From 4dc94b7a0bad0052f5b217bbbcfd53fbd24efc6b Mon Sep 17 00:00:00 2001
From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com>
Date: Thu, 20 Aug 2026 10:35:52 +0000
Subject: [PATCH] [autofix.ci] apply automated fixes

---
 api/openapi/markdown/console-openapi.md       |  55 +++
 .../api/console/workspaces/orpc.gen.ts        | 382 ++++++++++--------
 .../api/console/workspaces/types.gen.ts       |  55 +++
 .../api/console/workspaces/zod.gen.ts         |  51 +++
 4 files changed, 367 insertions(+), 176 deletions(-)

diff --git a/api/openapi/markdown/console-openapi.md b/api/openapi/markdown/console-openapi.md
index 6e97fe124e3..b474afac463 100644
--- a/api/openapi/markdown/console-openapi.md
+++ b/api/openapi/markdown/console-openapi.md
@@ -10698,6 +10698,26 @@ Update a plugin endpoint
 | ---- | ----------- | ------ |
 | 200 | Available models retrieved successfully | **application/json**: [AvailableModelListResponse](#availablemodellistresponse)<br> |
 
+### [GET] /workspaces/current/network-access-policy
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Workspace network access policies retrieved successfully | **application/json**: [NetworkAccessPolicyListResponse](#networkaccesspolicylistresponse)<br> |
+
+### [PUT] /workspaces/current/network-access-policy
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [NetworkAccessPolicyPayload](#networkaccesspolicypayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Workspace network access policy updated successfully | **application/json**: [NetworkAccessPolicyUpdateResponse](#networkaccesspolicyupdateresponse)<br> |
+
 ### [GET] /workspaces/current/permission
 **Get workspace permission settings**
 
@@ -19087,6 +19107,41 @@ Model with provider entity.
 | dataset | [ResourcePermissionSnapshot](#resourcepermissionsnapshot) |  | No |
 | workspace | [WorkspacePermissionSnapshot](#workspacepermissionsnapshot) |  | No |
 
+#### NetworkAccessPolicyListResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| entitled | boolean |  | Yes |
+| policies | [ [NetworkAccessPolicyResponse](#networkaccesspolicyresponse) ] |  | Yes |
+| tenant_id | string |  | Yes |
+
+#### NetworkAccessPolicyPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| allowed_cidrs | [ string ] |  | Yes |
+| expected_version | integer |  | Yes |
+| mode | string, <br>**Available values:** "disabled", "enforce", "shadow" | *Enum:* `"disabled"`, `"enforce"`, `"shadow"` | Yes |
+| scope | string, <br>**Available values:** "mcp", "plugin_trigger", "service_api", "workflow_webhook" | *Enum:* `"mcp"`, `"plugin_trigger"`, `"service_api"`, `"workflow_webhook"` | Yes |
+
+#### NetworkAccessPolicyResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| allowed_cidrs | [ string ] |  | Yes |
+| created_at | string |  | No |
+| mode | string, <br>**Available values:** "disabled", "enforce", "shadow" | *Enum:* `"disabled"`, `"enforce"`, `"shadow"` | Yes |
+| scope | string, <br>**Available values:** "mcp", "plugin_trigger", "service_api", "workflow_webhook" | *Enum:* `"mcp"`, `"plugin_trigger"`, `"service_api"`, `"workflow_webhook"` | Yes |
+| updated_at | string |  | No |
+| updated_by_account_id | string |  | No |
+| version | integer |  | Yes |
+
+#### NetworkAccessPolicyUpdateResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| policy | [NetworkAccessPolicyResponse](#networkaccesspolicyresponse) |  | Yes |
+
 #### NewAppResponse
 
 | Name | Type | Description | Required |
diff --git a/packages/contracts/generated/api/console/workspaces/orpc.gen.ts b/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
index 292ad4b0ebe..499b3ef6e05 100644
--- a/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
@@ -75,6 +75,7 @@ import {
   zGetWorkspacesCurrentModelProvidersSummaryResponse,
   zGetWorkspacesCurrentModelsModelTypesByModelTypePath,
   zGetWorkspacesCurrentModelsModelTypesByModelTypeResponse,
+  zGetWorkspacesCurrentNetworkAccessPolicyResponse,
   zGetWorkspacesCurrentPermissionResponse,
   zGetWorkspacesCurrentPluginAssetQuery,
   zGetWorkspacesCurrentPluginAssetResponse,
@@ -396,6 +397,8 @@ import {
   zPutWorkspacesCurrentModelProvidersByProviderModelsCredentialsBody,
   zPutWorkspacesCurrentModelProvidersByProviderModelsCredentialsPath,
   zPutWorkspacesCurrentModelProvidersByProviderModelsCredentialsResponse,
+  zPutWorkspacesCurrentNetworkAccessPolicyBody,
+  zPutWorkspacesCurrentNetworkAccessPolicyResponse,
   zPutWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath,
   zPutWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse,
   zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockPath,
@@ -1583,12 +1586,38 @@ export const models2 = {
   modelTypes,
 }
 
+export const get21 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentNetworkAccessPolicy',
+    path: '/workspaces/current/network-access-policy',
+    tags: ['console'],
+  })
+  .output(zGetWorkspacesCurrentNetworkAccessPolicyResponse)
+
+export const put4 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'putWorkspacesCurrentNetworkAccessPolicy',
+    path: '/workspaces/current/network-access-policy',
+    tags: ['console'],
+  })
+  .input(z.object({ body: zPutWorkspacesCurrentNetworkAccessPolicyBody }))
+  .output(zPutWorkspacesCurrentNetworkAccessPolicyResponse)
+
+export const networkAccessPolicy = {
+  get: get21,
+  put: put4,
+}
+
 /**
  * Get workspace permission settings
  *
  * Returns permission flags that control workspace features like member invitations and owner transfer.
  */
-export const get21 = oc
+export const get22 = oc
   .route({
     description:
       'Returns permission flags that control workspace features like member invitations and owner transfer.',
@@ -1602,10 +1631,10 @@ export const get21 = oc
   .output(zGetWorkspacesCurrentPermissionResponse)
 
 export const permission = {
-  get: get21,
+  get: get22,
 }
 
-export const get22 = oc
+export const get23 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1617,7 +1646,7 @@ export const get22 = oc
   .output(zGetWorkspacesCurrentPluginAssetResponse)
 
 export const asset = {
-  get: get22,
+  get: get23,
 }
 
 export const post26 = oc
@@ -1650,7 +1679,7 @@ export const exclude = {
   post: post27,
 }
 
-export const get23 = oc
+export const get24 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1662,7 +1691,7 @@ export const get23 = oc
   .output(zGetWorkspacesCurrentPluginAutoUpgradeFetchResponse)
 
 export const fetch_ = {
-  get: get23,
+  get: get24,
 }
 
 export const autoUpgrade = {
@@ -1671,7 +1700,7 @@ export const autoUpgrade = {
   fetch: fetch_,
 }
 
-export const get24 = oc
+export const get25 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1682,10 +1711,10 @@ export const get24 = oc
   .output(zGetWorkspacesCurrentPluginDebuggingKeyResponse)
 
 export const debuggingKey = {
-  get: get24,
+  get: get25,
 }
 
-export const get25 = oc
+export const get26 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1697,10 +1726,10 @@ export const get25 = oc
   .output(zGetWorkspacesCurrentPluginFetchManifestResponse)
 
 export const fetchManifest = {
-  get: get25,
+  get: get26,
 }
 
-export const get26 = oc
+export const get27 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1712,7 +1741,7 @@ export const get26 = oc
   .output(zGetWorkspacesCurrentPluginIconResponse)
 
 export const icon = {
-  get: get26,
+  get: get27,
 }
 
 export const post28 = oc
@@ -1766,7 +1795,7 @@ export const install = {
   pkg,
 }
 
-export const get27 = oc
+export const get28 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1778,7 +1807,7 @@ export const get27 = oc
   .output(zGetWorkspacesCurrentPluginInstalledIdsResponse)
 
 export const installedIds = {
-  get: get27,
+  get: get28,
 }
 
 export const post31 = oc
@@ -1815,7 +1844,7 @@ export const latestVersions = {
   post: post32,
 }
 
-export const get28 = oc
+export const get29 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1827,12 +1856,12 @@ export const get28 = oc
   .output(zGetWorkspacesCurrentPluginListResponse)
 
 export const list2 = {
-  get: get28,
+  get: get29,
   installations,
   latestVersions,
 }
 
-export const get29 = oc
+export const get30 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1844,14 +1873,14 @@ export const get29 = oc
   .output(zGetWorkspacesCurrentPluginMarketplacePkgResponse)
 
 export const pkg2 = {
-  get: get29,
+  get: get30,
 }
 
 export const marketplace2 = {
   pkg: pkg2,
 }
 
-export const get30 = oc
+export const get31 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1863,7 +1892,7 @@ export const get30 = oc
   .output(zGetWorkspacesCurrentPluginParametersDynamicOptionsResponse)
 
 export const dynamicOptions = {
-  get: get30,
+  get: get31,
 }
 
 /**
@@ -1907,7 +1936,7 @@ export const change2 = {
   post: post34,
 }
 
-export const get31 = oc
+export const get32 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1918,7 +1947,7 @@ export const get31 = oc
   .output(zGetWorkspacesCurrentPluginPermissionFetchResponse)
 
 export const fetch2 = {
-  get: get31,
+  get: get32,
 }
 
 export const permission2 = {
@@ -1926,7 +1955,7 @@ export const permission2 = {
   fetch: fetch2,
 }
 
-export const get32 = oc
+export const get33 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1938,7 +1967,7 @@ export const get32 = oc
   .output(zGetWorkspacesCurrentPluginReadmeResponse)
 
 export const readme = {
-  get: get32,
+  get: get33,
 }
 
 export const post35 = oc
@@ -1986,7 +2015,7 @@ export const delete8 = {
   byIdentifier,
 }
 
-export const get33 = oc
+export const get34 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1998,11 +2027,11 @@ export const get33 = oc
   .output(zGetWorkspacesCurrentPluginTasksByTaskIdResponse)
 
 export const byTaskId = {
-  get: get33,
+  get: get34,
   delete: delete8,
 }
 
-export const get34 = oc
+export const get35 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2014,7 +2043,7 @@ export const get34 = oc
   .output(zGetWorkspacesCurrentPluginTasksResponse)
 
 export const tasks = {
-  get: get34,
+  get: get35,
   deleteAll,
   byTaskId,
 }
@@ -2119,7 +2148,7 @@ export const upload = {
   pkg: pkg3,
 }
 
-export const get35 = oc
+export const get36 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2136,7 +2165,7 @@ export const get35 = oc
   .output(zGetWorkspacesCurrentPluginByCategoryListResponse)
 
 export const list3 = {
-  get: get35,
+  get: get36,
 }
 
 export const byCategory = {
@@ -2190,7 +2219,7 @@ export const delete9 = oc
   .input(z.object({ params: zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath }))
   .output(zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse)
 
-export const get36 = oc
+export const get37 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2201,7 +2230,7 @@ export const get36 = oc
   .input(z.object({ params: zGetWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath }))
   .output(zGetWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse)
 
-export const put4 = oc
+export const put5 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2214,12 +2243,12 @@ export const put4 = oc
 
 export const byPolicyId = {
   delete: delete9,
-  get: get36,
-  put: put4,
+  get: get37,
+  put: put5,
   copy,
 }
 
-export const get37 = oc
+export const get38 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2241,12 +2270,12 @@ export const post45 = oc
   .output(zPostWorkspacesCurrentRbacAccessPoliciesResponse)
 
 export const accessPolicies = {
-  get: get37,
+  get: get38,
   post: post45,
   byPolicyId,
 }
 
-export const put5 = oc
+export const put6 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2258,10 +2287,10 @@ export const put5 = oc
   .output(zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockResponse)
 
 export const lock = {
-  put: put5,
+  put: put6,
 }
 
-export const put6 = oc
+export const put7 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2273,7 +2302,7 @@ export const put6 = oc
   .output(zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdUnlockResponse)
 
 export const unlock = {
-  put: put6,
+  put: put7,
 }
 
 export const byBindingId = {
@@ -2301,7 +2330,7 @@ export const delete10 = oc
   )
   .output(zDeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponse)
 
-export const get38 = oc
+export const get39 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2318,10 +2347,10 @@ export const get38 = oc
 
 export const memberBindings = {
   delete: delete10,
-  get: get38,
+  get: get39,
 }
 
-export const get39 = oc
+export const get40 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2337,7 +2366,7 @@ export const get39 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings = {
-  get: get39,
+  get: get40,
 }
 
 export const byPolicyId2 = {
@@ -2349,7 +2378,7 @@ export const accessPolicies2 = {
   byPolicyId: byPolicyId2,
 }
 
-export const get40 = oc
+export const get41 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2366,10 +2395,10 @@ export const get40 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdAccessPolicyResponse)
 
 export const accessPolicy = {
-  get: get40,
+  get: get41,
 }
 
-export const get41 = oc
+export const get42 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2386,10 +2415,10 @@ export const get41 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesResponse)
 
 export const userAccessPolicies = {
-  get: get41,
+  get: get42,
 }
 
-export const put7 = oc
+export const put8 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2406,7 +2435,7 @@ export const put7 = oc
   .output(zPutWorkspacesCurrentRbacAppsByAppIdUsersByTargetAccountIdAccessPoliciesResponse)
 
 export const accessPolicies3 = {
-  put: put7,
+  put: put8,
 }
 
 export const byTargetAccountId = {
@@ -2417,7 +2446,7 @@ export const users = {
   byTargetAccountId,
 }
 
-export const get42 = oc
+export const get43 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2428,7 +2457,7 @@ export const get42 = oc
   .input(z.object({ params: zGetWorkspacesCurrentRbacAppsByAppIdWhitelistPath }))
   .output(zGetWorkspacesCurrentRbacAppsByAppIdWhitelistResponse)
 
-export const put8 = oc
+export const put9 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2445,8 +2474,8 @@ export const put8 = oc
   .output(zPutWorkspacesCurrentRbacAppsByAppIdWhitelistResponse)
 
 export const whitelist = {
-  get: get42,
-  put: put8,
+  get: get43,
+  put: put9,
 }
 
 export const byAppId = {
@@ -2481,7 +2510,7 @@ export const delete11 = oc
     zDeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponse,
   )
 
-export const get43 = oc
+export const get44 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2502,10 +2531,10 @@ export const get43 = oc
 
 export const memberBindings2 = {
   delete: delete11,
-  get: get43,
+  get: get44,
 }
 
-export const get44 = oc
+export const get45 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2521,7 +2550,7 @@ export const get44 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings2 = {
-  get: get44,
+  get: get45,
 }
 
 export const byPolicyId3 = {
@@ -2533,7 +2562,7 @@ export const accessPolicies4 = {
   byPolicyId: byPolicyId3,
 }
 
-export const get45 = oc
+export const get46 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2550,10 +2579,10 @@ export const get45 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyResponse)
 
 export const accessPolicy2 = {
-  get: get45,
+  get: get46,
 }
 
-export const get46 = oc
+export const get47 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2570,10 +2599,10 @@ export const get46 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesResponse)
 
 export const userAccessPolicies2 = {
-  get: get46,
+  get: get47,
 }
 
-export const put9 = oc
+export const put10 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2590,7 +2619,7 @@ export const put9 = oc
   .output(zPutWorkspacesCurrentRbacDatasetsByDatasetIdUsersByTargetAccountIdAccessPoliciesResponse)
 
 export const accessPolicies5 = {
-  put: put9,
+  put: put10,
 }
 
 export const byTargetAccountId2 = {
@@ -2601,7 +2630,7 @@ export const users2 = {
   byTargetAccountId: byTargetAccountId2,
 }
 
-export const get47 = oc
+export const get48 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2612,7 +2641,7 @@ export const get47 = oc
   .input(z.object({ params: zGetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistPath }))
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse)
 
-export const put10 = oc
+export const put11 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2629,8 +2658,8 @@ export const put10 = oc
   .output(zPutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse)
 
 export const whitelist2 = {
-  get: get47,
-  put: put10,
+  get: get48,
+  put: put11,
 }
 
 export const byDatasetId = {
@@ -2645,7 +2674,7 @@ export const datasets = {
   byDatasetId,
 }
 
-export const get48 = oc
+export const get49 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2656,7 +2685,7 @@ export const get48 = oc
   .input(z.object({ params: zGetWorkspacesCurrentRbacMembersByMemberIdRbacRolesPath }))
   .output(zGetWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse)
 
-export const put11 = oc
+export const put12 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2673,8 +2702,8 @@ export const put11 = oc
   .output(zPutWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse)
 
 export const rbacRoles = {
-  get: get48,
-  put: put11,
+  get: get49,
+  put: put12,
 }
 
 export const byMemberId2 = {
@@ -2685,7 +2714,7 @@ export const members2 = {
   byMemberId: byMemberId2,
 }
 
-export const get49 = oc
+export const get50 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2696,10 +2725,10 @@ export const get49 = oc
   .output(zGetWorkspacesCurrentRbacMyPermissionsResponse)
 
 export const myPermissions = {
-  get: get49,
+  get: get50,
 }
 
-export const get50 = oc
+export const get51 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2710,10 +2739,10 @@ export const get50 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogAppResponse)
 
 export const app = {
-  get: get50,
+  get: get51,
 }
 
-export const get51 = oc
+export const get52 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2724,10 +2753,10 @@ export const get51 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogDatasetResponse)
 
 export const dataset = {
-  get: get51,
+  get: get52,
 }
 
-export const get52 = oc
+export const get53 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2738,7 +2767,7 @@ export const get52 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogResponse)
 
 export const catalog = {
-  get: get52,
+  get: get53,
   app,
   dataset,
 }
@@ -2763,7 +2792,7 @@ export const copy2 = {
   post: post46,
 }
 
-export const get53 = oc
+export const get54 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2775,7 +2804,7 @@ export const get53 = oc
   .output(zGetWorkspacesCurrentRbacRolesByRoleIdMembersResponse)
 
 export const members3 = {
-  get: get53,
+  get: get54,
 }
 
 export const delete12 = oc
@@ -2789,7 +2818,7 @@ export const delete12 = oc
   .input(z.object({ params: zDeleteWorkspacesCurrentRbacRolesByRoleIdPath }))
   .output(zDeleteWorkspacesCurrentRbacRolesByRoleIdResponse)
 
-export const get54 = oc
+export const get55 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2800,7 +2829,7 @@ export const get54 = oc
   .input(z.object({ params: zGetWorkspacesCurrentRbacRolesByRoleIdPath }))
   .output(zGetWorkspacesCurrentRbacRolesByRoleIdResponse)
 
-export const put12 = oc
+export const put13 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2813,13 +2842,13 @@ export const put12 = oc
 
 export const byRoleId = {
   delete: delete12,
-  get: get54,
-  put: put12,
+  get: get55,
+  put: put13,
   copy: copy2,
   members: members3,
 }
 
-export const get55 = oc
+export const get56 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2841,12 +2870,12 @@ export const post47 = oc
   .output(zPostWorkspacesCurrentRbacRolesResponse)
 
 export const roles = {
-  get: get55,
+  get: get56,
   post: post47,
   byRoleId,
 }
 
-export const put13 = oc
+export const put14 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2863,10 +2892,10 @@ export const put13 = oc
   .output(zPutWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdBindingsResponse)
 
 export const bindings = {
-  put: put13,
+  put: put14,
 }
 
-export const get56 = oc
+export const get57 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2882,10 +2911,10 @@ export const get56 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsResponse)
 
 export const memberBindings3 = {
-  get: get56,
+  get: get57,
 }
 
-export const get57 = oc
+export const get58 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2901,7 +2930,7 @@ export const get57 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings3 = {
-  get: get57,
+  get: get58,
 }
 
 export const byPolicyId4 = {
@@ -2914,7 +2943,7 @@ export const accessPolicies6 = {
   byPolicyId: byPolicyId4,
 }
 
-export const get58 = oc
+export const get59 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2925,7 +2954,7 @@ export const get58 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPolicyResponse)
 
 export const accessPolicy3 = {
-  get: get58,
+  get: get59,
 }
 
 export const apps2 = {
@@ -2933,7 +2962,7 @@ export const apps2 = {
   accessPolicy: accessPolicy3,
 }
 
-export const put14 = oc
+export const put15 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2950,10 +2979,10 @@ export const put14 = oc
   .output(zPutWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdBindingsResponse)
 
 export const bindings2 = {
-  put: put14,
+  put: put15,
 }
 
-export const get59 = oc
+export const get60 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2969,10 +2998,10 @@ export const get59 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsResponse)
 
 export const memberBindings4 = {
-  get: get59,
+  get: get60,
 }
 
-export const get60 = oc
+export const get61 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2988,7 +3017,7 @@ export const get60 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings4 = {
-  get: get60,
+  get: get61,
 }
 
 export const byPolicyId5 = {
@@ -3001,7 +3030,7 @@ export const accessPolicies7 = {
   byPolicyId: byPolicyId5,
 }
 
-export const get61 = oc
+export const get62 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3012,7 +3041,7 @@ export const get61 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponse)
 
 export const accessPolicy4 = {
-  get: get61,
+  get: get62,
 }
 
 export const datasets2 = {
@@ -3037,7 +3066,7 @@ export const rbac = {
   workspace,
 }
 
-export const get62 = oc
+export const get63 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3048,10 +3077,10 @@ export const get62 = oc
   .output(zGetWorkspacesCurrentSummaryResponse)
 
 export const summary2 = {
-  get: get62,
+  get: get63,
 }
 
-export const get63 = oc
+export const get64 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3062,7 +3091,7 @@ export const get63 = oc
   .output(zGetWorkspacesCurrentToolLabelsResponse)
 
 export const toolLabels = {
-  get: get63,
+  get: get64,
 }
 
 export const post48 = oc
@@ -3095,7 +3124,7 @@ export const delete13 = {
   post: post49,
 }
 
-export const get64 = oc
+export const get65 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3106,11 +3135,11 @@ export const get64 = oc
   .input(z.object({ query: zGetWorkspacesCurrentToolProviderApiGetQuery }))
   .output(zGetWorkspacesCurrentToolProviderApiGetResponse)
 
-export const get65 = {
-  get: get64,
+export const get66 = {
+  get: get65,
 }
 
-export const get66 = oc
+export const get67 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3122,7 +3151,7 @@ export const get66 = oc
   .output(zGetWorkspacesCurrentToolProviderApiRemoteResponse)
 
 export const remote = {
-  get: get66,
+  get: get67,
 }
 
 export const post50 = oc
@@ -3159,7 +3188,7 @@ export const test = {
   pre,
 }
 
-export const get67 = oc
+export const get68 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3171,7 +3200,7 @@ export const get67 = oc
   .output(zGetWorkspacesCurrentToolProviderApiToolsResponse)
 
 export const tools = {
-  get: get67,
+  get: get68,
 }
 
 export const post52 = oc
@@ -3192,7 +3221,7 @@ export const update2 = {
 export const api = {
   add,
   delete: delete13,
-  get: get65,
+  get: get66,
   remote,
   schema,
   test,
@@ -3220,7 +3249,7 @@ export const add2 = {
   post: post53,
 }
 
-export const get68 = oc
+export const get69 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3237,10 +3266,10 @@ export const get68 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderCredentialInfoResponse)
 
 export const info = {
-  get: get68,
+  get: get69,
 }
 
-export const get69 = oc
+export const get70 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3260,7 +3289,7 @@ export const get69 = oc
   )
 
 export const byCredentialType = {
-  get: get69,
+  get: get70,
 }
 
 export const schema2 = {
@@ -3272,7 +3301,7 @@ export const credential = {
   schema: schema2,
 }
 
-export const get70 = oc
+export const get71 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3289,7 +3318,7 @@ export const get70 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderCredentialsResponse)
 
 export const credentials3 = {
-  get: get70,
+  get: get71,
 }
 
 export const post54 = oc
@@ -3332,7 +3361,7 @@ export const delete14 = {
   post: post55,
 }
 
-export const get71 = oc
+export const get72 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3344,10 +3373,10 @@ export const get71 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderIconResponse)
 
 export const icon2 = {
-  get: get71,
+  get: get72,
 }
 
-export const get72 = oc
+export const get73 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3359,10 +3388,10 @@ export const get72 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderInfoResponse)
 
 export const info2 = {
-  get: get72,
+  get: get73,
 }
 
-export const get73 = oc
+export const get74 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3376,7 +3405,7 @@ export const get73 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderOauthClientSchemaResponse)
 
 export const clientSchema = {
-  get: get73,
+  get: get74,
 }
 
 export const delete15 = oc
@@ -3394,7 +3423,7 @@ export const delete15 = oc
   )
   .output(zDeleteWorkspacesCurrentToolProviderBuiltinByProviderOauthCustomClientResponse)
 
-export const get74 = oc
+export const get75 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3425,7 +3454,7 @@ export const post56 = oc
 
 export const customClient = {
   delete: delete15,
-  get: get74,
+  get: get75,
   post: post56,
 }
 
@@ -3434,7 +3463,7 @@ export const oauth = {
   customClient,
 }
 
-export const get75 = oc
+export const get76 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3446,7 +3475,7 @@ export const get75 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderToolsResponse)
 
 export const tools2 = {
-  get: get75,
+  get: get76,
 }
 
 export const post57 = oc
@@ -3501,7 +3530,7 @@ export const auth = {
   post: post58,
 }
 
-export const get76 = oc
+export const get77 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3513,14 +3542,14 @@ export const get76 = oc
   .output(zGetWorkspacesCurrentToolProviderMcpToolsByProviderIdResponse)
 
 export const byProviderId = {
-  get: get76,
+  get: get77,
 }
 
 export const tools3 = {
   byProviderId,
 }
 
-export const get77 = oc
+export const get78 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3532,7 +3561,7 @@ export const get77 = oc
   .output(zGetWorkspacesCurrentToolProviderMcpUpdateByProviderIdResponse)
 
 export const byProviderId2 = {
-  get: get77,
+  get: get78,
 }
 
 export const update4 = {
@@ -3561,7 +3590,7 @@ export const post59 = oc
   .input(z.object({ body: zPostWorkspacesCurrentToolProviderMcpBody }))
   .output(zPostWorkspacesCurrentToolProviderMcpResponse)
 
-export const put15 = oc
+export const put16 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -3575,7 +3604,7 @@ export const put15 = oc
 export const mcp = {
   delete: delete16,
   post: post59,
-  put: put15,
+  put: put16,
   auth,
   tools: tools3,
   update: update4,
@@ -3611,7 +3640,7 @@ export const delete17 = {
   post: post61,
 }
 
-export const get78 = oc
+export const get79 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3622,11 +3651,11 @@ export const get78 = oc
   .input(z.object({ query: zGetWorkspacesCurrentToolProviderWorkflowGetQuery.optional() }))
   .output(zGetWorkspacesCurrentToolProviderWorkflowGetResponse)
 
-export const get79 = {
-  get: get78,
+export const get80 = {
+  get: get79,
 }
 
-export const get80 = oc
+export const get81 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3638,7 +3667,7 @@ export const get80 = oc
   .output(zGetWorkspacesCurrentToolProviderWorkflowToolsResponse)
 
 export const tools4 = {
-  get: get80,
+  get: get81,
 }
 
 export const post62 = oc
@@ -3659,7 +3688,7 @@ export const update5 = {
 export const workflow = {
   create: create2,
   delete: delete17,
-  get: get79,
+  get: get80,
   tools: tools4,
   update: update5,
 }
@@ -3671,7 +3700,7 @@ export const toolProvider = {
   workflow,
 }
 
-export const get81 = oc
+export const get82 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3683,10 +3712,10 @@ export const get81 = oc
   .output(zGetWorkspacesCurrentToolProvidersResponse)
 
 export const toolProviders = {
-  get: get81,
+  get: get82,
 }
 
-export const get82 = oc
+export const get83 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3697,10 +3726,10 @@ export const get82 = oc
   .output(zGetWorkspacesCurrentToolsApiResponse)
 
 export const api2 = {
-  get: get82,
+  get: get83,
 }
 
-export const get83 = oc
+export const get84 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3711,10 +3740,10 @@ export const get83 = oc
   .output(zGetWorkspacesCurrentToolsBuiltinResponse)
 
 export const builtin2 = {
-  get: get83,
+  get: get84,
 }
 
-export const get84 = oc
+export const get85 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3725,10 +3754,10 @@ export const get84 = oc
   .output(zGetWorkspacesCurrentToolsMcpResponse)
 
 export const mcp2 = {
-  get: get84,
+  get: get85,
 }
 
-export const get85 = oc
+export const get86 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3739,7 +3768,7 @@ export const get85 = oc
   .output(zGetWorkspacesCurrentToolsWorkflowResponse)
 
 export const workflow2 = {
-  get: get85,
+  get: get86,
 }
 
 export const tools5 = {
@@ -3749,7 +3778,7 @@ export const tools5 = {
   workflow: workflow2,
 }
 
-export const get86 = oc
+export const get87 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3761,13 +3790,13 @@ export const get86 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderIconResponse)
 
 export const icon3 = {
-  get: get86,
+  get: get87,
 }
 
 /**
  * Get info for a trigger provider
  */
-export const get87 = oc
+export const get88 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3780,7 +3809,7 @@ export const get87 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderInfoResponse)
 
 export const info3 = {
-  get: get87,
+  get: get88,
 }
 
 /**
@@ -3801,7 +3830,7 @@ export const delete18 = oc
 /**
  * Get OAuth client configuration for a provider
  */
-export const get88 = oc
+export const get89 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3835,7 +3864,7 @@ export const post63 = oc
 
 export const client = {
   delete: delete18,
-  get: get88,
+  get: get89,
   post: post63,
 }
 
@@ -3902,7 +3931,7 @@ export const create3 = {
 /**
  * Get the request logs for a subscription instance for a trigger provider
  */
-export const get89 = oc
+export const get90 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3923,7 +3952,7 @@ export const get89 = oc
   )
 
 export const bySubscriptionBuilderId2 = {
-  get: get89,
+  get: get90,
 }
 
 export const logs = {
@@ -3997,7 +4026,7 @@ export const verifyAndUpdate = {
 /**
  * Get a subscription instance for a trigger provider
  */
-export const get90 = oc
+export const get91 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4018,7 +4047,7 @@ export const get90 = oc
   )
 
 export const bySubscriptionBuilderId5 = {
-  get: get90,
+  get: get91,
 }
 
 export const builder = {
@@ -4033,7 +4062,7 @@ export const builder = {
 /**
  * List all trigger subscriptions for the current tenant's provider
  */
-export const get91 = oc
+export const get92 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4046,13 +4075,13 @@ export const get91 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderSubscriptionsListResponse)
 
 export const list4 = {
-  get: get91,
+  get: get92,
 }
 
 /**
  * Initiate OAuth authorization flow for a trigger provider
  */
-export const get92 = oc
+export const get93 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4069,7 +4098,7 @@ export const get92 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderSubscriptionsOauthAuthorizeResponse)
 
 export const authorize = {
-  get: get92,
+  get: get93,
 }
 
 export const oauth3 = {
@@ -4186,7 +4215,7 @@ export const triggerProvider = {
 /**
  * List all trigger providers for the current tenant
  */
-export const get93 = oc
+export const get94 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4198,7 +4227,7 @@ export const get93 = oc
   .output(zGetWorkspacesCurrentTriggersResponse)
 
 export const triggers = {
-  get: get93,
+  get: get94,
 }
 
 export const current = {
@@ -4211,6 +4240,7 @@ export const current = {
   members,
   modelProviders,
   models: models2,
+  networkAccessPolicy,
   permission,
   plugin: plugin2,
   rbac,
@@ -4243,7 +4273,7 @@ export const webappLogo = {
   upload: upload2,
 }
 
-export const get94 = oc
+export const get95 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4265,7 +4295,7 @@ export const post72 = oc
   .output(zPostWorkspacesCustomConfigResponse)
 
 export const customConfig = {
-  get: get94,
+  get: get95,
   post: post72,
   webappLogo,
 }
@@ -4300,7 +4330,7 @@ export const switch3 = {
   post: post74,
 }
 
-export const get95 = oc
+export const get96 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4312,7 +4342,7 @@ export const get95 = oc
   .output(zGetWorkspacesByTenantIdModelProvidersByProviderByIconTypeByLangResponse)
 
 export const byLang = {
-  get: get95,
+  get: get96,
 }
 
 export const byIconType = {
@@ -4331,7 +4361,7 @@ export const byTenantId = {
   modelProviders: modelProviders2,
 }
 
-export const get96 = oc
+export const get97 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4342,7 +4372,7 @@ export const get96 = oc
   .output(zGetWorkspacesResponse)
 
 export const workspaces = {
-  get: get96,
+  get: get97,
   current,
   customConfig,
   info: info4,
diff --git a/packages/contracts/generated/api/console/workspaces/types.gen.ts b/packages/contracts/generated/api/console/workspaces/types.gen.ts
index 99dab0f6291..417061a7caf 100644
--- a/packages/contracts/generated/api/console/workspaces/types.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/types.gen.ts
@@ -364,6 +364,23 @@ export type AvailableModelListResponse = {
   data: Array<ProviderWithModelsResponse>
 }
 
+export type NetworkAccessPolicyListResponse = {
+  entitled: boolean
+  policies: Array<NetworkAccessPolicyResponse>
+  tenant_id: string
+}
+
+export type NetworkAccessPolicyPayload = {
+  allowed_cidrs: Array<string>
+  expected_version: number
+  mode: 'disabled' | 'enforce' | 'shadow'
+  scope: 'mcp' | 'plugin_trigger' | 'service_api' | 'workflow_webhook'
+}
+
+export type NetworkAccessPolicyUpdateResponse = {
+  policy: NetworkAccessPolicyResponse
+}
+
 export type WorkspacePermissionResponse = {
   allow_member_invite: boolean
   allow_owner_transfer: boolean
@@ -1289,6 +1306,16 @@ export type ProviderWithModelsResponse = {
   tenant_id: string
 }
 
+export type NetworkAccessPolicyResponse = {
+  allowed_cidrs: Array<string>
+  created_at?: string | null
+  mode: 'disabled' | 'enforce' | 'shadow'
+  scope: 'mcp' | 'plugin_trigger' | 'service_api' | 'workflow_webhook'
+  updated_at?: string | null
+  updated_by_account_id?: string | null
+  version: number
+}
+
 export type PluginAutoUpgradeSettingsPayload = {
   exclude_plugins?: Array<string>
   include_plugins?: Array<string>
@@ -3499,6 +3526,34 @@ export type GetWorkspacesCurrentModelsModelTypesByModelTypeResponses = {
 export type GetWorkspacesCurrentModelsModelTypesByModelTypeResponse =
   GetWorkspacesCurrentModelsModelTypesByModelTypeResponses[keyof GetWorkspacesCurrentModelsModelTypesByModelTypeResponses]
 
+export type GetWorkspacesCurrentNetworkAccessPolicyData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/network-access-policy'
+}
+
+export type GetWorkspacesCurrentNetworkAccessPolicyResponses = {
+  200: NetworkAccessPolicyListResponse
+}
+
+export type GetWorkspacesCurrentNetworkAccessPolicyResponse =
+  GetWorkspacesCurrentNetworkAccessPolicyResponses[keyof GetWorkspacesCurrentNetworkAccessPolicyResponses]
+
+export type PutWorkspacesCurrentNetworkAccessPolicyData = {
+  body: NetworkAccessPolicyPayload
+  path?: never
+  query?: never
+  url: '/workspaces/current/network-access-policy'
+}
+
+export type PutWorkspacesCurrentNetworkAccessPolicyResponses = {
+  200: NetworkAccessPolicyUpdateResponse
+}
+
+export type PutWorkspacesCurrentNetworkAccessPolicyResponse =
+  PutWorkspacesCurrentNetworkAccessPolicyResponses[keyof PutWorkspacesCurrentNetworkAccessPolicyResponses]
+
 export type GetWorkspacesCurrentPermissionData = {
   body?: never
   path?: never
diff --git a/packages/contracts/generated/api/console/workspaces/zod.gen.ts b/packages/contracts/generated/api/console/workspaces/zod.gen.ts
index c55c0e70099..7f4c1e7f230 100644
--- a/packages/contracts/generated/api/console/workspaces/zod.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/zod.gen.ts
@@ -247,6 +247,16 @@ export const zParserPreferredProviderType = z.object({
   preferred_provider_type: z.enum(['custom', 'system']),
 })
 
+/**
+ * NetworkAccessPolicyPayload
+ */
+export const zNetworkAccessPolicyPayload = z.object({
+  allowed_cidrs: z.array(z.string()).max(100),
+  expected_version: z.int().gte(0),
+  mode: z.enum(['disabled', 'enforce', 'shadow']),
+  scope: z.enum(['mcp', 'plugin_trigger', 'service_api', 'workflow_webhook']),
+})
+
 /**
  * WorkspacePermissionResponse
  */
@@ -985,6 +995,35 @@ export const zCredentialConfiguration = z.object({
   credential_name: z.string(),
 })
 
+/**
+ * NetworkAccessPolicyResponse
+ */
+export const zNetworkAccessPolicyResponse = z.object({
+  allowed_cidrs: z.array(z.string()),
+  created_at: z.iso.datetime().nullish(),
+  mode: z.enum(['disabled', 'enforce', 'shadow']),
+  scope: z.enum(['mcp', 'plugin_trigger', 'service_api', 'workflow_webhook']),
+  updated_at: z.iso.datetime().nullish(),
+  updated_by_account_id: z.string().nullish(),
+  version: z.int().gte(0),
+})
+
+/**
+ * NetworkAccessPolicyListResponse
+ */
+export const zNetworkAccessPolicyListResponse = z.object({
+  entitled: z.boolean(),
+  policies: z.array(zNetworkAccessPolicyResponse),
+  tenant_id: z.string(),
+})
+
+/**
+ * NetworkAccessPolicyUpdateResponse
+ */
+export const zNetworkAccessPolicyUpdateResponse = z.object({
+  policy: zNetworkAccessPolicyResponse,
+})
+
 /**
  * TenantPluginAutoUpgradeCategory
  */
@@ -4101,6 +4140,18 @@ export const zGetWorkspacesCurrentModelsModelTypesByModelTypePath = z.object({
  */
 export const zGetWorkspacesCurrentModelsModelTypesByModelTypeResponse = zAvailableModelListResponse
 
+/**
+ * Workspace network access policies retrieved successfully
+ */
+export const zGetWorkspacesCurrentNetworkAccessPolicyResponse = zNetworkAccessPolicyListResponse
+
+export const zPutWorkspacesCurrentNetworkAccessPolicyBody = zNetworkAccessPolicyPayload
+
+/**
+ * Workspace network access policy updated successfully
+ */
+export const zPutWorkspacesCurrentNetworkAccessPolicyResponse = zNetworkAccessPolicyUpdateResponse
+
 /**
  * Success
  */