# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

from __future__ import annotations

from typing import Type, Union, Optional, cast
from datetime import datetime

import httpx

from ...._types import Body, Omit, Query, Headers, NotGiven, omit, not_given
from ...._utils import path_template, maybe_transform, async_maybe_transform
from ...._compat import cached_property
from ...._resource import SyncAPIResource, AsyncAPIResource
from ...._response import (
    to_raw_response_wrapper,
    to_streamed_response_wrapper,
    async_to_raw_response_wrapper,
    async_to_streamed_response_wrapper,
)
from ...._wrappers import ResultWrapper
from ....pagination import SyncV4PagePaginationArray, AsyncV4PagePaginationArray
from ...._base_client import AsyncPaginator, make_request_options
from ....types.zero_trust.access import (
    service_token_list_params,
    service_token_create_params,
    service_token_rotate_params,
    service_token_update_params,
)
from ....types.zero_trust.access.service_token import ServiceToken
from ....types.zero_trust.access.service_token_create_response import ServiceTokenCreateResponse
from ....types.zero_trust.access.service_token_rotate_response import ServiceTokenRotateResponse

__all__ = ["ServiceTokensResource", "AsyncServiceTokensResource"]


class ServiceTokensResource(SyncAPIResource):
    @cached_property
    def with_raw_response(self) -> ServiceTokensResourceWithRawResponse:
        """
        This property can be used as a prefix for any HTTP method call to return
        the raw response object instead of the parsed content.

        For more information, see https://www.github.com/cloudflare/cloudflare-python#accessing-raw-response-data-eg-headers
        """
        return ServiceTokensResourceWithRawResponse(self)

    @cached_property
    def with_streaming_response(self) -> ServiceTokensResourceWithStreamingResponse:
        """
        An alternative to `.with_raw_response` that doesn't eagerly read the response body.

        For more information, see https://www.github.com/cloudflare/cloudflare-python#with_streaming_response
        """
        return ServiceTokensResourceWithStreamingResponse(self)

    def create(
        self,
        *,
        name: str,
        account_id: str | Omit = omit,
        zone_id: str | Omit = omit,
        client_secret_version: float | Omit = omit,
        duration: str | Omit = omit,
        previous_client_secret_expires_at: Union[str, datetime] | Omit = omit,
        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
        # The extra values given here take precedence over values defined on the client or passed to this method.
        extra_headers: Headers | None = None,
        extra_query: Query | None = None,
        extra_body: Body | None = None,
        timeout: float | httpx.Timeout | None | NotGiven = not_given,
    ) -> Optional[ServiceTokenCreateResponse]:
        """Generates a new service token.

        **Note:** This is the only time you can get the
        Client Secret. If you lose the Client Secret, you will have to rotate the Client
        Secret or create a new service token.

        Args:
          name: The name of the service token.

          account_id: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

          zone_id: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

          client_secret_version: A version number identifying the current `client_secret` associated with the
              service token. Incrementing it triggers a rotation; the previous secret will
              still be accepted until the time indicated by
              `previous_client_secret_expires_at`.

          duration: The duration for how long the service token will be valid. Must be in the format
              `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The
              default is 1 year in hours (8760h).

          previous_client_secret_expires_at: The expiration of the previous `client_secret`. This can be modified at any
              point after a rotation. For example, you may extend it further into the future
              if you need more time to update services with the new secret; or move it into
              the past to immediately invalidate the previous token in case of compromise.

          extra_headers: Send extra headers

          extra_query: Add additional query parameters to the request

          extra_body: Add additional JSON properties to the request

          timeout: Override the client-level default timeout for this request, in seconds
        """
        if account_id and zone_id:
            raise ValueError("You cannot provide both account_id and zone_id")

        if account_id:
            account_or_zone = "accounts"
            account_or_zone_id = account_id
        else:
            if not zone_id:
                raise ValueError("You must provide either account_id or zone_id")

            account_or_zone = "zones"
            account_or_zone_id = zone_id
        return self._post(
            path_template(
                "/{account_or_zone}/{account_or_zone_id}/access/service_tokens",
                account_or_zone=account_or_zone,
                account_or_zone_id=account_or_zone_id,
            ),
            body=maybe_transform(
                {
                    "name": name,
                    "client_secret_version": client_secret_version,
                    "duration": duration,
                    "previous_client_secret_expires_at": previous_client_secret_expires_at,
                },
                service_token_create_params.ServiceTokenCreateParams,
            ),
            options=make_request_options(
                extra_headers=extra_headers,
                extra_query=extra_query,
                extra_body=extra_body,
                timeout=timeout,
                post_parser=ResultWrapper[Optional[ServiceTokenCreateResponse]]._unwrapper,
            ),
            cast_to=cast(Type[Optional[ServiceTokenCreateResponse]], ResultWrapper[ServiceTokenCreateResponse]),
        )

    def update(
        self,
        service_token_id: str,
        *,
        account_id: str | Omit = omit,
        zone_id: str | Omit = omit,
        client_secret_version: float | Omit = omit,
        duration: str | Omit = omit,
        name: str | Omit = omit,
        previous_client_secret_expires_at: Union[str, datetime] | Omit = omit,
        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
        # The extra values given here take precedence over values defined on the client or passed to this method.
        extra_headers: Headers | None = None,
        extra_query: Query | None = None,
        extra_body: Body | None = None,
        timeout: float | httpx.Timeout | None | NotGiven = not_given,
    ) -> Optional[ServiceToken]:
        """
        Updates a configured service token.

        Args:
          service_token_id: UUID.

          account_id: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

          zone_id: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

          client_secret_version: A version number identifying the current `client_secret` associated with the
              service token. Incrementing it triggers a rotation; the previous secret will
              still be accepted until the time indicated by
              `previous_client_secret_expires_at`.

          duration: The duration for how long the service token will be valid. Must be in the format
              `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The
              default is 1 year in hours (8760h).

          name: The name of the service token.

          previous_client_secret_expires_at: The expiration of the previous `client_secret`. This can be modified at any
              point after a rotation. For example, you may extend it further into the future
              if you need more time to update services with the new secret; or move it into
              the past to immediately invalidate the previous token in case of compromise.

          extra_headers: Send extra headers

          extra_query: Add additional query parameters to the request

          extra_body: Add additional JSON properties to the request

          timeout: Override the client-level default timeout for this request, in seconds
        """
        if not service_token_id:
            raise ValueError(f"Expected a non-empty value for `service_token_id` but received {service_token_id!r}")
        if account_id and zone_id:
            raise ValueError("You cannot provide both account_id and zone_id")

        if account_id:
            account_or_zone = "accounts"
            account_or_zone_id = account_id
        else:
            if not zone_id:
                raise ValueError("You must provide either account_id or zone_id")

            account_or_zone = "zones"
            account_or_zone_id = zone_id
        return self._put(
            path_template(
                "/{account_or_zone}/{account_or_zone_id}/access/service_tokens/{service_token_id}",
                service_token_id=service_token_id,
                account_or_zone=account_or_zone,
                account_or_zone_id=account_or_zone_id,
            ),
            body=maybe_transform(
                {
                    "client_secret_version": client_secret_version,
                    "duration": duration,
                    "name": name,
                    "previous_client_secret_expires_at": previous_client_secret_expires_at,
                },
                service_token_update_params.ServiceTokenUpdateParams,
            ),
            options=make_request_options(
                extra_headers=extra_headers,
                extra_query=extra_query,
                extra_body=extra_body,
                timeout=timeout,
                post_parser=ResultWrapper[Optional[ServiceToken]]._unwrapper,
            ),
            cast_to=cast(Type[Optional[ServiceToken]], ResultWrapper[ServiceToken]),
        )

    def list(
        self,
        *,
        account_id: str | Omit = omit,
        zone_id: str | Omit = omit,
        name: str | Omit = omit,
        page: int | Omit = omit,
        per_page: int | Omit = omit,
        search: str | Omit = omit,
        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
        # The extra values given here take precedence over values defined on the client or passed to this method.
        extra_headers: Headers | None = None,
        extra_query: Query | None = None,
        extra_body: Body | None = None,
        timeout: float | httpx.Timeout | None | NotGiven = not_given,
    ) -> SyncV4PagePaginationArray[ServiceToken]:
        """
        Lists all service tokens.

        Args:
          account_id: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

          zone_id: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

          name: The name of the service token.

          page: Page number of results.

          per_page: Number of results per page.

          search: Search for service tokens by other listed query parameters.

          extra_headers: Send extra headers

          extra_query: Add additional query parameters to the request

          extra_body: Add additional JSON properties to the request

          timeout: Override the client-level default timeout for this request, in seconds
        """
        if account_id and zone_id:
            raise ValueError("You cannot provide both account_id and zone_id")

        if account_id:
            account_or_zone = "accounts"
            account_or_zone_id = account_id
        else:
            if not zone_id:
                raise ValueError("You must provide either account_id or zone_id")

            account_or_zone = "zones"
            account_or_zone_id = zone_id
        return self._get_api_list(
            path_template(
                "/{account_or_zone}/{account_or_zone_id}/access/service_tokens",
                account_or_zone=account_or_zone,
                account_or_zone_id=account_or_zone_id,
            ),
            page=SyncV4PagePaginationArray[ServiceToken],
            options=make_request_options(
                extra_headers=extra_headers,
                extra_query=extra_query,
                extra_body=extra_body,
                timeout=timeout,
                query=maybe_transform(
                    {
                        "name": name,
                        "page": page,
                        "per_page": per_page,
                        "search": search,
                    },
                    service_token_list_params.ServiceTokenListParams,
                ),
            ),
            model=ServiceToken,
        )

    def delete(
        self,
        service_token_id: str,
        *,
        account_id: str | Omit = omit,
        zone_id: str | Omit = omit,
        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
        # The extra values given here take precedence over values defined on the client or passed to this method.
        extra_headers: Headers | None = None,
        extra_query: Query | None = None,
        extra_body: Body | None = None,
        timeout: float | httpx.Timeout | None | NotGiven = not_given,
    ) -> Optional[ServiceToken]:
        """
        Deletes a service token.

        Args:
          service_token_id: UUID.

          account_id: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

          zone_id: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

          extra_headers: Send extra headers

          extra_query: Add additional query parameters to the request

          extra_body: Add additional JSON properties to the request

          timeout: Override the client-level default timeout for this request, in seconds
        """
        if not service_token_id:
            raise ValueError(f"Expected a non-empty value for `service_token_id` but received {service_token_id!r}")
        if account_id and zone_id:
            raise ValueError("You cannot provide both account_id and zone_id")

        if account_id:
            account_or_zone = "accounts"
            account_or_zone_id = account_id
        else:
            if not zone_id:
                raise ValueError("You must provide either account_id or zone_id")

            account_or_zone = "zones"
            account_or_zone_id = zone_id
        return self._delete(
            path_template(
                "/{account_or_zone}/{account_or_zone_id}/access/service_tokens/{service_token_id}",
                service_token_id=service_token_id,
                account_or_zone=account_or_zone,
                account_or_zone_id=account_or_zone_id,
            ),
            options=make_request_options(
                extra_headers=extra_headers,
                extra_query=extra_query,
                extra_body=extra_body,
                timeout=timeout,
                post_parser=ResultWrapper[Optional[ServiceToken]]._unwrapper,
            ),
            cast_to=cast(Type[Optional[ServiceToken]], ResultWrapper[ServiceToken]),
        )

    def get(
        self,
        service_token_id: str,
        *,
        account_id: str | Omit = omit,
        zone_id: str | Omit = omit,
        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
        # The extra values given here take precedence over values defined on the client or passed to this method.
        extra_headers: Headers | None = None,
        extra_query: Query | None = None,
        extra_body: Body | None = None,
        timeout: float | httpx.Timeout | None | NotGiven = not_given,
    ) -> Optional[ServiceToken]:
        """
        Fetches a single service token.

        Args:
          service_token_id: UUID.

          account_id: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

          zone_id: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

          extra_headers: Send extra headers

          extra_query: Add additional query parameters to the request

          extra_body: Add additional JSON properties to the request

          timeout: Override the client-level default timeout for this request, in seconds
        """
        if not service_token_id:
            raise ValueError(f"Expected a non-empty value for `service_token_id` but received {service_token_id!r}")
        if account_id and zone_id:
            raise ValueError("You cannot provide both account_id and zone_id")

        if account_id:
            account_or_zone = "accounts"
            account_or_zone_id = account_id
        else:
            if not zone_id:
                raise ValueError("You must provide either account_id or zone_id")

            account_or_zone = "zones"
            account_or_zone_id = zone_id
        return self._get(
            path_template(
                "/{account_or_zone}/{account_or_zone_id}/access/service_tokens/{service_token_id}",
                service_token_id=service_token_id,
                account_or_zone=account_or_zone,
                account_or_zone_id=account_or_zone_id,
            ),
            options=make_request_options(
                extra_headers=extra_headers,
                extra_query=extra_query,
                extra_body=extra_body,
                timeout=timeout,
                post_parser=ResultWrapper[Optional[ServiceToken]]._unwrapper,
            ),
            cast_to=cast(Type[Optional[ServiceToken]], ResultWrapper[ServiceToken]),
        )

    def refresh(
        self,
        service_token_id: str,
        *,
        account_id: str,
        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
        # The extra values given here take precedence over values defined on the client or passed to this method.
        extra_headers: Headers | None = None,
        extra_query: Query | None = None,
        extra_body: Body | None = None,
        timeout: float | httpx.Timeout | None | NotGiven = not_given,
    ) -> Optional[ServiceToken]:
        """
        Refreshes the expiration of a service token.

        Args:
          account_id: Identifier.

          service_token_id: UUID.

          extra_headers: Send extra headers

          extra_query: Add additional query parameters to the request

          extra_body: Add additional JSON properties to the request

          timeout: Override the client-level default timeout for this request, in seconds
        """
        if not account_id:
            raise ValueError(f"Expected a non-empty value for `account_id` but received {account_id!r}")
        if not service_token_id:
            raise ValueError(f"Expected a non-empty value for `service_token_id` but received {service_token_id!r}")
        return self._post(
            path_template(
                "/accounts/{account_id}/access/service_tokens/{service_token_id}/refresh",
                account_id=account_id,
                service_token_id=service_token_id,
            ),
            options=make_request_options(
                extra_headers=extra_headers,
                extra_query=extra_query,
                extra_body=extra_body,
                timeout=timeout,
                post_parser=ResultWrapper[Optional[ServiceToken]]._unwrapper,
            ),
            cast_to=cast(Type[Optional[ServiceToken]], ResultWrapper[ServiceToken]),
        )

    def rotate(
        self,
        service_token_id: str,
        *,
        account_id: str,
        previous_client_secret_expires_at: Union[str, datetime] | Omit = omit,
        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
        # The extra values given here take precedence over values defined on the client or passed to this method.
        extra_headers: Headers | None = None,
        extra_query: Query | None = None,
        extra_body: Body | None = None,
        timeout: float | httpx.Timeout | None | NotGiven = not_given,
    ) -> Optional[ServiceTokenRotateResponse]:
        """
        Generates a new Client Secret for a service token and revokes the old one.

        Args:
          account_id: Identifier.

          service_token_id: UUID.

          previous_client_secret_expires_at: The expiration of the previous `client_secret`. If not provided, it defaults to
              the current timestamp in order to immediately expire the previous secret.

          extra_headers: Send extra headers

          extra_query: Add additional query parameters to the request

          extra_body: Add additional JSON properties to the request

          timeout: Override the client-level default timeout for this request, in seconds
        """
        if not account_id:
            raise ValueError(f"Expected a non-empty value for `account_id` but received {account_id!r}")
        if not service_token_id:
            raise ValueError(f"Expected a non-empty value for `service_token_id` but received {service_token_id!r}")
        return self._post(
            path_template(
                "/accounts/{account_id}/access/service_tokens/{service_token_id}/rotate",
                account_id=account_id,
                service_token_id=service_token_id,
            ),
            body=maybe_transform(
                {"previous_client_secret_expires_at": previous_client_secret_expires_at},
                service_token_rotate_params.ServiceTokenRotateParams,
            ),
            options=make_request_options(
                extra_headers=extra_headers,
                extra_query=extra_query,
                extra_body=extra_body,
                timeout=timeout,
                post_parser=ResultWrapper[Optional[ServiceTokenRotateResponse]]._unwrapper,
            ),
            cast_to=cast(Type[Optional[ServiceTokenRotateResponse]], ResultWrapper[ServiceTokenRotateResponse]),
        )


class AsyncServiceTokensResource(AsyncAPIResource):
    @cached_property
    def with_raw_response(self) -> AsyncServiceTokensResourceWithRawResponse:
        """
        This property can be used as a prefix for any HTTP method call to return
        the raw response object instead of the parsed content.

        For more information, see https://www.github.com/cloudflare/cloudflare-python#accessing-raw-response-data-eg-headers
        """
        return AsyncServiceTokensResourceWithRawResponse(self)

    @cached_property
    def with_streaming_response(self) -> AsyncServiceTokensResourceWithStreamingResponse:
        """
        An alternative to `.with_raw_response` that doesn't eagerly read the response body.

        For more information, see https://www.github.com/cloudflare/cloudflare-python#with_streaming_response
        """
        return AsyncServiceTokensResourceWithStreamingResponse(self)

    async def create(
        self,
        *,
        name: str,
        account_id: str | Omit = omit,
        zone_id: str | Omit = omit,
        client_secret_version: float | Omit = omit,
        duration: str | Omit = omit,
        previous_client_secret_expires_at: Union[str, datetime] | Omit = omit,
        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
        # The extra values given here take precedence over values defined on the client or passed to this method.
        extra_headers: Headers | None = None,
        extra_query: Query | None = None,
        extra_body: Body | None = None,
        timeout: float | httpx.Timeout | None | NotGiven = not_given,
    ) -> Optional[ServiceTokenCreateResponse]:
        """Generates a new service token.

        **Note:** This is the only time you can get the
        Client Secret. If you lose the Client Secret, you will have to rotate the Client
        Secret or create a new service token.

        Args:
          name: The name of the service token.

          account_id: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

          zone_id: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

          client_secret_version: A version number identifying the current `client_secret` associated with the
              service token. Incrementing it triggers a rotation; the previous secret will
              still be accepted until the time indicated by
              `previous_client_secret_expires_at`.

          duration: The duration for how long the service token will be valid. Must be in the format
              `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The
              default is 1 year in hours (8760h).

          previous_client_secret_expires_at: The expiration of the previous `client_secret`. This can be modified at any
              point after a rotation. For example, you may extend it further into the future
              if you need more time to update services with the new secret; or move it into
              the past to immediately invalidate the previous token in case of compromise.

          extra_headers: Send extra headers

          extra_query: Add additional query parameters to the request

          extra_body: Add additional JSON properties to the request

          timeout: Override the client-level default timeout for this request, in seconds
        """
        if account_id and zone_id:
            raise ValueError("You cannot provide both account_id and zone_id")

        if account_id:
            account_or_zone = "accounts"
            account_or_zone_id = account_id
        else:
            if not zone_id:
                raise ValueError("You must provide either account_id or zone_id")

            account_or_zone = "zones"
            account_or_zone_id = zone_id
        return await self._post(
            path_template(
                "/{account_or_zone}/{account_or_zone_id}/access/service_tokens",
                account_or_zone=account_or_zone,
                account_or_zone_id=account_or_zone_id,
            ),
            body=await async_maybe_transform(
                {
                    "name": name,
                    "client_secret_version": client_secret_version,
                    "duration": duration,
                    "previous_client_secret_expires_at": previous_client_secret_expires_at,
                },
                service_token_create_params.ServiceTokenCreateParams,
            ),
            options=make_request_options(
                extra_headers=extra_headers,
                extra_query=extra_query,
                extra_body=extra_body,
                timeout=timeout,
                post_parser=ResultWrapper[Optional[ServiceTokenCreateResponse]]._unwrapper,
            ),
            cast_to=cast(Type[Optional[ServiceTokenCreateResponse]], ResultWrapper[ServiceTokenCreateResponse]),
        )

    async def update(
        self,
        service_token_id: str,
        *,
        account_id: str | Omit = omit,
        zone_id: str | Omit = omit,
        client_secret_version: float | Omit = omit,
        duration: str | Omit = omit,
        name: str | Omit = omit,
        previous_client_secret_expires_at: Union[str, datetime] | Omit = omit,
        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
        # The extra values given here take precedence over values defined on the client or passed to this method.
        extra_headers: Headers | None = None,
        extra_query: Query | None = None,
        extra_body: Body | None = None,
        timeout: float | httpx.Timeout | None | NotGiven = not_given,
    ) -> Optional[ServiceToken]:
        """
        Updates a configured service token.

        Args:
          service_token_id: UUID.

          account_id: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

          zone_id: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

          client_secret_version: A version number identifying the current `client_secret` associated with the
              service token. Incrementing it triggers a rotation; the previous secret will
              still be accepted until the time indicated by
              `previous_client_secret_expires_at`.

          duration: The duration for how long the service token will be valid. Must be in the format
              `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The
              default is 1 year in hours (8760h).

          name: The name of the service token.

          previous_client_secret_expires_at: The expiration of the previous `client_secret`. This can be modified at any
              point after a rotation. For example, you may extend it further into the future
              if you need more time to update services with the new secret; or move it into
              the past to immediately invalidate the previous token in case of compromise.

          extra_headers: Send extra headers

          extra_query: Add additional query parameters to the request

          extra_body: Add additional JSON properties to the request

          timeout: Override the client-level default timeout for this request, in seconds
        """
        if not service_token_id:
            raise ValueError(f"Expected a non-empty value for `service_token_id` but received {service_token_id!r}")
        if account_id and zone_id:
            raise ValueError("You cannot provide both account_id and zone_id")

        if account_id:
            account_or_zone = "accounts"
            account_or_zone_id = account_id
        else:
            if not zone_id:
                raise ValueError("You must provide either account_id or zone_id")

            account_or_zone = "zones"
            account_or_zone_id = zone_id
        return await self._put(
            path_template(
                "/{account_or_zone}/{account_or_zone_id}/access/service_tokens/{service_token_id}",
                service_token_id=service_token_id,
                account_or_zone=account_or_zone,
                account_or_zone_id=account_or_zone_id,
            ),
            body=await async_maybe_transform(
                {
                    "client_secret_version": client_secret_version,
                    "duration": duration,
                    "name": name,
                    "previous_client_secret_expires_at": previous_client_secret_expires_at,
                },
                service_token_update_params.ServiceTokenUpdateParams,
            ),
            options=make_request_options(
                extra_headers=extra_headers,
                extra_query=extra_query,
                extra_body=extra_body,
                timeout=timeout,
                post_parser=ResultWrapper[Optional[ServiceToken]]._unwrapper,
            ),
            cast_to=cast(Type[Optional[ServiceToken]], ResultWrapper[ServiceToken]),
        )

    def list(
        self,
        *,
        account_id: str | Omit = omit,
        zone_id: str | Omit = omit,
        name: str | Omit = omit,
        page: int | Omit = omit,
        per_page: int | Omit = omit,
        search: str | Omit = omit,
        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
        # The extra values given here take precedence over values defined on the client or passed to this method.
        extra_headers: Headers | None = None,
        extra_query: Query | None = None,
        extra_body: Body | None = None,
        timeout: float | httpx.Timeout | None | NotGiven = not_given,
    ) -> AsyncPaginator[ServiceToken, AsyncV4PagePaginationArray[ServiceToken]]:
        """
        Lists all service tokens.

        Args:
          account_id: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

          zone_id: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

          name: The name of the service token.

          page: Page number of results.

          per_page: Number of results per page.

          search: Search for service tokens by other listed query parameters.

          extra_headers: Send extra headers

          extra_query: Add additional query parameters to the request

          extra_body: Add additional JSON properties to the request

          timeout: Override the client-level default timeout for this request, in seconds
        """
        if account_id and zone_id:
            raise ValueError("You cannot provide both account_id and zone_id")

        if account_id:
            account_or_zone = "accounts"
            account_or_zone_id = account_id
        else:
            if not zone_id:
                raise ValueError("You must provide either account_id or zone_id")

            account_or_zone = "zones"
            account_or_zone_id = zone_id
        return self._get_api_list(
            path_template(
                "/{account_or_zone}/{account_or_zone_id}/access/service_tokens",
                account_or_zone=account_or_zone,
                account_or_zone_id=account_or_zone_id,
            ),
            page=AsyncV4PagePaginationArray[ServiceToken],
            options=make_request_options(
                extra_headers=extra_headers,
                extra_query=extra_query,
                extra_body=extra_body,
                timeout=timeout,
                query=maybe_transform(
                    {
                        "name": name,
                        "page": page,
                        "per_page": per_page,
                        "search": search,
                    },
                    service_token_list_params.ServiceTokenListParams,
                ),
            ),
            model=ServiceToken,
        )

    async def delete(
        self,
        service_token_id: str,
        *,
        account_id: str | Omit = omit,
        zone_id: str | Omit = omit,
        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
        # The extra values given here take precedence over values defined on the client or passed to this method.
        extra_headers: Headers | None = None,
        extra_query: Query | None = None,
        extra_body: Body | None = None,
        timeout: float | httpx.Timeout | None | NotGiven = not_given,
    ) -> Optional[ServiceToken]:
        """
        Deletes a service token.

        Args:
          service_token_id: UUID.

          account_id: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

          zone_id: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

          extra_headers: Send extra headers

          extra_query: Add additional query parameters to the request

          extra_body: Add additional JSON properties to the request

          timeout: Override the client-level default timeout for this request, in seconds
        """
        if not service_token_id:
            raise ValueError(f"Expected a non-empty value for `service_token_id` but received {service_token_id!r}")
        if account_id and zone_id:
            raise ValueError("You cannot provide both account_id and zone_id")

        if account_id:
            account_or_zone = "accounts"
            account_or_zone_id = account_id
        else:
            if not zone_id:
                raise ValueError("You must provide either account_id or zone_id")

            account_or_zone = "zones"
            account_or_zone_id = zone_id
        return await self._delete(
            path_template(
                "/{account_or_zone}/{account_or_zone_id}/access/service_tokens/{service_token_id}",
                service_token_id=service_token_id,
                account_or_zone=account_or_zone,
                account_or_zone_id=account_or_zone_id,
            ),
            options=make_request_options(
                extra_headers=extra_headers,
                extra_query=extra_query,
                extra_body=extra_body,
                timeout=timeout,
                post_parser=ResultWrapper[Optional[ServiceToken]]._unwrapper,
            ),
            cast_to=cast(Type[Optional[ServiceToken]], ResultWrapper[ServiceToken]),
        )

    async def get(
        self,
        service_token_id: str,
        *,
        account_id: str | Omit = omit,
        zone_id: str | Omit = omit,
        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
        # The extra values given here take precedence over values defined on the client or passed to this method.
        extra_headers: Headers | None = None,
        extra_query: Query | None = None,
        extra_body: Body | None = None,
        timeout: float | httpx.Timeout | None | NotGiven = not_given,
    ) -> Optional[ServiceToken]:
        """
        Fetches a single service token.

        Args:
          service_token_id: UUID.

          account_id: The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

          zone_id: The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

          extra_headers: Send extra headers

          extra_query: Add additional query parameters to the request

          extra_body: Add additional JSON properties to the request

          timeout: Override the client-level default timeout for this request, in seconds
        """
        if not service_token_id:
            raise ValueError(f"Expected a non-empty value for `service_token_id` but received {service_token_id!r}")
        if account_id and zone_id:
            raise ValueError("You cannot provide both account_id and zone_id")

        if account_id:
            account_or_zone = "accounts"
            account_or_zone_id = account_id
        else:
            if not zone_id:
                raise ValueError("You must provide either account_id or zone_id")

            account_or_zone = "zones"
            account_or_zone_id = zone_id
        return await self._get(
            path_template(
                "/{account_or_zone}/{account_or_zone_id}/access/service_tokens/{service_token_id}",
                service_token_id=service_token_id,
                account_or_zone=account_or_zone,
                account_or_zone_id=account_or_zone_id,
            ),
            options=make_request_options(
                extra_headers=extra_headers,
                extra_query=extra_query,
                extra_body=extra_body,
                timeout=timeout,
                post_parser=ResultWrapper[Optional[ServiceToken]]._unwrapper,
            ),
            cast_to=cast(Type[Optional[ServiceToken]], ResultWrapper[ServiceToken]),
        )

    async def refresh(
        self,
        service_token_id: str,
        *,
        account_id: str,
        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
        # The extra values given here take precedence over values defined on the client or passed to this method.
        extra_headers: Headers | None = None,
        extra_query: Query | None = None,
        extra_body: Body | None = None,
        timeout: float | httpx.Timeout | None | NotGiven = not_given,
    ) -> Optional[ServiceToken]:
        """
        Refreshes the expiration of a service token.

        Args:
          account_id: Identifier.

          service_token_id: UUID.

          extra_headers: Send extra headers

          extra_query: Add additional query parameters to the request

          extra_body: Add additional JSON properties to the request

          timeout: Override the client-level default timeout for this request, in seconds
        """
        if not account_id:
            raise ValueError(f"Expected a non-empty value for `account_id` but received {account_id!r}")
        if not service_token_id:
            raise ValueError(f"Expected a non-empty value for `service_token_id` but received {service_token_id!r}")
        return await self._post(
            path_template(
                "/accounts/{account_id}/access/service_tokens/{service_token_id}/refresh",
                account_id=account_id,
                service_token_id=service_token_id,
            ),
            options=make_request_options(
                extra_headers=extra_headers,
                extra_query=extra_query,
                extra_body=extra_body,
                timeout=timeout,
                post_parser=ResultWrapper[Optional[ServiceToken]]._unwrapper,
            ),
            cast_to=cast(Type[Optional[ServiceToken]], ResultWrapper[ServiceToken]),
        )

    async def rotate(
        self,
        service_token_id: str,
        *,
        account_id: str,
        previous_client_secret_expires_at: Union[str, datetime] | Omit = omit,
        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
        # The extra values given here take precedence over values defined on the client or passed to this method.
        extra_headers: Headers | None = None,
        extra_query: Query | None = None,
        extra_body: Body | None = None,
        timeout: float | httpx.Timeout | None | NotGiven = not_given,
    ) -> Optional[ServiceTokenRotateResponse]:
        """
        Generates a new Client Secret for a service token and revokes the old one.

        Args:
          account_id: Identifier.

          service_token_id: UUID.

          previous_client_secret_expires_at: The expiration of the previous `client_secret`. If not provided, it defaults to
              the current timestamp in order to immediately expire the previous secret.

          extra_headers: Send extra headers

          extra_query: Add additional query parameters to the request

          extra_body: Add additional JSON properties to the request

          timeout: Override the client-level default timeout for this request, in seconds
        """
        if not account_id:
            raise ValueError(f"Expected a non-empty value for `account_id` but received {account_id!r}")
        if not service_token_id:
            raise ValueError(f"Expected a non-empty value for `service_token_id` but received {service_token_id!r}")
        return await self._post(
            path_template(
                "/accounts/{account_id}/access/service_tokens/{service_token_id}/rotate",
                account_id=account_id,
                service_token_id=service_token_id,
            ),
            body=await async_maybe_transform(
                {"previous_client_secret_expires_at": previous_client_secret_expires_at},
                service_token_rotate_params.ServiceTokenRotateParams,
            ),
            options=make_request_options(
                extra_headers=extra_headers,
                extra_query=extra_query,
                extra_body=extra_body,
                timeout=timeout,
                post_parser=ResultWrapper[Optional[ServiceTokenRotateResponse]]._unwrapper,
            ),
            cast_to=cast(Type[Optional[ServiceTokenRotateResponse]], ResultWrapper[ServiceTokenRotateResponse]),
        )


class ServiceTokensResourceWithRawResponse:
    def __init__(self, service_tokens: ServiceTokensResource) -> None:
        self._service_tokens = service_tokens

        self.create = to_raw_response_wrapper(
            service_tokens.create,
        )
        self.update = to_raw_response_wrapper(
            service_tokens.update,
        )
        self.list = to_raw_response_wrapper(
            service_tokens.list,
        )
        self.delete = to_raw_response_wrapper(
            service_tokens.delete,
        )
        self.get = to_raw_response_wrapper(
            service_tokens.get,
        )
        self.refresh = to_raw_response_wrapper(
            service_tokens.refresh,
        )
        self.rotate = to_raw_response_wrapper(
            service_tokens.rotate,
        )


class AsyncServiceTokensResourceWithRawResponse:
    def __init__(self, service_tokens: AsyncServiceTokensResource) -> None:
        self._service_tokens = service_tokens

        self.create = async_to_raw_response_wrapper(
            service_tokens.create,
        )
        self.update = async_to_raw_response_wrapper(
            service_tokens.update,
        )
        self.list = async_to_raw_response_wrapper(
            service_tokens.list,
        )
        self.delete = async_to_raw_response_wrapper(
            service_tokens.delete,
        )
        self.get = async_to_raw_response_wrapper(
            service_tokens.get,
        )
        self.refresh = async_to_raw_response_wrapper(
            service_tokens.refresh,
        )
        self.rotate = async_to_raw_response_wrapper(
            service_tokens.rotate,
        )


class ServiceTokensResourceWithStreamingResponse:
    def __init__(self, service_tokens: ServiceTokensResource) -> None:
        self._service_tokens = service_tokens

        self.create = to_streamed_response_wrapper(
            service_tokens.create,
        )
        self.update = to_streamed_response_wrapper(
            service_tokens.update,
        )
        self.list = to_streamed_response_wrapper(
            service_tokens.list,
        )
        self.delete = to_streamed_response_wrapper(
            service_tokens.delete,
        )
        self.get = to_streamed_response_wrapper(
            service_tokens.get,
        )
        self.refresh = to_streamed_response_wrapper(
            service_tokens.refresh,
        )
        self.rotate = to_streamed_response_wrapper(
            service_tokens.rotate,
        )


class AsyncServiceTokensResourceWithStreamingResponse:
    def __init__(self, service_tokens: AsyncServiceTokensResource) -> None:
        self._service_tokens = service_tokens

        self.create = async_to_streamed_response_wrapper(
            service_tokens.create,
        )
        self.update = async_to_streamed_response_wrapper(
            service_tokens.update,
        )
        self.list = async_to_streamed_response_wrapper(
            service_tokens.list,
        )
        self.delete = async_to_streamed_response_wrapper(
            service_tokens.delete,
        )
        self.get = async_to_streamed_response_wrapper(
            service_tokens.get,
        )
        self.refresh = async_to_streamed_response_wrapper(
            service_tokens.refresh,
        )
        self.rotate = async_to_streamed_response_wrapper(
            service_tokens.rotate,
        )
