful login for IDP
	// initiated logins.
	DefaultRelayState param.Field[string]      `json:"default_relay_state"`
	GrantTypes        param.Field[interface{}] `json:"grant_types"`
	// A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
	GroupFilterRegex         param.Field[string]      `json:"group_filter_regex"`
	HybridAndImplicitOptions param.Field[interface{}] `json:"hybrid_and_implicit_options"`
	// The unique identifier for your SaaS application.
	IdPEntityID param.Field[string] `json:"idp_entity_id"`
	// The format of the name identifier sent to the SaaS application.
	NameIDFormat param.Field[SaaSAppNameIDFormat] `json:"name_id_format"`
	// A [JSONata](https://jsonata.org/) expression that transforms an application's
	// user identities into a NameID value for its SAML assertion. This expression
	// should evaluate to a singular string. The output of this expression can override
	// the `name_id_format` setting.
	NameIDTransformJsonata param.Field[string] `json:"name_id_transform_jsonata"`
	// The Access public certificate that will be used to verify your identity.
	PublicKey           param.Field[string]      `json:"public_key"`
	RedirectURIs        param.Field[interface{}] `json:"redirect_uris"`
	RefreshTokenOptions param.Field[interface{}] `json:"refresh_token_options"`
	// A [JSONata] (https://jsonata.org/) expression that transforms an application's
	// user identities into attribute assertions in the SAML response. The expression
	// can transform id, email, name, and groups values. It can also transform fields
	// listed in the saml_attributes or oidc_fields of the identity provider used to
	// authenticate. The output of this expression must be a JSON object.
	SAMLAttributeTransformJsonata param.Field[string]      `json:"saml_attribute_transform_jsonata"`
	Scopes                        param.Field[interface{}] `json:"scopes"`
	// A globally unique name for an identity or service provider.
	SPEntityID param.Field[string] `json:"sp_entity_id"`
	// The endpoint where your SaaS application will send login requests.
	SSOEndpoint param.Field[string] `json:"sso_endpoint"`
}

func (r AccessApplicationNewParamsBodySaaSApplicationSaaSApp) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySaaSApplicationSaaSApp) implementsAccessApplicationNewParamsBodySaaSApplicationSaaSAppUnion() {
}

// Satisfied by [zero_trust.SAMLSaaSAppParam], [zero_trust.OIDCSaaSAppParam],
// [AccessApplicationNewParamsBodySaaSApplicationSaaSApp].
type AccessApplicationNewParamsBodySaaSApplicationSaaSAppUnion interface {
	implementsAccessApplicationNewParamsBodySaaSApplicationSaaSAppUnion()
}

// Optional identifier indicating the authentication protocol used for the saas
// app. Required for OIDC. Default if unset is "saml"
type AccessApplicationNewParamsBodySaaSApplicationSaaSAppAuthType string

const (
	AccessApplicationNewParamsBodySaaSApplicationSaaSAppAuthTypeSAML AccessApplicationNewParamsBodySaaSApplicationSaaSAppAuthType = "saml"
	AccessApplicationNewParamsBodySaaSApplicationSaaSAppAuthTypeOIDC AccessApplicationNewParamsBodySaaSApplicationSaaSAppAuthType = "oidc"
)

func (r AccessApplicationNewParamsBodySaaSApplicationSaaSAppAuthType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySaaSApplicationSaaSAppAuthTypeSAML, AccessApplicationNewParamsBodySaaSApplicationSaaSAppAuthTypeOIDC:
		return true
	}
	return false
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationNewParamsBodySaaSApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID param.Field[string] `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI param.Field[string] `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication param.Field[AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationUnion] `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete param.Field[bool] `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled param.Field[bool] `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings param.Field[[]SCIMConfigMappingParam] `json:"mappings"`
}

func (r AccessApplicationNewParamsBodySaaSApplicationSCIMConfig) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthentication struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthentication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthentication) implementsAccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [zero_trust.AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication],
// [AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthentication].
type AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion

func (r AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) implementsAccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem].
type AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion interface {
	implementsAccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationScheme string

const (
	AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeHttpbasic          AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationScheme = "httpbasic"
	AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeOauthbearertoken   AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeOauth2             AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationScheme = "oauth2"
	AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeAccessServiceToken AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeHttpbasic, AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeOauthbearertoken, AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeOauth2, AccessApplicationNewParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyBrowserSSHApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain param.Field[string] `json:"domain,required"`
	// The application type.
	Type param.Field[AccessApplicationNewParamsBodyBrowserSSHApplicationType] `json:"type,required"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP param.Field[bool] `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe param.Field[bool] `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible param.Field[bool] `json:"app_launcher_visible"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool]             `json:"auto_redirect_to_identity"`
	CORSHeaders            param.Field[CORSHeadersParam] `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage param.Field[string] `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations param.Field[[]AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationUnion] `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie param.Field[bool] `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute param.Field[bool] `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL param.Field[string] `json:"logo_url"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass param.Field[bool] `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute param.Field[bool] `json:"path_cookie_attribute"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationNewParamsBodyBrowserSSHApplicationPolicyUnion] `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader param.Field[string] `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute param.Field[string] `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig param.Field[AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfig] `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains param.Field[[]SelfHostedDomainsParam] `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect param.Field[bool] `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial param.Field[bool] `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags param.Field[[]string] `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL param.Field[bool] `json:"use_clientless_isolation_app_launcher_url"`
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplication) implementsAccessApplicationNewParamsBodyUnion() {
}

// The application type.
type AccessApplicationNewParamsBodyBrowserSSHApplicationType string

const (
	AccessApplicationNewParamsBodyBrowserSSHApplicationTypeSelfHosted     AccessApplicationNewParamsBodyBrowserSSHApplicationType = "self_hosted"
	AccessApplicationNewParamsBodyBrowserSSHApplicationTypeSaaS           AccessApplicationNewParamsBodyBrowserSSHApplicationType = "saas"
	AccessApplicationNewParamsBodyBrowserSSHApplicationTypeSSH            AccessApplicationNewParamsBodyBrowserSSHApplicationType = "ssh"
	AccessApplicationNewParamsBodyBrowserSSHApplicationTypeVNC            AccessApplicationNewParamsBodyBrowserSSHApplicationType = "vnc"
	AccessApplicationNewParamsBodyBrowserSSHApplicationTypeAppLauncher    AccessApplicationNewParamsBodyBrowserSSHApplicationType = "app_launcher"
	AccessApplicationNewParamsBodyBrowserSSHApplicationTypeWARP           AccessApplicationNewParamsBodyBrowserSSHApplicationType = "warp"
	AccessApplicationNewParamsBodyBrowserSSHApplicationTypeBISO           AccessApplicationNewParamsBodyBrowserSSHApplicationType = "biso"
	AccessApplicationNewParamsBodyBrowserSSHApplicationTypeBookmark       AccessApplicationNewParamsBodyBrowserSSHApplicationType = "bookmark"
	AccessApplicationNewParamsBodyBrowserSSHApplicationTypeDashSSO        AccessApplicationNewParamsBodyBrowserSSHApplicationType = "dash_sso"
	AccessApplicationNewParamsBodyBrowserSSHApplicationTypeInfrastructure AccessApplicationNewParamsBodyBrowserSSHApplicationType = "infrastructure"
	AccessApplicationNewParamsBodyBrowserSSHApplicationTypeRdp            AccessApplicationNewParamsBodyBrowserSSHApplicationType = "rdp"
	AccessApplicationNewParamsBodyBrowserSSHApplicationTypeMcp            AccessApplicationNewParamsBodyBrowserSSHApplicationType = "mcp"
	AccessApplicationNewParamsBodyBrowserSSHApplicationTypeMcpPortal      AccessApplicationNewParamsBodyBrowserSSHApplicationType = "mcp_portal"
	AccessApplicationNewParamsBodyBrowserSSHApplicationTypeProxyEndpoint  AccessApplicationNewParamsBodyBrowserSSHApplicationType = "proxy_endpoint"
)

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserSSHApplicationTypeSelfHosted, AccessApplicationNewParamsBodyBrowserSSHApplicationTypeSaaS, AccessApplicationNewParamsBodyBrowserSSHApplicationTypeSSH, AccessApplicationNewParamsBodyBrowserSSHApplicationTypeVNC, AccessApplicationNewParamsBodyBrowserSSHApplicationTypeAppLauncher, AccessApplicationNewParamsBodyBrowserSSHApplicationTypeWARP, AccessApplicationNewParamsBodyBrowserSSHApplicationTypeBISO, AccessApplicationNewParamsBodyBrowserSSHApplicationTypeBookmark, AccessApplicationNewParamsBodyBrowserSSHApplicationTypeDashSSO, AccessApplicationNewParamsBodyBrowserSSHApplicationTypeInfrastructure, AccessApplicationNewParamsBodyBrowserSSHApplicationTypeRdp, AccessApplicationNewParamsBodyBrowserSSHApplicationTypeMcp, AccessApplicationNewParamsBodyBrowserSSHApplicationTypeMcpPortal, AccessApplicationNewParamsBodyBrowserSSHApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewParamsBodyBrowserSSHApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsL4Protocol] `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string] `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                              `json:"port_range"`
	Type      param.Field[AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationDestination) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationDestinationUnion() {
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Satisfied by
// [zero_trust.AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPublicDestination],
// [zero_trust.AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestination],
// [zero_trust.AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestination],
// [AccessApplicationNewParamsBodyBrowserSSHApplicationDestination].
type AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationUnion interface {
	implementsAccessApplicationNewParamsBodyBrowserSSHApplicationDestinationUnion()
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPublicDestination struct {
	Type param.Field[AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPublicDestinationType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPublicDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPublicDestination) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationDestinationUnion() {
}

type AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPublicDestinationTypePublic AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol] `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                                                `json:"port_range"`
	Type      param.Field[AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationType] `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestination) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationDestinationUnion() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string]                                                                                           `json:"mcp_server_id"`
	Type        param.Field[AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType] `json:"type"`
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationDestinationUnion() {
}

type AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsL4Protocol string

const (
	AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsL4ProtocolTCP AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsL4ProtocolUdp AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsL4ProtocolTCP, AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsType string

const (
	AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsTypePublic             AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsType = "public"
	AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsTypePrivate            AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsType = "private"
	AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsTypeViaMcpServerPortal AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsTypePublic, AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsTypePrivate, AccessApplicationNewParamsBodyBrowserSSHApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyBrowserSSHApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationPolicy) ImplementsAccessApplicationNewParamsBodyBrowserSSHApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationNewParamsBodyBrowserSSHApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationNewParamsBodyBrowserSSHApplicationPoliciesObject],
// [AccessApplicationNewParamsBodyBrowserSSHApplicationPolicy].
type AccessApplicationNewParamsBodyBrowserSSHApplicationPolicyUnion interface {
	ImplementsAccessApplicationNewParamsBodyBrowserSSHApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyBrowserSSHApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationNewParamsBodyBrowserSSHApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodyBrowserSSHApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationPoliciesObject) ImplementsAccessApplicationNewParamsBodyBrowserSSHApplicationPolicyUnion() {
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID param.Field[string] `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI param.Field[string] `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication param.Field[AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion] `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete param.Field[bool] `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled param.Field[bool] `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings param.Field[[]SCIMConfigMappingParam] `json:"mappings"`
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfig) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthentication struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthentication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthentication) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [zero_trust.AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication],
// [AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthentication].
type AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem].
type AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion interface {
	implementsAccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationScheme string

const (
	AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeHttpbasic          AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationScheme = "httpbasic"
	AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeOauthbearertoken   AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeOauth2             AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationScheme = "oauth2"
	AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeAccessServiceToken AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeHttpbasic, AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeOauthbearertoken, AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeOauth2, AccessApplicationNewParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyBrowserVNCApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain param.Field[string] `json:"domain,required"`
	// The application type.
	Type param.Field[AccessApplicationNewParamsBodyBrowserVNCApplicationType] `json:"type,required"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP param.Field[bool] `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe param.Field[bool] `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible param.Field[bool] `json:"app_launcher_visible"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool]             `json:"auto_redirect_to_identity"`
	CORSHeaders            param.Field[CORSHeadersParam] `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage param.Field[string] `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations param.Field[[]AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationUnion] `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie param.Field[bool] `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute param.Field[bool] `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL param.Field[string] `json:"logo_url"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass param.Field[bool] `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute param.Field[bool] `json:"path_cookie_attribute"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationNewParamsBodyBrowserVNCApplicationPolicyUnion] `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader param.Field[string] `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute param.Field[string] `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig param.Field[AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfig] `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains param.Field[[]SelfHostedDomainsParam] `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect param.Field[bool] `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial param.Field[bool] `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags param.Field[[]string] `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL param.Field[bool] `json:"use_clientless_isolation_app_launcher_url"`
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplication) implementsAccessApplicationNewParamsBodyUnion() {
}

// The application type.
type AccessApplicationNewParamsBodyBrowserVNCApplicationType string

const (
	AccessApplicationNewParamsBodyBrowserVNCApplicationTypeSelfHosted     AccessApplicationNewParamsBodyBrowserVNCApplicationType = "self_hosted"
	AccessApplicationNewParamsBodyBrowserVNCApplicationTypeSaaS           AccessApplicationNewParamsBodyBrowserVNCApplicationType = "saas"
	AccessApplicationNewParamsBodyBrowserVNCApplicationTypeSSH            AccessApplicationNewParamsBodyBrowserVNCApplicationType = "ssh"
	AccessApplicationNewParamsBodyBrowserVNCApplicationTypeVNC            AccessApplicationNewParamsBodyBrowserVNCApplicationType = "vnc"
	AccessApplicationNewParamsBodyBrowserVNCApplicationTypeAppLauncher    AccessApplicationNewParamsBodyBrowserVNCApplicationType = "app_launcher"
	AccessApplicationNewParamsBodyBrowserVNCApplicationTypeWARP           AccessApplicationNewParamsBodyBrowserVNCApplicationType = "warp"
	AccessApplicationNewParamsBodyBrowserVNCApplicationTypeBISO           AccessApplicationNewParamsBodyBrowserVNCApplicationType = "biso"
	AccessApplicationNewParamsBodyBrowserVNCApplicationTypeBookmark       AccessApplicationNewParamsBodyBrowserVNCApplicationType = "bookmark"
	AccessApplicationNewParamsBodyBrowserVNCApplicationTypeDashSSO        AccessApplicationNewParamsBodyBrowserVNCApplicationType = "dash_sso"
	AccessApplicationNewParamsBodyBrowserVNCApplicationTypeInfrastructure AccessApplicationNewParamsBodyBrowserVNCApplicationType = "infrastructure"
	AccessApplicationNewParamsBodyBrowserVNCApplicationTypeRdp            AccessApplicationNewParamsBodyBrowserVNCApplicationType = "rdp"
	AccessApplicationNewParamsBodyBrowserVNCApplicationTypeMcp            AccessApplicationNewParamsBodyBrowserVNCApplicationType = "mcp"
	AccessApplicationNewParamsBodyBrowserVNCApplicationTypeMcpPortal      AccessApplicationNewParamsBodyBrowserVNCApplicationType = "mcp_portal"
	AccessApplicationNewParamsBodyBrowserVNCApplicationTypeProxyEndpoint  AccessApplicationNewParamsBodyBrowserVNCApplicationType = "proxy_endpoint"
)

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserVNCApplicationTypeSelfHosted, AccessApplicationNewParamsBodyBrowserVNCApplicationTypeSaaS, AccessApplicationNewParamsBodyBrowserVNCApplicationTypeSSH, AccessApplicationNewParamsBodyBrowserVNCApplicationTypeVNC, AccessApplicationNewParamsBodyBrowserVNCApplicationTypeAppLauncher, AccessApplicationNewParamsBodyBrowserVNCApplicationTypeWARP, AccessApplicationNewParamsBodyBrowserVNCApplicationTypeBISO, AccessApplicationNewParamsBodyBrowserVNCApplicationTypeBookmark, AccessApplicationNewParamsBodyBrowserVNCApplicationTypeDashSSO, AccessApplicationNewParamsBodyBrowserVNCApplicationTypeInfrastructure, AccessApplicationNewParamsBodyBrowserVNCApplicationTypeRdp, AccessApplicationNewParamsBodyBrowserVNCApplicationTypeMcp, AccessApplicationNewParamsBodyBrowserVNCApplicationTypeMcpPortal, AccessApplicationNewParamsBodyBrowserVNCApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewParamsBodyBrowserVNCApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsL4Protocol] `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string] `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                              `json:"port_range"`
	Type      param.Field[AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationDestination) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationDestinationUnion() {
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Satisfied by
// [zero_trust.AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPublicDestination],
// [zero_trust.AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestination],
// [zero_trust.AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestination],
// [AccessApplicationNewParamsBodyBrowserVNCApplicationDestination].
type AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationUnion interface {
	implementsAccessApplicationNewParamsBodyBrowserVNCApplicationDestinationUnion()
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPublicDestination struct {
	Type param.Field[AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPublicDestinationType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPublicDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPublicDestination) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationDestinationUnion() {
}

type AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPublicDestinationTypePublic AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol] `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                                                `json:"port_range"`
	Type      param.Field[AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationType] `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestination) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationDestinationUnion() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string]                                                                                           `json:"mcp_server_id"`
	Type        param.Field[AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType] `json:"type"`
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationDestinationUnion() {
}

type AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsL4Protocol string

const (
	AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsL4ProtocolTCP AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsL4ProtocolUdp AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsL4ProtocolTCP, AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsType string

const (
	AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsTypePublic             AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsType = "public"
	AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsTypePrivate            AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsType = "private"
	AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsTypeViaMcpServerPortal AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsTypePublic, AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsTypePrivate, AccessApplicationNewParamsBodyBrowserVNCApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyBrowserVNCApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationPolicy) ImplementsAccessApplicationNewParamsBodyBrowserVNCApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationNewParamsBodyBrowserVNCApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationNewParamsBodyBrowserVNCApplicationPoliciesObject],
// [AccessApplicationNewParamsBodyBrowserVNCApplicationPolicy].
type AccessApplicationNewParamsBodyBrowserVNCApplicationPolicyUnion interface {
	ImplementsAccessApplicationNewParamsBodyBrowserVNCApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyBrowserVNCApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationNewParamsBodyBrowserVNCApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodyBrowserVNCApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationPoliciesObject) ImplementsAccessApplicationNewParamsBodyBrowserVNCApplicationPolicyUnion() {
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID param.Field[string] `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI param.Field[string] `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication param.Field[AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion] `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete param.Field[bool] `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled param.Field[bool] `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings param.Field[[]SCIMConfigMappingParam] `json:"mappings"`
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfig) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthentication struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthentication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthentication) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [zero_trust.AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication],
// [AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthentication].
type AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem].
type AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion interface {
	implementsAccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationScheme string

const (
	AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeHttpbasic          AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationScheme = "httpbasic"
	AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeOauthbearertoken   AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeOauth2             AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationScheme = "oauth2"
	AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeAccessServiceToken AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeHttpbasic, AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeOauthbearertoken, AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeOauth2, AccessApplicationNewParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyAppLauncherApplication struct {
	// The application type.
	Type param.Field[AccessApplicationNewParamsBodyAppLauncherApplicationType] `json:"type,required"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// The image URL of the logo shown in the App Launcher header.
	AppLauncherLogoURL param.Field[string] `json:"app_launcher_logo_url"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool] `json:"auto_redirect_to_identity"`
	// The background color of the App Launcher page.
	BgColor param.Field[string] `json:"bg_color"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// The links in the App Launcher footer.
	FooterLinks param.Field[[]AccessApplicationNewParamsBodyAppLauncherApplicationFooterLink] `json:"footer_links"`
	// The background color of the App Launcher header.
	HeaderBgColor param.Field[string] `json:"header_bg_color"`
	// The design of the App Launcher landing page shown to users when they log in.
	LandingPageDesign param.Field[AccessApplicationNewParamsBodyAppLauncherApplicationLandingPageDesign] `json:"landing_page_design"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationNewParamsBodyAppLauncherApplicationPolicyUnion] `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
	// Determines when to skip the App Launcher landing page.
	SkipAppLauncherLoginPage param.Field[bool] `json:"skip_app_launcher_login_page"`
}

func (r AccessApplicationNewParamsBodyAppLauncherApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyAppLauncherApplication) implementsAccessApplicationNewParamsBodyUnion() {
}

// The application type.
type AccessApplicationNewParamsBodyAppLauncherApplicationType string

const (
	AccessApplicationNewParamsBodyAppLauncherApplicationTypeSelfHosted     AccessApplicationNewParamsBodyAppLauncherApplicationType = "self_hosted"
	AccessApplicationNewParamsBodyAppLauncherApplicationTypeSaaS           AccessApplicationNewParamsBodyAppLauncherApplicationType = "saas"
	AccessApplicationNewParamsBodyAppLauncherApplicationTypeSSH            AccessApplicationNewParamsBodyAppLauncherApplicationType = "ssh"
	AccessApplicationNewParamsBodyAppLauncherApplicationTypeVNC            AccessApplicationNewParamsBodyAppLauncherApplicationType = "vnc"
	AccessApplicationNewParamsBodyAppLauncherApplicationTypeAppLauncher    AccessApplicationNewParamsBodyAppLauncherApplicationType = "app_launcher"
	AccessApplicationNewParamsBodyAppLauncherApplicationTypeWARP           AccessApplicationNewParamsBodyAppLauncherApplicationType = "warp"
	AccessApplicationNewParamsBodyAppLauncherApplicationTypeBISO           AccessApplicationNewParamsBodyAppLauncherApplicationType = "biso"
	AccessApplicationNewParamsBodyAppLauncherApplicationTypeBookmark       AccessApplicationNewParamsBodyAppLauncherApplicationType = "bookmark"
	AccessApplicationNewParamsBodyAppLauncherApplicationTypeDashSSO        AccessApplicationNewParamsBodyAppLauncherApplicationType = "dash_sso"
	AccessApplicationNewParamsBodyAppLauncherApplicationTypeInfrastructure AccessApplicationNewParamsBodyAppLauncherApplicationType = "infrastructure"
	AccessApplicationNewParamsBodyAppLauncherApplicationTypeRdp            AccessApplicationNewParamsBodyAppLauncherApplicationType = "rdp"
	AccessApplicationNewParamsBodyAppLauncherApplicationTypeMcp            AccessApplicationNewParamsBodyAppLauncherApplicationType = "mcp"
	AccessApplicationNewParamsBodyAppLauncherApplicationTypeMcpPortal      AccessApplicationNewParamsBodyAppLauncherApplicationType = "mcp_portal"
	AccessApplicationNewParamsBodyAppLauncherApplicationTypeProxyEndpoint  AccessApplicationNewParamsBodyAppLauncherApplicationType = "proxy_endpoint"
)

func (r AccessApplicationNewParamsBodyAppLauncherApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyAppLauncherApplicationTypeSelfHosted, AccessApplicationNewParamsBodyAppLauncherApplicationTypeSaaS, AccessApplicationNewParamsBodyAppLauncherApplicationTypeSSH, AccessApplicationNewParamsBodyAppLauncherApplicationTypeVNC, AccessApplicationNewParamsBodyAppLauncherApplicationTypeAppLauncher, AccessApplicationNewParamsBodyAppLauncherApplicationTypeWARP, AccessApplicationNewParamsBodyAppLauncherApplicationTypeBISO, AccessApplicationNewParamsBodyAppLauncherApplicationTypeBookmark, AccessApplicationNewParamsBodyAppLauncherApplicationTypeDashSSO, AccessApplicationNewParamsBodyAppLauncherApplicationTypeInfrastructure, AccessApplicationNewParamsBodyAppLauncherApplicationTypeRdp, AccessApplicationNewParamsBodyAppLauncherApplicationTypeMcp, AccessApplicationNewParamsBodyAppLauncherApplicationTypeMcpPortal, AccessApplicationNewParamsBodyAppLauncherApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyAppLauncherApplicationFooterLink struct {
	// The hypertext in the footer link.
	Name param.Field[string] `json:"name,required"`
	// the hyperlink in the footer link.
	URL param.Field[string] `json:"url,required"`
}

func (r AccessApplicationNewParamsBodyAppLauncherApplicationFooterLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// The design of the App Launcher landing page shown to users when they log in.
type AccessApplicationNewParamsBodyAppLauncherApplicationLandingPageDesign struct {
	// The background color of the log in button on the landing page.
	ButtonColor param.Field[string] `json:"button_color"`
	// The color of the text in the log in button on the landing page.
	ButtonTextColor param.Field[string] `json:"button_text_color"`
	// The URL of the image shown on the landing page.
	ImageURL param.Field[string] `json:"image_url"`
	// The message shown on the landing page.
	Message param.Field[string] `json:"message"`
	// The title shown on the landing page.
	Title param.Field[string] `json:"title"`
}

func (r AccessApplicationNewParamsBodyAppLauncherApplicationLandingPageDesign) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyAppLauncherApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyAppLauncherApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyAppLauncherApplicationPolicy) ImplementsAccessApplicationNewParamsBodyAppLauncherApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationNewParamsBodyAppLauncherApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationNewParamsBodyAppLauncherApplicationPoliciesObject],
// [AccessApplicationNewParamsBodyAppLauncherApplicationPolicy].
type AccessApplicationNewParamsBodyAppLauncherApplicationPolicyUnion interface {
	ImplementsAccessApplicationNewParamsBodyAppLauncherApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyAppLauncherApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationNewParamsBodyAppLauncherApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyAppLauncherApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationNewParamsBodyAppLauncherApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodyAppLauncherApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyAppLauncherApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyAppLauncherApplicationPoliciesObject) ImplementsAccessApplicationNewParamsBodyAppLauncherApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplication struct {
	// The application type.
	Type param.Field[ApplicationType] `json:"type,required"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool] `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPolicyUnion] `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplication) implementsAccessApplicationNewParamsBodyUnion() {
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPolicy) ImplementsAccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesObject],
// [AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPolicy].
type AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPolicyUnion interface {
	ImplementsAccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesObject) ImplementsAccessApplicationNewParamsBodyDeviceEnrollmentPermissionsApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplication struct {
	// The application type.
	Type param.Field[ApplicationType] `json:"type,required"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool] `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPolicyUnion] `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplication) implementsAccessApplicationNewParamsBodyUnion() {
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPolicy) ImplementsAccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPoliciesObject],
// [AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPolicy].
type AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPolicyUnion interface {
	ImplementsAccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPoliciesObject) ImplementsAccessApplicationNewParamsBodyBrowserIsolationPermissionsApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplication struct {
	// The application type.
	Type param.Field[ApplicationType] `json:"type,required"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool] `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// The proxy endpoint domain in the format: 10 alphanumeric characters followed by
	// .proxy.cloudflare-gateway.com
	Domain param.Field[string] `json:"domain"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPolicyUnion] `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplication) implementsAccessApplicationNewParamsBodyUnion() {
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPolicy) ImplementsAccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesObject],
// [AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPolicy].
type AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPolicyUnion interface {
	ImplementsAccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesObject) ImplementsAccessApplicationNewParamsBodyGatewayIdentityProxyEndpointApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodyBookmarkApplication struct {
	// Displays the application in the App Launcher.
	AppLauncherVisible param.Field[bool] `json:"app_launcher_visible"`
	// The URL or domain of the bookmark.
	Domain param.Field[string] `json:"domain"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL param.Field[string] `json:"logo_url"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationNewParamsBodyBookmarkApplicationPolicyUnion] `json:"policies"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags param.Field[[]string] `json:"tags"`
	// The application type.
	Type param.Field[ApplicationType] `json:"type"`
}

func (r AccessApplicationNewParamsBodyBookmarkApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBookmarkApplication) implementsAccessApplicationNewParamsBodyUnion() {
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyBookmarkApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyBookmarkApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBookmarkApplicationPolicy) ImplementsAccessApplicationNewParamsBodyBookmarkApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationNewParamsBodyBookmarkApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationNewParamsBodyBookmarkApplicationPoliciesObject],
// [AccessApplicationNewParamsBodyBookmarkApplicationPolicy].
type AccessApplicationNewParamsBodyBookmarkApplicationPolicyUnion interface {
	ImplementsAccessApplicationNewParamsBodyBookmarkApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyBookmarkApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationNewParamsBodyBookmarkApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBookmarkApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationNewParamsBodyBookmarkApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodyBookmarkApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyBookmarkApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBookmarkApplicationPoliciesObject) ImplementsAccessApplicationNewParamsBodyBookmarkApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodyInfrastructureApplication struct {
	TargetCriteria param.Field[[]AccessApplicationNewParamsBodyInfrastructureApplicationTargetCriterion] `json:"target_criteria,required"`
	// The application type.
	Type param.Field[ApplicationType] `json:"type,required"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// The policies that Access applies to the application.
	Policies param.Field[[]AccessApplicationNewParamsBodyInfrastructureApplicationPolicy] `json:"policies"`
}

func (r AccessApplicationNewParamsBodyInfrastructureApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyInfrastructureApplication) implementsAccessApplicationNewParamsBodyUnion() {
}

type AccessApplicationNewParamsBodyInfrastructureApplicationTargetCriterion struct {
	// The port that the targets use for the chosen communication protocol. A port
	// cannot be assigned to multiple protocols.
	Port param.Field[int64] `json:"port,required"`
	// The communication protocol your application secures.
	Protocol param.Field[AccessApplicationNewParamsBodyInfrastructureApplicationTargetCriteriaProtocol] `json:"protocol,required"`
	// Contains a map of target attribute keys to target attribute values.
	TargetAttributes param.Field[map[string][]string] `json:"target_attributes,required"`
}

func (r AccessApplicationNewParamsBodyInfrastructureApplicationTargetCriterion) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// The communication protocol your application secures.
type AccessApplicationNewParamsBodyInfrastructureApplicationTargetCriteriaProtocol string

const (
	AccessApplicationNewParamsBodyInfrastructureApplicationTargetCriteriaProtocolSSH AccessApplicationNewParamsBodyInfrastructureApplicationTargetCriteriaProtocol = "SSH"
)

func (r AccessApplicationNewParamsBodyInfrastructureApplicationTargetCriteriaProtocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyInfrastructureApplicationTargetCriteriaProtocolSSH:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyInfrastructureApplicationPolicy struct {
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision param.Field[Decision] `json:"decision,required"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include param.Field[[]AccessRuleUnionParam] `json:"include,required"`
	// The name of the Access policy.
	Name param.Field[string] `json:"name,required"`
	// The rules that define how users may connect to the targets secured by your
	// application.
	ConnectionRules param.Field[AccessApplicationNewParamsBodyInfrastructureApplicationPoliciesConnectionRules] `json:"connection_rules"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude param.Field[[]AccessRuleUnionParam] `json:"exclude"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require param.Field[[]AccessRuleUnionParam] `json:"require"`
}

func (r AccessApplicationNewParamsBodyInfrastructureApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// The rules that define how users may connect to the targets secured by your
// application.
type AccessApplicationNewParamsBodyInfrastructureApplicationPoliciesConnectionRules struct {
	// The SSH-specific rules that define how users may connect to the targets secured
	// by your application.
	SSH param.Field[AccessApplicationNewParamsBodyInfrastructureApplicationPoliciesConnectionRulesSSH] `json:"ssh"`
}

func (r AccessApplicationNewParamsBodyInfrastructureApplicationPoliciesConnectionRules) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// The SSH-specific rules that define how users may connect to the targets secured
// by your application.
type AccessApplicationNewParamsBodyInfrastructureApplicationPoliciesConnectionRulesSSH struct {
	// Contains the Unix usernames that may be used when connecting over SSH.
	Usernames param.Field[[]string] `json:"usernames,required"`
	// Enables using Identity Provider email alias as SSH username.
	AllowEmailAlias param.Field[bool] `json:"allow_email_alias"`
}

func (r AccessApplicationNewParamsBodyInfrastructureApplicationPoliciesConnectionRulesSSH) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// Contains the targets secured by the application.
type AccessApplicationNewParamsBodyBrowserRdpApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain         param.Field[string]                                                               `json:"domain,required"`
	TargetCriteria param.Field[[]AccessApplicationNewParamsBodyBrowserRdpApplicationTargetCriterion] `json:"target_criteria,required"`
	// The application type.
	Type param.Field[ApplicationType] `json:"type,required"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP param.Field[bool] `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe param.Field[bool] `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible param.Field[bool] `json:"app_launcher_visible"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool]             `json:"auto_redirect_to_identity"`
	CORSHeaders            param.Field[CORSHeadersParam] `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage param.Field[string] `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations param.Field[[]AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationUnion] `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie param.Field[bool] `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute param.Field[bool] `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL param.Field[string] `json:"logo_url"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass param.Field[bool] `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute param.Field[bool] `json:"path_cookie_attribute"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationNewParamsBodyBrowserRdpApplicationPolicyUnion] `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader param.Field[string] `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute param.Field[string] `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig param.Field[AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfig] `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains param.Field[[]SelfHostedDomainsParam] `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect param.Field[bool] `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial param.Field[bool] `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags param.Field[[]string] `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL param.Field[bool] `json:"use_clientless_isolation_app_launcher_url"`
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplication) implementsAccessApplicationNewParamsBodyUnion() {
}

type AccessApplicationNewParamsBodyBrowserRdpApplicationTargetCriterion struct {
	// The port that the targets use for the chosen communication protocol. A port
	// cannot be assigned to multiple protocols.
	Port param.Field[int64] `json:"port,required"`
	// The communication protocol your application secures.
	Protocol param.Field[AccessApplicationNewParamsBodyBrowserRdpApplicationTargetCriteriaProtocol] `json:"protocol,required"`
	// Contains a map of target attribute keys to target attribute values.
	TargetAttributes param.Field[map[string][]string] `json:"target_attributes,required"`
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationTargetCriterion) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// The communication protocol your application secures.
type AccessApplicationNewParamsBodyBrowserRdpApplicationTargetCriteriaProtocol string

const (
	AccessApplicationNewParamsBodyBrowserRdpApplicationTargetCriteriaProtocolRdp AccessApplicationNewParamsBodyBrowserRdpApplicationTargetCriteriaProtocol = "RDP"
)

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationTargetCriteriaProtocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserRdpApplicationTargetCriteriaProtocolRdp:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewParamsBodyBrowserRdpApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsL4Protocol] `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string] `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                              `json:"port_range"`
	Type      param.Field[AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationDestination) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationDestinationUnion() {
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Satisfied by
// [zero_trust.AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPublicDestination],
// [zero_trust.AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestination],
// [zero_trust.AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestination],
// [AccessApplicationNewParamsBodyBrowserRdpApplicationDestination].
type AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationUnion interface {
	implementsAccessApplicationNewParamsBodyBrowserRdpApplicationDestinationUnion()
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPublicDestination struct {
	Type param.Field[AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPublicDestinationType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPublicDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPublicDestination) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationDestinationUnion() {
}

type AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPublicDestinationTypePublic AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol] `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                                                `json:"port_range"`
	Type      param.Field[AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationType] `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestination) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationDestinationUnion() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string]                                                                                           `json:"mcp_server_id"`
	Type        param.Field[AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType] `json:"type"`
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationDestinationUnion() {
}

type AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsL4Protocol string

const (
	AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsL4ProtocolTCP AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsL4ProtocolUdp AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsL4ProtocolTCP, AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsType string

const (
	AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsTypePublic             AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsType = "public"
	AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsTypePrivate            AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsType = "private"
	AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsTypeViaMcpServerPortal AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsTypePublic, AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsTypePrivate, AccessApplicationNewParamsBodyBrowserRdpApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyBrowserRdpApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationPolicy) ImplementsAccessApplicationNewParamsBodyBrowserRdpApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationNewParamsBodyBrowserRdpApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationNewParamsBodyBrowserRdpApplicationPoliciesObject],
// [AccessApplicationNewParamsBodyBrowserRdpApplicationPolicy].
type AccessApplicationNewParamsBodyBrowserRdpApplicationPolicyUnion interface {
	ImplementsAccessApplicationNewParamsBodyBrowserRdpApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationNewParamsBodyBrowserRdpApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationNewParamsBodyBrowserRdpApplicationPolicyUnion() {
}

type AccessApplicationNewParamsBodyBrowserRdpApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationPoliciesObject) ImplementsAccessApplicationNewParamsBodyBrowserRdpApplicationPolicyUnion() {
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID param.Field[string] `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI param.Field[string] `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication param.Field[AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion] `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete param.Field[bool] `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled param.Field[bool] `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings param.Field[[]SCIMConfigMappingParam] `json:"mappings"`
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfig) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthentication struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthentication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthentication) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [zero_trust.AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication],
// [AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthentication].
type AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem].
type AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion interface {
	implementsAccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationScheme string

const (
	AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeHttpbasic          AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationScheme = "httpbasic"
	AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeOauthbearertoken   AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationScheme = "oauthbearertoken"
	AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeOauth2             AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationScheme = "oauth2"
	AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeAccessServiceToken AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeHttpbasic, AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeOauthbearertoken, AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeOauth2, AccessApplicationNewParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationNewResponseEnvelope struct {
	Errors   []AccessApplicationNewResponseEnvelopeErrors   `json:"errors,required"`
	Messages []AccessApplicationNewResponseEnvelopeMessages `json:"messages,required"`
	// Whether the API call was successful.
	Success AccessApplicationNewResponseEnvelopeSuccess `json:"success,required"`
	Result  AccessApplicationNewResponse                `json:"result"`
	JSON    accessApplicationNewResponseEnvelopeJSON    `json:"-"`
}

// accessApplicationNewResponseEnvelopeJSON contains the JSON metadata for the
// struct [AccessApplicationNewResponseEnvelope]
type accessApplicationNewResponseEnvelopeJSON struct {
	Errors      apijson.Field
	Messages    apijson.Field
	Success     apijson.Field
	Result      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseEnvelope) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseEnvelopeJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationNewResponseEnvelopeErrors struct {
	Code             int64                                            `json:"code,required"`
	Message          string                                           `json:"message,required"`
	DocumentationURL string                                           `json:"documentation_url"`
	Source           AccessApplicationNewResponseEnvelopeErrorsSource `json:"source"`
	JSON             accessApplicationNewResponseEnvelopeErrorsJSON   `json:"-"`
}

// accessApplicationNewResponseEnvelopeErrorsJSON contains the JSON metadata for
// the struct [AccessApplicationNewResponseEnvelopeErrors]
type accessApplicationNewResponseEnvelopeErrorsJSON struct {
	Code             apijson.Field
	Message          apijson.Field
	DocumentationURL apijson.Field
	Source           apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationNewResponseEnvelopeErrors) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseEnvelopeErrorsJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationNewResponseEnvelopeErrorsSource struct {
	Pointer string                                               `json:"pointer"`
	JSON    accessApplicationNewResponseEnvelopeErrorsSourceJSON `json:"-"`
}

// accessApplicationNewResponseEnvelopeErrorsSourceJSON contains the JSON metadata
// for the struct [AccessApplicationNewResponseEnvelopeErrorsSource]
type accessApplicationNewResponseEnvelopeErrorsSourceJSON struct {
	Pointer     apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseEnvelopeErrorsSource) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseEnvelopeErrorsSourceJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationNewResponseEnvelopeMessages struct {
	Code             int64                                              `json:"code,required"`
	Message          string                                             `json:"message,required"`
	DocumentationURL string                                             `json:"documentation_url"`
	Source           AccessApplicationNewResponseEnvelopeMessagesSource `json:"source"`
	JSON             accessApplicationNewResponseEnvelopeMessagesJSON   `json:"-"`
}

// accessApplicationNewResponseEnvelopeMessagesJSON contains the JSON metadata for
// the struct [AccessApplicationNewResponseEnvelopeMessages]
type accessApplicationNewResponseEnvelopeMessagesJSON struct {
	Code             apijson.Field
	Message          apijson.Field
	DocumentationURL apijson.Field
	Source           apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationNewResponseEnvelopeMessages) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseEnvelopeMessagesJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationNewResponseEnvelopeMessagesSource struct {
	Pointer string                                                 `json:"pointer"`
	JSON    accessApplicationNewResponseEnvelopeMessagesSourceJSON `json:"-"`
}

// accessApplicationNewResponseEnvelopeMessagesSourceJSON contains the JSON
// metadata for the struct [AccessApplicationNewResponseEnvelopeMessagesSource]
type accessApplicationNewResponseEnvelopeMessagesSourceJSON struct {
	Pointer     apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationNewResponseEnvelopeMessagesSource) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationNewResponseEnvelopeMessagesSourceJSON) RawJSON() string {
	return r.raw
}

// Whether the API call was successful.
type AccessApplicationNewResponseEnvelopeSuccess bool

const (
	AccessApplicationNewResponseEnvelopeSuccessTrue AccessApplicationNewResponseEnvelopeSuccess = true
)

func (r AccessApplicationNewResponseEnvelopeSuccess) IsKnown() bool {
	switch r {
	case AccessApplicationNewResponseEnvelopeSuccessTrue:
		return true
	}
	return false
}

type AccessApplicationUpdateParams struct {
	// Contains the targets secured by the application.
	Body AccessApplicationUpdateParamsBodyUnion `json:"body,required"`
	// The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
	AccountID param.Field[string] `path:"account_id"`
	// The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
	ZoneID param.Field[string] `path:"zone_id"`
}

func (r AccessApplicationUpdateParams) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r.Body)
}

// Contains the targets secured by the application.
type AccessApplicationUpdateParamsBody struct {
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP param.Field[bool] `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe param.Field[bool]        `json:"allow_iframe"`
	AllowedIdPs param.Field[interface{}] `json:"allowed_idps"`
	// The image URL of the logo shown in the App Launcher header.
	AppLauncherLogoURL param.Field[string] `json:"app_launcher_logo_url"`
	// Displays the application in the App Launcher.
	AppLauncherVisible param.Field[bool] `json:"app_launcher_visible"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool] `json:"auto_redirect_to_identity"`
	// The background color of the App Launcher page.
	BgColor     param.Field[string]           `json:"bg_color"`
	CORSHeaders param.Field[CORSHeadersParam] `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage param.Field[string] `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string]      `json:"custom_non_identity_deny_url"`
	CustomPages              param.Field[interface{}] `json:"custom_pages"`
	Destinations             param.Field[interface{}] `json:"destinations"`
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain param.Field[string] `json:"domain"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie param.Field[bool]        `json:"enable_binding_cookie"`
	FooterLinks         param.Field[interface{}] `json:"footer_links"`
	// The background color of the App Launcher header.
	HeaderBgColor param.Field[string] `json:"header_bg_color"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute param.Field[bool]        `json:"http_only_cookie_attribute"`
	LandingPageDesign       param.Field[interface{}] `json:"landing_page_design"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL param.Field[string] `json:"logo_url"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass param.Field[bool] `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute param.Field[bool]        `json:"path_cookie_attribute"`
	Policies            param.Field[interface{}] `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader param.Field[string]      `json:"read_service_tokens_from_header"`
	SaaSApp                     param.Field[interface{}] `json:"saas_app"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute param.Field[string]      `json:"same_site_cookie_attribute"`
	SCIMConfig              param.Field[interface{}] `json:"scim_config"`
	SelfHostedDomains       param.Field[interface{}] `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect param.Field[bool] `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
	// Determines when to skip the App Launcher landing page.
	SkipAppLauncherLoginPage param.Field[bool] `json:"skip_app_launcher_login_page"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial param.Field[bool]        `json:"skip_interstitial"`
	Tags             param.Field[interface{}] `json:"tags"`
	TargetCriteria   param.Field[interface{}] `json:"target_criteria"`
	// The application type.
	Type param.Field[ApplicationType] `json:"type"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL param.Field[bool] `json:"use_clientless_isolation_app_launcher_url"`
}

func (r AccessApplicationUpdateParamsBody) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBody) implementsAccessApplicationUpdateParamsBodyUnion() {}

// Contains the targets secured by the application.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodySelfHostedApplication],
// [zero_trust.AccessApplicationUpdateParamsBodySaaSApplication],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserSSHApplication],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserVNCApplication],
// [zero_trust.AccessApplicationUpdateParamsBodyAppLauncherApplication],
// [zero_trust.AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplication],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplication],
// [zero_trust.AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplication],
// [zero_trust.AccessApplicationUpdateParamsBodyBookmarkApplication],
// [zero_trust.AccessApplicationUpdateParamsBodyInfrastructureApplication],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserRdpApplication],
// [AccessApplicationUpdateParamsBody].
type AccessApplicationUpdateParamsBodyUnion interface {
	implementsAccessApplicationUpdateParamsBodyUnion()
}

type AccessApplicationUpdateParamsBodySelfHostedApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain param.Field[string] `json:"domain,required"`
	// The application type.
	Type param.Field[ApplicationType] `json:"type,required"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP param.Field[bool] `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe param.Field[bool] `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible param.Field[bool] `json:"app_launcher_visible"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool]             `json:"auto_redirect_to_identity"`
	CORSHeaders            param.Field[CORSHeadersParam] `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage param.Field[string] `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations param.Field[[]AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationUnion] `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie param.Field[bool] `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute param.Field[bool] `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL param.Field[string] `json:"logo_url"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass param.Field[bool] `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute param.Field[bool] `json:"path_cookie_attribute"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationUpdateParamsBodySelfHostedApplicationPolicyUnion] `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader param.Field[string] `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute param.Field[string] `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig param.Field[AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfig] `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains param.Field[[]SelfHostedDomainsParam] `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect param.Field[bool] `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial param.Field[bool] `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags param.Field[[]string] `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL param.Field[bool] `json:"use_clientless_isolation_app_launcher_url"`
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplication) implementsAccessApplicationUpdateParamsBodyUnion() {
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateParamsBodySelfHostedApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsL4Protocol] `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string] `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                                 `json:"port_range"`
	Type      param.Field[AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationDestination) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationDestinationUnion() {
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPublicDestination],
// [zero_trust.AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestination],
// [zero_trust.AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestination],
// [AccessApplicationUpdateParamsBodySelfHostedApplicationDestination].
type AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationUnion interface {
	implementsAccessApplicationUpdateParamsBodySelfHostedApplicationDestinationUnion()
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPublicDestination struct {
	Type param.Field[AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPublicDestinationType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPublicDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPublicDestination) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationDestinationUnion() {
}

type AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPublicDestinationTypePublic AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4Protocol] `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                                                   `json:"port_range"`
	Type      param.Field[AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationType] `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestination) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationDestinationUnion() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string]                                                                                              `json:"mcp_server_id"`
	Type        param.Field[AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestinationType] `json:"type"`
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationDestinationUnion() {
}

type AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsL4Protocol string

const (
	AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsL4ProtocolTCP AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsL4ProtocolUdp AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsL4ProtocolTCP, AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsType string

const (
	AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsTypePublic             AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsType = "public"
	AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsTypePrivate            AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsType = "private"
	AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsTypeViaMcpServerPortal AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsTypePublic, AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsTypePrivate, AccessApplicationUpdateParamsBodySelfHostedApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodySelfHostedApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationPolicy) ImplementsAccessApplicationUpdateParamsBodySelfHostedApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodySelfHostedApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationUpdateParamsBodySelfHostedApplicationPoliciesObject],
// [AccessApplicationUpdateParamsBodySelfHostedApplicationPolicy].
type AccessApplicationUpdateParamsBodySelfHostedApplicationPolicyUnion interface {
	ImplementsAccessApplicationUpdateParamsBodySelfHostedApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodySelfHostedApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationUpdateParamsBodySelfHostedApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodySelfHostedApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationPoliciesObject) ImplementsAccessApplicationUpdateParamsBodySelfHostedApplicationPolicyUnion() {
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID param.Field[string] `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI param.Field[string] `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication param.Field[AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion] `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete param.Field[bool] `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled param.Field[bool] `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings param.Field[[]SCIMConfigMappingParam] `json:"mappings"`
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfig) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthentication struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthentication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthentication) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [zero_trust.AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication],
// [AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthentication].
type AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem].
type AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion interface {
	implementsAccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationScheme string

const (
	AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeHttpbasic          AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeOauth2             AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationScheme = "oauth2"
	AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeAccessServiceToken AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeHttpbasic, AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeOauth2, AccessApplicationUpdateParamsBodySelfHostedApplicationSCIMConfigAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodySaaSApplication struct {
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible param.Field[bool] `json:"app_launcher_visible"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool] `json:"auto_redirect_to_identity"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL param.Field[string] `json:"logo_url"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationUpdateParamsBodySaaSApplicationPolicyUnion] `json:"policies"`
	SaaSApp  param.Field[AccessApplicationUpdateParamsBodySaaSApplicationSaaSAppUnion]  `json:"saas_app"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig param.Field[AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfig] `json:"scim_config"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags param.Field[[]string] `json:"tags"`
	// The application type.
	Type param.Field[ApplicationType] `json:"type"`
}

func (r AccessApplicationUpdateParamsBodySaaSApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySaaSApplication) implementsAccessApplicationUpdateParamsBodyUnion() {
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodySaaSApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationPolicy) ImplementsAccessApplicationUpdateParamsBodySaaSApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodySaaSApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationUpdateParamsBodySaaSApplicationPoliciesObject],
// [AccessApplicationUpdateParamsBodySaaSApplicationPolicy].
type AccessApplicationUpdateParamsBodySaaSApplicationPolicyUnion interface {
	ImplementsAccessApplicationUpdateParamsBodySaaSApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodySaaSApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationUpdateParamsBodySaaSApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodySaaSApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationPoliciesObject) ImplementsAccessApplicationUpdateParamsBodySaaSApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodySaaSApplicationSaaSApp struct {
	// The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must
	// be greater than or equal to 1m and less than or equal to 24h.
	AccessTokenLifetime param.Field[string] `json:"access_token_lifetime"`
	// If client secret should be required on the token endpoint when
	// authorization_code_with_pkce grant is used.
	AllowPKCEWithoutClientSecret param.Field[bool] `json:"allow_pkce_without_client_secret"`
	// The URL where this applications tile redirects users
	AppLauncherURL param.Field[string] `json:"app_launcher_url"`
	// Optional identifier indicating the authentication protocol used for the saas
	// app. Required for OIDC. Default if unset is "saml"
	AuthType param.Field[AccessApplicationUpdateParamsBodySaaSApplicationSaaSAppAuthType] `json:"auth_type"`
	// The application client id
	ClientID param.Field[string] `json:"client_id"`
	// The application client secret, only returned on POST request.
	ClientSecret param.Field[string] `json:"client_secret"`
	// The service provider's endpoint that is responsible for receiving and parsing a
	// SAML assertion.
	ConsumerServiceURL param.Field[string]      `json:"consumer_service_url"`
	CustomAttributes   param.Field[interface{}] `json:"custom_attributes"`
	CustomClaims       param.Field[interface{}] `json:"custom_claims"`
	// The URL that the user will be redirected to after a successful login for IDP
	// initiated logins.
	DefaultRelayState param.Field[string]      `json:"default_relay_state"`
	GrantTypes        param.Field[interface{}] `json:"grant_types"`
	// A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
	GroupFilterRegex         param.Field[string]      `json:"group_filter_regex"`
	HybridAndImplicitOptions param.Field[interface{}] `json:"hybrid_and_implicit_options"`
	// The unique identifier for your SaaS application.
	IdPEntityID param.Field[string] `json:"idp_entity_id"`
	// The format of the name identifier sent to the SaaS application.
	NameIDFormat param.Field[SaaSAppNameIDFormat] `json:"name_id_format"`
	// A [JSONata](https://jsonata.org/) expression that transforms an application's
	// user identities into a NameID value for its SAML assertion. This expression
	// should evaluate to a singular string. The output of this expression can override
	// the `name_id_format` setting.
	NameIDTransformJsonata param.Field[string] `json:"name_id_transform_jsonata"`
	// The Access public certificate that will be used to verify your identity.
	PublicKey           param.Field[string]      `json:"public_key"`
	RedirectURIs        param.Field[interface{}] `json:"redirect_uris"`
	RefreshTokenOptions param.Field[interface{}] `json:"refresh_token_options"`
	// A [JSONata] (https://jsonata.org/) expression that transforms an application's
	// user identities into attribute assertions in the SAML response. The expression
	// can transform id, email, name, and groups values. It can also transform fields
	// listed in the saml_attributes or oidc_fields of the identity provider used to
	// authenticate. The output of this expression must be a JSON object.
	SAMLAttributeTransformJsonata param.Field[string]      `json:"saml_attribute_transform_jsonata"`
	Scopes                        param.Field[interface{}] `json:"scopes"`
	// A globally unique name for an identity or service provider.
	SPEntityID param.Field[string] `json:"sp_entity_id"`
	// The endpoint where your SaaS application will send login requests.
	SSOEndpoint param.Field[string] `json:"sso_endpoint"`
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationSaaSApp) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationSaaSApp) implementsAccessApplicationUpdateParamsBodySaaSApplicationSaaSAppUnion() {
}

// Satisfied by [zero_trust.SAMLSaaSAppParam], [zero_trust.OIDCSaaSAppParam],
// [AccessApplicationUpdateParamsBodySaaSApplicationSaaSApp].
type AccessApplicationUpdateParamsBodySaaSApplicationSaaSAppUnion interface {
	implementsAccessApplicationUpdateParamsBodySaaSApplicationSaaSAppUnion()
}

// Optional identifier indicating the authentication protocol used for the saas
// app. Required for OIDC. Default if unset is "saml"
type AccessApplicationUpdateParamsBodySaaSApplicationSaaSAppAuthType string

const (
	AccessApplicationUpdateParamsBodySaaSApplicationSaaSAppAuthTypeSAML AccessApplicationUpdateParamsBodySaaSApplicationSaaSAppAuthType = "saml"
	AccessApplicationUpdateParamsBodySaaSApplicationSaaSAppAuthTypeOIDC AccessApplicationUpdateParamsBodySaaSApplicationSaaSAppAuthType = "oidc"
)

func (r AccessApplicationUpdateParamsBodySaaSApplicationSaaSAppAuthType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySaaSApplicationSaaSAppAuthTypeSAML, AccessApplicationUpdateParamsBodySaaSApplicationSaaSAppAuthTypeOIDC:
		return true
	}
	return false
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID param.Field[string] `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI param.Field[string] `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication param.Field[AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationUnion] `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete param.Field[bool] `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled param.Field[bool] `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings param.Field[[]SCIMConfigMappingParam] `json:"mappings"`
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfig) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthentication struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthentication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthentication) implementsAccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [zero_trust.AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication],
// [AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthentication].
type AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion

func (r AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) implementsAccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem].
type AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion interface {
	implementsAccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationScheme string

const (
	AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeHttpbasic          AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeOauth2             AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationScheme = "oauth2"
	AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeAccessServiceToken AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeHttpbasic, AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeOauth2, AccessApplicationUpdateParamsBodySaaSApplicationSCIMConfigAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyBrowserSSHApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain param.Field[string] `json:"domain,required"`
	// The application type.
	Type param.Field[AccessApplicationUpdateParamsBodyBrowserSSHApplicationType] `json:"type,required"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP param.Field[bool] `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe param.Field[bool] `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible param.Field[bool] `json:"app_launcher_visible"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool]             `json:"auto_redirect_to_identity"`
	CORSHeaders            param.Field[CORSHeadersParam] `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage param.Field[string] `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations param.Field[[]AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationUnion] `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie param.Field[bool] `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute param.Field[bool] `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL param.Field[string] `json:"logo_url"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass param.Field[bool] `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute param.Field[bool] `json:"path_cookie_attribute"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationUpdateParamsBodyBrowserSSHApplicationPolicyUnion] `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader param.Field[string] `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute param.Field[string] `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig param.Field[AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfig] `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains param.Field[[]SelfHostedDomainsParam] `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect param.Field[bool] `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial param.Field[bool] `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags param.Field[[]string] `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL param.Field[bool] `json:"use_clientless_isolation_app_launcher_url"`
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplication) implementsAccessApplicationUpdateParamsBodyUnion() {
}

// The application type.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationType string

const (
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeSelfHosted     AccessApplicationUpdateParamsBodyBrowserSSHApplicationType = "self_hosted"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeSaaS           AccessApplicationUpdateParamsBodyBrowserSSHApplicationType = "saas"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeSSH            AccessApplicationUpdateParamsBodyBrowserSSHApplicationType = "ssh"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeVNC            AccessApplicationUpdateParamsBodyBrowserSSHApplicationType = "vnc"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeAppLauncher    AccessApplicationUpdateParamsBodyBrowserSSHApplicationType = "app_launcher"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeWARP           AccessApplicationUpdateParamsBodyBrowserSSHApplicationType = "warp"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeBISO           AccessApplicationUpdateParamsBodyBrowserSSHApplicationType = "biso"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeBookmark       AccessApplicationUpdateParamsBodyBrowserSSHApplicationType = "bookmark"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeDashSSO        AccessApplicationUpdateParamsBodyBrowserSSHApplicationType = "dash_sso"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeInfrastructure AccessApplicationUpdateParamsBodyBrowserSSHApplicationType = "infrastructure"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeRdp            AccessApplicationUpdateParamsBodyBrowserSSHApplicationType = "rdp"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeMcp            AccessApplicationUpdateParamsBodyBrowserSSHApplicationType = "mcp"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeMcpPortal      AccessApplicationUpdateParamsBodyBrowserSSHApplicationType = "mcp_portal"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeProxyEndpoint  AccessApplicationUpdateParamsBodyBrowserSSHApplicationType = "proxy_endpoint"
)

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeSelfHosted, AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeSaaS, AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeSSH, AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeVNC, AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeAppLauncher, AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeWARP, AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeBISO, AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeBookmark, AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeDashSSO, AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeInfrastructure, AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeRdp, AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeMcp, AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeMcpPortal, AccessApplicationUpdateParamsBodyBrowserSSHApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsL4Protocol] `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string] `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                                 `json:"port_range"`
	Type      param.Field[AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestination) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationUnion() {
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPublicDestination],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestination],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestination],
// [AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestination].
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationUnion interface {
	implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationUnion()
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPublicDestination struct {
	Type param.Field[AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPublicDestinationType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPublicDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPublicDestination) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationUnion() {
}

type AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPublicDestinationTypePublic AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol] `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                                                   `json:"port_range"`
	Type      param.Field[AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationType] `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestination) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationUnion() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string]                                                                                              `json:"mcp_server_id"`
	Type        param.Field[AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType] `json:"type"`
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationUnion() {
}

type AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsL4Protocol string

const (
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsL4ProtocolTCP AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsL4ProtocolUdp AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsL4ProtocolTCP, AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsType string

const (
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsTypePublic             AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsType = "public"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsTypePrivate            AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsType = "private"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsTypeViaMcpServerPortal AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsTypePublic, AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsTypePrivate, AccessApplicationUpdateParamsBodyBrowserSSHApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationPolicy) ImplementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserSSHApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserSSHApplicationPoliciesObject],
// [AccessApplicationUpdateParamsBodyBrowserSSHApplicationPolicy].
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationPolicyUnion interface {
	ImplementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodyBrowserSSHApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationPoliciesObject) ImplementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationPolicyUnion() {
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID param.Field[string] `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI param.Field[string] `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication param.Field[AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion] `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete param.Field[bool] `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled param.Field[bool] `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings param.Field[[]SCIMConfigMappingParam] `json:"mappings"`
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfig) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthentication struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthentication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthentication) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication],
// [AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthentication].
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem].
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion interface {
	implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationScheme string

const (
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeHttpbasic          AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeOauth2             AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationScheme = "oauth2"
	AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeAccessServiceToken AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeHttpbasic, AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeOauth2, AccessApplicationUpdateParamsBodyBrowserSSHApplicationSCIMConfigAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyBrowserVNCApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain param.Field[string] `json:"domain,required"`
	// The application type.
	Type param.Field[AccessApplicationUpdateParamsBodyBrowserVNCApplicationType] `json:"type,required"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP param.Field[bool] `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe param.Field[bool] `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible param.Field[bool] `json:"app_launcher_visible"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool]             `json:"auto_redirect_to_identity"`
	CORSHeaders            param.Field[CORSHeadersParam] `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage param.Field[string] `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations param.Field[[]AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationUnion] `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie param.Field[bool] `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute param.Field[bool] `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL param.Field[string] `json:"logo_url"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass param.Field[bool] `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute param.Field[bool] `json:"path_cookie_attribute"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationUpdateParamsBodyBrowserVNCApplicationPolicyUnion] `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader param.Field[string] `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute param.Field[string] `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig param.Field[AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfig] `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains param.Field[[]SelfHostedDomainsParam] `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect param.Field[bool] `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial param.Field[bool] `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags param.Field[[]string] `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL param.Field[bool] `json:"use_clientless_isolation_app_launcher_url"`
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplication) implementsAccessApplicationUpdateParamsBodyUnion() {
}

// The application type.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationType string

const (
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeSelfHosted     AccessApplicationUpdateParamsBodyBrowserVNCApplicationType = "self_hosted"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeSaaS           AccessApplicationUpdateParamsBodyBrowserVNCApplicationType = "saas"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeSSH            AccessApplicationUpdateParamsBodyBrowserVNCApplicationType = "ssh"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeVNC            AccessApplicationUpdateParamsBodyBrowserVNCApplicationType = "vnc"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeAppLauncher    AccessApplicationUpdateParamsBodyBrowserVNCApplicationType = "app_launcher"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeWARP           AccessApplicationUpdateParamsBodyBrowserVNCApplicationType = "warp"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeBISO           AccessApplicationUpdateParamsBodyBrowserVNCApplicationType = "biso"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeBookmark       AccessApplicationUpdateParamsBodyBrowserVNCApplicationType = "bookmark"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeDashSSO        AccessApplicationUpdateParamsBodyBrowserVNCApplicationType = "dash_sso"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeInfrastructure AccessApplicationUpdateParamsBodyBrowserVNCApplicationType = "infrastructure"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeRdp            AccessApplicationUpdateParamsBodyBrowserVNCApplicationType = "rdp"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeMcp            AccessApplicationUpdateParamsBodyBrowserVNCApplicationType = "mcp"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeMcpPortal      AccessApplicationUpdateParamsBodyBrowserVNCApplicationType = "mcp_portal"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeProxyEndpoint  AccessApplicationUpdateParamsBodyBrowserVNCApplicationType = "proxy_endpoint"
)

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeSelfHosted, AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeSaaS, AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeSSH, AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeVNC, AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeAppLauncher, AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeWARP, AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeBISO, AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeBookmark, AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeDashSSO, AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeInfrastructure, AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeRdp, AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeMcp, AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeMcpPortal, AccessApplicationUpdateParamsBodyBrowserVNCApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsL4Protocol] `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string] `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                                 `json:"port_range"`
	Type      param.Field[AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestination) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationUnion() {
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPublicDestination],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestination],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestination],
// [AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestination].
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationUnion interface {
	implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationUnion()
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPublicDestination struct {
	Type param.Field[AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPublicDestinationType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPublicDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPublicDestination) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationUnion() {
}

type AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPublicDestinationTypePublic AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol] `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                                                   `json:"port_range"`
	Type      param.Field[AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationType] `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestination) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationUnion() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string]                                                                                              `json:"mcp_server_id"`
	Type        param.Field[AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType] `json:"type"`
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationUnion() {
}

type AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsL4Protocol string

const (
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsL4ProtocolTCP AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsL4ProtocolUdp AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsL4ProtocolTCP, AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsType string

const (
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsTypePublic             AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsType = "public"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsTypePrivate            AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsType = "private"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsTypeViaMcpServerPortal AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsTypePublic, AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsTypePrivate, AccessApplicationUpdateParamsBodyBrowserVNCApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationPolicy) ImplementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserVNCApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserVNCApplicationPoliciesObject],
// [AccessApplicationUpdateParamsBodyBrowserVNCApplicationPolicy].
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationPolicyUnion interface {
	ImplementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodyBrowserVNCApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationPoliciesObject) ImplementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationPolicyUnion() {
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID param.Field[string] `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI param.Field[string] `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication param.Field[AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion] `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete param.Field[bool] `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled param.Field[bool] `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings param.Field[[]SCIMConfigMappingParam] `json:"mappings"`
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfig) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthentication struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthentication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthentication) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication],
// [AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthentication].
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem].
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion interface {
	implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationScheme string

const (
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeHttpbasic          AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeOauth2             AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationScheme = "oauth2"
	AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeAccessServiceToken AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeHttpbasic, AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeOauth2, AccessApplicationUpdateParamsBodyBrowserVNCApplicationSCIMConfigAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyAppLauncherApplication struct {
	// The application type.
	Type param.Field[AccessApplicationUpdateParamsBodyAppLauncherApplicationType] `json:"type,required"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// The image URL of the logo shown in the App Launcher header.
	AppLauncherLogoURL param.Field[string] `json:"app_launcher_logo_url"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool] `json:"auto_redirect_to_identity"`
	// The background color of the App Launcher page.
	BgColor param.Field[string] `json:"bg_color"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// The links in the App Launcher footer.
	FooterLinks param.Field[[]AccessApplicationUpdateParamsBodyAppLauncherApplicationFooterLink] `json:"footer_links"`
	// The background color of the App Launcher header.
	HeaderBgColor param.Field[string] `json:"header_bg_color"`
	// The design of the App Launcher landing page shown to users when they log in.
	LandingPageDesign param.Field[AccessApplicationUpdateParamsBodyAppLauncherApplicationLandingPageDesign] `json:"landing_page_design"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationUpdateParamsBodyAppLauncherApplicationPolicyUnion] `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
	// Determines when to skip the App Launcher landing page.
	SkipAppLauncherLoginPage param.Field[bool] `json:"skip_app_launcher_login_page"`
}

func (r AccessApplicationUpdateParamsBodyAppLauncherApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyAppLauncherApplication) implementsAccessApplicationUpdateParamsBodyUnion() {
}

// The application type.
type AccessApplicationUpdateParamsBodyAppLauncherApplicationType string

const (
	AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeSelfHosted     AccessApplicationUpdateParamsBodyAppLauncherApplicationType = "self_hosted"
	AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeSaaS           AccessApplicationUpdateParamsBodyAppLauncherApplicationType = "saas"
	AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeSSH            AccessApplicationUpdateParamsBodyAppLauncherApplicationType = "ssh"
	AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeVNC            AccessApplicationUpdateParamsBodyAppLauncherApplicationType = "vnc"
	AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeAppLauncher    AccessApplicationUpdateParamsBodyAppLauncherApplicationType = "app_launcher"
	AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeWARP           AccessApplicationUpdateParamsBodyAppLauncherApplicationType = "warp"
	AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeBISO           AccessApplicationUpdateParamsBodyAppLauncherApplicationType = "biso"
	AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeBookmark       AccessApplicationUpdateParamsBodyAppLauncherApplicationType = "bookmark"
	AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeDashSSO        AccessApplicationUpdateParamsBodyAppLauncherApplicationType = "dash_sso"
	AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeInfrastructure AccessApplicationUpdateParamsBodyAppLauncherApplicationType = "infrastructure"
	AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeRdp            AccessApplicationUpdateParamsBodyAppLauncherApplicationType = "rdp"
	AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeMcp            AccessApplicationUpdateParamsBodyAppLauncherApplicationType = "mcp"
	AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeMcpPortal      AccessApplicationUpdateParamsBodyAppLauncherApplicationType = "mcp_portal"
	AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeProxyEndpoint  AccessApplicationUpdateParamsBodyAppLauncherApplicationType = "proxy_endpoint"
)

func (r AccessApplicationUpdateParamsBodyAppLauncherApplicationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeSelfHosted, AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeSaaS, AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeSSH, AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeVNC, AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeAppLauncher, AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeWARP, AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeBISO, AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeBookmark, AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeDashSSO, AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeInfrastructure, AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeRdp, AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeMcp, AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeMcpPortal, AccessApplicationUpdateParamsBodyAppLauncherApplicationTypeProxyEndpoint:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyAppLauncherApplicationFooterLink struct {
	// The hypertext in the footer link.
	Name param.Field[string] `json:"name,required"`
	// the hyperlink in the footer link.
	URL param.Field[string] `json:"url,required"`
}

func (r AccessApplicationUpdateParamsBodyAppLauncherApplicationFooterLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// The design of the App Launcher landing page shown to users when they log in.
type AccessApplicationUpdateParamsBodyAppLauncherApplicationLandingPageDesign struct {
	// The background color of the log in button on the landing page.
	ButtonColor param.Field[string] `json:"button_color"`
	// The color of the text in the log in button on the landing page.
	ButtonTextColor param.Field[string] `json:"button_text_color"`
	// The URL of the image shown on the landing page.
	ImageURL param.Field[string] `json:"image_url"`
	// The message shown on the landing page.
	Message param.Field[string] `json:"message"`
	// The title shown on the landing page.
	Title param.Field[string] `json:"title"`
}

func (r AccessApplicationUpdateParamsBodyAppLauncherApplicationLandingPageDesign) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyAppLauncherApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyAppLauncherApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyAppLauncherApplicationPolicy) ImplementsAccessApplicationUpdateParamsBodyAppLauncherApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodyAppLauncherApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationUpdateParamsBodyAppLauncherApplicationPoliciesObject],
// [AccessApplicationUpdateParamsBodyAppLauncherApplicationPolicy].
type AccessApplicationUpdateParamsBodyAppLauncherApplicationPolicyUnion interface {
	ImplementsAccessApplicationUpdateParamsBodyAppLauncherApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyAppLauncherApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationUpdateParamsBodyAppLauncherApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyAppLauncherApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationUpdateParamsBodyAppLauncherApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodyAppLauncherApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyAppLauncherApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyAppLauncherApplicationPoliciesObject) ImplementsAccessApplicationUpdateParamsBodyAppLauncherApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplication struct {
	// The application type.
	Type param.Field[ApplicationType] `json:"type,required"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool] `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPolicyUnion] `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplication) implementsAccessApplicationUpdateParamsBodyUnion() {
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPolicy) ImplementsAccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesObject],
// [AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPolicy].
type AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPolicyUnion interface {
	ImplementsAccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPoliciesObject) ImplementsAccessApplicationUpdateParamsBodyDeviceEnrollmentPermissionsApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplication struct {
	// The application type.
	Type param.Field[ApplicationType] `json:"type,required"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool] `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPolicyUnion] `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplication) implementsAccessApplicationUpdateParamsBodyUnion() {
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPolicy) ImplementsAccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPoliciesObject],
// [AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPolicy].
type AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPolicyUnion interface {
	ImplementsAccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPoliciesObject) ImplementsAccessApplicationUpdateParamsBodyBrowserIsolationPermissionsApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplication struct {
	// The application type.
	Type param.Field[ApplicationType] `json:"type,required"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool] `json:"auto_redirect_to_identity"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// The proxy endpoint domain in the format: 10 alphanumeric characters followed by
	// .proxy.cloudflare-gateway.com
	Domain param.Field[string] `json:"domain"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPolicyUnion] `json:"policies"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplication) implementsAccessApplicationUpdateParamsBodyUnion() {
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPolicy) ImplementsAccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesObject],
// [AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPolicy].
type AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPolicyUnion interface {
	ImplementsAccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPoliciesObject) ImplementsAccessApplicationUpdateParamsBodyGatewayIdentityProxyEndpointApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodyBookmarkApplication struct {
	// Displays the application in the App Launcher.
	AppLauncherVisible param.Field[bool] `json:"app_launcher_visible"`
	// The URL or domain of the bookmark.
	Domain param.Field[string] `json:"domain"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL param.Field[string] `json:"logo_url"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationUpdateParamsBodyBookmarkApplicationPolicyUnion] `json:"policies"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags param.Field[[]string] `json:"tags"`
	// The application type.
	Type param.Field[ApplicationType] `json:"type"`
}

func (r AccessApplicationUpdateParamsBodyBookmarkApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBookmarkApplication) implementsAccessApplicationUpdateParamsBodyUnion() {
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyBookmarkApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyBookmarkApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBookmarkApplicationPolicy) ImplementsAccessApplicationUpdateParamsBodyBookmarkApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodyBookmarkApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationUpdateParamsBodyBookmarkApplicationPoliciesObject],
// [AccessApplicationUpdateParamsBodyBookmarkApplicationPolicy].
type AccessApplicationUpdateParamsBodyBookmarkApplicationPolicyUnion interface {
	ImplementsAccessApplicationUpdateParamsBodyBookmarkApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyBookmarkApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationUpdateParamsBodyBookmarkApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBookmarkApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationUpdateParamsBodyBookmarkApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodyBookmarkApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyBookmarkApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBookmarkApplicationPoliciesObject) ImplementsAccessApplicationUpdateParamsBodyBookmarkApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodyInfrastructureApplication struct {
	TargetCriteria param.Field[[]AccessApplicationUpdateParamsBodyInfrastructureApplicationTargetCriterion] `json:"target_criteria,required"`
	// The application type.
	Type param.Field[ApplicationType] `json:"type,required"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// The policies that Access applies to the application.
	Policies param.Field[[]AccessApplicationUpdateParamsBodyInfrastructureApplicationPolicy] `json:"policies"`
}

func (r AccessApplicationUpdateParamsBodyInfrastructureApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyInfrastructureApplication) implementsAccessApplicationUpdateParamsBodyUnion() {
}

type AccessApplicationUpdateParamsBodyInfrastructureApplicationTargetCriterion struct {
	// The port that the targets use for the chosen communication protocol. A port
	// cannot be assigned to multiple protocols.
	Port param.Field[int64] `json:"port,required"`
	// The communication protocol your application secures.
	Protocol param.Field[AccessApplicationUpdateParamsBodyInfrastructureApplicationTargetCriteriaProtocol] `json:"protocol,required"`
	// Contains a map of target attribute keys to target attribute values.
	TargetAttributes param.Field[map[string][]string] `json:"target_attributes,required"`
}

func (r AccessApplicationUpdateParamsBodyInfrastructureApplicationTargetCriterion) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// The communication protocol your application secures.
type AccessApplicationUpdateParamsBodyInfrastructureApplicationTargetCriteriaProtocol string

const (
	AccessApplicationUpdateParamsBodyInfrastructureApplicationTargetCriteriaProtocolSSH AccessApplicationUpdateParamsBodyInfrastructureApplicationTargetCriteriaProtocol = "SSH"
)

func (r AccessApplicationUpdateParamsBodyInfrastructureApplicationTargetCriteriaProtocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyInfrastructureApplicationTargetCriteriaProtocolSSH:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyInfrastructureApplicationPolicy struct {
	// The action Access will take if a user matches this policy. Infrastructure
	// application policies can only use the Allow action.
	Decision param.Field[Decision] `json:"decision,required"`
	// Rules evaluated with an OR logical operator. A user needs to meet only one of
	// the Include rules.
	Include param.Field[[]AccessRuleUnionParam] `json:"include,required"`
	// The name of the Access policy.
	Name param.Field[string] `json:"name,required"`
	// The rules that define how users may connect to the targets secured by your
	// application.
	ConnectionRules param.Field[AccessApplicationUpdateParamsBodyInfrastructureApplicationPoliciesConnectionRules] `json:"connection_rules"`
	// Rules evaluated with a NOT logical operator. To match the policy, a user cannot
	// meet any of the Exclude rules.
	Exclude param.Field[[]AccessRuleUnionParam] `json:"exclude"`
	// Rules evaluated with an AND logical operator. To match the policy, a user must
	// meet all of the Require rules.
	Require param.Field[[]AccessRuleUnionParam] `json:"require"`
}

func (r AccessApplicationUpdateParamsBodyInfrastructureApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// The rules that define how users may connect to the targets secured by your
// application.
type AccessApplicationUpdateParamsBodyInfrastructureApplicationPoliciesConnectionRules struct {
	// The SSH-specific rules that define how users may connect to the targets secured
	// by your application.
	SSH param.Field[AccessApplicationUpdateParamsBodyInfrastructureApplicationPoliciesConnectionRulesSSH] `json:"ssh"`
}

func (r AccessApplicationUpdateParamsBodyInfrastructureApplicationPoliciesConnectionRules) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// The SSH-specific rules that define how users may connect to the targets secured
// by your application.
type AccessApplicationUpdateParamsBodyInfrastructureApplicationPoliciesConnectionRulesSSH struct {
	// Contains the Unix usernames that may be used when connecting over SSH.
	Usernames param.Field[[]string] `json:"usernames,required"`
	// Enables using Identity Provider email alias as SSH username.
	AllowEmailAlias param.Field[bool] `json:"allow_email_alias"`
}

func (r AccessApplicationUpdateParamsBodyInfrastructureApplicationPoliciesConnectionRulesSSH) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// Contains the targets secured by the application.
type AccessApplicationUpdateParamsBodyBrowserRdpApplication struct {
	// The primary hostname and path secured by Access. This domain will be displayed
	// if the app is visible in the App Launcher.
	Domain         param.Field[string]                                                                  `json:"domain,required"`
	TargetCriteria param.Field[[]AccessApplicationUpdateParamsBodyBrowserRdpApplicationTargetCriterion] `json:"target_criteria,required"`
	// The application type.
	Type param.Field[ApplicationType] `json:"type,required"`
	// When set to true, users can authenticate to this application using their WARP
	// session. When set to false this application will always require direct IdP
	// authentication. This setting always overrides the organization setting for WARP
	// authentication.
	AllowAuthenticateViaWARP param.Field[bool] `json:"allow_authenticate_via_warp"`
	// Enables loading application content in an iFrame.
	AllowIframe param.Field[bool] `json:"allow_iframe"`
	// The identity providers your users can select when connecting to this
	// application. Defaults to all IdPs configured in your account.
	AllowedIdPs param.Field[[]AllowedIdPsParam] `json:"allowed_idps"`
	// Displays the application in the App Launcher.
	AppLauncherVisible param.Field[bool] `json:"app_launcher_visible"`
	// When set to `true`, users skip the identity provider selection step during
	// login. You must specify only one identity provider in allowed_idps.
	AutoRedirectToIdentity param.Field[bool]             `json:"auto_redirect_to_identity"`
	CORSHeaders            param.Field[CORSHeadersParam] `json:"cors_headers"`
	// The custom error message shown to a user when they are denied access to the
	// application.
	CustomDenyMessage param.Field[string] `json:"custom_deny_message"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing identity-based rules.
	CustomDenyURL param.Field[string] `json:"custom_deny_url"`
	// The custom URL a user is redirected to when they are denied access to the
	// application when failing non-identity rules.
	CustomNonIdentityDenyURL param.Field[string] `json:"custom_non_identity_deny_url"`
	// The custom pages that will be displayed when applicable for this application
	CustomPages param.Field[[]string] `json:"custom_pages"`
	// List of destinations secured by Access. This supersedes `self_hosted_domains` to
	// allow for more flexibility in defining different types of domains. If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	Destinations param.Field[[]AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationUnion] `json:"destinations"`
	// Enables the binding cookie, which increases security against compromised
	// authorization tokens and CSRF attacks.
	EnableBindingCookie param.Field[bool] `json:"enable_binding_cookie"`
	// Enables the HttpOnly cookie attribute, which increases security against XSS
	// attacks.
	HTTPOnlyCookieAttribute param.Field[bool] `json:"http_only_cookie_attribute"`
	// The image URL for the logo shown in the App Launcher dashboard.
	LogoURL param.Field[string] `json:"logo_url"`
	// The name of the application.
	Name param.Field[string] `json:"name"`
	// Allows options preflight requests to bypass Access authentication and go
	// directly to the origin. Cannot turn on if cors_headers is set.
	OptionsPreflightBypass param.Field[bool] `json:"options_preflight_bypass"`
	// Enables cookie paths to scope an application's JWT to the application path. If
	// disabled, the JWT will scope to the hostname by default
	PathCookieAttribute param.Field[bool] `json:"path_cookie_attribute"`
	// The policies that Access applies to the application, in ascending order of
	// precedence. Items can reference existing policies or create new policies
	// exclusive to the application.
	Policies param.Field[[]AccessApplicationUpdateParamsBodyBrowserRdpApplicationPolicyUnion] `json:"policies"`
	// Allows matching Access Service Tokens passed HTTP in a single header with this
	// name. This works as an alternative to the (CF-Access-Client-Id,
	// CF-Access-Client-Secret) pair of headers. The header value will be interpreted
	// as a json object similar to: { "cf-access-client-id":
	// "88bf3b6d86161464f6509f7219099e57.access.example.com",
	// "cf-access-client-secret":
	// "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5" }
	ReadServiceTokensFromHeader param.Field[string] `json:"read_service_tokens_from_header"`
	// Sets the SameSite cookie setting, which provides increased security against CSRF
	// attacks.
	SameSiteCookieAttribute param.Field[string] `json:"same_site_cookie_attribute"`
	// Configuration for provisioning to this application via SCIM. This is currently
	// in closed beta.
	SCIMConfig param.Field[AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfig] `json:"scim_config"`
	// List of public domains that Access will secure. This field is deprecated in
	// favor of `destinations` and will be supported until **November 21, 2025.** If
	// `destinations` are provided, then `self_hosted_domains` will be ignored.
	//
	// Deprecated: deprecated
	SelfHostedDomains param.Field[[]SelfHostedDomainsParam] `json:"self_hosted_domains"`
	// Returns a 401 status code when the request is blocked by a Service Auth policy.
	ServiceAuth401Redirect param.Field[bool] `json:"service_auth_401_redirect"`
	// The amount of time that tokens issued for this application will be valid. Must
	// be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
	// s, m, h. Note: unsupported for infrastructure type applications.
	SessionDuration param.Field[string] `json:"session_duration"`
	// Enables automatic authentication through cloudflared.
	SkipInterstitial param.Field[bool] `json:"skip_interstitial"`
	// The tags you want assigned to an application. Tags are used to filter
	// applications in the App Launcher dashboard.
	Tags param.Field[[]string] `json:"tags"`
	// Determines if users can access this application via a clientless browser
	// isolation URL. This allows users to access private domains without connecting to
	// Gateway. The option requires Clientless Browser Isolation to be set up with
	// policies that allow users of this application.
	UseClientlessIsolationAppLauncherURL param.Field[bool] `json:"use_clientless_isolation_app_launcher_url"`
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplication) implementsAccessApplicationUpdateParamsBodyUnion() {
}

type AccessApplicationUpdateParamsBodyBrowserRdpApplicationTargetCriterion struct {
	// The port that the targets use for the chosen communication protocol. A port
	// cannot be assigned to multiple protocols.
	Port param.Field[int64] `json:"port,required"`
	// The communication protocol your application secures.
	Protocol param.Field[AccessApplicationUpdateParamsBodyBrowserRdpApplicationTargetCriteriaProtocol] `json:"protocol,required"`
	// Contains a map of target attribute keys to target attribute values.
	TargetAttributes param.Field[map[string][]string] `json:"target_attributes,required"`
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationTargetCriterion) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// The communication protocol your application secures.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationTargetCriteriaProtocol string

const (
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationTargetCriteriaProtocolRdp AccessApplicationUpdateParamsBodyBrowserRdpApplicationTargetCriteriaProtocol = "RDP"
)

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationTargetCriteriaProtocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserRdpApplicationTargetCriteriaProtocolRdp:
		return true
	}
	return false
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsL4Protocol] `json:"l4_protocol"`
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string] `json:"mcp_server_id"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                                 `json:"port_range"`
	Type      param.Field[AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestination) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationUnion() {
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPublicDestination],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestination],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestination],
// [AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestination].
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationUnion interface {
	implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationUnion()
}

// A public hostname that Access will secure. Public destinations support
// sub-domain and path. Wildcard '\*' can be used in the definition.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPublicDestination struct {
	Type param.Field[AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPublicDestinationType] `json:"type"`
	// The URI of the destination. Public destinations' URIs can include a domain and
	// path with
	// [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
	URI param.Field[string] `json:"uri"`
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPublicDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPublicDestination) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationUnion() {
}

type AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPublicDestinationType string

const (
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPublicDestinationTypePublic AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPublicDestinationType = "public"
)

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPublicDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPublicDestinationTypePublic:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestination struct {
	// The CIDR range of the destination. Single IPs will be computed as /32.
	CIDR param.Field[string] `json:"cidr"`
	// The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
	Hostname param.Field[string] `json:"hostname"`
	// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
	// match.
	L4Protocol param.Field[AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol] `json:"l4_protocol"`
	// The port range of the destination. Can be a single port or a range of ports.
	// When omitted, all ports will match.
	PortRange param.Field[string]                                                                                   `json:"port_range"`
	Type      param.Field[AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationType] `json:"type"`
	// The VNET ID to match the destination. When omitted, all VNETs will match.
	VnetID param.Field[string] `json:"vnet_id"`
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestination) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationUnion() {
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol string

const (
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolTCP AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol = "tcp"
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolUdp AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol = "udp"
)

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolTCP, AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationType string

const (
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationTypePrivate AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationType = "private"
)

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsPrivateDestinationTypePrivate:
		return true
	}
	return false
}

// A MCP server id configured in ai-controls. Access will secure the MCP server if
// accessed through a MCP portal.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestination struct {
	// The MCP server id configured in ai-controls.
	McpServerID param.Field[string]                                                                                              `json:"mcp_server_id"`
	Type        param.Field[AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType] `json:"type"`
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestination) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestination) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationUnion() {
}

type AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType string

const (
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsViaMcpServerPortalDestinationTypeViaMcpServerPortal:
		return true
	}
	return false
}

// The L4 protocol of the destination. When omitted, both UDP and TCP traffic will
// match.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsL4Protocol string

const (
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsL4ProtocolTCP AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsL4Protocol = "tcp"
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsL4ProtocolUdp AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsL4Protocol = "udp"
)

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsL4Protocol) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsL4ProtocolTCP, AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsL4ProtocolUdp:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsType string

const (
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsTypePublic             AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsType = "public"
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsTypePrivate            AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsType = "private"
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsTypeViaMcpServerPortal AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsType = "via_mcp_server_portal"
)

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsType) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsTypePublic, AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsTypePrivate, AccessApplicationUpdateParamsBodyBrowserRdpApplicationDestinationsTypeViaMcpServerPortal:
		return true
	}
	return false
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationPolicy struct {
	// The UUID of the policy
	ID             param.Field[string]      `json:"id"`
	ApprovalGroups param.Field[interface{}] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationPolicy) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationPolicy) ImplementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationPolicyUnion() {
}

// A JSON that links a reusable policy to an application.
//
// Satisfied by
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserRdpApplicationPoliciesAccessAppPolicyLink],
// [shared.UnionString],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserRdpApplicationPoliciesObject],
// [AccessApplicationUpdateParamsBodyBrowserRdpApplicationPolicy].
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationPolicyUnion interface {
	ImplementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationPolicyUnion()
}

// A JSON that links a reusable policy to an application.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationPoliciesAccessAppPolicyLink struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationPoliciesAccessAppPolicyLink) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationPoliciesAccessAppPolicyLink) ImplementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationPolicyUnion() {
}

type AccessApplicationUpdateParamsBodyBrowserRdpApplicationPoliciesObject struct {
	// The UUID of the policy
	ID param.Field[string] `json:"id"`
	// Administrators who can approve a temporary authentication request.
	ApprovalGroups param.Field[[]ApprovalGroupParam] `json:"approval_groups"`
	// Requires the user to request access from an administrator at the start of each
	// session.
	ApprovalRequired param.Field[bool] `json:"approval_required"`
	// Require this application to be served in an isolated browser for users matching
	// this policy. 'Client Web Isolation' must be on for the account in order to use
	// this feature.
	IsolationRequired param.Field[bool] `json:"isolation_required"`
	// The order of execution for this policy. Must be unique for each policy within an
	// app.
	Precedence param.Field[int64] `json:"precedence"`
	// A custom message that will appear on the purpose justification screen.
	PurposeJustificationPrompt param.Field[string] `json:"purpose_justification_prompt"`
	// Require users to enter a justification when they log in to the application.
	PurposeJustificationRequired param.Field[bool] `json:"purpose_justification_required"`
	// The amount of time that tokens issued for the application will be valid. Must be
	// in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s,
	// m, h.
	SessionDuration param.Field[string] `json:"session_duration"`
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationPoliciesObject) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationPoliciesObject) ImplementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationPolicyUnion() {
}

// Configuration for provisioning to this application via SCIM. This is currently
// in closed beta.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfig struct {
	// The UID of the IdP to use as the source for SCIM resources to provision to this
	// application.
	IdPUID param.Field[string] `json:"idp_uid,required"`
	// The base URI for the application's SCIM-compatible API.
	RemoteURI param.Field[string] `json:"remote_uri,required"`
	// Attributes for configuring HTTP Basic authentication scheme for SCIM
	// provisioning to an application.
	Authentication param.Field[AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion] `json:"authentication"`
	// If false, propagates DELETE requests to the target application for SCIM
	// resources. If true, sets 'active' to false on the SCIM resource. Note: Some
	// targets do not support DELETE operations.
	DeactivateOnDelete param.Field[bool] `json:"deactivate_on_delete"`
	// Whether SCIM provisioning is turned on for this application.
	Enabled param.Field[bool] `json:"enabled"`
	// A list of mappings to apply to SCIM resources before provisioning them in this
	// application. These can transform or filter the resources to be provisioned.
	Mappings param.Field[[]SCIMConfigMappingParam] `json:"mappings"`
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfig) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthentication struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthentication) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthentication) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication],
// [AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthentication].
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion interface {
	implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication []AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthentication) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem struct {
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme] `json:"scheme,required"`
	// Token used to authenticate with the remote SCIM service.
	Token param.Field[string] `json:"token"`
	// URL used to generate the auth code used during token generation.
	AuthorizationURL param.Field[string] `json:"authorization_url"`
	// Client ID used to authenticate when generating a token for authenticating with
	// the remote SCIM service.
	ClientID param.Field[string] `json:"client_id"`
	// Secret used to authenticate when generating a token for authenticating with the
	// remove SCIM service.
	ClientSecret param.Field[string] `json:"client_secret"`
	// Password used to authenticate with the remote SCIM service.
	Password param.Field[string]      `json:"password"`
	Scopes   param.Field[interface{}] `json:"scopes"`
	// URL used to generate the token used to authenticate with the remote SCIM
	// service.
	TokenURL param.Field[string] `json:"token_url"`
	// User name used to authenticate with the remote SCIM service.
	User param.Field[string] `json:"user"`
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// Attributes for configuring HTTP Basic authentication scheme for SCIM
// provisioning to an application.
//
// Satisfied by [zero_trust.SCIMConfigAuthenticationHTTPBasicParam],
// [zero_trust.SCIMConfigAuthenticationOAuthBearerTokenParam],
// [zero_trust.SCIMConfigAuthenticationOauth2Param],
// [zero_trust.AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken],
// [AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItem].
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion interface {
	implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion()
}

// Attributes for configuring Access Service Token authentication scheme for SCIM
// provisioning to an application.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken struct {
	// Client ID of the Access service token used to authenticate with the remote
	// service.
	ClientID param.Field[string] `json:"client_id,required"`
	// Client secret of the Access service token used to authenticate with the remote
	// service.
	ClientSecret param.Field[string] `json:"client_secret,required"`
	// The authentication scheme to use when making SCIM requests to this application.
	Scheme param.Field[AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme] `json:"scheme,required"`
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) MarshalJSON() (data []byte, err error) {
	return apijson.MarshalRoot(r)
}

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceToken) implementsAccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationItemUnion() {
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme string

const (
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationAccessSCIMConfigAuthenticationAccessServiceTokenSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme string

const (
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic          AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2             AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "oauth2"
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeHttpbasic, AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeOauth2, AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationAccessSCIMConfigMultiAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

// The authentication scheme to use when making SCIM requests to this application.
type AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationScheme string

const (
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeHttpbasic          AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationScheme = "httpbasic"
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeOauthbearertoken   AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationScheme = "oauthbearertoken"
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeOauth2             AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationScheme = "oauth2"
	AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeAccessServiceToken AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationScheme = "access_service_token"
)

func (r AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationScheme) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeHttpbasic, AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeOauthbearertoken, AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeOauth2, AccessApplicationUpdateParamsBodyBrowserRdpApplicationSCIMConfigAuthenticationSchemeAccessServiceToken:
		return true
	}
	return false
}

type AccessApplicationUpdateResponseEnvelope struct {
	Errors   []AccessApplicationUpdateResponseEnvelopeErrors   `json:"errors,required"`
	Messages []AccessApplicationUpdateResponseEnvelopeMessages `json:"messages,required"`
	// Whether the API call was successful.
	Success AccessApplicationUpdateResponseEnvelopeSuccess `json:"success,required"`
	Result  AccessApplicationUpdateResponse                `json:"result"`
	JSON    accessApplicationUpdateResponseEnvelopeJSON    `json:"-"`
}

// accessApplicationUpdateResponseEnvelopeJSON contains the JSON metadata for the
// struct [AccessApplicationUpdateResponseEnvelope]
type accessApplicationUpdateResponseEnvelopeJSON struct {
	Errors      apijson.Field
	Messages    apijson.Field
	Success     apijson.Field
	Result      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseEnvelope) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseEnvelopeJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationUpdateResponseEnvelopeErrors struct {
	Code             int64                                               `json:"code,required"`
	Message          string                                              `json:"message,required"`
	DocumentationURL string                                              `json:"documentation_url"`
	Source           AccessApplicationUpdateResponseEnvelopeErrorsSource `json:"source"`
	JSON             accessApplicationUpdateResponseEnvelopeErrorsJSON   `json:"-"`
}

// accessApplicationUpdateResponseEnvelopeErrorsJSON contains the JSON metadata for
// the struct [AccessApplicationUpdateResponseEnvelopeErrors]
type accessApplicationUpdateResponseEnvelopeErrorsJSON struct {
	Code             apijson.Field
	Message          apijson.Field
	DocumentationURL apijson.Field
	Source           apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseEnvelopeErrors) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseEnvelopeErrorsJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationUpdateResponseEnvelopeErrorsSource struct {
	Pointer string                                                  `json:"pointer"`
	JSON    accessApplicationUpdateResponseEnvelopeErrorsSourceJSON `json:"-"`
}

// accessApplicationUpdateResponseEnvelopeErrorsSourceJSON contains the JSON
// metadata for the struct [AccessApplicationUpdateResponseEnvelopeErrorsSource]
type accessApplicationUpdateResponseEnvelopeErrorsSourceJSON struct {
	Pointer     apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseEnvelopeErrorsSource) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseEnvelopeErrorsSourceJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationUpdateResponseEnvelopeMessages struct {
	Code             int64                                                 `json:"code,required"`
	Message          string                                                `json:"message,required"`
	DocumentationURL string                                                `json:"documentation_url"`
	Source           AccessApplicationUpdateResponseEnvelopeMessagesSource `json:"source"`
	JSON             accessApplicationUpdateResponseEnvelopeMessagesJSON   `json:"-"`
}

// accessApplicationUpdateResponseEnvelopeMessagesJSON contains the JSON metadata
// for the struct [AccessApplicationUpdateResponseEnvelopeMessages]
type accessApplicationUpdateResponseEnvelopeMessagesJSON struct {
	Code             apijson.Field
	Message          apijson.Field
	DocumentationURL apijson.Field
	Source           apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseEnvelopeMessages) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseEnvelopeMessagesJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationUpdateResponseEnvelopeMessagesSource struct {
	Pointer string                                                    `json:"pointer"`
	JSON    accessApplicationUpdateResponseEnvelopeMessagesSourceJSON `json:"-"`
}

// accessApplicationUpdateResponseEnvelopeMessagesSourceJSON contains the JSON
// metadata for the struct [AccessApplicationUpdateResponseEnvelopeMessagesSource]
type accessApplicationUpdateResponseEnvelopeMessagesSourceJSON struct {
	Pointer     apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationUpdateResponseEnvelopeMessagesSource) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationUpdateResponseEnvelopeMessagesSourceJSON) RawJSON() string {
	return r.raw
}

// Whether the API call was successful.
type AccessApplicationUpdateResponseEnvelopeSuccess bool

const (
	AccessApplicationUpdateResponseEnvelopeSuccessTrue AccessApplicationUpdateResponseEnvelopeSuccess = true
)

func (r AccessApplicationUpdateResponseEnvelopeSuccess) IsKnown() bool {
	switch r {
	case AccessApplicationUpdateResponseEnvelopeSuccessTrue:
		return true
	}
	return false
}

type AccessApplicationListParams struct {
	// The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
	AccountID param.Field[string] `path:"account_id"`
	// The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
	ZoneID param.Field[string] `path:"zone_id"`
	// The aud of the app.
	AUD param.Field[string] `query:"aud"`
	// The domain of the app.
	Domain param.Field[string] `query:"domain"`
	// True for only exact string matches against passed name/domain query parameters.
	Exact param.Field[bool] `query:"exact"`
	// The name of the app.
	Name param.Field[string] `query:"name"`
	// Page number of results.
	Page param.Field[int64] `query:"page"`
	// Number of results per page.
	PerPage param.Field[int64] `query:"per_page"`
	// Search for apps by other listed query parameters.
	Search param.Field[string] `query:"search"`
	// Target Criteria attributes in key=value format.
	TargetAttributes param.Field[string] `query:"target_attributes"`
}

// URLQuery serializes [AccessApplicationListParams]'s query parameters as
// `url.Values`.
func (r AccessApplicationListParams) URLQuery() (v url.Values) {
	return apiquery.MarshalWithSettings(r, apiquery.QuerySettings{
		ArrayFormat:  apiquery.ArrayQueryFormatRepeat,
		NestedFormat: apiquery.NestedQueryFormatDots,
	})
}

type AccessApplicationDeleteParams struct {
	// The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
	AccountID param.Field[string] `path:"account_id"`
	// The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
	ZoneID param.Field[string] `path:"zone_id"`
}

type AccessApplicationDeleteResponseEnvelope struct {
	Errors   []AccessApplicationDeleteResponseEnvelopeErrors   `json:"errors,required"`
	Messages []AccessApplicationDeleteResponseEnvelopeMessages `json:"messages,required"`
	// Whether the API call was successful.
	Success AccessApplicationDeleteResponseEnvelopeSuccess `json:"success,required"`
	Result  AccessApplicationDeleteResponse                `json:"result"`
	JSON    accessApplicationDeleteResponseEnvelopeJSON    `json:"-"`
}

// accessApplicationDeleteResponseEnvelopeJSON contains the JSON metadata for the
// struct [AccessApplicationDeleteResponseEnvelope]
type accessApplicationDeleteResponseEnvelopeJSON struct {
	Errors      apijson.Field
	Messages    apijson.Field
	Success     apijson.Field
	Result      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationDeleteResponseEnvelope) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationDeleteResponseEnvelopeJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationDeleteResponseEnvelopeErrors struct {
	Code             int64                                               `json:"code,required"`
	Message          string                                              `json:"message,required"`
	DocumentationURL string                                              `json:"documentation_url"`
	Source           AccessApplicationDeleteResponseEnvelopeErrorsSource `json:"source"`
	JSON             accessApplicationDeleteResponseEnvelopeErrorsJSON   `json:"-"`
}

// accessApplicationDeleteResponseEnvelopeErrorsJSON contains the JSON metadata for
// the struct [AccessApplicationDeleteResponseEnvelopeErrors]
type accessApplicationDeleteResponseEnvelopeErrorsJSON struct {
	Code             apijson.Field
	Message          apijson.Field
	DocumentationURL apijson.Field
	Source           apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationDeleteResponseEnvelopeErrors) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationDeleteResponseEnvelopeErrorsJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationDeleteResponseEnvelopeErrorsSource struct {
	Pointer string                                                  `json:"pointer"`
	JSON    accessApplicationDeleteResponseEnvelopeErrorsSourceJSON `json:"-"`
}

// accessApplicationDeleteResponseEnvelopeErrorsSourceJSON contains the JSON
// metadata for the struct [AccessApplicationDeleteResponseEnvelopeErrorsSource]
type accessApplicationDeleteResponseEnvelopeErrorsSourceJSON struct {
	Pointer     apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationDeleteResponseEnvelopeErrorsSource) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationDeleteResponseEnvelopeErrorsSourceJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationDeleteResponseEnvelopeMessages struct {
	Code             int64                                                 `json:"code,required"`
	Message          string                                                `json:"message,required"`
	DocumentationURL string                                                `json:"documentation_url"`
	Source           AccessApplicationDeleteResponseEnvelopeMessagesSource `json:"source"`
	JSON             accessApplicationDeleteResponseEnvelopeMessagesJSON   `json:"-"`
}

// accessApplicationDeleteResponseEnvelopeMessagesJSON contains the JSON metadata
// for the struct [AccessApplicationDeleteResponseEnvelopeMessages]
type accessApplicationDeleteResponseEnvelopeMessagesJSON struct {
	Code             apijson.Field
	Message          apijson.Field
	DocumentationURL apijson.Field
	Source           apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationDeleteResponseEnvelopeMessages) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationDeleteResponseEnvelopeMessagesJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationDeleteResponseEnvelopeMessagesSource struct {
	Pointer string                                                    `json:"pointer"`
	JSON    accessApplicationDeleteResponseEnvelopeMessagesSourceJSON `json:"-"`
}

// accessApplicationDeleteResponseEnvelopeMessagesSourceJSON contains the JSON
// metadata for the struct [AccessApplicationDeleteResponseEnvelopeMessagesSource]
type accessApplicationDeleteResponseEnvelopeMessagesSourceJSON struct {
	Pointer     apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationDeleteResponseEnvelopeMessagesSource) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationDeleteResponseEnvelopeMessagesSourceJSON) RawJSON() string {
	return r.raw
}

// Whether the API call was successful.
type AccessApplicationDeleteResponseEnvelopeSuccess bool

const (
	AccessApplicationDeleteResponseEnvelopeSuccessTrue AccessApplicationDeleteResponseEnvelopeSuccess = true
)

func (r AccessApplicationDeleteResponseEnvelopeSuccess) IsKnown() bool {
	switch r {
	case AccessApplicationDeleteResponseEnvelopeSuccessTrue:
		return true
	}
	return false
}

type AccessApplicationGetParams struct {
	// The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
	AccountID param.Field[string] `path:"account_id"`
	// The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
	ZoneID param.Field[string] `path:"zone_id"`
}

type AccessApplicationGetResponseEnvelope struct {
	Errors   []AccessApplicationGetResponseEnvelopeErrors   `json:"errors,required"`
	Messages []AccessApplicationGetResponseEnvelopeMessages `json:"messages,required"`
	// Whether the API call was successful.
	Success AccessApplicationGetResponseEnvelopeSuccess `json:"success,required"`
	Result  AccessApplicationGetResponse                `json:"result"`
	JSON    accessApplicationGetResponseEnvelopeJSON    `json:"-"`
}

// accessApplicationGetResponseEnvelopeJSON contains the JSON metadata for the
// struct [AccessApplicationGetResponseEnvelope]
type accessApplicationGetResponseEnvelopeJSON struct {
	Errors      apijson.Field
	Messages    apijson.Field
	Success     apijson.Field
	Result      apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseEnvelope) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseEnvelopeJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationGetResponseEnvelopeErrors struct {
	Code             int64                                            `json:"code,required"`
	Message          string                                           `json:"message,required"`
	DocumentationURL string                                           `json:"documentation_url"`
	Source           AccessApplicationGetResponseEnvelopeErrorsSource `json:"source"`
	JSON             accessApplicationGetResponseEnvelopeErrorsJSON   `json:"-"`
}

// accessApplicationGetResponseEnvelopeErrorsJSON contains the JSON metadata for
// the struct [AccessApplicationGetResponseEnvelopeErrors]
type accessApplicationGetResponseEnvelopeErrorsJSON struct {
	Code             apijson.Field
	Message          apijson.Field
	DocumentationURL apijson.Field
	Source           apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationGetResponseEnvelopeErrors) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseEnvelopeErrorsJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationGetResponseEnvelopeErrorsSource struct {
	Pointer string                                               `json:"pointer"`
	JSON    accessApplicationGetResponseEnvelopeErrorsSourceJSON `json:"-"`
}

// accessApplicationGetResponseEnvelopeErrorsSourceJSON contains the JSON metadata
// for the struct [AccessApplicationGetResponseEnvelopeErrorsSource]
type accessApplicationGetResponseEnvelopeErrorsSourceJSON struct {
	Pointer     apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseEnvelopeErrorsSource) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseEnvelopeErrorsSourceJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationGetResponseEnvelopeMessages struct {
	Code             int64                                              `json:"code,required"`
	Message          string                                             `json:"message,required"`
	DocumentationURL string                                             `json:"documentation_url"`
	Source           AccessApplicationGetResponseEnvelopeMessagesSource `json:"source"`
	JSON             accessApplicationGetResponseEnvelopeMessagesJSON   `json:"-"`
}

// accessApplicationGetResponseEnvelopeMessagesJSON contains the JSON metadata for
// the struct [AccessApplicationGetResponseEnvelopeMessages]
type accessApplicationGetResponseEnvelopeMessagesJSON struct {
	Code             apijson.Field
	Message          apijson.Field
	DocumentationURL apijson.Field
	Source           apijson.Field
	raw              string
	ExtraFields      map[string]apijson.Field
}

func (r *AccessApplicationGetResponseEnvelopeMessages) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseEnvelopeMessagesJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationGetResponseEnvelopeMessagesSource struct {
	Pointer string                                                 `json:"pointer"`
	JSON    accessApplicationGetResponseEnvelopeMessagesSourceJSON `json:"-"`
}

// accessApplicationGetResponseEnvelopeMessagesSourceJSON contains the JSON
// metadata for the struct [AccessApplicationGetResponseEnvelopeMessagesSource]
type accessApplicationGetResponseEnvelopeMessagesSourceJSON struct {
	Pointer     apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationGetResponseEnvelopeMessagesSource) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationGetResponseEnvelopeMessagesSourceJSON) RawJSON() string {
	return r.raw
}

// Whether the API call was successful.
type AccessApplicationGetResponseEnvelopeSuccess bool

const (
	AccessApplicationGetResponseEnvelopeSuccessTrue AccessApplicationGetResponseEnvelopeSuccess = true
)

func (r AccessApplicationGetResponseEnvelopeSuccess) IsKnown() bool {
	switch r {
	case AccessApplicationGetResponseEnvelopeSuccessTrue:
		return true
	}
	return false
}

type AccessApplicationRevokeTokensParams struct {
	// The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
	AccountID param.Field[string] `path:"account_id"`
	// The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
	ZoneID param.Field[string] `path:"zone_id"`
}

type AccessApplicationRevokeTokensResponseEnvelope struct {
	Result  AccessApplicationRevokeTokensResponse                `json:"result,nullable"`
	Success AccessApplicationRevokeTokensResponseEnvelopeSuccess `json:"success"`
	JSON    accessApplicationRevokeTokensResponseEnvelopeJSON    `json:"-"`
}

// accessApplicationRevokeTokensResponseEnvelopeJSON contains the JSON metadata for
// the struct [AccessApplicationRevokeTokensResponseEnvelope]
type accessApplicationRevokeTokensResponseEnvelopeJSON struct {
	Result      apijson.Field
	Success     apijson.Field
	raw         string
	ExtraFields map[string]apijson.Field
}

func (r *AccessApplicationRevokeTokensResponseEnvelope) UnmarshalJSON(data []byte) (err error) {
	return apijson.UnmarshalRoot(data, r)
}

func (r accessApplicationRevokeTokensResponseEnvelopeJSON) RawJSON() string {
	return r.raw
}

type AccessApplicationRevokeTokensResponseEnvelopeSuccess bool

const (
	AccessApplicationRevokeTokensResponseEnvelopeSuccessTrue  AccessApplicationRevokeTokensResponseEnvelopeSuccess = true
	AccessApplicationRevokeTokensResponseEnvelopeSuccessFalse AccessApplicationRevokeTokensResponseEnvelopeSuccess = false
)

func (r AccessApplicationRevokeTokensResponseEnvelopeSuccess) IsKnown() bool {
	switch r {
	case AccessApplicationRevokeTokensResponseEnvelopeSuccessTrue, AccessApplicationRevokeTokensResponseEnvelopeSuccessFalse:
		return true
	}
	return false
}
