Policies

ModelsExpand Collapse

type DevicePolicyCertificates struct{…}

Enabled bool

The current status of the device policy certificate provisioning feature for WARP clients.

type FallbackDomain struct{…}

Suffix string

The domain suffix to match when resolving locally.

Description stringOptional

A description of the fallback domain, displayed in the client UI.

maxLength100

DNSServer []stringOptional

A list of IP addresses to handle domain resolution.

type FallbackDomainPolicy []FallbackDomain

Suffix string

The domain suffix to match when resolving locally.

Description stringOptional

A description of the fallback domain, displayed in the client UI.

maxLength100

DNSServer []stringOptional

A list of IP addresses to handle domain resolution.

type SettingsPolicy struct{…}

AllowModeSwitch boolOptional

Whether to allow the user to switch WARP between modes.

AllowUpdates boolOptional

Whether to receive update notifications when a new version of the client is available.

AllowedToLeave boolOptional

Whether to allow devices to leave the organization.

AutoConnect float64Optional

The amount of time in seconds to reconnect after having been disabled.

CaptivePortal float64Optional

Turn on the captive portal after the specified amount of time.

Default boolOptional

Whether the policy is the default policy for an account.

Description stringOptional

A description of the policy.

maxLength500

DisableAutoFallback boolOptional

If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.

DNSSearchSuffixes []SettingsPolicyDNSSearchSuffixOptional

List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.

Suffix string

The DNS search suffix to append when resolving short hostnames.

Description stringOptional

A description of the DNS search suffix.

Enabled boolOptional

Whether the policy will be applied to matching devices.

Exclude []SplitTunnelExcludeOptional

List of routes excluded in the WARP client’s tunnel.

One of the following:

type SplitTunnelExcludeTeamsDevicesExcludeSplitTunnelWithAddress struct{…}

Address string

The address in CIDR format to exclude from the tunnel. If address is present, host must not be present.

Description stringOptional

A description of the Split Tunnel item, displayed in the client UI.

maxLength100

type SplitTunnelExcludeTeamsDevicesExcludeSplitTunnelWithHost struct{…}

Host string

The domain name to exclude from the tunnel. If host is present, address must not be present.

Description stringOptional

A description of the Split Tunnel item, displayed in the client UI.

maxLength100

ExcludeOfficeIPs boolOptional

Whether to add Microsoft IPs to Split Tunnel exclusions.

FallbackDomains []FallbackDomainOptional

Suffix string

The domain suffix to match when resolving locally.

Description stringOptional

A description of the fallback domain, displayed in the client UI.

maxLength100

DNSServer []stringOptional

A list of IP addresses to handle domain resolution.

GatewayUniqueID stringOptional

GlobalAcceleration SettingsPolicyGlobalAccelerationOptional

Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.

APIEndpoints []string

IP:port entries for the API endpoints.

Enabled bool

Global acceleration settings are used only when “enabled”.

MasqueEndpoints []string

IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.

WireguardEndpoints []string

IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.

Include []SplitTunnelIncludeOptional

List of routes included in the WARP client’s tunnel.

One of the following:

type SplitTunnelIncludeTeamsDevicesIncludeSplitTunnelWithAddress struct{…}

Address string

The address in CIDR format to include in the tunnel. If address is present, host must not be present.

Description stringOptional

A description of the Split Tunnel item, displayed in the client UI.

maxLength100

type SplitTunnelIncludeTeamsDevicesIncludeSplitTunnelWithHost struct{…}

Host string

The domain name to include in the tunnel. If host is present, address must not be present.

Description stringOptional

A description of the Split Tunnel item, displayed in the client UI.

maxLength100

LANAllowMinutes float64Optional

The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.

LANAllowSubnetSize float64Optional

The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.

Match stringOptional

The wirefilter expression to match devices. Available values: “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.service_token_uuid”, “identity.saml_attributes”, “network”, “os.name”, “os.version”.

maxLength500

Name stringOptional

The name of the device settings profile.

maxLength100

PolicyID stringOptional

maxLength36

Precedence float64Optional

The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.

RegisterInterfaceIPWithDNS boolOptional

Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.

SccmVpnBoundarySupport boolOptional

Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).

ServiceModeV2 SettingsPolicyServiceModeV2Optional

Mode stringOptional

The mode to run the WARP client under.

Port float64Optional

The port number when used with proxy mode.

SupportURL stringOptional

The URL to launch when the Send Feedback button is clicked.

SwitchLocked boolOptional

Whether to allow the user to turn off the WARP switch and disconnect the client.

TargetTests []SettingsPolicyTargetTestOptional

ID stringOptional

The id of the DEX test targeting this policy.

Name stringOptional

The name of the DEX test targeting this policy.

TunnelProtocol stringOptional

Determines which tunnel protocol to use.

VirtualNetworks SettingsPolicyVirtualNetworksOptional

Virtual network access settings for the device.

Allowed []string

List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.

Default string

The default virtual network ID. Must be included in the allowed list.

formatuuid

type SplitTunnelExclude interface{…}

One of the following:

type SplitTunnelExcludeTeamsDevicesExcludeSplitTunnelWithAddress struct{…}

Address string

The address in CIDR format to exclude from the tunnel. If address is present, host must not be present.

Description stringOptional

A description of the Split Tunnel item, displayed in the client UI.

maxLength100

type SplitTunnelExcludeTeamsDevicesExcludeSplitTunnelWithHost struct{…}

Host string

The domain name to exclude from the tunnel. If host is present, address must not be present.

Description stringOptional

A description of the Split Tunnel item, displayed in the client UI.

maxLength100

type SplitTunnelInclude interface{…}

One of the following:

type SplitTunnelIncludeTeamsDevicesIncludeSplitTunnelWithAddress struct{…}

Address string

The address in CIDR format to include in the tunnel. If address is present, host must not be present.

Description stringOptional

A description of the Split Tunnel item, displayed in the client UI.

maxLength100

type SplitTunnelIncludeTeamsDevicesIncludeSplitTunnelWithHost struct{…}

Host string

The domain name to include in the tunnel. If host is present, address must not be present.

Description stringOptional

A description of the Split Tunnel item, displayed in the client UI.

maxLength100

PoliciesDefault

Get the default device settings profile

client.ZeroTrust.Devices.Policies.Default.Get(ctx, query) (*DevicePolicyDefaultGetResponse, error)

GET/accounts/{account_id}/devices/policy

Update the default device settings profile

client.ZeroTrust.Devices.Policies.Default.Edit(ctx, params) (*DevicePolicyDefaultEditResponse, error)

PATCH/accounts/{account_id}/devices/policy

PoliciesDefaultExcludes

Get the Split Tunnel exclude list

client.ZeroTrust.Devices.Policies.Default.Excludes.Get(ctx, query) (*SinglePage[SplitTunnelExclude], error)

GET/accounts/{account_id}/devices/policy/exclude

Set the Split Tunnel exclude list

client.ZeroTrust.Devices.Policies.Default.Excludes.Update(ctx, params) (*SinglePage[SplitTunnelExclude], error)

PUT/accounts/{account_id}/devices/policy/exclude

PoliciesDefaultIncludes

Get the Split Tunnel include list

client.ZeroTrust.Devices.Policies.Default.Includes.Get(ctx, query) (*SinglePage[SplitTunnelInclude], error)

GET/accounts/{account_id}/devices/policy/include

Set the Split Tunnel include list

client.ZeroTrust.Devices.Policies.Default.Includes.Update(ctx, params) (*SinglePage[SplitTunnelInclude], error)

PUT/accounts/{account_id}/devices/policy/include

PoliciesDefaultFallback Domains

Get your Local Domain Fallback list

client.ZeroTrust.Devices.Policies.Default.FallbackDomains.Get(ctx, query) (*SinglePage[FallbackDomain], error)

GET/accounts/{account_id}/devices/policy/fallback_domains

Set your Local Domain Fallback list

client.ZeroTrust.Devices.Policies.Default.FallbackDomains.Update(ctx, params) (*SinglePage[FallbackDomain], error)

PUT/accounts/{account_id}/devices/policy/fallback_domains

PoliciesDefaultCertificates

Get device certificate provisioning status

client.ZeroTrust.Devices.Policies.Default.Certificates.Get(ctx, query) (*DevicePolicyCertificates, error)

GET/zones/{zone_id}/devices/policy/certificates

Update device certificate provisioning status

client.ZeroTrust.Devices.Policies.Default.Certificates.Edit(ctx, params) (*DevicePolicyCertificates, error)

PATCH/zones/{zone_id}/devices/policy/certificates

PoliciesCustom

List device settings profiles

client.ZeroTrust.Devices.Policies.Custom.List(ctx, query) (*SinglePage[SettingsPolicy], error)

GET/accounts/{account_id}/devices/policies

Get device settings profile by ID

client.ZeroTrust.Devices.Policies.Custom.Get(ctx, policyID, query) (*SettingsPolicy, error)

GET/accounts/{account_id}/devices/policy/{policy_id}

Create a device settings profile

client.ZeroTrust.Devices.Policies.Custom.New(ctx, params) (*SettingsPolicy, error)

POST/accounts/{account_id}/devices/policy

Update a device settings profile

client.ZeroTrust.Devices.Policies.Custom.Edit(ctx, policyID, params) (*SettingsPolicy, error)

PATCH/accounts/{account_id}/devices/policy/{policy_id}

Delete a device settings profile

client.ZeroTrust.Devices.Policies.Custom.Delete(ctx, policyID, body) (*SinglePage[SettingsPolicy], error)

DELETE/accounts/{account_id}/devices/policy/{policy_id}

PoliciesCustomExcludes

Get the Split Tunnel exclude list for a device settings profile

client.ZeroTrust.Devices.Policies.Custom.Excludes.Get(ctx, policyID, query) (*SinglePage[SplitTunnelExclude], error)

GET/accounts/{account_id}/devices/policy/{policy_id}/exclude

Set the Split Tunnel exclude list for a device settings profile

client.ZeroTrust.Devices.Policies.Custom.Excludes.Update(ctx, policyID, params) (*SinglePage[SplitTunnelExclude], error)

PUT/accounts/{account_id}/devices/policy/{policy_id}/exclude

PoliciesCustomIncludes

Get the Split Tunnel include list for a device settings profile

client.ZeroTrust.Devices.Policies.Custom.Includes.Get(ctx, policyID, query) (*SinglePage[SplitTunnelInclude], error)

GET/accounts/{account_id}/devices/policy/{policy_id}/include

Set the Split Tunnel include list for a device settings profile

client.ZeroTrust.Devices.Policies.Custom.Includes.Update(ctx, policyID, params) (*SinglePage[SplitTunnelInclude], error)

PUT/accounts/{account_id}/devices/policy/{policy_id}/include

PoliciesCustomFallback Domains

Get the Local Domain Fallback list for a device settings profile

client.ZeroTrust.Devices.Policies.Custom.FallbackDomains.Get(ctx, policyID, query) (*SinglePage[FallbackDomain], error)

GET/accounts/{account_id}/devices/policy/{policy_id}/fallback_domains

Set the Local Domain Fallback list for a device settings profile

client.ZeroTrust.Devices.Policies.Custom.FallbackDomains.Update(ctx, policyID, params) (*SinglePage[FallbackDomain], error)

PUT/accounts/{account_id}/devices/policy/{policy_id}/fallback_domains