securitycloud

type ActivationProfile struct {
	// Unique identifier code for the activation profile.
	Code string `json:"code"`
}

type ActivationProfileDeployRequest struct {
	// The device platform type for the configuration profile.
	// Allowed values: see the ActivationProfileDeployRequestPlatform constants.
	Platform string `json:"platform"`
	// The UEM platform to deploy profiles to.
	// Allowed values: see the ActivationProfileDeployRequestUem constants.
	Uem string `json:"uem"`
	// Optional UEM group IDs to scope the deployment to.
	// Group names are not accepted. These are the UEM's own group IDs — for Jamf Pro, obtain them from
	// the Jamf Pro API (`GET /v1/computer-groups`, `GET /v1/mobile-device-groups`). An ID is either bare
	// numeric (`"123"`) or device-type-prefixed (`"computer_123"`, `"mobile_456"`); a prefix, when
	// present, must match the device type the `platform` deploys to. IDs are scoped to a single UEM
	// instance.
	// Scoping is additive: the IDs are merged into the configuration profile's existing scope, so a later
	// deploy can widen the scope but cannot narrow or clear it. Omitting the field or sending an empty
	// array leaves any existing scope untouched — on the first deploy of a profile it means no group
	// scope is set, not that the profile is scoped to every group.
	UemGroups *[]string `json:"uemGroups,omitempty"`
}

type ActivationProfileDeployRequestPlatform = string

type ActivationProfileDeployRequestUem = string

type ActivationProfileResponse struct {
	// URL of the created activation profile.
	Href string `json:"href"`
	// Unique identifier code for the newly created activation profile.
	ID string `json:"id"`
}

type ActivationProfilesResponse struct {
	// List of activation profiles. Returns empty array if no profiles exist.
	ActivationProfiles []ActivationProfile `json:"activationProfiles"`
}

type ApiError struct {
	// The list of individual errors that occurred while processing the request.
	Errors []ApiErrorItem `json:"errors"`
	// HTTP status code of the response.
	HttpStatus int `json:"httpStatus"`
	// Trace identifier correlating the response with server-side logs. May be absent on infrastructure
	// errors such as bare 500/503.
	TraceID *string `json:"traceId,omitempty"`
}

type ApiErrorEntry struct {
	// Machine-readable error code.
	Code string `json:"code"`
	// Human-readable explanation.
	Description string `json:"description"`
	// The request field the error relates to, when applicable.
	Field *string `json:"field,omitempty"`
}

type ApiErrorErrorsItem struct {
	// Machine-readable error code.
	Code string `json:"code"`
	// Human-readable description for debugging. Do not display to end users.
	Description string `json:"description"`
	// Name of the field that caused the error, if applicable.
	Field string `json:"field"`
	// ID of the object with the error, if applicable.
	ID string `json:"id"`
}

type ApiErrorItem struct {
	// Error-specific code that can be used to identify a localization string, etc.
	// Allowed values: see the ApiErrorItemCode constants.
	Code string `json:"code"`
	// A general description of the error for troubleshooting and debugging. Generally this text should not
	// be displayed to a user; instead refer to the code and its localized text. May be null.
	Description *string `json:"description,omitempty"`
	// Name of the field that caused the error. Optional.
	Field *string `json:"field,omitempty"`
	// Identifier of the object with the error. Optional.
	ID *string `json:"id,omitempty"`
}

type ApiErrorItemCode = string

type App struct {
	// User/group assignment rules for an App.
	Assignments *Assignments `json:"assignments,omitempty"`
	// IPv4 CIDR subnets (e.g. `192.168.1.0/24`). Duplicating a subnet across Apps returns 409.
	BareIps []string `json:"bareIps"`
	// App category name. Must exactly match a `displayName` returned by `GET /v1/categories` (e.g.
	// `"Business & Industry"`) — that endpoint is the authoritative source. Unknown values return `409
	// MISSING_CATEGORY_NAME` — the category list is server-owned and may change, so an unrecognized name
	// is a state conflict, not a malformed request.
	CategoryName CategoryName `json:"categoryName"`
	// Per-group routing overrides that take precedence over the App's default routing. Each override's
	// `groupIds` must be a subset of `assignments.inclusions.groups` (or `allUsers: true`); references to
	// unassigned groups return `400`.
	GroupOverrides *GroupOverrides `json:"groupOverrides,omitempty"`
	// Hostnames/domains for traffic matching. Each entry must be a valid domain name, `"*"` (full-tunnel
	// wildcard), or a wildcard prefix (`"*.example.com"`). Overlapping entries are rejected — e.g.
	// `["*.example.com", "sub.example.com"]` returns `400` because `sub.example.com` is covered by
	// `*.example.com`. Duplicating a hostname across Apps returns `409`.
	Hostnames []string `json:"hostnames"`
	// App ID. Format: UUID (e.g. `3fa85f64-5717-4562-b3fc-2c963f66afa6`).
	ID string `json:"id"`
	// Null when `predefinedAppId` is set — the name is owned by the predefined app template. Present and
	// non-null when `predefinedAppId` is absent (custom app).
	Name *string `json:"name,omitempty"`
	// ID of the predefined SaaS app template (from `GET /predefined-apps`). Once set, cannot be changed or
	// removed. When set, `name` is null (owned by the template); additional `hostnames` can still be
	// appended.
	PredefinedAppID *string `json:"predefinedAppId,omitempty"`
	// Traffic routing configuration for an App.
	Routing *Routing `json:"routing,omitempty"`
	// Security controls applied to App traffic.
	Security *AppSecurity `json:"security,omitempty"`
}

type AppCreateRequest struct {
	// User/group assignment rules for an App.
	Assignments Assignments `json:"assignments"`
	// IPv4 CIDR subnets (e.g. `192.168.1.0/24`). Duplicating a subnet across Apps returns 409.
	BareIps *[]string `json:"bareIps,omitempty"`
	// App category name. Must exactly match a `displayName` returned by `GET /v1/categories` (e.g.
	// `"Business & Industry"`) — that endpoint is the authoritative source. Unknown values return `409
	// MISSING_CATEGORY_NAME` — the category list is server-owned and may change, so an unrecognized name
	// is a state conflict, not a malformed request.
	CategoryName CategoryName `json:"categoryName"`
	// Per-group routing overrides that take precedence over the App's default routing. Each override's
	// `groupIds` must be a subset of `assignments.inclusions.groups` (or `allUsers: true`); references to
	// unassigned groups return `400`.
	GroupOverrides *GroupOverrides `json:"groupOverrides,omitempty"`
	// Unique set of hostnames/domains. Each entry must be a valid domain name, `"*"`, or `"*.domain"`.
	// Overlapping entries (e.g. `["*.example.com", "sub.example.com"]`) return `400`. Specifying the same
	// hostname across multiple Apps returns `409`. When `predefinedAppId` is set, additional hostnames
	// extend the template set.
	Hostnames *[]string `json:"hostnames,omitempty"`
	// Required (non-null) when `predefinedAppId` is absent — `400` if missing or null. Must be null or
	// omitted when `predefinedAppId` is set.
	Name *string `json:"name,omitempty"`
	// Optional. ID from `GET /predefined-apps`. Once set, cannot be changed or removed. When set, `name`
	// must be null or omitted; additional `hostnames` can be appended. Presence indicates a Predefined
	// (SaaS) App; absence indicates a Custom (Enterprise) App.
	PredefinedAppID *string `json:"predefinedAppId,omitempty"`
	// Traffic routing configuration for an App.
	Routing Routing `json:"routing"`
	// Security controls applied to App traffic.
	Security *AppSecurity `json:"security,omitempty"`
}

type AppListResponse struct {
	Results []App `json:"results"`
	// Total number of items across all pages.
	TotalCount int `json:"totalCount"`
}

type AppPatchRequest struct {
	// User/group assignment rules for an App.
	Assignments *Assignments `json:"assignments,omitempty"`
	// Replaces the full bareIps list. IPv4 CIDR subnets (e.g. `192.168.1.0/24`).
	BareIps *[]string `json:"bareIps,omitempty"`
	// App category name. Must exactly match a `displayName` returned by `GET /v1/categories` (e.g.
	// `"Business & Industry"`) — that endpoint is the authoritative source. Unknown values return `409
	// MISSING_CATEGORY_NAME` — the category list is server-owned and may change, so an unrecognized name
	// is a state conflict, not a malformed request.
	CategoryName *CategoryName `json:"categoryName,omitempty"`
	// Per-group routing overrides that take precedence over the App's default routing. Each override's
	// `groupIds` must be a subset of `assignments.inclusions.groups` (or `allUsers: true`); references to
	// unassigned groups return `400`.
	GroupOverrides *GroupOverrides `json:"groupOverrides,omitempty"`
	// Replaces the full hostname list. Each entry must be a valid domain name, `"*"`, or `"*.domain"`.
	// Overlapping entries (e.g. `["*.example.com", "sub.example.com"]`) return `400`. Specifying the same
	// hostname as another App returns `409`.
	Hostnames *[]string `json:"hostnames,omitempty"`
	// New name. Must be non-empty — a blank string returns `400`. Ignored when `predefinedAppId` is set
	// (name is owned by the template). Omit to leave unchanged.
	Name *string `json:"name,omitempty"`
	// Traffic routing configuration for an App.
	Routing *Routing `json:"routing,omitempty"`
	// Security controls applied to App traffic.
	Security *AppSecurity `json:"security,omitempty"`
}

type AppSecurity struct {
	// Device management enrollment-based access control.
	DeviceManagementBasedAccess *DeviceManagementBasedAccess `json:"deviceManagementBasedAccess,omitempty"`
	// DNS-over-HTTPS integration settings for the App.
	DohIntegration *DohIntegration `json:"dohIntegration,omitempty"`
	// Risk-based access controls for the App.
	RiskControls *RiskControls `json:"riskControls,omitempty"`
}

type Assignments struct {
	// Inclusion rules controlling who can access the App.
	Inclusions AssignmentsInclusions `json:"inclusions"`
}

type AssignmentsInclusions struct {
	// `true` grants access to all users; `groups` array is then ignored.
	AllUsers bool `json:"allUsers"`
	// Device Group IDs (from the Device Groups API). Used when `allUsers` is `false`. When `allUsers:
	// false`, at least one group ID must be supplied — an empty `groups` array returns `400`.
	Groups *[]string `json:"groups,omitempty"`
}

type BulkDeleteActivationProfilesRequest struct {
	// Codes of the activation profiles to delete.
	Codes []string `json:"codes"`
}

type Category struct {
	// Human-readable label (e.g. `"Social"`). This is the value to pass as `categoryName` when creating or
	// updating an App — TRS validates `categoryName` against this field via
	// `ContentBlockServiceClient.getCategories()` which maps `Category::getDisplayName`.
	DisplayName string `json:"displayName"`
	// Unique category identifier.
	ID string `json:"id"`
	// Internal category name (e.g. `Category - Social`). Informational only — do not use as
	// `categoryName`; use `displayName`, which TRS validates against.
	Name string `json:"name"`
}

type CategoryListResponse struct {
	Results []Category `json:"results"`
	// Total number of content categories.
	TotalCount int `json:"totalCount"`
}

type CategoryName = string

type CipherSuiteConfig struct {
	// Diffie-Hellman group. Exactly one value.
	// Allowed values: see the CipherSuiteConfigDhGroups constants.
	DhGroups []string `json:"dhGroups"`
	// Encryption algorithm. Exactly one value.
	// Allowed values: see the CipherSuiteConfigEncryption constants.
	Encryption []string `json:"encryption"`
	// Integrity algorithm. Exactly one value.
	// Allowed values: see the CipherSuiteConfigIntegrity constants.
	Integrity []string `json:"integrity"`
	// Key lifetime in seconds (e.g. `28800` for IKE, `3600` for ESP).
	LifetimeInSec int64 `json:"lifetimeInSec"`
}

type CipherSuiteConfigDhGroups = string

type CipherSuiteConfigEncryption = string

type CipherSuiteConfigIntegrity = string

type CitrixCloudConfig struct {
	// Citrix Cloud API client (application) id.
	ApplicationID string `json:"applicationId"`
	// Citrix Cloud API client secret.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	ApplicationSecret string `json:"applicationSecret"`
	// Citrix Cloud customer id.
	CustomerID string `json:"customerId"`
	// Citrix Cloud API URL.
	URL string `json:"url"`
}

type CitrixCloudOauthConfig struct {
	// Citrix Cloud API client (application) id.
	ApplicationID string `json:"applicationId"`
	// Citrix Cloud API client secret.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	ApplicationSecret string `json:"applicationSecret"`
	// Citrix Cloud customer id.
	CustomerID string `json:"customerId"`
	// Citrix Cloud region — determines the API endpoint.
	// Allowed values: see the CitrixCloudOauthConfigRegion constants.
	Region string `json:"region"`
}

type CitrixCloudOauthConfigRegion = string

type Client struct {
	// contains filtered or unexported fields
}

type ConnectionConfigLeftRequest struct {
	// Endpoint address or `%any`.
	Host string `json:"host"`
	// IKE identity (e.g. `wpa.wandera.com` or `%any`).
	ID string `json:"id"`
	// Pre-shared key. Provide to set or rotate the secret. Omit to preserve the existing secret on PATCH
	// — it can only be rotated, never cleared. Sending `null` explicitly returns `400
	// IPSEC_SECRET_CLEAR_NOT_SUPPORTED`.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	Secret *string `json:"secret,omitempty"`
	// Jamf-side encryption domain. Must be a private (RFC1918) CIDR in one of the ranges above. Exactly 1
	// element.
	Subnets []string `json:"subnets"`
}

type ConnectionConfigLeftResponse struct {
	// Authentication method.
	// Allowed values: see the ConnectionConfigLeftResponseAuth constants.
	Auth string `json:"auth"`
	// Endpoint address.
	Host string `json:"host"`
	// IKE identity.
	ID string `json:"id"`
	// CIDR subnets.
	Subnets []string `json:"subnets"`
}

type ConnectionConfigLeftResponseAuth = string

type ConnectionConfigPatchLeftRequest struct {
	// Endpoint address or `%any`.
	Host *string `json:"host,omitempty"`
	// IKE identity (e.g. `wpa.wandera.com` or `%any`).
	ID *string `json:"id,omitempty"`
	// Pre-shared key. Provide to set or rotate the PSK. Omit to preserve the existing secret. Sending
	// `null` returns `400 IPSEC_SECRET_CLEAR_NOT_SUPPORTED`.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	Secret *string `json:"secret,omitempty"`
	// Jamf-side encryption domain. Must be a private (RFC1918) CIDR in one of the ranges above. Exactly 1
	// element.
	Subnets *[]string `json:"subnets,omitempty"`
}

type ConnectionConfigPatchRightRequest struct {
	// Endpoint address or `%any`.
	Host *string `json:"host,omitempty"`
	// IKE identity (e.g. `wpa.wandera.com` or `%any`).
	ID *string `json:"id,omitempty"`
	// CIDR subnets routed through this endpoint.
	Subnets *[]string `json:"subnets,omitempty"`
	// VPN vendor identifier of the remote peer. Case-sensitive.
	// Allowed values: see the ConnectionConfigPatchRightRequestVendor constants.
	Vendor *string `json:"vendor,omitempty"`
}

type ConnectionConfigPatchRightRequestVendor = string

type ConnectionConfigRightRequest struct {
	// Endpoint address.
	Host string `json:"host"`
	// IKE identity.
	ID string `json:"id"`
	// CIDR subnets routed through this endpoint (e.g. `0.0.0.0/0`).
	Subnets []string `json:"subnets"`
	// VPN vendor identifier of the remote peer. Case-sensitive. **Required**.
	// Allowed values: see the ConnectionConfigRightRequestVendor constants.
	Vendor string `json:"vendor"`
}

type ConnectionConfigRightRequestVendor = string

type ConnectionConfigRightResponse struct {
	// Authentication method.
	// Allowed values: see the ConnectionConfigRightResponseAuth constants.
	Auth string `json:"auth"`
	// Endpoint address.
	Host string `json:"host"`
	// IKE identity.
	ID string `json:"id"`
	// CIDR subnets.
	Subnets []string `json:"subnets"`
	// VPN vendor identifier of the remote peer.
	// Allowed values: see the ConnectionConfigRightResponseVendor constants.
	Vendor string `json:"vendor"`
}

type ConnectionConfigRightResponseAuth = string

type ConnectionConfigRightResponseVendor = string

type ConnectorConfig struct {
	// Whether this connector may sync concurrently with other connectors.
	ConcurrentSyncEnabled bool `json:"concurrentSyncEnabled"`
	// Whether the connector is currently connected to the UEM platform.
	Connected bool `json:"connected"`
	// Internal device-type discriminator for this connector's vendor.
	ConnectorDeviceTypeAlias string `json:"connectorDeviceTypeAlias"`
	// Identifier of the customer that owns this connector configuration.
	CustomerID string `json:"customerId"`
	// Controls which UEM attribute each JSC device field is populated from. Each value is an enum of UEM
	// attribute names whose members are vendor-specific, so the accepted values for a given key depend on
	// the connector's `vendor`. The Google connector accepts no mappings.
	DeviceFieldMappings *DeviceFieldMappings `json:"deviceFieldMappings,omitempty"`
	// Whether device risk levels are sent back to the UEM platform.
	DeviceRiskTagging bool `json:"deviceRiskTagging"`
	// Credentials the connector authenticates to the UEM instance with, as read back off a connector.
	// Restored from the wire (probed 2026-08-21, re-verified 2026-08-31) because the published spec omits
	// `deviceSyncAuth` from the *response* schema; the request side is upstream's own `JamfProCredentials`
	// as of v1882, which carries the same four members. Which of them apply depends on `authStrategy` —
	// OAuth strategies use `clientId`/`clientSecret`, basic-auth strategies use `username`/`password`.
	// Secrets are write-only and never returned; a read reports only `clientId`, `username` and an `empty`
	// flag, and for an `M2M`-provisioned connector the `clientId` is the one Jamf Security Cloud minted
	// for itself.
	DeviceSyncAuth *DeviceSyncAuth `json:"deviceSyncAuth,omitempty"`
	// Number of days since last check-in before a device is treated as unmanaged. `0` uses the platform
	// default (3 days). Not applicable for JAMF_PRO — any value sent for that vendor is silently ignored
	// (device status is taken exclusively from the UEM).
	// Allowed values: see the ConnectorConfigDeviceUnmanagedThreshold constants.
	DeviceUnmanagedThreshold int `json:"deviceUnmanagedThreshold"`
	// Whether the UEM platform supports receiving device tags from JSC.
	EmmTaggingSupported bool `json:"emmTaggingSupported"`
	// Whether the connector is enabled for synchronization.
	Enabled bool `json:"enabled"`
	// Group mapping configuration. Maps UEM groups to JSC groups.
	GroupSettings *GroupSettings `json:"groupSettings,omitempty"`
	// Unique identifier for the connector configuration.
	ID string `json:"id"`
	// ISO country code for the UEM instance, when applicable.
	IsoCountry *string `json:"isoCountry,omitempty"`
	// Summary of the connector's most recent sync run, embedded in `ConnectorConfig`. The containing
	// `latestSync` property is `null` until the connector has run its first sync.
	// This is **not** the same shape as the `SyncRun` entries returned by `GET
	// /connectors/{configId}/sync/runs`: it carries `lastSeen` and `errorDetails`, and has no per-run
	// device counters, because the connector record keeps only the current transaction's state and not its
	// tallies. Use the sync-runs endpoint for run history and counts.
	// `startedUtcMs` and `finishedUtcMs` are retained, deprecated epoch-millisecond duplicates of the
	// ISO-8601 `started` and `finished`. They are still emitted for existing consumers; new consumers
	// should read the ISO-8601 fields.
	LatestSync *LatestSync `json:"latestSync,omitempty"`
	// Timestamp of the next scheduled sync (ISO 8601).
	NextScheduledSync *time.Time `json:"nextScheduledSync,omitempty"`
	// Timestamp when the previous sync started (ISO 8601).
	PreviousSyncStart *time.Time `json:"previousSyncStart,omitempty"`
	// Sync refresh interval in minutes.
	// Allowed values: see the ConnectorConfigRefreshRateMinutes constants.
	RefreshRateMinutes int64 `json:"refreshRateMinutes"`
	// Whether scheduled sync is active.
	Scheduled bool `json:"scheduled"`
	// Sync configuration settings as returned in responses. Response-only: the corresponding update
	// request carries these two settings as **top-level** `autoDeviceDeletion` and
	// `disableSyncOnAuthError` fields on `SyncSettings`, not nested under `syncConfig`.
	SyncConfig *SyncConfig `json:"syncConfig,omitempty"`
	// Platform tenant identifier of the Jamf Pro instance this connector syncs with, when it was created
	// by naming one. Null for a connector created from caller-supplied credentials.
	// Load-bearing beyond information: `authStrategy` reads back as `JAMF_PRO_OAUTH` whichever way the
	// connector was created, so this field is the only thing in the response that distinguishes the two
	// forms. A consumer reconstructing a connector's configuration — Terraform importing one it did not
	// create, say — has nothing else to key on. Note that a tenant-named connector also reports a
	// `deviceSyncAuth.clientId`, the credential Jamf Security Cloud provisioned for itself, so the
	// presence of credentials cannot serve as the signal. Restored from the wire (probed 2026-08-28),
	// where the published spec omits it.
	TenantID *string `json:"tenantId"`
	// Version of the UEM instance the connector is talking to — for a Jamf Pro connector, the Jamf Pro
	// version. Reported by the connector rather than configured, and useful for surfacing what the
	// integration is actually connected to. Restored from the wire (probed 2026-08-28), where the
	// published spec omits it.
	UemVersion *string `json:"uemVersion"`
	// UEM server URL.
	URL string `json:"url"`
	// UEM vendor name.
	// Allowed values: see the ConnectorConfigVendor constants.
	Vendor string `json:"vendor"`
}

type ConnectorConfigDeviceUnmanagedThreshold = int

type ConnectorConfigRefreshRateMinutes = int64

type ConnectorConfigVendor = string

type ConnectorCreateRequestBody struct {
	// Allowed values: see the ConnectorCreateRequestBodyVendor constants.
	Vendor          string                                 `json:"vendor"`
	AIRWATCH        *WorkspaceOneConnectorCreateRequest    `json:"-"`
	GOOGLE          *GoogleConnectorCreateRequest          `json:"-"`
	INTUNE          *IntuneConnectorCreateRequest          `json:"-"`
	JAMFPRO         *JamfProConnectorCreateRequest         `json:"-"`
	JAMFSCHOOL      *JamfSchoolConnectorCreateRequest      `json:"-"`
	MAAS360         *Maas360ConnectorCreateRequest         `json:"-"`
	MOBILEIRONCLOUD *MobileIronCloudConnectorCreateRequest `json:"-"`
	MOBILEIRONCORE  *MobileIronCoreConnectorCreateRequest  `json:"-"`
	WIZY            *WizyConnectorCreateRequest            `json:"-"`
	XENMOBILE       *XenMobileConnectorCreateRequest       `json:"-"`
}

type ConnectorCreateRequestBodyVendor = string

type ConnectorPage struct {
	// The connectors for the requested page.
	Results []ConnectorConfig `json:"results"`
	// Total number of connectors across all pages.
	TotalCount int64 `json:"totalCount"`
}

type CreateGroupRequest struct {
	// Name of the group.
	Name string `json:"name"`
}

type CreateResponse struct {
	// Tenant-scoped path of the created resource.
	Href string `json:"href"`
	// ID of the created resource.
	ID string `json:"id"`
}

type CreatedResource struct {
	// Location of the created resource, as a path relative to the API base URL the request was made
	// against.
	// It is deliberately relative rather than absolute, and it does not repeat the tenant scope segment:
	// connector-service is customer-scoped downstream of the gateway and never receives the `tenantId` or
	// the external host, so it cannot construct the fully qualified tenant-scoped URL. Resolve it against
	// the same base URL — including the tenant scope prefix the publishing pipeline injects — that was
	// used for the `POST`.
	Href string `json:"href"`
	// Identifier of the created resource.
	ID string `json:"id"`
}

type DedicatedIps struct {
	// Whether dedicated egress IPs are provisioned for this gateway.
	Enabled bool `json:"enabled"`
	// Dedicated egress IPv4 addresses provisioned by the system. Present when `enabled: true` and
	// provisioning is complete.
	Ips *[]string `json:"ips,omitempty"`
}

type DeviceFieldMappings struct {
	// UEM attribute the device name is read from.
	DeviceNameMapping *string `json:"deviceNameMapping,omitempty"`
	// UEM attribute the phone number is read from.
	PhoneNumberMapping *string `json:"phoneNumberMapping,omitempty"`
	// How the device email is derived. `EMAIL_ADDRESS` uses the UEM email attribute directly; any other
	// type reads from that attribute and optionally decorates it into an address.
	// Vendors that support the `CUSTOM` type carry an additional `fieldName` property naming the UEM
	// attribute to read. It is not documented as a property here because the vendors that do not support
	// `CUSTOM` do not emit it at all, and ADG-125 requires every documented field to be present in every
	// response.
	UserEmailMapping *EmailMapping `json:"userEmailMapping,omitempty"`
	// UEM attribute the user identifier is read from.
	UserIDMapping *string `json:"userIdMapping,omitempty"`
	// UEM attribute the user name is read from.
	UserNameMapping *string `json:"userNameMapping,omitempty"`
}

type DeviceManagementBasedAccess struct {
	// Whether device management enrollment is required for access.
	Enabled bool `json:"enabled"`
	// Whether to notify users when access is blocked due to unenrolled device.
	NotificationsEnabled bool `json:"notificationsEnabled"`
}

type DeviceSyncAuth struct {
	// OAuth client ID. For `JAMF_PRO_OAUTH`, the client ID of an API integration on the target Jamf Pro
	// instance.
	ClientID string `json:"clientId"`
	// OAuth client secret paired with `clientId`. Write-only — never returned on a read.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	ClientSecret string `json:"clientSecret"`
	// Password paired with `username`. Write-only — never returned on a read.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	Password string `json:"password"`
	// Username, for the basic-auth strategies.
	Username string `json:"username"`
}

type DohIntegration struct {
	// Whether DoH traffic is blocked for this App.
	Blocking bool `json:"blocking"`
	// Whether to notify users when DoH traffic is blocked.
	NotificationsEnabled bool `json:"notificationsEnabled"`
}

type EmailMapping struct {
	// Prepended to the resolved value. Ignored when `type` is `EMAIL_ADDRESS`.
	FieldPrefix *string `json:"fieldPrefix,omitempty"`
	// Appended to the resolved value to form a full address; an `@` is inserted when the suffix does not
	// already start with one. Ignored when `type` is `EMAIL_ADDRESS`.
	FieldSuffix *string `json:"fieldSuffix,omitempty"`
	// UEM attribute the email is derived from.
	// Allowed values: see the EmailMappingType constants.
	Type string `json:"type"`
	// Apply this mapping only when the UEM email attribute is empty, rather than always.
	UseOnlyIfEmailMissing *bool `json:"useOnlyIfEmailMissing,omitempty"`
}

type EmailMappingType = string

type EnablementRequest struct {
	// Whether the connector should be enabled for synchronization.
	Enabled bool `json:"enabled"`
}

type Gateway struct {
	// Public IPv4 addresses of the availability zone nodes (e.g. `18.202.42.169`). Must belong to the
	// gateway's datacenter region. Note: despite the field name, values are IPv4 addresses — not zone
	// identifier strings.
	// For **IPsec gateways**, these are the source addresses the peer firewall must allow. Valid IPs per
	// datacenter:
	// | Datacenter | Name | IP 1 | IP 2 |
	// |---|---|---|---|
	// | `af-south-1` | Africa - Cape Town | `13.244.169.182` | `13.246.106.52` |
	// | `ap-east-1` | Asia - Hong Kong | `16.163.54.105` | `16.163.15.242` |
	// | `ap-northeast-1` | Asia - Japan | `35.76.189.152` | `52.192.166.230` |
	// | `ap-south-1` | Asia - Mumbai | `3.109.252.176` | `65.1.247.99` |
	// | `ap-southeast-1` | Asia - Singapore | `18.140.158.235` | `52.77.139.71` |
	// | `ap-southeast-2` | Australia | `54.66.243.182` | `13.238.46.250` |
	// | `ca-central-1` | North America - Canada | `15.222.200.189` | `3.98.80.44` |
	// | `eu-central-1` | Europe - Germany | `3.66.107.208` | `3.121.43.105` |
	// | `eu-west-1` | Europe - Ireland | `54.220.161.57` | `18.202.42.169` |
	// | `eu-west-2` | Europe - UK | `3.9.67.90` | `18.130.213.235` |
	// | `sa-east-1` | South America - Brazil | `54.207.180.94` | `54.232.123.56` |
	// | `us-east-1` | North America - USA East | `163.123.175.1` | `163.123.175.2` |
	// | `us-west-2` | North America - USA West | `163.123.174.1` | `163.123.174.2` |
	AvailabilityZones []string `json:"availabilityZones"`
	// Operational contact for this gateway.
	Contact *GatewayContact `json:"contact,omitempty"`
	// Datacenter this gateway is deployed to (e.g. `eu-west-1`). Can be changed on PATCH — triggers
	// re-provisioning; `availabilityZones` must match the new datacenter prefix (returns `400` on
	// mismatch).
	// Allowed values: see the GatewayDatacenter constants.
	Datacenter string `json:"datacenter"`
	// Dedicated egress IP configuration.
	DedicatedIps *DedicatedIps `json:"dedicatedIps,omitempty"`
	// Whether this deployment is active.
	Enabled bool `json:"enabled"`
	// Gateway ID. Format: 4-character lowercase hexadecimal string (e.g. `a1b2`).
	ID string `json:"id"`
	// IPSec tunnel configuration returned on GET. Secrets are never included in responses.
	Ipsec *GatewayIpSec `json:"ipsec,omitempty"`
	// Human-readable name.
	Name string `json:"name"`
	// Read-only operational status of the gateway. Always present — `PENDING` on creation (or `DISABLED`
	// if `enabled: false`), then updated as infrastructure is provisioned.
	Status *GatewayStatus `json:"status,omitempty"`
	// Tenant IDs that have access to this gateway.
	TenantIds []string `json:"tenantIds"`
}

type GatewayContact struct {
	// Contact email address.
	Email string `json:"email"`
	// Contact name or team name.
	Name string `json:"name"`
}

type GatewayCreateRequest struct {
	// Public IPv4 addresses of the availability zone nodes to deploy into (e.g. `18.202.42.169`). Must
	// belong to the gateway's datacenter region. Must be empty when `dedicatedIps.enabled: true`. Note:
	// despite the field name, values are IPv4 addresses — not zone identifier strings.
	// For **IPsec gateways**, these are the source addresses the peer firewall must allow. Valid IPs per
	// datacenter:
	// | Datacenter | Name | IP 1 | IP 2 |
	// |---|---|---|---|
	// | `af-south-1` | Africa - Cape Town | `13.244.169.182` | `13.246.106.52` |
	// | `ap-east-1` | Asia - Hong Kong | `16.163.54.105` | `16.163.15.242` |
	// | `ap-northeast-1` | Asia - Japan | `35.76.189.152` | `52.192.166.230` |
	// | `ap-south-1` | Asia - Mumbai | `3.109.252.176` | `65.1.247.99` |
	// | `ap-southeast-1` | Asia - Singapore | `18.140.158.235` | `52.77.139.71` |
	// | `ap-southeast-2` | Australia | `54.66.243.182` | `13.238.46.250` |
	// | `ca-central-1` | North America - Canada | `15.222.200.189` | `3.98.80.44` |
	// | `eu-central-1` | Europe - Germany | `3.66.107.208` | `3.121.43.105` |
	// | `eu-west-1` | Europe - Ireland | `54.220.161.57` | `18.202.42.169` |
	// | `eu-west-2` | Europe - UK | `3.9.67.90` | `18.130.213.235` |
	// | `sa-east-1` | South America - Brazil | `54.207.180.94` | `54.232.123.56` |
	// | `us-east-1` | North America - USA East | `163.123.175.1` | `163.123.175.2` |
	// | `us-west-2` | North America - USA West | `163.123.174.1` | `163.123.174.2` |
	AvailabilityZones *[]string `json:"availabilityZones,omitempty"`
	// Operational contact for this gateway.
	Contact GatewayContact `json:"contact"`
	// Target datacenter identifier (e.g. `eu-west-1`).
	// Allowed values: see the GatewayCreateRequestDatacenter constants.
	Datacenter string `json:"datacenter"`
	// Dedicated egress IP configuration.
	DedicatedIps *DedicatedIps `json:"dedicatedIps,omitempty"`
	// Whether the deployment should be active on creation.
	Enabled *bool `json:"enabled,omitempty"`
	// IPSec tunnel configuration for POST requests. All fields required. `left.secret` sets the pre-shared
	// key — it is automatically applied to both tunnel endpoints.
	Ipsec *GatewayIpSecRequest `json:"ipsec,omitempty"`
	// Human-readable name.
	Name string `json:"name"`
	// Tenant IDs to grant access. Validated against the caller's organization — **403** if mismatched.
	TenantIds []string `json:"tenantIds"`
}

type GatewayCreateRequestDatacenter = string

type GatewayDatacenter = string

type GatewayIpSec struct {
	// Cipher suite configuration for an IKE or ESP phase.
	Esp *CipherSuiteConfig `json:"esp,omitempty"`
	// Cipher suite configuration for an IKE or ESP phase.
	Ike *CipherSuiteConfig `json:"ike,omitempty"`
	// IKE version.
	// Allowed values: see the GatewayIpSecKeyExchange constants.
	KeyExchange string `json:"keyExchange"`
	// IPSec Jamf-side endpoint returned on GET. Secrets are never included.
	Left *ConnectionConfigLeftResponse `json:"left,omitempty"`
	// IPSec remote-peer endpoint returned on GET. Secrets are never included.
	Right *ConnectionConfigRightResponse `json:"right,omitempty"`
}

type GatewayIpSecKeyExchange = string

type GatewayIpSecPatchRequest struct {
	// Cipher suite configuration for an IKE or ESP phase.
	Esp *CipherSuiteConfig `json:"esp,omitempty"`
	// Cipher suite configuration for an IKE or ESP phase.
	Ike *CipherSuiteConfig `json:"ike,omitempty"`
	// IKE version.
	// Allowed values: see the GatewayIpSecPatchRequestKeyExchange constants.
	KeyExchange *string `json:"keyExchange,omitempty"`
	// IPSec connection endpoint for PATCH `left`. All fields optional — supply only the fields to
	// update. `secret` is write-only; omit to preserve the existing PSK; sending `null` returns `400
	// IPSEC_SECRET_CLEAR_NOT_SUPPORTED`.
	Left *ConnectionConfigPatchLeftRequest `json:"left,omitempty"`
	// IPSec connection endpoint for PATCH `right` (remote peer). The secret is always derived from
	// `left.secret` — callers never supply it here.
	Right *ConnectionConfigPatchRightRequest `json:"right,omitempty"`
}

type GatewayIpSecPatchRequestKeyExchange = string

type GatewayIpSecRequest struct {
	// Cipher suite configuration for an IKE or ESP phase.
	Esp CipherSuiteConfig `json:"esp"`
	// Cipher suite configuration for an IKE or ESP phase.
	Ike CipherSuiteConfig `json:"ike"`
	// IKE version.
	// Allowed values: see the GatewayIpSecRequestKeyExchange constants.
	KeyExchange string `json:"keyExchange"`
	// IPSec connection endpoint for write requests. Includes the `secret` field. `secret` is write-only
	// — it is never returned in GET responses.
	Left ConnectionConfigLeftRequest `json:"left"`
	// IPSec connection endpoint for the `right` (remote peer) side. The secret is derived automatically
	// from `left.secret` — callers never supply it here. `vendor` is **required** — use the peer's VPN
	// vendor identifier (e.g. `cisco`, `strongSwan`, `juniper`).
	Right ConnectionConfigRightRequest `json:"right"`
}

type GatewayIpSecRequestKeyExchange = string

type GatewayListResponse struct {
	Results []Gateway `json:"results"`
	// Total number of items across all pages.
	TotalCount int `json:"totalCount"`
}

type GatewayPatchRequest struct {
	// Replaces the availability zone node list. Accepts public IPv4 addresses (e.g. `18.202.42.169`).
	// Zones must belong to the (new or existing) datacenter.
	// For **IPsec gateways**, these are the source addresses the peer firewall must allow. Valid IPs per
	// datacenter:
	// | Datacenter | Name | IP 1 | IP 2 |
	// |---|---|---|---|
	// | `af-south-1` | Africa - Cape Town | `13.244.169.182` | `13.246.106.52` |
	// | `ap-east-1` | Asia - Hong Kong | `16.163.54.105` | `16.163.15.242` |
	// | `ap-northeast-1` | Asia - Japan | `35.76.189.152` | `52.192.166.230` |
	// | `ap-south-1` | Asia - Mumbai | `3.109.252.176` | `65.1.247.99` |
	// | `ap-southeast-1` | Asia - Singapore | `18.140.158.235` | `52.77.139.71` |
	// | `ap-southeast-2` | Australia | `54.66.243.182` | `13.238.46.250` |
	// | `ca-central-1` | North America - Canada | `15.222.200.189` | `3.98.80.44` |
	// | `eu-central-1` | Europe - Germany | `3.66.107.208` | `3.121.43.105` |
	// | `eu-west-1` | Europe - Ireland | `54.220.161.57` | `18.202.42.169` |
	// | `eu-west-2` | Europe - UK | `3.9.67.90` | `18.130.213.235` |
	// | `sa-east-1` | South America - Brazil | `54.207.180.94` | `54.232.123.56` |
	// | `us-east-1` | North America - USA East | `163.123.175.1` | `163.123.175.2` |
	// | `us-west-2` | North America - USA West | `163.123.174.1` | `163.123.174.2` |
	AvailabilityZones *[]string `json:"availabilityZones,omitempty"`
	// Operational contact for this gateway.
	Contact *GatewayContact `json:"contact,omitempty"`
	// New datacenter for this deployment (e.g. `eu-central-1`). When changed, `availabilityZones` must
	// match the new datacenter prefix — returns `400` on mismatch. **Destructive:** triggers
	// re-provisioning, connectivity outage, and immediate `status.state` reset to `PENDING`.
	// `dedicatedIps.ips` remain stale until VSC completes provisioning in the new datacenter.
	// Allowed values: see the GatewayPatchRequestDatacenter constants.
	Datacenter *string `json:"datacenter,omitempty"`
	// Whether the deployment should be active.
	Enabled *bool `json:"enabled,omitempty"`
	// Partial IPSec configuration for PATCH. All fields optional — fields are deep-merged. Supply only
	// `left.secret` to rotate the pre-shared key, or the full block to replace cipher suites and endpoint
	// addresses simultaneously. `right.secret` is derived automatically from `left.secret` — callers
	// never set it directly.
	Ipsec *GatewayIpSecPatchRequest `json:"ipsec,omitempty"`
	// New name for the gateway.
	Name *string `json:"name,omitempty"`
	// Replaces the full tenantIds list. Validated against the caller's organization — **403** if
	// mismatched. Setting `tenantIds: []` (empty array) returns `400` — `minItems: 1` enforced by
	// schema.
	TenantIds *[]string `json:"tenantIds,omitempty"`
}

type GatewayPatchRequestDatacenter = string

type GatewayStatus struct {
	// Composite status derived from infrastructure and tunnel health. `PENDING` — gateway is being
	// provisioned. `UP` — gateway is fully operational. `DOWN` — gateway is unreachable or degraded.
	// `DISABLED` — gateway has `enabled: false`.
	// Allowed values: see the GatewayStatusState constants.
	State string `json:"state"`
	// IPSec tunnel health. Present only when the gateway has an IPSec configuration. `null` for non-IPSec
	// gateways or before VSC reports the first tunnel status.
	// Allowed values: see the GatewayStatusTunnelState constants.
	TunnelState *string `json:"tunnelState,omitempty"`
	// Timestamp of the last status update.
	UpdatedAt time.Time `json:"updatedAt"`
}

type GatewayStatusState = string

type GatewayStatusTunnelState = string

type GoogleApiSettings struct {
	// OAuth client id.
	ClientID string `json:"clientId"`
	// OAuth client secret.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	ClientSecret *string `json:"clientSecret,omitempty"`
}

type GoogleConnectorCreateRequest struct {
	// OAuth client credentials for the Google API.
	ApiSettings *GoogleApiSettings `json:"apiSettings,omitempty"`
	// Override for the Google authentication URL.
	AuthURL *string `json:"authUrl,omitempty"`
	// ISO country code for the UEM instance, when applicable.
	IsoCountry *string `json:"isoCountry,omitempty"`
	// Google API URL.
	URL string `json:"url"`
	// UEM vendor discriminator.
	// Allowed values: see the GoogleConnectorCreateRequestVendor constants.
	Vendor string `json:"vendor"`
}

type GoogleConnectorCreateRequestVendor = string

type Group struct {
	// Unique group identifier.
	ID string `json:"id"`
	// Display name of the group.
	Name string `json:"name"`
}

type GroupListItem struct {
	// Unique group identifier. Omitted for the implicit "Default Group" entry, which is not a stored
	// group.
	ID string `json:"id"`
	// Display name of the group.
	Name string `json:"name"`
}

type GroupListResponseV2 struct {
	// Device groups belonging to the customer. Always contains at least the implicit "Default Group"
	// entry.
	Groups []GroupListItem `json:"groups"`
}

type GroupMapping struct {
	// Group ID in the UEM platform. Group names are not accepted.
	// For Jamf Pro the device-type prefix is **required** here — `computer_<id>` or `mobile_<id>` —
	// unlike `ActivationProfileDeployRequest.uemGroups`, where a bare numeric ID is also accepted. A value
	// without the prefix is rejected.
	EmmGroupID string `json:"emmGroupId"`
	// JSC group identifier devices in the UEM group are assigned to.
	WanderaGroupID string `json:"wanderaGroupId"`
}

type GroupOverrides struct {
	RoutingOverrides *[]RoutingOverride `json:"routingOverrides,omitempty"`
}

type GroupSettings struct {
	// JSC group that devices are assigned to when no explicit mapping matches.
	DefaultGroupID *string `json:"defaultGroupId,omitempty"`
	// Whether group mapping is applied during sync.
	GroupMappingEnabled *bool `json:"groupMappingEnabled,omitempty"`
	// Explicit UEM-group-to-JSC-group assignments. Replaces the existing set on update; send an empty
	// array to clear all mappings.
	GroupMappings *[]GroupMapping `json:"groupMappings,omitempty"`
}

type GroupedGateway struct {
	// When the Grouped Gateway was created.
	CreatedAt time.Time `json:"createdAt"`
	// IDs of member Gateways (minimum 2). Discover via `GET /gateways`. All members must be dedicated
	// gateways (not from `GET /shared-gateways`), must have the same tunnel type (all IPSec or all
	// non-IPSec), and the same `dedicatedIps.enabled` value — `422` on violation.
	GatewayIds []string `json:"gatewayIds"`
	// Grouped Gateway ID. Format: UUID (e.g. `3fa85f64-5717-4562-b3fc-2c963f66afa6`).
	ID string `json:"id"`
	// Human-readable name.
	Name string `json:"name"`
	// Recovery delay in seconds for the `ACTIVE_STANDBY` strategy — how long to wait before failing back
	// to the primary after it recovers. New and updated grouped gateways use one of the supported
	// durations (`300`, `1800`, `3600`, `10800`, `28800`); grouped gateways created earlier may return a
	// legacy value. Ignored for `RANDOM` and `NEAREST` strategies.
	RecoveryDelayInSec int `json:"recoveryDelayInSec"`
	// `ACTIVE_STANDBY` — traffic goes to the primary gateway; failover to secondary on failure. `RANDOM`
	// — traffic is distributed randomly across gateways. `NEAREST` — traffic routes to the
	// geographically closest gateway.
	RoutingStrategy RoutingStrategy `json:"routingStrategy"`
	// Tenant IDs with access to this grouped gateway.
	TenantIds []string `json:"tenantIds"`
	// Last update to the Grouped Gateway.
	UpdatedAt time.Time `json:"updatedAt"`
}

type GroupedGatewayCreateRequest struct {
	// IDs of member Gateways (minimum 2).
	GatewayIds []string `json:"gatewayIds"`
	// Human-readable name.
	Name string `json:"name"`
	// Required gateway stability before failover, in seconds, for the `ACTIVE_STANDBY` strategy. Must be
	// one of the listed durations (mirrors the Jamf console). Required on create even for
	// `RANDOM`/`NEAREST`, where it is ignored.
	// Allowed values: see the GroupedGatewayCreateRequestRecoveryDelayInSec constants.
	RecoveryDelayInSec int `json:"recoveryDelayInSec"`
	// `ACTIVE_STANDBY` — traffic goes to the primary gateway; failover to secondary on failure. `RANDOM`
	// — traffic is distributed randomly across gateways. `NEAREST` — traffic routes to the
	// geographically closest gateway.
	RoutingStrategy RoutingStrategy `json:"routingStrategy"`
	// Tenant IDs to grant access. Validated against the caller's organization — **403** if mismatched.
	TenantIds []string `json:"tenantIds"`
}

type GroupedGatewayCreateRequestRecoveryDelayInSec = int

type GroupedGatewayListResponse struct {
	Results []GroupedGateway `json:"results"`
	// Total number of items across all pages.
	TotalCount int `json:"totalCount"`
}

type GroupedGatewayPatchRequest struct {
	// Replaces the full member gateway list (minimum 2).
	GatewayIds *[]string `json:"gatewayIds,omitempty"`
	// New name for the grouped gateway.
	Name *string `json:"name,omitempty"`
	// Recovery delay in seconds for the `ACTIVE_STANDBY` strategy. If provided, must be one of the listed
	// durations. Omit to leave unchanged. Grouped gateways created before this constraint may hold a
	// legacy value; `recoveryDelayInSec` is unaffected on PATCH operations that omit it.
	// Allowed values: see the GroupedGatewayPatchRequestRecoveryDelayInSec constants.
	RecoveryDelayInSec *int `json:"recoveryDelayInSec,omitempty"`
	// `ACTIVE_STANDBY` — traffic goes to the primary gateway; failover to secondary on failure. `RANDOM`
	// — traffic is distributed randomly across gateways. `NEAREST` — traffic routes to the
	// geographically closest gateway.
	RoutingStrategy *RoutingStrategy `json:"routingStrategy,omitempty"`
	// Replaces the full tenantIds list. Validated against the caller's organization — **403** if
	// mismatched. Setting `tenantIds: []` (empty array) returns `400` — `minItems: 1` enforced by
	// schema.
	TenantIds *[]string `json:"tenantIds,omitempty"`
}

type GroupedGatewayPatchRequestRecoveryDelayInSec = int

type IntuneApiCredentials struct {
	// OAuth client (application) id.
	ClientID string `json:"clientId"`
	// OAuth client secret.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	ClientSecret *string `json:"clientSecret,omitempty"`
}

type IntuneConnectorCreateRequest struct {
	// Override for the Microsoft Graph authentication URL.
	GraphAuthURL *string `json:"graphAuthUrl,omitempty"`
	// Override for the Microsoft Graph API URL.
	GraphURL *string `json:"graphUrl,omitempty"`
	// ISO country code for the UEM instance, when applicable.
	IsoCountry *string `json:"isoCountry,omitempty"`
	// OAuth client credentials for a single Intune API.
	Lcm *IntuneApiCredentials `json:"lcm,omitempty"`
	// OAuth client credentials for a single Intune API.
	Mtd *IntuneApiCredentials `json:"mtd,omitempty"`
	// Override for the Mobile Threat Defense API URL.
	MtdURL *string `json:"mtdUrl,omitempty"`
	// Override for the authentication URL of the non-Graph Intune APIs.
	OtherApisAuthURL *string `json:"otherApisAuthUrl,omitempty"`
	// OAuth client credentials for a single Intune API.
	Tag *IntuneApiCredentials `json:"tag,omitempty"`
	// Intune (Microsoft Graph) server URL.
	URL string `json:"url"`
	// UEM vendor discriminator.
	// Allowed values: see the IntuneConnectorCreateRequestVendor constants.
	Vendor string `json:"vendor"`
}

type IntuneConnectorCreateRequestVendor = string

type JamfProConnectorCreateRequest struct {
	// Authentication strategy used to connect to Jamf Pro. See the schema description for the fields each
	// strategy requires.
	// Allowed values: see the JamfProConnectorCreateRequestAuthStrategy constants.
	AuthStrategy string `json:"authStrategy"`
	// Jamf Pro connection credentials. Provide the OAuth pair (`clientId` + `clientSecret`) when
	// `authStrategy` is `JAMF_PRO_OAUTH`, or the basic pair (`username` + `password`) when `authStrategy`
	// is `BASIC`. Omit entirely for `M2M`.
	DeviceSyncAuth *JamfProCredentials `json:"deviceSyncAuth,omitempty"`
	// ISO country code for the UEM instance, when applicable.
	IsoCountry *string `json:"isoCountry,omitempty"`
	// Jamf Pro tenant identifier. Required when `authStrategy` is `M2M`; must be omitted for the other
	// strategies.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	TenantID *string `json:"tenantId,omitempty"`
	// Jamf Pro server URL.
	URL string `json:"url"`
	// UEM vendor discriminator.
	// Allowed values: see the JamfProConnectorCreateRequestVendor constants.
	Vendor string `json:"vendor"`
}

type JamfProConnectorCreateRequestAuthStrategy = string

type JamfProConnectorCreateRequestVendor = string

type JamfProCredentials struct {
	// Jamf Pro API-role OAuth client id (JAMF_PRO_OAUTH strategy).
	ClientID *string `json:"clientId,omitempty"`
	// Jamf Pro API-role OAuth client secret (JAMF_PRO_OAUTH strategy).
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	ClientSecret *string `json:"clientSecret,omitempty"`
	// Jamf Pro password (BASIC strategy).
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	Password *string `json:"password,omitempty"`
	// Jamf Pro username (BASIC strategy).
	Username *string `json:"username,omitempty"`
}

type JamfSchoolConnectorCreateRequest struct {
	// Jamf School API key.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	ApiKey string `json:"apiKey"`
	// ISO country code for the UEM instance, when applicable.
	IsoCountry *string `json:"isoCountry,omitempty"`
	// Jamf School network id.
	NetworkID string `json:"networkId"`
	// Jamf School server URL.
	URL string `json:"url"`
	// UEM vendor discriminator.
	// Allowed values: see the JamfSchoolConnectorCreateRequestVendor constants.
	Vendor string `json:"vendor"`
}

type JamfSchoolConnectorCreateRequestVendor = string

type LatestSync struct {
	// Why the most recent sync failed. Always present, with null members when the sync did not fail.
	ErrorDetails *SyncErrorDetails `json:"errorDetails,omitempty"`
	// Timestamp when sync completed (ISO 8601), null if still running.
	Finished *time.Time `json:"finished,omitempty"`
	// `finished` as epoch milliseconds. Deprecated duplicate — prefer the ISO-8601 `finished`.
	FinishedUtcMs *int64 `json:"finishedUtcMs,omitempty"`
	// Timestamp of the last progress heartbeat from the running sync (ISO 8601), used to detect stalled
	// syncs.
	LastSeen *time.Time `json:"lastSeen,omitempty"`
	// What triggered this sync.
	// Allowed values: see the LatestSyncRefreshType constants.
	RefreshType *string `json:"refreshType,omitempty"`
	// Timestamp when sync started (ISO 8601).
	Started *time.Time `json:"started,omitempty"`
	// `started` as epoch milliseconds. Deprecated duplicate — prefer the ISO-8601 `started`.
	StartedUtcMs *int64 `json:"startedUtcMs,omitempty"`
	// Current sync status.
	// Allowed values: see the LatestSyncStatus constants.
	Status string `json:"status"`
	// Unique identifier for this sync run. Always present when `latestSync` itself is present: it is the
	// identifier of the underlying sync transaction, and the whole object is null when there is no
	// transaction.
	TransactionID string `json:"transactionId"`
}

type LatestSyncRefreshType = string

type LatestSyncStatus = string

type Maas360ConnectorCreateRequest struct {
	// MaaS360 application access key.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	AppAccessKey string `json:"appAccessKey"`
	// MaaS360 registered application id.
	AppID string `json:"appId"`
	// MaaS360 registered application version.
	AppVersion string `json:"appVersion"`
	// MaaS360 billing (account) id.
	BillingID string `json:"billingId"`
	// MaaS360 API password.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	EmmPassword string `json:"emmPassword"`
	// MaaS360 API username.
	EmmUsername string `json:"emmUsername"`
	// ISO country code for the UEM instance, when applicable.
	IsoCountry *string `json:"isoCountry,omitempty"`
	// MaaS360 server URL.
	URL string `json:"url"`
	// UEM vendor discriminator.
	// Allowed values: see the Maas360ConnectorCreateRequestVendor constants.
	Vendor string `json:"vendor"`
}

type Maas360ConnectorCreateRequestVendor = string

type Mapping struct {
	// IPv4 (A record) addresses the hostname resolves to. May be null or absent when no IPv4 records are
	// configured. Maximum 10 entries.
	ARecords *[]string `json:"aRecords,omitempty"`
	// IPv6 (AAAA record) addresses the hostname resolves to. May be null or absent when no IPv6 records
	// are configured. Maximum 10 entries.
	AaaaRecords *[]string `json:"aaaaRecords,omitempty"`
	// The fully qualified hostname this mapping applies to.
	Hostname string `json:"hostname"`
	// Whether Secure DNS (DoH/DoT) is enabled for this mapping.
	SecureDns *bool `json:"secureDns,omitempty"`
	// Whether this mapping is routed through Zero Trust Network Access (ZTNA).
	Ztna *bool `json:"ztna,omitempty"`
}

type MappingList struct {
	// The custom hostname mappings. Contains at most 500 entries.
	Results []Mapping `json:"results"`
	// Total number of custom hostname mappings returned.
	TotalCount int `json:"totalCount"`
}

type MobileIronCloudConnectorCreateRequest struct {
	// MobileIron Cloud API password.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	EmmPassword string `json:"emmPassword"`
	// MobileIron Cloud API username.
	EmmUsername string `json:"emmUsername"`
	// ISO country code for the UEM instance, when applicable.
	IsoCountry *string `json:"isoCountry,omitempty"`
	// MobileIron Cloud server URL.
	URL string `json:"url"`
	// UEM vendor discriminator.
	// Allowed values: see the MobileIronCloudConnectorCreateRequestVendor constants.
	Vendor string `json:"vendor"`
}

type MobileIronCloudConnectorCreateRequestVendor = string

type MobileIronCoreConnectorCreateRequest struct {
	// MobileIron Core API password.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	EmmPassword string `json:"emmPassword"`
	// MobileIron Core API username.
	EmmUsername string `json:"emmUsername"`
	// ISO country code for the UEM instance, when applicable.
	IsoCountry *string `json:"isoCountry,omitempty"`
	// Optional PEM-encoded root certificate for TLS verification.
	RootCertificate *string `json:"rootCertificate,omitempty"`
	// MobileIron Core server URL.
	URL string `json:"url"`
	// UEM vendor discriminator.
	// Allowed values: see the MobileIronCoreConnectorCreateRequestVendor constants.
	Vendor string `json:"vendor"`
}

type MobileIronCoreConnectorCreateRequestVendor = string

type NameServer struct {
	// Public identifier for the gateway. This is the public-facing name for the internal route identifier.
	GatewayID string `json:"gatewayId"`
	// IPv4 address of the name server.
	IP string `json:"ip"`
}

type PredefinedApp struct {
	// Hostnames inherited by Apps that reference this template.
	Hostnames []string `json:"hostnames"`
	// Template ID. Pass as `predefinedAppId` when creating an App.
	ID string `json:"id"`
	// Display name of the predefined SaaS application.
	Name string `json:"name"`
}

type PredefinedAppListResponse struct {
	Results []PredefinedApp `json:"results"`
	// Total number of predefined app templates available.
	TotalCount int `json:"totalCount"`
}

type PublicApiCapabilities struct {
	// Enable data policy capability.
	DataPolicy *bool `json:"dataPolicy,omitempty"`
	// Enable network security capability.
	NetworkSecurity *bool `json:"networkSecurity,omitempty"`
	// Optional note for this capability configuration.
	Note *string `json:"note,omitempty"`
	// Enable vulnerability management capability.
	VulnerabilityManagement *bool `json:"vulnerabilityManagement,omitempty"`
}

type PublicApiCreateActivationProfileRequest struct {
	// Capability configuration. At least one capability must be enabled.
	Capabilities PublicApiCapabilities `json:"capabilities"`
	// Optional group ID to associate with the activation profile.
	GroupID *string `json:"groupId,omitempty"`
	// Name of the activation profile.
	Name string `json:"name"`
	// Creation origin.
	// Allowed values: see the PublicApiCreateActivationProfileRequestOrigin constants.
	Origin string `json:"origin"`
	// Target platforms for this activation profile.
	// Allowed values: see the PublicApiCreateActivationProfileRequestPlatforms constants.
	Platforms []string `json:"platforms"`
}

type PublicApiCreateActivationProfileRequestOrigin = string

type PublicApiCreateActivationProfileRequestPlatforms = string

type RiskControls struct {
	// Whether risk-based access control is active.
	Enabled bool `json:"enabled"`
	// Minimum risk level that triggers access denial.
	// Allowed values: see the RiskControlsLevelThreshold constants.
	LevelThreshold string `json:"levelThreshold"`
	// Whether to notify users when access is blocked by risk controls.
	NotificationsEnabled bool `json:"notificationsEnabled"`
}

type RiskControlsLevelThreshold = string

type Routing struct {
	// DNS IP resolution preference. Optional. When omitted and `type=CUSTOM`, defaults to `IPv6`.
	// Explicitly set to `IPv4` if your network requires it. **Must be absent (or null) when
	// `type=DIRECT`** — returns `400` if set.
	// Allowed values: see the RoutingDnsIpResolutionType constants.
	DnsIpResolutionType *string `json:"dnsIpResolutionType"`
	// ID of a Gateway or Grouped Gateway. Required when `type=CUSTOM`, must be null/absent when
	// `type=DIRECT`. Gateway IDs are 4-character lowercase hex strings (e.g. `a1b2`); Grouped Gateway IDs
	// are UUIDs (e.g. `3fa85f64-5717-4562-b3fc-2c963f66afa6`).
	GatewayID *string `json:"gatewayId"`
	// `CUSTOM` routes traffic via a ZTNA gateway (`gatewayId` required). `DIRECT` uses default device
	// routing (`gatewayId` must be null/absent). `BLOCK` is not exposed in the public API.
	// Allowed values: see the RoutingType constants.
	Type string `json:"type"`
}

type RoutingDnsIpResolutionType = string

type RoutingOverride struct {
	// Must be a subset of `assignments.inclusions.groups` (or `allUsers: true`). A group ID may not appear
	// in more than one routing override entry — returns `400` on conflict.
	GroupIds []string `json:"groupIds"`
	// Traffic routing configuration for an App.
	Routing Routing `json:"routing"`
}

type RoutingStrategy = string

type RoutingType = string

type SearchDomain struct {
	// The DNS search suffix appended to unqualified host names. Bounded to the maximum DNS name length of
	// 253 characters (RFC 1035).
	Suffix string `json:"suffix"`
}

type SharedGateway struct {
	// Gateway ID. Format: 4-character lowercase hexadecimal string (e.g. `a1b2`).
	ID string `json:"id"`
	// Human-readable name.
	Name string `json:"name"`
}

type SharedGatewayListResponse struct {
	Results []SharedGateway `json:"results"`
	// Total number of Shared Gateways available to this tenant.
	TotalCount int `json:"totalCount"`
}

type SyncConfig struct {
	// Auto-deletion policy for devices removed from the UEM platform.
	// Allowed values: see the SyncConfigAutoDeviceDeletion constants.
	AutoDeviceDeletion string `json:"autoDeviceDeletion"`
	// Whether to automatically disable sync after repeated authentication failures.
	DisableSyncOnAuthError bool `json:"disableSyncOnAuthError"`
}

type SyncConfigAutoDeviceDeletion = string

type SyncErrorDetails struct {
	// Human-readable failure detail.
	Description *string `json:"description,omitempty"`
	// Coarse failure category.
	// Allowed values: see the SyncErrorDetailsReason constants.
	Reason *string `json:"reason,omitempty"`
}

type SyncErrorDetailsReason = string

type SyncRun struct {
	// Connector configuration identifier.
	ConfigID string `json:"configId"`
	// Number of devices removed during this run.
	Deleted int `json:"deleted"`
	// Number of devices that encountered errors during this run.
	Errored int `json:"errored"`
	// Timestamp when sync completed (ISO 8601), null if still running.
	Finished *time.Time `json:"finished,omitempty"`
	// What triggered this sync.
	// Allowed values: see the SyncRunRefreshType constants.
	RefreshType string `json:"refreshType"`
	// Timestamp when sync started (ISO 8601).
	Started *time.Time `json:"started,omitempty"`
	// Current sync status.
	// Allowed values: see the SyncRunStatus constants.
	Status string `json:"status"`
	// Number of devices synced (added or updated) during this run.
	Synced int `json:"synced"`
	// Unique identifier for this sync run.
	TransactionID string `json:"transactionId"`
}

type SyncRunPage struct {
	// The sync runs for the requested page.
	Results []SyncRun `json:"results"`
	// Total number of sync runs across all pages.
	TotalCount int64 `json:"totalCount"`
}

type SyncRunRefreshType = string

type SyncRunStatus = string

type SyncSettings struct {
	// Auto-deletion policy for devices removed from the UEM platform.
	// Allowed values: see the SyncSettingsAutoDeviceDeletion constants.
	AutoDeviceDeletion string `json:"autoDeviceDeletion"`
	// Whether this connector may sync several devices concurrently, for faster inventory updates.
	// Absent from the published spec's update request while present on the response, and writable — a
	// `PUT` carrying `false` persists (wire-verified 2026-08-28). Because the update is a full
	// replacement, a request built from the unpatched spec could not express the field and therefore reset
	// it to `true` on every write, silently discarding an operator's choice.
	ConcurrentSyncEnabled *bool `json:"concurrentSyncEnabled,omitempty"`
	// Controls which UEM attribute each JSC device field is populated from. Each value is an enum of UEM
	// attribute names whose members are vendor-specific, so the accepted values for a given key depend on
	// the connector's `vendor`. The Google connector accepts no mappings.
	DeviceFieldMappings DeviceFieldMappings `json:"deviceFieldMappings"`
	// Whether device risk levels are sent back to UEM.
	DeviceRiskTagging *bool `json:"deviceRiskTagging,omitempty"`
	// Number of days since last check-in before a device is treated as unmanaged. `0` uses the platform
	// default (3 days). Not applicable for JAMF_PRO — any value sent for that vendor is silently ignored
	// (device status is taken exclusively from the UEM).
	// Allowed values: see the SyncSettingsDeviceUnmanagedThreshold constants.
	DeviceUnmanagedThreshold *int `json:"deviceUnmanagedThreshold,omitempty"`
	// Whether to automatically disable sync after repeated authentication failures.
	DisableSyncOnAuthError *bool `json:"disableSyncOnAuthError,omitempty"`
	// Group mapping configuration. Maps UEM groups to JSC groups.
	GroupSettings *GroupSettings `json:"groupSettings,omitempty"`
	// Sync refresh interval in minutes.
	// Allowed values: see the SyncSettingsRefreshRateMinutes constants.
	RefreshRateMinutes *int64 `json:"refreshRateMinutes,omitempty"`
	// Whether scheduled sync is enabled.
	Scheduled *bool `json:"scheduled,omitempty"`
	// UEM vendor name — determines the shape of vendor-specific fields. Must match the stored
	// connector's vendor; a value that disagrees with it is rejected with `422 VENDOR_MISMATCH`. This
	// field selects the applicable vendor-specific fields, it does not change which connector is updated
	// (that is the path `configId`) nor the connector's vendor.
	// Allowed values: see the SyncSettingsVendor constants.
	Vendor string `json:"vendor"`
}

type SyncSettingsAutoDeviceDeletion = string

type SyncSettingsDeviceUnmanagedThreshold = int

type SyncSettingsRefreshRateMinutes = int64

type SyncSettingsVendor = string

type UpdateGroupRequest struct {
	// New name for the group.
	Name string `json:"name"`
}

type WizyConnectorCreateRequest struct {
	// ISO country code for the UEM instance, when applicable.
	IsoCountry *string `json:"isoCountry,omitempty"`
	// Wizy namespace.
	Namespace string `json:"namespace"`
	// Wizy server URL.
	URL string `json:"url"`
	// UEM vendor discriminator.
	// Allowed values: see the WizyConnectorCreateRequestVendor constants.
	Vendor string `json:"vendor"`
}

type WizyConnectorCreateRequestVendor = string

type WorkspaceOneConnectorCreateRequest struct {
	// Workspace ONE API password.
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	EmmPassword string `json:"emmPassword"`
	// Workspace ONE API username.
	EmmUsername string `json:"emmUsername"`
	// ISO country code for the UEM instance, when applicable.
	IsoCountry *string `json:"isoCountry,omitempty"`
	// Optional PEM-encoded root certificate for TLS verification.
	RootCertificate *string `json:"rootCertificate,omitempty"`
	// Workspace ONE REST API tenant code (aw-tenant-code).
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	TenantCode string `json:"tenantCode"`
	// Workspace ONE server URL.
	URL string `json:"url"`
	// UEM vendor discriminator.
	// Allowed values: see the WorkspaceOneConnectorCreateRequestVendor constants.
	Vendor string `json:"vendor"`
}

type WorkspaceOneConnectorCreateRequestVendor = string

type XenMobileConnectorCreateRequest struct {
	// Authentication strategy used to connect to XenMobile. See the schema description for the fields each
	// strategy requires.
	// Allowed values: see the XenMobileConnectorCreateRequestAuthStrategy constants.
	AuthStrategy string `json:"authStrategy"`
	// Citrix Cloud administrator credentials for the CITRIX_CLOUD_ADMIN strategy.
	CitrixCloudConfig *CitrixCloudConfig `json:"citrixCloudConfig,omitempty"`
	// Citrix Cloud OAuth credentials for the CITRIX_CLOUD_ADMIN_OAUTH strategy.
	CitrixCloudOauthConfig *CitrixCloudOauthConfig `json:"citrixCloudOauthConfig,omitempty"`
	// XenMobile password (USERNAME_PASSWORD strategy).
	// Write-only. Servers MUST NOT return this field in responses; the SDK preserves it only so the caller
	// can supply a value on update.
	EmmPassword *string `json:"emmPassword,omitempty"`
	// XenMobile username (USERNAME_PASSWORD strategy).
	EmmUsername *string `json:"emmUsername,omitempty"`
	// ISO country code for the UEM instance, when applicable.
	IsoCountry *string `json:"isoCountry,omitempty"`
	// XenMobile server URL.
	URL string `json:"url"`
	// UEM vendor discriminator.
	// Allowed values: see the XenMobileConnectorCreateRequestVendor constants.
	Vendor string `json:"vendor"`
}

type XenMobileConnectorCreateRequestAuthStrategy = string

type XenMobileConnectorCreateRequestVendor = string

type Zone struct {
	// The list of domains served by this DNS Zone.
	Domains []string `json:"domains"`
	// Server-assigned unique identifier of the DNS Zone.
	ID string `json:"id"`
	// Human-readable name of the DNS Zone. Maximum length 100 characters.
	Name string `json:"name"`
	// The list of name servers that resolve queries for this Zone.
	NameServers []NameServer `json:"nameServers"`
}

type ZoneList struct {
	// The DNS Zones for the tenant.
	Results []Zone `json:"results"`
	// Total number of DNS Zones returned in the list.
	TotalCount int `json:"totalCount"`
}

type ZonePatch struct {
	// Updated list of domains served by this DNS Zone. Omit to leave unchanged.
	Domains *[]string `json:"domains,omitempty"`
	// Updated name of the DNS Zone. 1 to 100 characters when supplied. Omit to leave unchanged.
	Name *string `json:"name,omitempty"`
	// Updated list of name servers for this Zone. Omit to leave unchanged.
	NameServers *[]NameServer `json:"nameServers,omitempty"`
}

type ZoneRef struct {
	// Canonical URL of the DNS Zone.
	Href string `json:"href"`
	// Server-assigned unique identifier of the DNS Zone.
	ID string `json:"id"`
}

type ZoneWrite struct {
	// The list of domains served by this DNS Zone. Must contain between 1 and 100 entries.
	Domains []string `json:"domains"`
	// Human-readable name of the DNS Zone. 1 to 100 characters.
	Name string `json:"name"`
	// The list of name servers that resolve queries for this Zone. Must contain between 1 and 20 entries.
	NameServers []NameServer `json:"nameServers"`
}