# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from . import _utilities
from . import outputs

__all__ = [
    'AppConfiguration',
    'AppEnforcementPoint',
    'AppEnforcementPointResource',
    'AppEnforcementPointSessionExpiryFixed',
    'AppEnforcementPointSessionExpiryInactivity',
    'AppParameters',
    'AppParametersGroups',
    'AppProvisioning',
    'AppSso',
    'AppSsoCertificate',
    'AuthServersConfiguration',
    'PrivilegesPrivilege',
    'PrivilegesPrivilegeStatement',
    'RiskRulesSource',
    'GetAppsConfigurationResult',
    'GetAppsEnforcementPointResult',
    'GetAppsEnforcementPointResourceResult',
    'GetAppsEnforcementPointSessionExpiryFixedResult',
    'GetAppsEnforcementPointSessionExpiryInactivityResult',
    'GetAppsFilterResult',
    'GetAppsParametersResult',
    'GetAppsParametersGroupsResult',
    'GetAppsProvisioningResult',
    'GetAppsSsoResult',
    'GetAppsSsoCertificateResult',
    'GetAuthServersClaimsFilterResult',
    'GetAuthServersConfigurationResult',
    'GetAuthServersFilterResult',
    'GetAuthServersInstanceConfigurationResult',
    'GetAuthServersScopesFilterResult',
    'GetMappingsActionResult',
    'GetMappingsConditionResult',
    'GetMappingsFilterResult',
    'GetPrivilegesFilterResult',
    'GetPrivilegesInstancePrivilegeResult',
    'GetPrivilegesInstancePrivilegeStatementResult',
    'GetPrivilegesPrivilegeResult',
    'GetPrivilegesPrivilegeStatementResult',
    'GetRiskRulesFilterResult',
    'GetRiskRulesInstanceSourceResult',
    'GetRiskRulesSourceResult',
]

@pulumi.output_type
class AppConfiguration(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "accessTokenExpirationMinutes":
            suggest = "access_token_expiration_minutes"
        elif key == "loginUrl":
            suggest = "login_url"
        elif key == "oidcApiVersion":
            suggest = "oidc_api_version"
        elif key == "oidcApplicationType":
            suggest = "oidc_application_type"
        elif key == "oidcEncryptionKey":
            suggest = "oidc_encryption_key"
        elif key == "postLogoutRedirectUri":
            suggest = "post_logout_redirect_uri"
        elif key == "redirectUri":
            suggest = "redirect_uri"
        elif key == "refreshTokenExpirationMinutes":
            suggest = "refresh_token_expiration_minutes"
        elif key == "tokenEndpointAuthMethod":
            suggest = "token_endpoint_auth_method"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AppConfiguration. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AppConfiguration.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AppConfiguration.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 access_token_expiration_minutes: Optional[int] = None,
                 login_url: Optional[str] = None,
                 oidc_api_version: Optional[str] = None,
                 oidc_application_type: Optional[int] = None,
                 oidc_encryption_key: Optional[str] = None,
                 post_logout_redirect_uri: Optional[str] = None,
                 redirect_uri: Optional[str] = None,
                 refresh_token_expiration_minutes: Optional[int] = None,
                 token_endpoint_auth_method: Optional[int] = None):
        """
        :param int access_token_expiration_minutes: OIDC Apps only Number of minutes the refresh token will be valid for.
        :param str login_url: OIDC Apps only The OpenId Connect Client Id. Note that client_secret is only returned after Creating an App.
        :param int oidc_application_type: OIDC Apps Only
                 - 0: Web
                 - 1: Native/Mobile
        :param str oidc_encryption_key: OIDC Apps only
        :param str post_logout_redirect_uri: OIDC Apps only
        :param str redirect_uri: OIDC Apps only Comma or newline separated list of valid redirect uris for the OpenId Connect Authorization Code flow.
        :param int refresh_token_expiration_minutes: Number of minutes the refresh token will be valid for.
        :param int token_endpoint_auth_method: OIDC Apps only
                - 0: Basic
                - 1: POST
                - 2: None / PKCE
        """
        if access_token_expiration_minutes is not None:
            pulumi.set(__self__, "access_token_expiration_minutes", access_token_expiration_minutes)
        if login_url is not None:
            pulumi.set(__self__, "login_url", login_url)
        if oidc_api_version is not None:
            pulumi.set(__self__, "oidc_api_version", oidc_api_version)
        if oidc_application_type is not None:
            pulumi.set(__self__, "oidc_application_type", oidc_application_type)
        if oidc_encryption_key is not None:
            pulumi.set(__self__, "oidc_encryption_key", oidc_encryption_key)
        if post_logout_redirect_uri is not None:
            pulumi.set(__self__, "post_logout_redirect_uri", post_logout_redirect_uri)
        if redirect_uri is not None:
            pulumi.set(__self__, "redirect_uri", redirect_uri)
        if refresh_token_expiration_minutes is not None:
            pulumi.set(__self__, "refresh_token_expiration_minutes", refresh_token_expiration_minutes)
        if token_endpoint_auth_method is not None:
            pulumi.set(__self__, "token_endpoint_auth_method", token_endpoint_auth_method)

    @property
    @pulumi.getter(name="accessTokenExpirationMinutes")
    def access_token_expiration_minutes(self) -> Optional[int]:
        """
        OIDC Apps only Number of minutes the refresh token will be valid for.
        """
        return pulumi.get(self, "access_token_expiration_minutes")

    @property
    @pulumi.getter(name="loginUrl")
    def login_url(self) -> Optional[str]:
        """
        OIDC Apps only The OpenId Connect Client Id. Note that client_secret is only returned after Creating an App.
        """
        return pulumi.get(self, "login_url")

    @property
    @pulumi.getter(name="oidcApiVersion")
    def oidc_api_version(self) -> Optional[str]:
        return pulumi.get(self, "oidc_api_version")

    @property
    @pulumi.getter(name="oidcApplicationType")
    def oidc_application_type(self) -> Optional[int]:
        """
        OIDC Apps Only
          - 0: Web
          - 1: Native/Mobile
        """
        return pulumi.get(self, "oidc_application_type")

    @property
    @pulumi.getter(name="oidcEncryptionKey")
    def oidc_encryption_key(self) -> Optional[str]:
        """
        OIDC Apps only
        """
        return pulumi.get(self, "oidc_encryption_key")

    @property
    @pulumi.getter(name="postLogoutRedirectUri")
    def post_logout_redirect_uri(self) -> Optional[str]:
        """
        OIDC Apps only
        """
        return pulumi.get(self, "post_logout_redirect_uri")

    @property
    @pulumi.getter(name="redirectUri")
    def redirect_uri(self) -> Optional[str]:
        """
        OIDC Apps only Comma or newline separated list of valid redirect uris for the OpenId Connect Authorization Code flow.
        """
        return pulumi.get(self, "redirect_uri")

    @property
    @pulumi.getter(name="refreshTokenExpirationMinutes")
    def refresh_token_expiration_minutes(self) -> Optional[int]:
        """
        Number of minutes the refresh token will be valid for.
        """
        return pulumi.get(self, "refresh_token_expiration_minutes")

    @property
    @pulumi.getter(name="tokenEndpointAuthMethod")
    def token_endpoint_auth_method(self) -> Optional[int]:
        """
        OIDC Apps only
         - 0: Basic
         - 1: POST
         - 2: None / PKCE
        """
        return pulumi.get(self, "token_endpoint_auth_method")


@pulumi.output_type
class AppEnforcementPoint(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "caseSensitive":
            suggest = "case_sensitive"
        elif key == "contextRoot":
            suggest = "context_root"
        elif key == "landingPage":
            suggest = "landing_page"
        elif key == "requireSitewideAuthentication":
            suggest = "require_sitewide_authentication"
        elif key == "sessionExpiryFixed":
            suggest = "session_expiry_fixed"
        elif key == "sessionExpiryInactivity":
            suggest = "session_expiry_inactivity"
        elif key == "useTargetHostHeader":
            suggest = "use_target_host_header"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AppEnforcementPoint. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AppEnforcementPoint.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AppEnforcementPoint.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 case_sensitive: Optional[bool] = None,
                 conditions: Optional[str] = None,
                 context_root: Optional[str] = None,
                 landing_page: Optional[str] = None,
                 permissions: Optional[str] = None,
                 require_sitewide_authentication: Optional[bool] = None,
                 resources: Optional[Sequence['outputs.AppEnforcementPointResource']] = None,
                 session_expiry_fixed: Optional['outputs.AppEnforcementPointSessionExpiryFixed'] = None,
                 session_expiry_inactivity: Optional['outputs.AppEnforcementPointSessionExpiryInactivity'] = None,
                 target: Optional[str] = None,
                 token: Optional[str] = None,
                 use_target_host_header: Optional[bool] = None,
                 vhost: Optional[str] = None):
        """
        :param bool case_sensitive: The URL path evaluation is case insensitive by default. Resources hosted on web servers such as Apache, NGINX and Java EE are case sensitive paths. Web servers such as Microsoft IIS are not case-sensitive.
        :param str conditions: If access is conditional, the conditions that must evaluate to true to allow access to a resource. For example, to require the user must be authenticated and have either the role Admin or User
        :param str context_root: The root path to the application, often the name of the application. Can be any name, path or just a slash (“/”). The context root uniquely identifies the application within the enforcement point.
        :param str landing_page: The location within the context root to which the browser will be redirected for IdP-initiated single sign-on. For example, the landing page might be an index page in the context root such as index.html or default.aspx. The landing page cannot begin with a slash and must use valid URL characters.
        :param str permissions: Specify to always `allow`, `deny` access to resources, of if access is `conditional`.
        :param bool require_sitewide_authentication: Require user authentication to access any resource protected by this enforcement point.
        :param Sequence['AppEnforcementPointResourceArgs'] resources: Array of resource objects
        :param 'AppEnforcementPointSessionExpiryFixedArgs' session_expiry_fixed: unit: - 0 = Seconds - 1 = Minutes - 2 = Hours value: - When Unit = 0 or 1 value must be 0-60 - When Unit = 2 value must be 0-24
        :param 'AppEnforcementPointSessionExpiryInactivityArgs' session_expiry_inactivity: unit: - 0 = Seconds - 1 = Minutes - 2 = Hours value: - When Unit = 0 or 1 value must be 0-60 - When Unit = 2 value must be 0-24
        :param str target: A fully-qualified URL to the internal application including scheme, authority and path. The target host authority must be an IP address, not a hostname.
        :param str token: Can only be set on create. Access Gateway Token.
        :param bool use_target_host_header: Use the target host header as opposed to the original gateway or upstream host header.
        :param str vhost: A comma-delimited list of one or more virtual hosts that map to applications assigned to the enforcement point. A VHOST may be a host name or an IP address. VHOST distinguish between applications that are at the same context root.
        """
        if case_sensitive is not None:
            pulumi.set(__self__, "case_sensitive", case_sensitive)
        if conditions is not None:
            pulumi.set(__self__, "conditions", conditions)
        if context_root is not None:
            pulumi.set(__self__, "context_root", context_root)
        if landing_page is not None:
            pulumi.set(__self__, "landing_page", landing_page)
        if permissions is not None:
            pulumi.set(__self__, "permissions", permissions)
        if require_sitewide_authentication is not None:
            pulumi.set(__self__, "require_sitewide_authentication", require_sitewide_authentication)
        if resources is not None:
            pulumi.set(__self__, "resources", resources)
        if session_expiry_fixed is not None:
            pulumi.set(__self__, "session_expiry_fixed", session_expiry_fixed)
        if session_expiry_inactivity is not None:
            pulumi.set(__self__, "session_expiry_inactivity", session_expiry_inactivity)
        if target is not None:
            pulumi.set(__self__, "target", target)
        if token is not None:
            pulumi.set(__self__, "token", token)
        if use_target_host_header is not None:
            pulumi.set(__self__, "use_target_host_header", use_target_host_header)
        if vhost is not None:
            pulumi.set(__self__, "vhost", vhost)

    @property
    @pulumi.getter(name="caseSensitive")
    def case_sensitive(self) -> Optional[bool]:
        """
        The URL path evaluation is case insensitive by default. Resources hosted on web servers such as Apache, NGINX and Java EE are case sensitive paths. Web servers such as Microsoft IIS are not case-sensitive.
        """
        return pulumi.get(self, "case_sensitive")

    @property
    @pulumi.getter
    def conditions(self) -> Optional[str]:
        """
        If access is conditional, the conditions that must evaluate to true to allow access to a resource. For example, to require the user must be authenticated and have either the role Admin or User
        """
        return pulumi.get(self, "conditions")

    @property
    @pulumi.getter(name="contextRoot")
    def context_root(self) -> Optional[str]:
        """
        The root path to the application, often the name of the application. Can be any name, path or just a slash (“/”). The context root uniquely identifies the application within the enforcement point.
        """
        return pulumi.get(self, "context_root")

    @property
    @pulumi.getter(name="landingPage")
    def landing_page(self) -> Optional[str]:
        """
        The location within the context root to which the browser will be redirected for IdP-initiated single sign-on. For example, the landing page might be an index page in the context root such as index.html or default.aspx. The landing page cannot begin with a slash and must use valid URL characters.
        """
        return pulumi.get(self, "landing_page")

    @property
    @pulumi.getter
    def permissions(self) -> Optional[str]:
        """
        Specify to always `allow`, `deny` access to resources, of if access is `conditional`.
        """
        return pulumi.get(self, "permissions")

    @property
    @pulumi.getter(name="requireSitewideAuthentication")
    def require_sitewide_authentication(self) -> Optional[bool]:
        """
        Require user authentication to access any resource protected by this enforcement point.
        """
        return pulumi.get(self, "require_sitewide_authentication")

    @property
    @pulumi.getter
    def resources(self) -> Optional[Sequence['outputs.AppEnforcementPointResource']]:
        """
        Array of resource objects
        """
        return pulumi.get(self, "resources")

    @property
    @pulumi.getter(name="sessionExpiryFixed")
    def session_expiry_fixed(self) -> Optional['outputs.AppEnforcementPointSessionExpiryFixed']:
        """
        unit: - 0 = Seconds - 1 = Minutes - 2 = Hours value: - When Unit = 0 or 1 value must be 0-60 - When Unit = 2 value must be 0-24
        """
        return pulumi.get(self, "session_expiry_fixed")

    @property
    @pulumi.getter(name="sessionExpiryInactivity")
    def session_expiry_inactivity(self) -> Optional['outputs.AppEnforcementPointSessionExpiryInactivity']:
        """
        unit: - 0 = Seconds - 1 = Minutes - 2 = Hours value: - When Unit = 0 or 1 value must be 0-60 - When Unit = 2 value must be 0-24
        """
        return pulumi.get(self, "session_expiry_inactivity")

    @property
    @pulumi.getter
    def target(self) -> Optional[str]:
        """
        A fully-qualified URL to the internal application including scheme, authority and path. The target host authority must be an IP address, not a hostname.
        """
        return pulumi.get(self, "target")

    @property
    @pulumi.getter
    def token(self) -> Optional[str]:
        """
        Can only be set on create. Access Gateway Token.
        """
        return pulumi.get(self, "token")

    @property
    @pulumi.getter(name="useTargetHostHeader")
    def use_target_host_header(self) -> Optional[bool]:
        """
        Use the target host header as opposed to the original gateway or upstream host header.
        """
        return pulumi.get(self, "use_target_host_header")

    @property
    @pulumi.getter
    def vhost(self) -> Optional[str]:
        """
        A comma-delimited list of one or more virtual hosts that map to applications assigned to the enforcement point. A VHOST may be a host name or an IP address. VHOST distinguish between applications that are at the same context root.
        """
        return pulumi.get(self, "vhost")


@pulumi.output_type
class AppEnforcementPointResource(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "isPathRegex":
            suggest = "is_path_regex"
        elif key == "requireAuth":
            suggest = "require_auth"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AppEnforcementPointResource. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AppEnforcementPointResource.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AppEnforcementPointResource.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 conditions: Optional[str] = None,
                 is_path_regex: Optional[bool] = None,
                 path: Optional[str] = None,
                 permission: Optional[str] = None,
                 require_auth: Optional[bool] = None):
        """
        :param str conditions: required if permission == "conditions"
        """
        if conditions is not None:
            pulumi.set(__self__, "conditions", conditions)
        if is_path_regex is not None:
            pulumi.set(__self__, "is_path_regex", is_path_regex)
        if path is not None:
            pulumi.set(__self__, "path", path)
        if permission is not None:
            pulumi.set(__self__, "permission", permission)
        if require_auth is not None:
            pulumi.set(__self__, "require_auth", require_auth)

    @property
    @pulumi.getter
    def conditions(self) -> Optional[str]:
        """
        required if permission == "conditions"
        """
        return pulumi.get(self, "conditions")

    @property
    @pulumi.getter(name="isPathRegex")
    def is_path_regex(self) -> Optional[bool]:
        return pulumi.get(self, "is_path_regex")

    @property
    @pulumi.getter
    def path(self) -> Optional[str]:
        return pulumi.get(self, "path")

    @property
    @pulumi.getter
    def permission(self) -> Optional[str]:
        return pulumi.get(self, "permission")

    @property
    @pulumi.getter(name="requireAuth")
    def require_auth(self) -> Optional[bool]:
        return pulumi.get(self, "require_auth")


@pulumi.output_type
class AppEnforcementPointSessionExpiryFixed(dict):
    def __init__(__self__, *,
                 unit: Optional[int] = None,
                 value: Optional[int] = None):
        if unit is not None:
            pulumi.set(__self__, "unit", unit)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def unit(self) -> Optional[int]:
        return pulumi.get(self, "unit")

    @property
    @pulumi.getter
    def value(self) -> Optional[int]:
        return pulumi.get(self, "value")


@pulumi.output_type
class AppEnforcementPointSessionExpiryInactivity(dict):
    def __init__(__self__, *,
                 unit: Optional[int] = None,
                 value: Optional[int] = None):
        if unit is not None:
            pulumi.set(__self__, "unit", unit)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def unit(self) -> Optional[int]:
        return pulumi.get(self, "unit")

    @property
    @pulumi.getter
    def value(self) -> Optional[int]:
        return pulumi.get(self, "value")


@pulumi.output_type
class AppParameters(dict):
    def __init__(__self__, *,
                 groups: Optional['outputs.AppParametersGroups'] = None):
        if groups is not None:
            pulumi.set(__self__, "groups", groups)

    @property
    @pulumi.getter
    def groups(self) -> Optional['outputs.AppParametersGroups']:
        return pulumi.get(self, "groups")


@pulumi.output_type
class AppParametersGroups(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "attributesTransformations":
            suggest = "attributes_transformations"
        elif key == "defaultValues":
            suggest = "default_values"
        elif key == "provisionedEntitlements":
            suggest = "provisioned_entitlements"
        elif key == "skipIfBlank":
            suggest = "skip_if_blank"
        elif key == "userAttributeMacros":
            suggest = "user_attribute_macros"
        elif key == "userAttributeMappings":
            suggest = "user_attribute_mappings"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AppParametersGroups. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AppParametersGroups.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AppParametersGroups.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 attributes_transformations: Optional[str] = None,
                 default_values: Optional[str] = None,
                 id: Optional[int] = None,
                 label: Optional[str] = None,
                 provisioned_entitlements: Optional[bool] = None,
                 skip_if_blank: Optional[bool] = None,
                 user_attribute_macros: Optional[str] = None,
                 user_attribute_mappings: Optional[str] = None,
                 values: Optional[str] = None):
        if attributes_transformations is not None:
            pulumi.set(__self__, "attributes_transformations", attributes_transformations)
        if default_values is not None:
            pulumi.set(__self__, "default_values", default_values)
        if id is not None:
            pulumi.set(__self__, "id", id)
        if label is not None:
            pulumi.set(__self__, "label", label)
        if provisioned_entitlements is not None:
            pulumi.set(__self__, "provisioned_entitlements", provisioned_entitlements)
        if skip_if_blank is not None:
            pulumi.set(__self__, "skip_if_blank", skip_if_blank)
        if user_attribute_macros is not None:
            pulumi.set(__self__, "user_attribute_macros", user_attribute_macros)
        if user_attribute_mappings is not None:
            pulumi.set(__self__, "user_attribute_mappings", user_attribute_mappings)
        if values is not None:
            pulumi.set(__self__, "values", values)

    @property
    @pulumi.getter(name="attributesTransformations")
    def attributes_transformations(self) -> Optional[str]:
        return pulumi.get(self, "attributes_transformations")

    @property
    @pulumi.getter(name="defaultValues")
    def default_values(self) -> Optional[str]:
        return pulumi.get(self, "default_values")

    @property
    @pulumi.getter
    def id(self) -> Optional[int]:
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def label(self) -> Optional[str]:
        return pulumi.get(self, "label")

    @property
    @pulumi.getter(name="provisionedEntitlements")
    def provisioned_entitlements(self) -> Optional[bool]:
        return pulumi.get(self, "provisioned_entitlements")

    @property
    @pulumi.getter(name="skipIfBlank")
    def skip_if_blank(self) -> Optional[bool]:
        return pulumi.get(self, "skip_if_blank")

    @property
    @pulumi.getter(name="userAttributeMacros")
    def user_attribute_macros(self) -> Optional[str]:
        return pulumi.get(self, "user_attribute_macros")

    @property
    @pulumi.getter(name="userAttributeMappings")
    def user_attribute_mappings(self) -> Optional[str]:
        return pulumi.get(self, "user_attribute_mappings")

    @property
    @pulumi.getter
    def values(self) -> Optional[str]:
        return pulumi.get(self, "values")


@pulumi.output_type
class AppProvisioning(dict):
    def __init__(__self__, *,
                 enabled: Optional[bool] = None,
                 status: Optional[str] = None):
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if status is not None:
            pulumi.set(__self__, "status", status)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[bool]:
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter
    def status(self) -> Optional[str]:
        return pulumi.get(self, "status")


@pulumi.output_type
class AppSso(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "acsUrl":
            suggest = "acs_url"
        elif key == "clientId":
            suggest = "client_id"
        elif key == "clientSecret":
            suggest = "client_secret"
        elif key == "metadataUrl":
            suggest = "metadata_url"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AppSso. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AppSso.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AppSso.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 acs_url: Optional[str] = None,
                 certificate: Optional['outputs.AppSsoCertificate'] = None,
                 client_id: Optional[str] = None,
                 client_secret: Optional[str] = None,
                 issuer: Optional[str] = None,
                 metadata_url: Optional[str] = None):
        """
        :param str acs_url: App Name.	This is only returned after Creating a SAML App.
        :param 'AppSsoCertificateArgs' certificate: The certificate used for signing.	This is only returned after Creating a SAML App.
        :param str client_id: The OpenId Connect Client Id. Note that client_secret is only returned after Creating an OIDC App.
        :param str client_secret: OpenId Connet Client Secret
        :param str issuer: Issuer of app.	This is only returned after Creating a SAML App.
        :param str metadata_url: ID of the apps underlying connector.	This is only returned after Creating a SAML App.
        """
        if acs_url is not None:
            pulumi.set(__self__, "acs_url", acs_url)
        if certificate is not None:
            pulumi.set(__self__, "certificate", certificate)
        if client_id is not None:
            pulumi.set(__self__, "client_id", client_id)
        if client_secret is not None:
            pulumi.set(__self__, "client_secret", client_secret)
        if issuer is not None:
            pulumi.set(__self__, "issuer", issuer)
        if metadata_url is not None:
            pulumi.set(__self__, "metadata_url", metadata_url)

    @property
    @pulumi.getter(name="acsUrl")
    def acs_url(self) -> Optional[str]:
        """
        App Name.	This is only returned after Creating a SAML App.
        """
        return pulumi.get(self, "acs_url")

    @property
    @pulumi.getter
    def certificate(self) -> Optional['outputs.AppSsoCertificate']:
        """
        The certificate used for signing.	This is only returned after Creating a SAML App.
        """
        return pulumi.get(self, "certificate")

    @property
    @pulumi.getter(name="clientId")
    def client_id(self) -> Optional[str]:
        """
        The OpenId Connect Client Id. Note that client_secret is only returned after Creating an OIDC App.
        """
        return pulumi.get(self, "client_id")

    @property
    @pulumi.getter(name="clientSecret")
    def client_secret(self) -> Optional[str]:
        """
        OpenId Connet Client Secret
        """
        return pulumi.get(self, "client_secret")

    @property
    @pulumi.getter
    def issuer(self) -> Optional[str]:
        """
        Issuer of app.	This is only returned after Creating a SAML App.
        """
        return pulumi.get(self, "issuer")

    @property
    @pulumi.getter(name="metadataUrl")
    def metadata_url(self) -> Optional[str]:
        """
        ID of the apps underlying connector.	This is only returned after Creating a SAML App.
        """
        return pulumi.get(self, "metadata_url")


@pulumi.output_type
class AppSsoCertificate(dict):
    def __init__(__self__, *,
                 id: Optional[int] = None,
                 name: Optional[str] = None,
                 value: Optional[str] = None):
        if id is not None:
            pulumi.set(__self__, "id", id)
        if name is not None:
            pulumi.set(__self__, "name", name)
        if value is not None:
            pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def id(self) -> Optional[int]:
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def name(self) -> Optional[str]:
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def value(self) -> Optional[str]:
        return pulumi.get(self, "value")


@pulumi.output_type
class AuthServersConfiguration(dict):
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "resourceIdentifier":
            suggest = "resource_identifier"
        elif key == "accessTokenExpirationMinutes":
            suggest = "access_token_expiration_minutes"
        elif key == "refreshTokenExpirationMinutes":
            suggest = "refresh_token_expiration_minutes"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in AuthServersConfiguration. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        AuthServersConfiguration.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        AuthServersConfiguration.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 audiences: Sequence[str],
                 resource_identifier: str,
                 access_token_expiration_minutes: Optional[int] = None,
                 refresh_token_expiration_minutes: Optional[int] = None):
        """
        :param Sequence[str] audiences: List of API endpoints that will be returned in Access Tokens.
        :param str resource_identifier: Unique identifier for the API that the Authorization Server will issue Access Tokens for.
        :param int access_token_expiration_minutes: The number of minutes until access token expires. There is no maximum expiry limit.
        :param int refresh_token_expiration_minutes: The number of minutes until refresh token expires. There is no maximum expiry limit.
        """
        pulumi.set(__self__, "audiences", audiences)
        pulumi.set(__self__, "resource_identifier", resource_identifier)
        if access_token_expiration_minutes is not None:
            pulumi.set(__self__, "access_token_expiration_minutes", access_token_expiration_minutes)
        if refresh_token_expiration_minutes is not None:
            pulumi.set(__self__, "refresh_token_expiration_minutes", refresh_token_expiration_minutes)

    @property
    @pulumi.getter
    def audiences(self) -> Sequence[str]:
        """
        List of API endpoints that will be returned in Access Tokens.
        """
        return pulumi.get(self, "audiences")

    @property
    @pulumi.getter(name="resourceIdentifier")
    def resource_identifier(self) -> str:
        """
        Unique identifier for the API that the Authorization Server will issue Access Tokens for.
        """
        return pulumi.get(self, "resource_identifier")

    @property
    @pulumi.getter(name="accessTokenExpirationMinutes")
    def access_token_expiration_minutes(self) -> Optional[int]:
        """
        The number of minutes until access token expires. There is no maximum expiry limit.
        """
        return pulumi.get(self, "access_token_expiration_minutes")

    @property
    @pulumi.getter(name="refreshTokenExpirationMinutes")
    def refresh_token_expiration_minutes(self) -> Optional[int]:
        """
        The number of minutes until refresh token expires. There is no maximum expiry limit.
        """
        return pulumi.get(self, "refresh_token_expiration_minutes")


@pulumi.output_type
class PrivilegesPrivilege(dict):
    def __init__(__self__, *,
                 statements: Optional[Sequence['outputs.PrivilegesPrivilegeStatement']] = None,
                 version: Optional[str] = None):
        if statements is not None:
            pulumi.set(__self__, "statements", statements)
        if version is not None:
            pulumi.set(__self__, "version", version)

    @property
    @pulumi.getter
    def statements(self) -> Optional[Sequence['outputs.PrivilegesPrivilegeStatement']]:
        return pulumi.get(self, "statements")

    @property
    @pulumi.getter
    def version(self) -> Optional[str]:
        return pulumi.get(self, "version")


@pulumi.output_type
class PrivilegesPrivilegeStatement(dict):
    def __init__(__self__, *,
                 actions: Sequence[str],
                 effect: str,
                 scopes: Sequence[str]):
        """
        :param Sequence[str] actions: An array of strings that represent actions within OneLogin. Actions are prefixed with the class of object they are related to and followed by a specific action for the given class.
               e.g. users:List, where the class is users and the specific action is List. Don’t mix classes within an Action array. To create a privilege that includes multiple different classes, create multiple statements. A wildcard * that includes all actions is supported. Use wildcards to create a Super User privilege.
        :param str effect: Set to “Allow.” By default, all actions are denied, this Statement allows the listed actions to be executed.
        :param Sequence[str] scopes: Target the privileged action against specific resources with the scope.
               The scope pattern is the class of object used by the Action, followed by an ID that represents a resource in OneLogin.
               e.g. apps/1234, where apps is the class and 1234 is the ID of an app.
               The wildcard * is supported and indicates that all resources of the class type declared, in the Action, are in scope.
               The Action and Scope classes must match. However, there is an exception, a scope of roles/{role_id} can be combined with Actions on the user or app class. The exception allows you to target groups of users or apps with specific actions.
        """
        pulumi.set(__self__, "actions", actions)
        pulumi.set(__self__, "effect", effect)
        pulumi.set(__self__, "scopes", scopes)

    @property
    @pulumi.getter
    def actions(self) -> Sequence[str]:
        """
        An array of strings that represent actions within OneLogin. Actions are prefixed with the class of object they are related to and followed by a specific action for the given class.
        e.g. users:List, where the class is users and the specific action is List. Don’t mix classes within an Action array. To create a privilege that includes multiple different classes, create multiple statements. A wildcard * that includes all actions is supported. Use wildcards to create a Super User privilege.
        """
        return pulumi.get(self, "actions")

    @property
    @pulumi.getter
    def effect(self) -> str:
        """
        Set to “Allow.” By default, all actions are denied, this Statement allows the listed actions to be executed.
        """
        return pulumi.get(self, "effect")

    @property
    @pulumi.getter
    def scopes(self) -> Sequence[str]:
        """
        Target the privileged action against specific resources with the scope.
        The scope pattern is the class of object used by the Action, followed by an ID that represents a resource in OneLogin.
        e.g. apps/1234, where apps is the class and 1234 is the ID of an app.
        The wildcard * is supported and indicates that all resources of the class type declared, in the Action, are in scope.
        The Action and Scope classes must match. However, there is an exception, a scope of roles/{role_id} can be combined with Actions on the user or app class. The exception allows you to target groups of users or apps with specific actions.
        """
        return pulumi.get(self, "scopes")


@pulumi.output_type
class RiskRulesSource(dict):
    def __init__(__self__, *,
                 id: Optional[str] = None,
                 name: Optional[str] = None):
        """
        :param str id: A unique id that represents the source of the event.
        :param str name: The name of the source
        """
        if id is not None:
            pulumi.set(__self__, "id", id)
        if name is not None:
            pulumi.set(__self__, "name", name)

    @property
    @pulumi.getter
    def id(self) -> Optional[str]:
        """
        A unique id that represents the source of the event.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def name(self) -> Optional[str]:
        """
        The name of the source
        """
        return pulumi.get(self, "name")


@pulumi.output_type
class GetAppsConfigurationResult(dict):
    def __init__(__self__, *,
                 access_token_expiration_minutes: int,
                 login_url: str,
                 oidc_api_version: str,
                 oidc_application_type: int,
                 oidc_encryption_key: str,
                 post_logout_redirect_uri: str,
                 redirect_uri: str,
                 refresh_token_expiration_minutes: int,
                 token_endpoint_auth_method: int):
        """
        :param int access_token_expiration_minutes: OIDC Apps only Number of minutes the refresh token will be valid for.
        :param str login_url: OIDC Apps only The OpenId Connect Client Id. Note that client_secret is only returned after Creating an App.
        :param int oidc_application_type: OIDC Apps Only
                 - 0: Web
                 - 1: Native/Mobile
        :param str oidc_encryption_key: OIDC Apps only
        :param str post_logout_redirect_uri: OIDC Apps only
        :param str redirect_uri: OIDC Apps only Comma or newline separated list of valid redirect uris for the OpenId Connect Authorization Code flow.
        :param int refresh_token_expiration_minutes: Number of minutes the refresh token will be valid for.
        :param int token_endpoint_auth_method: OIDC Apps only
                - 0: Basic
                - 1: POST
                - 2: None / PKCE
        """
        pulumi.set(__self__, "access_token_expiration_minutes", access_token_expiration_minutes)
        pulumi.set(__self__, "login_url", login_url)
        pulumi.set(__self__, "oidc_api_version", oidc_api_version)
        pulumi.set(__self__, "oidc_application_type", oidc_application_type)
        pulumi.set(__self__, "oidc_encryption_key", oidc_encryption_key)
        pulumi.set(__self__, "post_logout_redirect_uri", post_logout_redirect_uri)
        pulumi.set(__self__, "redirect_uri", redirect_uri)
        pulumi.set(__self__, "refresh_token_expiration_minutes", refresh_token_expiration_minutes)
        pulumi.set(__self__, "token_endpoint_auth_method", token_endpoint_auth_method)

    @property
    @pulumi.getter(name="accessTokenExpirationMinutes")
    def access_token_expiration_minutes(self) -> int:
        """
        OIDC Apps only Number of minutes the refresh token will be valid for.
        """
        return pulumi.get(self, "access_token_expiration_minutes")

    @property
    @pulumi.getter(name="loginUrl")
    def login_url(self) -> str:
        """
        OIDC Apps only The OpenId Connect Client Id. Note that client_secret is only returned after Creating an App.
        """
        return pulumi.get(self, "login_url")

    @property
    @pulumi.getter(name="oidcApiVersion")
    def oidc_api_version(self) -> str:
        return pulumi.get(self, "oidc_api_version")

    @property
    @pulumi.getter(name="oidcApplicationType")
    def oidc_application_type(self) -> int:
        """
        OIDC Apps Only
          - 0: Web
          - 1: Native/Mobile
        """
        return pulumi.get(self, "oidc_application_type")

    @property
    @pulumi.getter(name="oidcEncryptionKey")
    def oidc_encryption_key(self) -> str:
        """
        OIDC Apps only
        """
        return pulumi.get(self, "oidc_encryption_key")

    @property
    @pulumi.getter(name="postLogoutRedirectUri")
    def post_logout_redirect_uri(self) -> str:
        """
        OIDC Apps only
        """
        return pulumi.get(self, "post_logout_redirect_uri")

    @property
    @pulumi.getter(name="redirectUri")
    def redirect_uri(self) -> str:
        """
        OIDC Apps only Comma or newline separated list of valid redirect uris for the OpenId Connect Authorization Code flow.
        """
        return pulumi.get(self, "redirect_uri")

    @property
    @pulumi.getter(name="refreshTokenExpirationMinutes")
    def refresh_token_expiration_minutes(self) -> int:
        """
        Number of minutes the refresh token will be valid for.
        """
        return pulumi.get(self, "refresh_token_expiration_minutes")

    @property
    @pulumi.getter(name="tokenEndpointAuthMethod")
    def token_endpoint_auth_method(self) -> int:
        """
        OIDC Apps only
         - 0: Basic
         - 1: POST
         - 2: None / PKCE
        """
        return pulumi.get(self, "token_endpoint_auth_method")


@pulumi.output_type
class GetAppsEnforcementPointResult(dict):
    def __init__(__self__, *,
                 case_sensitive: bool,
                 conditions: str,
                 context_root: str,
                 landing_page: str,
                 permissions: str,
                 require_sitewide_authentication: bool,
                 resources: Sequence['outputs.GetAppsEnforcementPointResourceResult'],
                 session_expiry_fixed: 'outputs.GetAppsEnforcementPointSessionExpiryFixedResult',
                 session_expiry_inactivity: 'outputs.GetAppsEnforcementPointSessionExpiryInactivityResult',
                 target: str,
                 token: str,
                 use_target_host_header: bool,
                 vhost: str):
        """
        :param bool case_sensitive: The URL path evaluation is case insensitive by default. Resources hosted on web servers such as Apache, NGINX and Java EE are case sensitive paths. Web servers such as Microsoft IIS are not case-sensitive.
        :param str conditions: If access is conditional, the conditions that must evaluate to true to allow access to a resource. For example, to require the user must be authenticated and have either the role Admin or User
        :param str context_root: The root path to the application, often the name of the application. Can be any name, path or just a slash (“/”). The context root uniquely identifies the application within the enforcement point.
        :param str landing_page: The location within the context root to which the browser will be redirected for IdP-initiated single sign-on. For example, the landing page might be an index page in the context root such as index.html or default.aspx. The landing page cannot begin with a slash and must use valid URL characters.
        :param str permissions: Specify to always `allow`, `deny` access to resources, of if access is `conditional`.
        :param bool require_sitewide_authentication: Require user authentication to access any resource protected by this enforcement point.
        :param Sequence['GetAppsEnforcementPointResourceArgs'] resources: Array of resource objects
        :param 'GetAppsEnforcementPointSessionExpiryFixedArgs' session_expiry_fixed: unit: - 0 = Seconds - 1 = Minutes - 2 = Hours value: - When Unit = 0 or 1 value must be 0-60 - When Unit = 2 value must be 0-24
        :param 'GetAppsEnforcementPointSessionExpiryInactivityArgs' session_expiry_inactivity: unit: - 0 = Seconds - 1 = Minutes - 2 = Hours value: - When Unit = 0 or 1 value must be 0-60 - When Unit = 2 value must be 0-24
        :param str target: A fully-qualified URL to the internal application including scheme, authority and path. The target host authority must be an IP address, not a hostname.
        :param str token: Can only be set on create. Access Gateway Token.
        :param bool use_target_host_header: Use the target host header as opposed to the original gateway or upstream host header.
        :param str vhost: A comma-delimited list of one or more virtual hosts that map to applications assigned to the enforcement point. A VHOST may be a host name or an IP address. VHOST distinguish between applications that are at the same context root.
        """
        pulumi.set(__self__, "case_sensitive", case_sensitive)
        pulumi.set(__self__, "conditions", conditions)
        pulumi.set(__self__, "context_root", context_root)
        pulumi.set(__self__, "landing_page", landing_page)
        pulumi.set(__self__, "permissions", permissions)
        pulumi.set(__self__, "require_sitewide_authentication", require_sitewide_authentication)
        pulumi.set(__self__, "resources", resources)
        pulumi.set(__self__, "session_expiry_fixed", session_expiry_fixed)
        pulumi.set(__self__, "session_expiry_inactivity", session_expiry_inactivity)
        pulumi.set(__self__, "target", target)
        pulumi.set(__self__, "token", token)
        pulumi.set(__self__, "use_target_host_header", use_target_host_header)
        pulumi.set(__self__, "vhost", vhost)

    @property
    @pulumi.getter(name="caseSensitive")
    def case_sensitive(self) -> bool:
        """
        The URL path evaluation is case insensitive by default. Resources hosted on web servers such as Apache, NGINX and Java EE are case sensitive paths. Web servers such as Microsoft IIS are not case-sensitive.
        """
        return pulumi.get(self, "case_sensitive")

    @property
    @pulumi.getter
    def conditions(self) -> str:
        """
        If access is conditional, the conditions that must evaluate to true to allow access to a resource. For example, to require the user must be authenticated and have either the role Admin or User
        """
        return pulumi.get(self, "conditions")

    @property
    @pulumi.getter(name="contextRoot")
    def context_root(self) -> str:
        """
        The root path to the application, often the name of the application. Can be any name, path or just a slash (“/”). The context root uniquely identifies the application within the enforcement point.
        """
        return pulumi.get(self, "context_root")

    @property
    @pulumi.getter(name="landingPage")
    def landing_page(self) -> str:
        """
        The location within the context root to which the browser will be redirected for IdP-initiated single sign-on. For example, the landing page might be an index page in the context root such as index.html or default.aspx. The landing page cannot begin with a slash and must use valid URL characters.
        """
        return pulumi.get(self, "landing_page")

    @property
    @pulumi.getter
    def permissions(self) -> str:
        """
        Specify to always `allow`, `deny` access to resources, of if access is `conditional`.
        """
        return pulumi.get(self, "permissions")

    @property
    @pulumi.getter(name="requireSitewideAuthentication")
    def require_sitewide_authentication(self) -> bool:
        """
        Require user authentication to access any resource protected by this enforcement point.
        """
        return pulumi.get(self, "require_sitewide_authentication")

    @property
    @pulumi.getter
    def resources(self) -> Sequence['outputs.GetAppsEnforcementPointResourceResult']:
        """
        Array of resource objects
        """
        return pulumi.get(self, "resources")

    @property
    @pulumi.getter(name="sessionExpiryFixed")
    def session_expiry_fixed(self) -> 'outputs.GetAppsEnforcementPointSessionExpiryFixedResult':
        """
        unit: - 0 = Seconds - 1 = Minutes - 2 = Hours value: - When Unit = 0 or 1 value must be 0-60 - When Unit = 2 value must be 0-24
        """
        return pulumi.get(self, "session_expiry_fixed")

    @property
    @pulumi.getter(name="sessionExpiryInactivity")
    def session_expiry_inactivity(self) -> 'outputs.GetAppsEnforcementPointSessionExpiryInactivityResult':
        """
        unit: - 0 = Seconds - 1 = Minutes - 2 = Hours value: - When Unit = 0 or 1 value must be 0-60 - When Unit = 2 value must be 0-24
        """
        return pulumi.get(self, "session_expiry_inactivity")

    @property
    @pulumi.getter
    def target(self) -> str:
        """
        A fully-qualified URL to the internal application including scheme, authority and path. The target host authority must be an IP address, not a hostname.
        """
        return pulumi.get(self, "target")

    @property
    @pulumi.getter
    def token(self) -> str:
        """
        Can only be set on create. Access Gateway Token.
        """
        return pulumi.get(self, "token")

    @property
    @pulumi.getter(name="useTargetHostHeader")
    def use_target_host_header(self) -> bool:
        """
        Use the target host header as opposed to the original gateway or upstream host header.
        """
        return pulumi.get(self, "use_target_host_header")

    @property
    @pulumi.getter
    def vhost(self) -> str:
        """
        A comma-delimited list of one or more virtual hosts that map to applications assigned to the enforcement point. A VHOST may be a host name or an IP address. VHOST distinguish between applications that are at the same context root.
        """
        return pulumi.get(self, "vhost")


@pulumi.output_type
class GetAppsEnforcementPointResourceResult(dict):
    def __init__(__self__, *,
                 conditions: str,
                 is_path_regex: bool,
                 path: str,
                 permission: str,
                 require_auth: bool):
        """
        :param str conditions: required if permission == "conditions"
        """
        pulumi.set(__self__, "conditions", conditions)
        pulumi.set(__self__, "is_path_regex", is_path_regex)
        pulumi.set(__self__, "path", path)
        pulumi.set(__self__, "permission", permission)
        pulumi.set(__self__, "require_auth", require_auth)

    @property
    @pulumi.getter
    def conditions(self) -> str:
        """
        required if permission == "conditions"
        """
        return pulumi.get(self, "conditions")

    @property
    @pulumi.getter(name="isPathRegex")
    def is_path_regex(self) -> bool:
        return pulumi.get(self, "is_path_regex")

    @property
    @pulumi.getter
    def path(self) -> str:
        return pulumi.get(self, "path")

    @property
    @pulumi.getter
    def permission(self) -> str:
        return pulumi.get(self, "permission")

    @property
    @pulumi.getter(name="requireAuth")
    def require_auth(self) -> bool:
        return pulumi.get(self, "require_auth")


@pulumi.output_type
class GetAppsEnforcementPointSessionExpiryFixedResult(dict):
    def __init__(__self__, *,
                 unit: int,
                 value: int):
        pulumi.set(__self__, "unit", unit)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def unit(self) -> int:
        return pulumi.get(self, "unit")

    @property
    @pulumi.getter
    def value(self) -> int:
        return pulumi.get(self, "value")


@pulumi.output_type
class GetAppsEnforcementPointSessionExpiryInactivityResult(dict):
    def __init__(__self__, *,
                 unit: int,
                 value: int):
        pulumi.set(__self__, "unit", unit)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def unit(self) -> int:
        return pulumi.get(self, "unit")

    @property
    @pulumi.getter
    def value(self) -> int:
        return pulumi.get(self, "value")


@pulumi.output_type
class GetAppsFilterResult(dict):
    def __init__(__self__, *,
                 name: str,
                 values: Sequence[str]):
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "values", values)

    @property
    @pulumi.getter
    def name(self) -> str:
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def values(self) -> Sequence[str]:
        return pulumi.get(self, "values")


@pulumi.output_type
class GetAppsParametersResult(dict):
    def __init__(__self__, *,
                 groups: 'outputs.GetAppsParametersGroupsResult'):
        pulumi.set(__self__, "groups", groups)

    @property
    @pulumi.getter
    def groups(self) -> 'outputs.GetAppsParametersGroupsResult':
        return pulumi.get(self, "groups")


@pulumi.output_type
class GetAppsParametersGroupsResult(dict):
    def __init__(__self__, *,
                 attributes_transformations: str,
                 default_values: str,
                 id: int,
                 label: str,
                 provisioned_entitlements: bool,
                 skip_if_blank: bool,
                 user_attribute_macros: str,
                 user_attribute_mappings: str,
                 values: str):
        pulumi.set(__self__, "attributes_transformations", attributes_transformations)
        pulumi.set(__self__, "default_values", default_values)
        pulumi.set(__self__, "id", id)
        pulumi.set(__self__, "label", label)
        pulumi.set(__self__, "provisioned_entitlements", provisioned_entitlements)
        pulumi.set(__self__, "skip_if_blank", skip_if_blank)
        pulumi.set(__self__, "user_attribute_macros", user_attribute_macros)
        pulumi.set(__self__, "user_attribute_mappings", user_attribute_mappings)
        pulumi.set(__self__, "values", values)

    @property
    @pulumi.getter(name="attributesTransformations")
    def attributes_transformations(self) -> str:
        return pulumi.get(self, "attributes_transformations")

    @property
    @pulumi.getter(name="defaultValues")
    def default_values(self) -> str:
        return pulumi.get(self, "default_values")

    @property
    @pulumi.getter
    def id(self) -> int:
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def label(self) -> str:
        return pulumi.get(self, "label")

    @property
    @pulumi.getter(name="provisionedEntitlements")
    def provisioned_entitlements(self) -> bool:
        return pulumi.get(self, "provisioned_entitlements")

    @property
    @pulumi.getter(name="skipIfBlank")
    def skip_if_blank(self) -> bool:
        return pulumi.get(self, "skip_if_blank")

    @property
    @pulumi.getter(name="userAttributeMacros")
    def user_attribute_macros(self) -> str:
        return pulumi.get(self, "user_attribute_macros")

    @property
    @pulumi.getter(name="userAttributeMappings")
    def user_attribute_mappings(self) -> str:
        return pulumi.get(self, "user_attribute_mappings")

    @property
    @pulumi.getter
    def values(self) -> str:
        return pulumi.get(self, "values")


@pulumi.output_type
class GetAppsProvisioningResult(dict):
    def __init__(__self__, *,
                 enabled: bool,
                 status: str):
        pulumi.set(__self__, "enabled", enabled)
        pulumi.set(__self__, "status", status)

    @property
    @pulumi.getter
    def enabled(self) -> bool:
        return pulumi.get(self, "enabled")

    @property
    @pulumi.getter
    def status(self) -> str:
        return pulumi.get(self, "status")


@pulumi.output_type
class GetAppsSsoResult(dict):
    def __init__(__self__, *,
                 acs_url: str,
                 certificate: 'outputs.GetAppsSsoCertificateResult',
                 client_id: str,
                 client_secret: str,
                 issuer: str,
                 metadata_url: str):
        """
        :param str acs_url: App Name.	This is only returned after Creating a SAML App.
        :param 'GetAppsSsoCertificateArgs' certificate: The certificate used for signing.	This is only returned after Creating a SAML App.
        :param str client_id: The OpenId Connect Client Id. Note that client_secret is only returned after Creating an OIDC App.
        :param str client_secret: OpenId Connet Client Secret
        :param str issuer: Issuer of app.	This is only returned after Creating a SAML App.
        :param str metadata_url: ID of the apps underlying connector.	This is only returned after Creating a SAML App.
        """
        pulumi.set(__self__, "acs_url", acs_url)
        pulumi.set(__self__, "certificate", certificate)
        pulumi.set(__self__, "client_id", client_id)
        pulumi.set(__self__, "client_secret", client_secret)
        pulumi.set(__self__, "issuer", issuer)
        pulumi.set(__self__, "metadata_url", metadata_url)

    @property
    @pulumi.getter(name="acsUrl")
    def acs_url(self) -> str:
        """
        App Name.	This is only returned after Creating a SAML App.
        """
        return pulumi.get(self, "acs_url")

    @property
    @pulumi.getter
    def certificate(self) -> 'outputs.GetAppsSsoCertificateResult':
        """
        The certificate used for signing.	This is only returned after Creating a SAML App.
        """
        return pulumi.get(self, "certificate")

    @property
    @pulumi.getter(name="clientId")
    def client_id(self) -> str:
        """
        The OpenId Connect Client Id. Note that client_secret is only returned after Creating an OIDC App.
        """
        return pulumi.get(self, "client_id")

    @property
    @pulumi.getter(name="clientSecret")
    def client_secret(self) -> str:
        """
        OpenId Connet Client Secret
        """
        return pulumi.get(self, "client_secret")

    @property
    @pulumi.getter
    def issuer(self) -> str:
        """
        Issuer of app.	This is only returned after Creating a SAML App.
        """
        return pulumi.get(self, "issuer")

    @property
    @pulumi.getter(name="metadataUrl")
    def metadata_url(self) -> str:
        """
        ID of the apps underlying connector.	This is only returned after Creating a SAML App.
        """
        return pulumi.get(self, "metadata_url")


@pulumi.output_type
class GetAppsSsoCertificateResult(dict):
    def __init__(__self__, *,
                 id: int,
                 name: str,
                 value: str):
        pulumi.set(__self__, "id", id)
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def id(self) -> int:
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def name(self) -> str:
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def value(self) -> str:
        return pulumi.get(self, "value")


@pulumi.output_type
class GetAuthServersClaimsFilterResult(dict):
    def __init__(__self__, *,
                 name: str,
                 values: Sequence[str]):
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "values", values)

    @property
    @pulumi.getter
    def name(self) -> str:
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def values(self) -> Sequence[str]:
        return pulumi.get(self, "values")


@pulumi.output_type
class GetAuthServersConfigurationResult(dict):
    def __init__(__self__, *,
                 access_token_expiration_minutes: int,
                 audiences: Sequence[str],
                 refresh_token_expiration_minutes: int,
                 resource_identifier: str):
        """
        :param int access_token_expiration_minutes: The number of minutes until access token expires. There is no maximum expiry limit.
        :param Sequence[str] audiences: List of API endpoints that will be returned in Access Tokens.
        :param int refresh_token_expiration_minutes: The number of minutes until refresh token expires. There is no maximum expiry limit.
        :param str resource_identifier: Unique identifier for the API that the Authorization Server will issue Access Tokens for.
        """
        pulumi.set(__self__, "access_token_expiration_minutes", access_token_expiration_minutes)
        pulumi.set(__self__, "audiences", audiences)
        pulumi.set(__self__, "refresh_token_expiration_minutes", refresh_token_expiration_minutes)
        pulumi.set(__self__, "resource_identifier", resource_identifier)

    @property
    @pulumi.getter(name="accessTokenExpirationMinutes")
    def access_token_expiration_minutes(self) -> int:
        """
        The number of minutes until access token expires. There is no maximum expiry limit.
        """
        return pulumi.get(self, "access_token_expiration_minutes")

    @property
    @pulumi.getter
    def audiences(self) -> Sequence[str]:
        """
        List of API endpoints that will be returned in Access Tokens.
        """
        return pulumi.get(self, "audiences")

    @property
    @pulumi.getter(name="refreshTokenExpirationMinutes")
    def refresh_token_expiration_minutes(self) -> int:
        """
        The number of minutes until refresh token expires. There is no maximum expiry limit.
        """
        return pulumi.get(self, "refresh_token_expiration_minutes")

    @property
    @pulumi.getter(name="resourceIdentifier")
    def resource_identifier(self) -> str:
        """
        Unique identifier for the API that the Authorization Server will issue Access Tokens for.
        """
        return pulumi.get(self, "resource_identifier")


@pulumi.output_type
class GetAuthServersFilterResult(dict):
    def __init__(__self__, *,
                 name: str,
                 values: Sequence[str]):
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "values", values)

    @property
    @pulumi.getter
    def name(self) -> str:
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def values(self) -> Sequence[str]:
        return pulumi.get(self, "values")


@pulumi.output_type
class GetAuthServersInstanceConfigurationResult(dict):
    def __init__(__self__, *,
                 access_token_expiration_minutes: int,
                 audiences: Sequence[str],
                 refresh_token_expiration_minutes: int,
                 resource_identifier: str):
        """
        :param int access_token_expiration_minutes: The number of minutes until access token expires. There is no maximum expiry limit.
        :param Sequence[str] audiences: List of API endpoints that will be returned in Access Tokens.
        :param int refresh_token_expiration_minutes: The number of minutes until refresh token expires. There is no maximum expiry limit.
        :param str resource_identifier: Unique identifier for the API that the Authorization Server will issue Access Tokens for.
        """
        pulumi.set(__self__, "access_token_expiration_minutes", access_token_expiration_minutes)
        pulumi.set(__self__, "audiences", audiences)
        pulumi.set(__self__, "refresh_token_expiration_minutes", refresh_token_expiration_minutes)
        pulumi.set(__self__, "resource_identifier", resource_identifier)

    @property
    @pulumi.getter(name="accessTokenExpirationMinutes")
    def access_token_expiration_minutes(self) -> int:
        """
        The number of minutes until access token expires. There is no maximum expiry limit.
        """
        return pulumi.get(self, "access_token_expiration_minutes")

    @property
    @pulumi.getter
    def audiences(self) -> Sequence[str]:
        """
        List of API endpoints that will be returned in Access Tokens.
        """
        return pulumi.get(self, "audiences")

    @property
    @pulumi.getter(name="refreshTokenExpirationMinutes")
    def refresh_token_expiration_minutes(self) -> int:
        """
        The number of minutes until refresh token expires. There is no maximum expiry limit.
        """
        return pulumi.get(self, "refresh_token_expiration_minutes")

    @property
    @pulumi.getter(name="resourceIdentifier")
    def resource_identifier(self) -> str:
        """
        Unique identifier for the API that the Authorization Server will issue Access Tokens for.
        """
        return pulumi.get(self, "resource_identifier")


@pulumi.output_type
class GetAuthServersScopesFilterResult(dict):
    def __init__(__self__, *,
                 name: str,
                 values: Sequence[str]):
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "values", values)

    @property
    @pulumi.getter
    def name(self) -> str:
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def values(self) -> Sequence[str]:
        return pulumi.get(self, "values")


@pulumi.output_type
class GetMappingsActionResult(dict):
    def __init__(__self__, *,
                 action: str,
                 values: Sequence[str]):
        """
        :param str action: The action to apply
        :param Sequence[str] values: Only applicable to provisioned and set_* actions. Items in the array will be a plain text string or valid value for the selected action.
        """
        pulumi.set(__self__, "action", action)
        pulumi.set(__self__, "values", values)

    @property
    @pulumi.getter
    def action(self) -> str:
        """
        The action to apply
        """
        return pulumi.get(self, "action")

    @property
    @pulumi.getter
    def values(self) -> Sequence[str]:
        """
        Only applicable to provisioned and set_* actions. Items in the array will be a plain text string or valid value for the selected action.
        """
        return pulumi.get(self, "values")


@pulumi.output_type
class GetMappingsConditionResult(dict):
    def __init__(__self__, *,
                 operator: str,
                 source: str,
                 value: str):
        """
        :param str operator: A valid operator for the selected condition source
        :param str source: source field to check.
        :param str value: A plain text string or valid value for the selected  condition source
        """
        pulumi.set(__self__, "operator", operator)
        pulumi.set(__self__, "source", source)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def operator(self) -> str:
        """
        A valid operator for the selected condition source
        """
        return pulumi.get(self, "operator")

    @property
    @pulumi.getter
    def source(self) -> str:
        """
        source field to check.
        """
        return pulumi.get(self, "source")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        A plain text string or valid value for the selected  condition source
        """
        return pulumi.get(self, "value")


@pulumi.output_type
class GetMappingsFilterResult(dict):
    def __init__(__self__, *,
                 name: str,
                 values: Sequence[str]):
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "values", values)

    @property
    @pulumi.getter
    def name(self) -> str:
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def values(self) -> Sequence[str]:
        return pulumi.get(self, "values")


@pulumi.output_type
class GetPrivilegesFilterResult(dict):
    def __init__(__self__, *,
                 name: str,
                 values: Sequence[str]):
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "values", values)

    @property
    @pulumi.getter
    def name(self) -> str:
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def values(self) -> Sequence[str]:
        return pulumi.get(self, "values")


@pulumi.output_type
class GetPrivilegesInstancePrivilegeResult(dict):
    def __init__(__self__, *,
                 statements: Sequence['outputs.GetPrivilegesInstancePrivilegeStatementResult'],
                 version: str):
        pulumi.set(__self__, "statements", statements)
        pulumi.set(__self__, "version", version)

    @property
    @pulumi.getter
    def statements(self) -> Sequence['outputs.GetPrivilegesInstancePrivilegeStatementResult']:
        return pulumi.get(self, "statements")

    @property
    @pulumi.getter
    def version(self) -> str:
        return pulumi.get(self, "version")


@pulumi.output_type
class GetPrivilegesInstancePrivilegeStatementResult(dict):
    def __init__(__self__, *,
                 actions: Sequence[str],
                 effect: str,
                 scopes: Sequence[str]):
        """
        :param Sequence[str] actions: An array of strings that represent actions within OneLogin. Actions are prefixed with the class of object they are related to and followed by a specific action for the given class.
               e.g. users:List, where the class is users and the specific action is List. Don’t mix classes within an Action array. To create a privilege that includes multiple different classes, create multiple statements. A wildcard * that includes all actions is supported. Use wildcards to create a Super User privilege.
        :param str effect: Set to “Allow.” By default, all actions are denied, this Statement allows the listed actions to be executed.
        :param Sequence[str] scopes: Target the privileged action against specific resources with the scope.
               The scope pattern is the class of object used by the Action, followed by an ID that represents a resource in OneLogin.
               e.g. apps/1234, where apps is the class and 1234 is the ID of an app.
               The wildcard * is supported and indicates that all resources of the class type declared, in the Action, are in scope.
               The Action and Scope classes must match. However, there is an exception, a scope of roles/{role_id} can be combined with Actions on the user or app class. The exception allows you to target groups of users or apps with specific actions.
        """
        pulumi.set(__self__, "actions", actions)
        pulumi.set(__self__, "effect", effect)
        pulumi.set(__self__, "scopes", scopes)

    @property
    @pulumi.getter
    def actions(self) -> Sequence[str]:
        """
        An array of strings that represent actions within OneLogin. Actions are prefixed with the class of object they are related to and followed by a specific action for the given class.
        e.g. users:List, where the class is users and the specific action is List. Don’t mix classes within an Action array. To create a privilege that includes multiple different classes, create multiple statements. A wildcard * that includes all actions is supported. Use wildcards to create a Super User privilege.
        """
        return pulumi.get(self, "actions")

    @property
    @pulumi.getter
    def effect(self) -> str:
        """
        Set to “Allow.” By default, all actions are denied, this Statement allows the listed actions to be executed.
        """
        return pulumi.get(self, "effect")

    @property
    @pulumi.getter
    def scopes(self) -> Sequence[str]:
        """
        Target the privileged action against specific resources with the scope.
        The scope pattern is the class of object used by the Action, followed by an ID that represents a resource in OneLogin.
        e.g. apps/1234, where apps is the class and 1234 is the ID of an app.
        The wildcard * is supported and indicates that all resources of the class type declared, in the Action, are in scope.
        The Action and Scope classes must match. However, there is an exception, a scope of roles/{role_id} can be combined with Actions on the user or app class. The exception allows you to target groups of users or apps with specific actions.
        """
        return pulumi.get(self, "scopes")


@pulumi.output_type
class GetPrivilegesPrivilegeResult(dict):
    def __init__(__self__, *,
                 statements: Sequence['outputs.GetPrivilegesPrivilegeStatementResult'],
                 version: str):
        pulumi.set(__self__, "statements", statements)
        pulumi.set(__self__, "version", version)

    @property
    @pulumi.getter
    def statements(self) -> Sequence['outputs.GetPrivilegesPrivilegeStatementResult']:
        return pulumi.get(self, "statements")

    @property
    @pulumi.getter
    def version(self) -> str:
        return pulumi.get(self, "version")


@pulumi.output_type
class GetPrivilegesPrivilegeStatementResult(dict):
    def __init__(__self__, *,
                 actions: Sequence[str],
                 effect: str,
                 scopes: Sequence[str]):
        """
        :param Sequence[str] actions: An array of strings that represent actions within OneLogin. Actions are prefixed with the class of object they are related to and followed by a specific action for the given class.
               e.g. users:List, where the class is users and the specific action is List. Don’t mix classes within an Action array. To create a privilege that includes multiple different classes, create multiple statements. A wildcard * that includes all actions is supported. Use wildcards to create a Super User privilege.
        :param str effect: Set to “Allow.” By default, all actions are denied, this Statement allows the listed actions to be executed.
        :param Sequence[str] scopes: Target the privileged action against specific resources with the scope.
               The scope pattern is the class of object used by the Action, followed by an ID that represents a resource in OneLogin.
               e.g. apps/1234, where apps is the class and 1234 is the ID of an app.
               The wildcard * is supported and indicates that all resources of the class type declared, in the Action, are in scope.
               The Action and Scope classes must match. However, there is an exception, a scope of roles/{role_id} can be combined with Actions on the user or app class. The exception allows you to target groups of users or apps with specific actions.
        """
        pulumi.set(__self__, "actions", actions)
        pulumi.set(__self__, "effect", effect)
        pulumi.set(__self__, "scopes", scopes)

    @property
    @pulumi.getter
    def actions(self) -> Sequence[str]:
        """
        An array of strings that represent actions within OneLogin. Actions are prefixed with the class of object they are related to and followed by a specific action for the given class.
        e.g. users:List, where the class is users and the specific action is List. Don’t mix classes within an Action array. To create a privilege that includes multiple different classes, create multiple statements. A wildcard * that includes all actions is supported. Use wildcards to create a Super User privilege.
        """
        return pulumi.get(self, "actions")

    @property
    @pulumi.getter
    def effect(self) -> str:
        """
        Set to “Allow.” By default, all actions are denied, this Statement allows the listed actions to be executed.
        """
        return pulumi.get(self, "effect")

    @property
    @pulumi.getter
    def scopes(self) -> Sequence[str]:
        """
        Target the privileged action against specific resources with the scope.
        The scope pattern is the class of object used by the Action, followed by an ID that represents a resource in OneLogin.
        e.g. apps/1234, where apps is the class and 1234 is the ID of an app.
        The wildcard * is supported and indicates that all resources of the class type declared, in the Action, are in scope.
        The Action and Scope classes must match. However, there is an exception, a scope of roles/{role_id} can be combined with Actions on the user or app class. The exception allows you to target groups of users or apps with specific actions.
        """
        return pulumi.get(self, "scopes")


@pulumi.output_type
class GetRiskRulesFilterResult(dict):
    def __init__(__self__, *,
                 name: str,
                 values: Sequence[str]):
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "values", values)

    @property
    @pulumi.getter
    def name(self) -> str:
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def values(self) -> Sequence[str]:
        return pulumi.get(self, "values")


@pulumi.output_type
class GetRiskRulesInstanceSourceResult(dict):
    def __init__(__self__, *,
                 id: str,
                 name: str):
        """
        :param str id: A unique id that represents the source of the event.
        :param str name: The name of the source
        """
        pulumi.set(__self__, "id", id)
        pulumi.set(__self__, "name", name)

    @property
    @pulumi.getter
    def id(self) -> str:
        """
        A unique id that represents the source of the event.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the source
        """
        return pulumi.get(self, "name")


@pulumi.output_type
class GetRiskRulesSourceResult(dict):
    def __init__(__self__, *,
                 id: str,
                 name: str):
        """
        :param str id: A unique id that represents the source of the event.
        :param str name: The name of the source
        """
        pulumi.set(__self__, "id", id)
        pulumi.set(__self__, "name", name)

    @property
    @pulumi.getter
    def id(self) -> str:
        """
        A unique id that represents the source of the event.
        """
        return pulumi.get(self, "id")

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        The name of the source
        """
        return pulumi.get(self, "name")


