cloudflare
Version:
The official TypeScript library for the Cloudflare API
972 lines • 40 kB
text/typescript
import { APIResource } from "../../../core/resource.mjs";
import * as DOHAPI from "./doh.mjs";
import { BaseDOH, DOH, DOHGetParams, DOHGetResponse, DOHUpdateParams, DOHUpdateResponse } from "./doh.mjs";
import { APIPromise } from "../../../core/api-promise.mjs";
import { RequestOptions } from "../../../internal/request-options.mjs";
export declare class BaseOrganizations extends APIResource {
static readonly _key: readonly ['zeroTrust', 'organizations'];
/**
* Sets up a Zero Trust organization for your account or zone.
*
* @example
* ```ts
* const organization =
* await client.zeroTrust.organizations.create({
* auth_domain: 'test.cloudflareaccess.com',
* name: 'Widget Corps Internal Applications',
* account_id: 'account_id',
* });
* ```
*/
create(params: OrganizationCreateParams, options?: RequestOptions): APIPromise<Organization>;
/**
* Updates the configuration for your Zero Trust organization.
*
* @example
* ```ts
* const organization =
* await client.zeroTrust.organizations.update({
* account_id: 'account_id',
* });
* ```
*/
update(params: OrganizationUpdateParams, options?: RequestOptions): APIPromise<Organization>;
/**
* Returns the configuration for your Zero Trust organization.
*
* @example
* ```ts
* const organizations =
* await client.zeroTrust.organizations.list({
* account_id: 'account_id',
* });
* ```
*/
list(params?: OrganizationListParams | null | undefined, options?: RequestOptions): APIPromise<OrganizationListResponse>;
/**
* Revokes a user's access across all applications.
*
* @example
* ```ts
* const response =
* await client.zeroTrust.organizations.revokeUsers({
* email: 'test@example.com',
* account_id: 'account_id',
* });
* ```
*/
revokeUsers(params: OrganizationRevokeUsersParams, options?: RequestOptions): APIPromise<OrganizationRevokeUsersResponse>;
}
export declare class Organizations extends BaseOrganizations {
doh: DOHAPI.DOH;
}
export interface LoginDesign {
/**
* The background color on your login page.
*/
background_color?: string;
/**
* The text at the bottom of your login page.
*/
footer_text?: string;
/**
* The text at the top of your login page.
*/
header_text?: string;
/**
* The URL of the logo on your login page.
*/
logo_path?: string;
/**
* The text color on your login page.
*/
text_color?: string;
}
export interface LoginDesignParam {
/**
* The background color on your login page.
*/
background_color?: string;
/**
* The text at the bottom of your login page.
*/
footer_text?: string;
/**
* The text at the top of your login page.
*/
header_text?: string;
/**
* The URL of the logo on your login page.
*/
logo_path?: string;
/**
* The text color on your login page.
*/
text_color?: string;
}
export interface Organization {
/**
* When set to true, users can authenticate via WARP for any application in your
* organization. Application settings will take precedence over this value.
*/
allow_authenticate_via_warp?: boolean;
/**
* The unique subdomain assigned to your Zero Trust organization.
*/
auth_domain?: string;
/**
* When set to `true`, users skip the identity provider selection step during
* login.
*/
auto_redirect_to_identity?: boolean;
custom_pages?: Organization.CustomPages;
/**
* Determines whether to deny all requests to Cloudflare-protected resources that
* lack an associated Access application. If enabled, you must explicitly configure
* an Access application and policy to allow traffic to your Cloudflare-protected
* resources. For domains you want to be public across all subdomains, add the
* domain to the `deny_unmatched_requests_exempted_zone_names` array.
*/
deny_unmatched_requests?: boolean;
/**
* Contains zone names to exempt from the `deny_unmatched_requests` feature.
* Requests to a subdomain in an exempted zone will block unauthenticated traffic
* by default if there is a configured Access application and policy that matches
* the request.
*/
deny_unmatched_requests_exempted_zone_names?: Array<string>;
/**
* Lock all settings as Read-Only in the Dashboard, regardless of user permission.
* Updates may only be made via the API or Terraform for this account when enabled.
*/
is_ui_read_only?: boolean;
login_design?: LoginDesign;
/**
* Configures multi-factor authentication (MFA) settings for an organization.
*/
mfa_config?: Organization.MfaConfig;
/**
* Configures PIV key requirements for MFA using hardware security keys.
*/
mfa_piv_key_requirements?: Organization.MfaPivKeyRequirements;
/**
* Determines whether global MFA settings apply to applications by default. The
* organization must have MFA enabled with at least one authentication method and a
* session duration configured. Note: 'allowed_authenticators' cannot contain only
* the infrastructure SSH authenticators ('piv_key' and 'ssh_fido2_key') if the
* organization has any non-infrastructure applications.
*/
mfa_required_for_all_apps?: boolean;
/**
* The name of your Zero Trust organization.
*/
name?: string;
/**
* Configures automatic enforcement for inactive service tokens. A service token is
* inactive if no policy references it, and it has not successfully authenticated
* with an Access application during the selected inactivity period. This setting
* applies to every service token in your Zero Trust account.
*/
service_token_inactivity?: Organization.ServiceTokenInactivity;
/**
* The amount of time that tokens issued for applications will be valid. Must be in
* the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m,
* h.
*/
session_duration?: string;
/**
* Enables new behaviors for requests made with Access service tokens. Unauthorized
* requests emit audit logs, and return a 401 or 403 status code in the response
* instead of redirecting to the login page. Successful requests no longer receive
* a CF_Authorization cookie in the response. Zero Trust organizations created on
* or after October 5, 2026 will have this setting enabled by default, and cannot
* disable it.
*/
strict_service_token_auth?: boolean;
/**
* A description of the reason why the UI read only field is being toggled.
*/
ui_read_only_toggle_reason?: string;
/**
* The amount of time a user seat is inactive before it expires. When the user seat
* exceeds the set time of inactivity, the user is removed as an active seat and no
* longer counts against your Teams seat count. Minimum value for this setting is 1
* month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are:
* `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`.
*/
user_seat_expiration_inactive_time?: string;
/**
* When enabled, unsuccessful WARP authentication requests with a non-HTML Accept
* header return a 401 response instead of redirecting to the login page.
*/
warp_auth_non_browser_401?: boolean;
/**
* The amount of time that tokens issued for applications will be valid. Must be in
* the format `30m` or `2h45m`. Valid time units are: m, h.
*/
warp_auth_session_duration?: string;
}
export declare namespace Organization {
interface CustomPages {
/**
* The uid of the custom page to use when a user is denied access after failing a
* non-identity rule.
*/
forbidden?: string;
/**
* The uid of the custom page to use when a user is denied access.
*/
identity_denied?: string;
}
/**
* Configures multi-factor authentication (MFA) settings for an organization.
*/
interface MfaConfig {
/**
* Lists the MFA methods that users can authenticate with. The `piv_key` and
* `ssh_fido2_key` values are supported only for infrastructure applications.
*/
allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key' | 'piv_key' | 'ssh_fido2_key'>;
/**
* Allows a user to skip MFA via Authentication Method Reference (AMR) matching
* when the AMR claim provided by the IdP the user used to authenticate contains
* "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30
* days).
*/
amr_matching_session_duration?: string;
/**
* Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.
*/
required_aaguids?: string;
/**
* Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
* Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
*/
session_duration?: string;
}
/**
* Configures PIV key requirements for MFA using hardware security keys.
*/
interface MfaPivKeyRequirements {
/**
* Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN
* required), `once` (PIN required once per session), `always` (PIN required for
* each use).
*/
pin_policy?: 'never' | 'once' | 'always';
/**
* Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated
* device.
*/
require_fips_device?: boolean;
/**
* Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type.
* Ed25519 has a fixed key size and does not accept this parameter.
*/
ssh_key_size?: Array<256 | 384 | 521 | 2048 | 3072 | 4096>;
/**
* Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and
* `rsa`.
*/
ssh_key_type?: Array<'ecdsa' | 'ed25519' | 'rsa'>;
/**
* Defines when physical touch is required to use the SSH key. Valid values:
* `never` (no touch required), `always` (touch required for each use), `cached`
* (touch cached for 15 seconds).
*/
touch_policy?: 'never' | 'always' | 'cached';
}
/**
* Configures automatic enforcement for inactive service tokens. A service token is
* inactive if no policy references it, and it has not successfully authenticated
* with an Access application during the selected inactivity period. This setting
* applies to every service token in your Zero Trust account.
*/
interface ServiceTokenInactivity {
/**
* The action applied to an inactive service token.
*/
action: 'disable' | 'delete';
/**
* Whether automatic enforcement for inactive service tokens is enabled.
*/
enabled: boolean;
/**
* The number of days a service token must be inactive before the configured action
* is applied.
*/
inactivity_threshold_days: number;
}
}
export interface OrganizationListResponse {
/**
* When set to true, users can authenticate via WARP for any application in your
* organization. Application settings will take precedence over this value.
*/
allow_authenticate_via_warp?: boolean;
/**
* The unique subdomain assigned to your Zero Trust organization.
*/
auth_domain?: string;
/**
* When set to `true`, users skip the identity provider selection step during
* login.
*/
auto_redirect_to_identity?: boolean;
custom_pages?: OrganizationListResponse.CustomPages;
/**
* Determines whether to deny all requests to Cloudflare-protected resources that
* lack an associated Access application. If enabled, you must explicitly configure
* an Access application and policy to allow traffic to your Cloudflare-protected
* resources. For domains you want to be public across all subdomains, add the
* domain to the `deny_unmatched_requests_exempted_zone_names` array.
*/
deny_unmatched_requests?: boolean;
/**
* Contains zone names to exempt from the `deny_unmatched_requests` feature.
* Requests to a subdomain in an exempted zone will block unauthenticated traffic
* by default if there is a configured Access application and policy that matches
* the request.
*/
deny_unmatched_requests_exempted_zone_names?: Array<string>;
/**
* Lock all settings as Read-Only in the Dashboard, regardless of user permission.
* Updates may only be made via the API or Terraform for this account when enabled.
*/
is_ui_read_only?: boolean;
login_design?: LoginDesign;
/**
* Configures multi-factor authentication (MFA) settings for an organization.
*/
mfa_config?: OrganizationListResponse.MfaConfig;
/**
* Configures PIV key requirements for MFA using hardware security keys.
*/
mfa_piv_key_requirements?: OrganizationListResponse.MfaPivKeyRequirements;
/**
* Determines whether global MFA settings apply to applications by default. The
* organization must have MFA enabled with at least one authentication method and a
* session duration configured. Note: 'allowed_authenticators' cannot contain only
* the infrastructure SSH authenticators ('piv_key' and 'ssh_fido2_key') if the
* organization has any non-infrastructure applications.
*/
mfa_required_for_all_apps?: boolean;
/**
* The name of your Zero Trust organization.
*/
name?: string;
/**
* Configures automatic enforcement for inactive service tokens. A service token is
* inactive if no policy references it, and it has not successfully authenticated
* with an Access application during the selected inactivity period. This setting
* applies to every service token in your Zero Trust account.
*/
service_token_inactivity?: OrganizationListResponse.ServiceTokenInactivity;
/**
* The amount of time that tokens issued for applications will be valid. Must be in
* the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m,
* h.
*/
session_duration?: string;
/**
* Enables new behaviors for requests made with Access service tokens. Unauthorized
* requests emit audit logs, and return a 401 or 403 status code in the response
* instead of redirecting to the login page. Successful requests no longer receive
* a CF_Authorization cookie in the response. Zero Trust organizations created on
* or after October 5, 2026 will have this setting enabled by default, and cannot
* disable it.
*/
strict_service_token_auth?: boolean;
/**
* The account tags of organizations trusted by this organization for policy and
* device posture sharing.
*/
trusted_accounts?: Array<string>;
/**
* A description of the reason why the UI read only field is being toggled.
*/
ui_read_only_toggle_reason?: string;
/**
* The amount of time a user seat is inactive before it expires. When the user seat
* exceeds the set time of inactivity, the user is removed as an active seat and no
* longer counts against your Teams seat count. Minimum value for this setting is 1
* month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are:
* `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`.
*/
user_seat_expiration_inactive_time?: string;
/**
* When enabled, unsuccessful WARP authentication requests with a non-HTML Accept
* header return a 401 response instead of redirecting to the login page.
*/
warp_auth_non_browser_401?: boolean;
/**
* The amount of time that tokens issued for applications will be valid. Must be in
* the format `30m` or `2h45m`. Valid time units are: m, h.
*/
warp_auth_session_duration?: string;
}
export declare namespace OrganizationListResponse {
interface CustomPages {
/**
* The uid of the custom page to use when a user is denied access after failing a
* non-identity rule.
*/
forbidden?: string;
/**
* The uid of the custom page to use when a user is denied access.
*/
identity_denied?: string;
}
/**
* Configures multi-factor authentication (MFA) settings for an organization.
*/
interface MfaConfig {
/**
* Lists the MFA methods that users can authenticate with. The `piv_key` and
* `ssh_fido2_key` values are supported only for infrastructure applications.
*/
allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key' | 'piv_key' | 'ssh_fido2_key'>;
/**
* Allows a user to skip MFA via Authentication Method Reference (AMR) matching
* when the AMR claim provided by the IdP the user used to authenticate contains
* "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30
* days).
*/
amr_matching_session_duration?: string;
/**
* Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.
*/
required_aaguids?: string;
/**
* Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
* Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
*/
session_duration?: string;
}
/**
* Configures PIV key requirements for MFA using hardware security keys.
*/
interface MfaPivKeyRequirements {
/**
* Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN
* required), `once` (PIN required once per session), `always` (PIN required for
* each use).
*/
pin_policy?: 'never' | 'once' | 'always';
/**
* Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated
* device.
*/
require_fips_device?: boolean;
/**
* Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type.
* Ed25519 has a fixed key size and does not accept this parameter.
*/
ssh_key_size?: Array<256 | 384 | 521 | 2048 | 3072 | 4096>;
/**
* Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and
* `rsa`.
*/
ssh_key_type?: Array<'ecdsa' | 'ed25519' | 'rsa'>;
/**
* Defines when physical touch is required to use the SSH key. Valid values:
* `never` (no touch required), `always` (touch required for each use), `cached`
* (touch cached for 15 seconds).
*/
touch_policy?: 'never' | 'always' | 'cached';
}
/**
* Configures automatic enforcement for inactive service tokens. A service token is
* inactive if no policy references it, and it has not successfully authenticated
* with an Access application during the selected inactivity period. This setting
* applies to every service token in your Zero Trust account.
*/
interface ServiceTokenInactivity {
/**
* The action applied to an inactive service token.
*/
action: 'disable' | 'delete';
/**
* Whether automatic enforcement for inactive service tokens is enabled.
*/
enabled: boolean;
/**
* The number of days a service token must be inactive before the configured action
* is applied.
*/
inactivity_threshold_days: number;
}
}
export type OrganizationRevokeUsersResponse = true | false;
export interface OrganizationCreateParams {
/**
* Body param: The unique subdomain assigned to your Zero Trust organization.
*/
auth_domain: string;
/**
* Body param: The name of your Zero Trust organization.
*/
name: string;
/**
* Path param: The Account ID to use for this endpoint. Mutually exclusive with the
* Zone ID.
*/
account_id?: string;
/**
* Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
* Account ID.
*/
zone_id?: string;
/**
* Body param: When set to true, users can authenticate via WARP for any
* application in your organization. Application settings will take precedence over
* this value.
*/
allow_authenticate_via_warp?: boolean;
/**
* Body param: When set to `true`, users skip the identity provider selection step
* during login.
*/
auto_redirect_to_identity?: boolean;
/**
* Body param: Determines whether to deny all requests to Cloudflare-protected
* resources that lack an associated Access application. If enabled, you must
* explicitly configure an Access application and policy to allow traffic to your
* Cloudflare-protected resources. For domains you want to be public across all
* subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names`
* array.
*/
deny_unmatched_requests?: boolean;
/**
* Body param: Contains zone names to exempt from the `deny_unmatched_requests`
* feature. Requests to a subdomain in an exempted zone will block unauthenticated
* traffic by default if there is a configured Access application and policy that
* matches the request.
*/
deny_unmatched_requests_exempted_zone_names?: Array<string>;
/**
* Body param: Lock all settings as Read-Only in the Dashboard, regardless of user
* permission. Updates may only be made via the API or Terraform for this account
* when enabled.
*/
is_ui_read_only?: boolean;
/**
* Body param
*/
login_design?: LoginDesignParam;
/**
* Body param: Configures multi-factor authentication (MFA) settings for an
* organization.
*/
mfa_config?: OrganizationCreateParams.MfaConfig;
/**
* Body param: Configures PIV key requirements for MFA using hardware security
* keys.
*/
mfa_piv_key_requirements?: OrganizationCreateParams.MfaPivKeyRequirements;
/**
* Body param: Determines whether global MFA settings apply to applications by
* default. The organization must have MFA enabled with at least one authentication
* method and a session duration configured. Note: 'allowed_authenticators' cannot
* contain only the infrastructure SSH authenticators ('piv_key' and
* 'ssh_fido2_key') if the organization has any non-infrastructure applications.
*/
mfa_required_for_all_apps?: boolean;
/**
* Body param: Configures automatic enforcement for inactive service tokens. A
* service token is inactive if no policy references it, and it has not
* successfully authenticated with an Access application during the selected
* inactivity period. This setting applies to every service token in your Zero
* Trust account.
*/
service_token_inactivity?: OrganizationCreateParams.ServiceTokenInactivity;
/**
* Body param: The amount of time that tokens issued for applications will be
* valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
* (or µs), ms, s, m, h.
*/
session_duration?: string;
/**
* Body param: Enables new behaviors for requests made with Access service tokens.
* Unauthorized requests emit audit logs, and return a 401 or 403 status code in
* the response instead of redirecting to the login page. Successful requests no
* longer receive a CF_Authorization cookie in the response. Zero Trust
* organizations created on or after October 5, 2026 will have this setting enabled
* by default, and cannot disable it.
*/
strict_service_token_auth?: boolean;
/**
* Body param: A description of the reason why the UI read only field is being
* toggled.
*/
ui_read_only_toggle_reason?: string;
/**
* Body param: The amount of time a user seat is inactive before it expires. When
* the user seat exceeds the set time of inactivity, the user is removed as an
* active seat and no longer counts against your Teams seat count. Minimum value
* for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`.
* Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`.
*/
user_seat_expiration_inactive_time?: string;
/**
* Body param: When enabled, unsuccessful WARP authentication requests with a
* non-HTML Accept header return a 401 response instead of redirecting to the login
* page.
*/
warp_auth_non_browser_401?: boolean;
/**
* Body param: The amount of time that tokens issued for applications will be
* valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h.
*/
warp_auth_session_duration?: string;
}
export declare namespace OrganizationCreateParams {
/**
* Configures multi-factor authentication (MFA) settings for an organization.
*/
interface MfaConfig {
/**
* Lists the MFA methods that users can authenticate with. The `piv_key` and
* `ssh_fido2_key` values are supported only for infrastructure applications.
*/
allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key' | 'piv_key' | 'ssh_fido2_key'>;
/**
* Allows a user to skip MFA via Authentication Method Reference (AMR) matching
* when the AMR claim provided by the IdP the user used to authenticate contains
* "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30
* days).
*/
amr_matching_session_duration?: string;
/**
* Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.
*/
required_aaguids?: string;
/**
* Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
* Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
*/
session_duration?: string;
}
/**
* Configures PIV key requirements for MFA using hardware security keys.
*/
interface MfaPivKeyRequirements {
/**
* Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN
* required), `once` (PIN required once per session), `always` (PIN required for
* each use).
*/
pin_policy?: 'never' | 'once' | 'always';
/**
* Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated
* device.
*/
require_fips_device?: boolean;
/**
* Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type.
* Ed25519 has a fixed key size and does not accept this parameter.
*/
ssh_key_size?: Array<256 | 384 | 521 | 2048 | 3072 | 4096>;
/**
* Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and
* `rsa`.
*/
ssh_key_type?: Array<'ecdsa' | 'ed25519' | 'rsa'>;
/**
* Defines when physical touch is required to use the SSH key. Valid values:
* `never` (no touch required), `always` (touch required for each use), `cached`
* (touch cached for 15 seconds).
*/
touch_policy?: 'never' | 'always' | 'cached';
}
/**
* Configures automatic enforcement for inactive service tokens. A service token is
* inactive if no policy references it, and it has not successfully authenticated
* with an Access application during the selected inactivity period. This setting
* applies to every service token in your Zero Trust account.
*/
interface ServiceTokenInactivity {
/**
* The action applied to an inactive service token.
*/
action: 'disable' | 'delete';
/**
* Whether automatic enforcement for inactive service tokens is enabled.
*/
enabled: boolean;
/**
* The number of days a service token must be inactive before the configured action
* is applied.
*/
inactivity_threshold_days: number;
}
}
export interface OrganizationUpdateParams {
/**
* Path param: The Account ID to use for this endpoint. Mutually exclusive with the
* Zone ID.
*/
account_id?: string;
/**
* Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
* Account ID.
*/
zone_id?: string;
/**
* Body param: When set to true, users can authenticate via WARP for any
* application in your organization. Application settings will take precedence over
* this value.
*/
allow_authenticate_via_warp?: boolean;
/**
* Body param: The unique subdomain assigned to your Zero Trust organization.
*/
auth_domain?: string;
/**
* Body param: When set to `true`, users skip the identity provider selection step
* during login.
*/
auto_redirect_to_identity?: boolean;
/**
* Body param
*/
custom_pages?: OrganizationUpdateParams.CustomPages;
/**
* Body param: Determines whether to deny all requests to Cloudflare-protected
* resources that lack an associated Access application. If enabled, you must
* explicitly configure an Access application and policy to allow traffic to your
* Cloudflare-protected resources. For domains you want to be public across all
* subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names`
* array.
*/
deny_unmatched_requests?: boolean;
/**
* Body param: Contains zone names to exempt from the `deny_unmatched_requests`
* feature. Requests to a subdomain in an exempted zone will block unauthenticated
* traffic by default if there is a configured Access application and policy that
* matches the request.
*/
deny_unmatched_requests_exempted_zone_names?: Array<string>;
/**
* Body param: Lock all settings as Read-Only in the Dashboard, regardless of user
* permission. Updates may only be made via the API or Terraform for this account
* when enabled.
*/
is_ui_read_only?: boolean;
/**
* Body param
*/
login_design?: LoginDesignParam;
/**
* Body param: Configures multi-factor authentication (MFA) settings for an
* organization.
*/
mfa_config?: OrganizationUpdateParams.MfaConfig;
/**
* Body param: Configures PIV key requirements for MFA using hardware security
* keys.
*/
mfa_piv_key_requirements?: OrganizationUpdateParams.MfaPivKeyRequirements;
/**
* Body param: Determines whether global MFA settings apply to applications by
* default. The organization must have MFA enabled with at least one authentication
* method and a session duration configured. Note: 'allowed_authenticators' cannot
* contain only the infrastructure SSH authenticators ('piv_key' and
* 'ssh_fido2_key') if the organization has any non-infrastructure applications.
*/
mfa_required_for_all_apps?: boolean;
/**
* Body param: The name of your Zero Trust organization.
*/
name?: string;
/**
* Body param: Configures automatic enforcement for inactive service tokens. A
* service token is inactive if no policy references it, and it has not
* successfully authenticated with an Access application during the selected
* inactivity period. This setting applies to every service token in your Zero
* Trust account.
*/
service_token_inactivity?: OrganizationUpdateParams.ServiceTokenInactivity;
/**
* Body param: The amount of time that tokens issued for applications will be
* valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us
* (or µs), ms, s, m, h.
*/
session_duration?: string;
/**
* Body param: Enables new behaviors for requests made with Access service tokens.
* Unauthorized requests emit audit logs, and return a 401 or 403 status code in
* the response instead of redirecting to the login page. Successful requests no
* longer receive a CF_Authorization cookie in the response. Zero Trust
* organizations created on or after October 5, 2026 will have this setting enabled
* by default, and cannot disable it.
*/
strict_service_token_auth?: boolean;
/**
* Body param: A description of the reason why the UI read only field is being
* toggled.
*/
ui_read_only_toggle_reason?: string;
/**
* Body param: The amount of time a user seat is inactive before it expires. When
* the user seat exceeds the set time of inactivity, the user is removed as an
* active seat and no longer counts against your Teams seat count. Minimum value
* for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`.
* Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`.
*/
user_seat_expiration_inactive_time?: string;
/**
* Body param: When enabled, unsuccessful WARP authentication requests with a
* non-HTML Accept header return a 401 response instead of redirecting to the login
* page.
*/
warp_auth_non_browser_401?: boolean;
/**
* Body param: The amount of time that tokens issued for applications will be
* valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h.
*/
warp_auth_session_duration?: string;
}
export declare namespace OrganizationUpdateParams {
interface CustomPages {
/**
* The uid of the custom page to use when a user is denied access after failing a
* non-identity rule.
*/
forbidden?: string;
/**
* The uid of the custom page to use when a user is denied access.
*/
identity_denied?: string;
}
/**
* Configures multi-factor authentication (MFA) settings for an organization.
*/
interface MfaConfig {
/**
* Lists the MFA methods that users can authenticate with. The `piv_key` and
* `ssh_fido2_key` values are supported only for infrastructure applications.
*/
allowed_authenticators?: Array<'totp' | 'biometrics' | 'security_key' | 'piv_key' | 'ssh_fido2_key'>;
/**
* Allows a user to skip MFA via Authentication Method Reference (AMR) matching
* when the AMR claim provided by the IdP the user used to authenticate contains
* "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30
* days).
*/
amr_matching_session_duration?: string;
/**
* Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.
*/
required_aaguids?: string;
/**
* Defines the duration of an MFA session. Must be in minutes (m) or hours (h).
* Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`.
*/
session_duration?: string;
}
/**
* Configures PIV key requirements for MFA using hardware security keys.
*/
interface MfaPivKeyRequirements {
/**
* Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN
* required), `once` (PIN required once per session), `always` (PIN required for
* each use).
*/
pin_policy?: 'never' | 'once' | 'always';
/**
* Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated
* device.
*/
require_fips_device?: boolean;
/**
* Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type.
* Ed25519 has a fixed key size and does not accept this parameter.
*/
ssh_key_size?: Array<256 | 384 | 521 | 2048 | 3072 | 4096>;
/**
* Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and
* `rsa`.
*/
ssh_key_type?: Array<'ecdsa' | 'ed25519' | 'rsa'>;
/**
* Defines when physical touch is required to use the SSH key. Valid values:
* `never` (no touch required), `always` (touch required for each use), `cached`
* (touch cached for 15 seconds).
*/
touch_policy?: 'never' | 'always' | 'cached';
}
/**
* Configures automatic enforcement for inactive service tokens. A service token is
* inactive if no policy references it, and it has not successfully authenticated
* with an Access application during the selected inactivity period. This setting
* applies to every service token in your Zero Trust account.
*/
interface ServiceTokenInactivity {
/**
* The action applied to an inactive service token.
*/
action: 'disable' | 'delete';
/**
* Whether automatic enforcement for inactive service tokens is enabled.
*/
enabled: boolean;
/**
* The number of days a service token must be inactive before the configured action
* is applied.
*/
inactivity_threshold_days: number;
}
}
export interface OrganizationListParams {
/**
* The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
*/
account_id?: string;
/**
* The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
*/
zone_id?: string;
}
export interface OrganizationRevokeUsersParams {
/**
* Body param: The email of the user to revoke.
*/
email: string;
/**
* Path param: The Account ID to use for this endpoint. Mutually exclusive with the
* Zone ID.
*/
account_id?: string;
/**
* Path param: The Zone ID to use for this endpoint. Mutually exclusive with the
* Account ID.
*/
zone_id?: string;
/**
* Query param: When set to `true`, all devices associated with the user will be
* revoked.
*/
query_devices?: boolean;
/**
* Body param: When set to `true`, all devices associated with the user will be
* revoked.
*/
body_devices?: boolean;
/**
* Body param: The uuid of the user to revoke.
*/
user_uid?: string;
/**
* Body param: When set to `true`, the user will be required to re-authenticate to
* WARP for all Gateway policies that enforce a WARP client session duration. When
* `false`, the user’s WARP session will remain active
*/
warp_session_reauth?: boolean;
}
export declare namespace Organizations {
export { type LoginDesign as LoginDesign, type Organization as Organization, type OrganizationListResponse as OrganizationListResponse, type OrganizationRevokeUsersResponse as OrganizationRevokeUsersResponse, type OrganizationCreateParams as OrganizationCreateParams, type OrganizationUpdateParams as OrganizationUpdateParams, type OrganizationListParams as OrganizationListParams, type OrganizationRevokeUsersParams as OrganizationRevokeUsersParams, };
export { DOH as DOH, BaseDOH as BaseDOH, type DOHUpdateResponse as DOHUpdateResponse, type DOHGetResponse as DOHGetResponse, type DOHUpdateParams as DOHUpdateParams, type DOHGetParams as DOHGetParams, };
}
//# sourceMappingURL=organizations.d.mts.map