authentik-api 2026.2.4 → 2026.5.0.rc1

data/lib/authentik/api/models/patched_apple_independent_secure_enclave_request.rb

@@ -0,0 +1,235 @@
+=begin
+This file is automatically generated by: https://openapi-generator.tech.
+Any manual changes will be lost when the OpenAPI scheme changes.
+
+=end
+
+require 'date'
+require 'time'
+
+module Authentik::Api
+  class PatchedAppleIndependentSecureEnclaveRequest < ApiModelBase
+    attr_accessor :uuid
+
+    # The user that this device belongs to.
+    attr_accessor :user
+
+    attr_accessor :apple_secure_enclave_key
+
+    attr_accessor :apple_enclave_key_id
+
+    attr_accessor :device_type
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    def self.attribute_map
+      {
+        :'uuid' => :'uuid',
+        :'user' => :'user',
+        :'apple_secure_enclave_key' => :'apple_secure_enclave_key',
+        :'apple_enclave_key_id' => :'apple_enclave_key_id',
+        :'device_type' => :'device_type'
+      }
+    end
+
+    # Returns attribute mapping this model knows about
+    def self.acceptable_attribute_map
+      attribute_map
+    end
+
+    # Returns all the JSON keys this model knows about
+    def self.acceptable_attributes
+      acceptable_attribute_map.values
+    end
+
+    # Attribute type mapping.
+    def self.openapi_types
+      {
+        :'uuid' => :'String',
+        :'user' => :'Integer',
+        :'apple_secure_enclave_key' => :'String',
+        :'apple_enclave_key_id' => :'String',
+        :'device_type' => :'String'
+      }
+    end
+
+    # List of attributes with nullable: true
+    def self.openapi_nullable
+      Set.new([
+      ])
+    end
+
+    # Initializes the object
+    # @param [Hash] attributes Model attributes in the form of hash
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `Authentik::Api::PatchedAppleIndependentSecureEnclaveRequest` initialize method"
+      end
+
+      # check to see if the attribute exists and convert string to symbol for hash key
+      acceptable_attribute_map = self.class.acceptable_attribute_map
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!acceptable_attribute_map.key?(k.to_sym))
+          fail ArgumentError, "`#{k}` is not a valid attribute in `Authentik::Api::PatchedAppleIndependentSecureEnclaveRequest`. Please check the name to make sure it's valid. List of attributes: " + acceptable_attribute_map.keys.inspect
+        end
+        h[k.to_sym] = v
+      }
+
+      if attributes.key?(:'uuid')
+        self.uuid = attributes[:'uuid']
+      end
+
+      if attributes.key?(:'user')
+        self.user = attributes[:'user']
+      end
+
+      if attributes.key?(:'apple_secure_enclave_key')
+        self.apple_secure_enclave_key = attributes[:'apple_secure_enclave_key']
+      end
+
+      if attributes.key?(:'apple_enclave_key_id')
+        self.apple_enclave_key_id = attributes[:'apple_enclave_key_id']
+      end
+
+      if attributes.key?(:'device_type')
+        self.device_type = attributes[:'device_type']
+      end
+    end
+
+    # Show invalid properties with the reasons. Usually used together with valid?
+    # @return Array for valid properties with the reasons
+    def list_invalid_properties
+      warn '[DEPRECATED] the `list_invalid_properties` method is obsolete'
+      invalid_properties = Array.new
+      if !@apple_secure_enclave_key.nil? && @apple_secure_enclave_key.to_s.length < 1
+        invalid_properties.push('invalid value for "apple_secure_enclave_key", the character length must be greater than or equal to 1.')
+      end
+
+      if !@apple_enclave_key_id.nil? && @apple_enclave_key_id.to_s.length < 1
+        invalid_properties.push('invalid value for "apple_enclave_key_id", the character length must be greater than or equal to 1.')
+      end
+
+      if !@device_type.nil? && @device_type.to_s.length < 1
+        invalid_properties.push('invalid value for "device_type", the character length must be greater than or equal to 1.')
+      end
+
+      invalid_properties
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    def valid?
+      warn '[DEPRECATED] the `valid?` method is obsolete'
+      return false if !@apple_secure_enclave_key.nil? && @apple_secure_enclave_key.to_s.length < 1
+      return false if !@apple_enclave_key_id.nil? && @apple_enclave_key_id.to_s.length < 1
+      return false if !@device_type.nil? && @device_type.to_s.length < 1
+      true
+    end
+
+    # Custom attribute writer method with validation
+    # @param [Object] apple_secure_enclave_key Value to be assigned
+    def apple_secure_enclave_key=(apple_secure_enclave_key)
+      if apple_secure_enclave_key.nil?
+        fail ArgumentError, 'apple_secure_enclave_key cannot be nil'
+      end
+
+      if apple_secure_enclave_key.to_s.length < 1
+        fail ArgumentError, 'invalid value for "apple_secure_enclave_key", the character length must be greater than or equal to 1.'
+      end
+
+      @apple_secure_enclave_key = apple_secure_enclave_key
+    end
+
+    # Custom attribute writer method with validation
+    # @param [Object] apple_enclave_key_id Value to be assigned
+    def apple_enclave_key_id=(apple_enclave_key_id)
+      if apple_enclave_key_id.nil?
+        fail ArgumentError, 'apple_enclave_key_id cannot be nil'
+      end
+
+      if apple_enclave_key_id.to_s.length < 1
+        fail ArgumentError, 'invalid value for "apple_enclave_key_id", the character length must be greater than or equal to 1.'
+      end
+
+      @apple_enclave_key_id = apple_enclave_key_id
+    end
+
+    # Custom attribute writer method with validation
+    # @param [Object] device_type Value to be assigned
+    def device_type=(device_type)
+      if device_type.nil?
+        fail ArgumentError, 'device_type cannot be nil'
+      end
+
+      if device_type.to_s.length < 1
+        fail ArgumentError, 'invalid value for "device_type", the character length must be greater than or equal to 1.'
+      end
+
+      @device_type = device_type
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param [Object] Object to be compared
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          uuid == o.uuid &&
+          user == o.user &&
+          apple_secure_enclave_key == o.apple_secure_enclave_key &&
+          apple_enclave_key_id == o.apple_enclave_key_id &&
+          device_type == o.device_type
+    end
+
+    # @see the `==` method
+    # @param [Object] Object to be compared
+    def eql?(o)
+      self == o
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    def hash
+      [uuid, user, apple_secure_enclave_key, apple_enclave_key_id, device_type].hash
+    end
+
+    # Builds the object from hash
+    # @param [Hash] attributes Model attributes in the form of hash
+    # @return [Object] Returns the model itself
+    def self.build_from_hash(attributes)
+      return nil unless attributes.is_a?(Hash)
+      attributes = attributes.transform_keys(&:to_sym)
+      transformed_hash = {}
+      openapi_types.each_pair do |key, type|
+        if attributes.key?(attribute_map[key]) && attributes[attribute_map[key]].nil?
+          transformed_hash["#{key}"] = nil
+        elsif type =~ /\AArray<(.*)>/i
+          # check to ensure the input is an array given that the attribute
+          # is documented as an array but the input is not
+          if attributes[attribute_map[key]].is_a?(Array)
+            transformed_hash["#{key}"] = attributes[attribute_map[key]].map { |v| _deserialize($1, v) }
+          end
+        elsif !attributes[attribute_map[key]].nil?
+          transformed_hash["#{key}"] = _deserialize(type, attributes[attribute_map[key]])
+        end
+      end
+      new(transformed_hash)
+    end
+
+    # Returns the object in the form of hash
+    # @return [Hash] Returns the object in the form of hash
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      hash
+    end
+
+  end
+
+end

data/lib/authentik/api/models/patched_application_request.rb

@@ -35,6 +35,9 @@ module Authentik::Api
 
     attr_accessor :group
 
+    # Hide this application from the user's My applications page.
+    attr_accessor :meta_hide
+
     class EnumAttributeValidator
       attr_reader :datatype
       attr_reader :allowable_values
@@ -70,7 +73,8 @@ module Authentik::Api
         :'meta_description' => :'meta_description',
         :'meta_publisher' => :'meta_publisher',
         :'policy_engine_mode' => :'policy_engine_mode',
-        :'group' => :'group'
+        :'group' => :'group',
+        :'meta_hide' => :'meta_hide'
       }
     end
 
@@ -97,7 +101,8 @@ module Authentik::Api
         :'meta_description' => :'String',
         :'meta_publisher' => :'String',
         :'policy_engine_mode' => :'PolicyEngineMode',
-        :'group' => :'String'
+        :'group' => :'String',
+        :'meta_hide' => :'Boolean'
       }
     end
 
@@ -169,6 +174,10 @@ module Authentik::Api
       if attributes.key?(:'group')
         self.group = attributes[:'group']
       end
+
+      if attributes.key?(:'meta_hide')
+        self.meta_hide = attributes[:'meta_hide']
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -250,7 +259,8 @@ module Authentik::Api
           meta_description == o.meta_description &&
           meta_publisher == o.meta_publisher &&
           policy_engine_mode == o.policy_engine_mode &&
-          group == o.group
+          group == o.group &&
+          meta_hide == o.meta_hide
     end
 
     # @see the `==` method
@@ -262,7 +272,7 @@ module Authentik::Api
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [name, slug, provider, backchannel_providers, open_in_new_tab, meta_launch_url, meta_icon, meta_description, meta_publisher, policy_engine_mode, group].hash
+      [name, slug, provider, backchannel_providers, open_in_new_tab, meta_launch_url, meta_icon, meta_description, meta_publisher, policy_engine_mode, group, meta_hide].hash
     end
 
     # Builds the object from hash

data/lib/authentik/api/models/patched_authenticator_validate_stage_request.rb

@@ -26,8 +26,18 @@ module Authentik::Api
     # Enforce user verification for WebAuthn devices.
     attr_accessor :webauthn_user_verification
 
+    attr_accessor :webauthn_hints
+
     attr_accessor :webauthn_allowed_device_types
 
+    attr_accessor :email_otp_throttling_factor
+
+    attr_accessor :sms_otp_throttling_factor
+
+    attr_accessor :totp_otp_throttling_factor
+
+    attr_accessor :static_otp_throttling_factor
+
     class EnumAttributeValidator
       attr_reader :datatype
       attr_reader :allowable_values
@@ -59,7 +69,12 @@ module Authentik::Api
         :'configuration_stages' => :'configuration_stages',
         :'last_auth_threshold' => :'last_auth_threshold',
         :'webauthn_user_verification' => :'webauthn_user_verification',
-        :'webauthn_allowed_device_types' => :'webauthn_allowed_device_types'
+        :'webauthn_hints' => :'webauthn_hints',
+        :'webauthn_allowed_device_types' => :'webauthn_allowed_device_types',
+        :'email_otp_throttling_factor' => :'email_otp_throttling_factor',
+        :'sms_otp_throttling_factor' => :'sms_otp_throttling_factor',
+        :'totp_otp_throttling_factor' => :'totp_otp_throttling_factor',
+        :'static_otp_throttling_factor' => :'static_otp_throttling_factor'
       }
     end
 
@@ -82,7 +97,12 @@ module Authentik::Api
         :'configuration_stages' => :'Array<String>',
         :'last_auth_threshold' => :'String',
         :'webauthn_user_verification' => :'UserVerificationEnum',
-        :'webauthn_allowed_device_types' => :'Array<String>'
+        :'webauthn_hints' => :'Array<WebAuthnHintEnum>',
+        :'webauthn_allowed_device_types' => :'Array<String>',
+        :'email_otp_throttling_factor' => :'Float',
+        :'sms_otp_throttling_factor' => :'Float',
+        :'totp_otp_throttling_factor' => :'Float',
+        :'static_otp_throttling_factor' => :'Float'
       }
     end
 
@@ -136,11 +156,33 @@ module Authentik::Api
         self.webauthn_user_verification = attributes[:'webauthn_user_verification']
       end
 
+      if attributes.key?(:'webauthn_hints')
+        if (value = attributes[:'webauthn_hints']).is_a?(Array)
+          self.webauthn_hints = value
+        end
+      end
+
       if attributes.key?(:'webauthn_allowed_device_types')
         if (value = attributes[:'webauthn_allowed_device_types']).is_a?(Array)
           self.webauthn_allowed_device_types = value
         end
       end
+
+      if attributes.key?(:'email_otp_throttling_factor')
+        self.email_otp_throttling_factor = attributes[:'email_otp_throttling_factor']
+      end
+
+      if attributes.key?(:'sms_otp_throttling_factor')
+        self.sms_otp_throttling_factor = attributes[:'sms_otp_throttling_factor']
+      end
+
+      if attributes.key?(:'totp_otp_throttling_factor')
+        self.totp_otp_throttling_factor = attributes[:'totp_otp_throttling_factor']
+      end
+
+      if attributes.key?(:'static_otp_throttling_factor')
+        self.static_otp_throttling_factor = attributes[:'static_otp_throttling_factor']
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -207,7 +249,12 @@ module Authentik::Api
           configuration_stages == o.configuration_stages &&
           last_auth_threshold == o.last_auth_threshold &&
           webauthn_user_verification == o.webauthn_user_verification &&
-          webauthn_allowed_device_types == o.webauthn_allowed_device_types
+          webauthn_hints == o.webauthn_hints &&
+          webauthn_allowed_device_types == o.webauthn_allowed_device_types &&
+          email_otp_throttling_factor == o.email_otp_throttling_factor &&
+          sms_otp_throttling_factor == o.sms_otp_throttling_factor &&
+          totp_otp_throttling_factor == o.totp_otp_throttling_factor &&
+          static_otp_throttling_factor == o.static_otp_throttling_factor
     end
 
     # @see the `==` method
@@ -219,7 +266,7 @@ module Authentik::Api
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [name, not_configured_action, device_classes, configuration_stages, last_auth_threshold, webauthn_user_verification, webauthn_allowed_device_types].hash
+      [name, not_configured_action, device_classes, configuration_stages, last_auth_threshold, webauthn_user_verification, webauthn_hints, webauthn_allowed_device_types, email_otp_throttling_factor, sms_otp_throttling_factor, totp_otp_throttling_factor, static_otp_throttling_factor].hash
     end
 
     # Builds the object from hash

data/lib/authentik/api/models/patched_authenticator_web_authn_stage_request.rb

@@ -23,8 +23,13 @@ module Authentik::Api
 
     attr_accessor :resident_key_requirement
 
+    attr_accessor :hints
+
     attr_accessor :device_type_restrictions
 
+    # When enabled, a given device can only be registered once.
+    attr_accessor :prevent_duplicate_devices
+
     attr_accessor :max_attempts
 
     class EnumAttributeValidator
@@ -58,7 +63,9 @@ module Authentik::Api
         :'user_verification' => :'user_verification',
         :'authenticator_attachment' => :'authenticator_attachment',
         :'resident_key_requirement' => :'resident_key_requirement',
+        :'hints' => :'hints',
         :'device_type_restrictions' => :'device_type_restrictions',
+        :'prevent_duplicate_devices' => :'prevent_duplicate_devices',
         :'max_attempts' => :'max_attempts'
       }
     end
@@ -81,8 +88,10 @@ module Authentik::Api
         :'friendly_name' => :'String',
         :'user_verification' => :'UserVerificationEnum',
         :'authenticator_attachment' => :'AuthenticatorAttachmentEnum',
-        :'resident_key_requirement' => :'ResidentKeyRequirementEnum',
+        :'resident_key_requirement' => :'UserVerificationEnum',
+        :'hints' => :'Array<WebAuthnHintEnum>',
         :'device_type_restrictions' => :'Array<String>',
+        :'prevent_duplicate_devices' => :'Boolean',
         :'max_attempts' => :'Integer'
       }
     end
@@ -135,12 +144,22 @@ module Authentik::Api
         self.resident_key_requirement = attributes[:'resident_key_requirement']
       end
 
+      if attributes.key?(:'hints')
+        if (value = attributes[:'hints']).is_a?(Array)
+          self.hints = value
+        end
+      end
+
       if attributes.key?(:'device_type_restrictions')
         if (value = attributes[:'device_type_restrictions']).is_a?(Array)
           self.device_type_restrictions = value
         end
       end
 
+      if attributes.key?(:'prevent_duplicate_devices')
+        self.prevent_duplicate_devices = attributes[:'prevent_duplicate_devices']
+      end
+
       if attributes.key?(:'max_attempts')
         self.max_attempts = attributes[:'max_attempts']
       end
@@ -219,7 +238,9 @@ module Authentik::Api
           user_verification == o.user_verification &&
           authenticator_attachment == o.authenticator_attachment &&
           resident_key_requirement == o.resident_key_requirement &&
+          hints == o.hints &&
           device_type_restrictions == o.device_type_restrictions &&
+          prevent_duplicate_devices == o.prevent_duplicate_devices &&
           max_attempts == o.max_attempts
     end
 
@@ -232,7 +253,7 @@ module Authentik::Api
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [name, configure_flow, friendly_name, user_verification, authenticator_attachment, resident_key_requirement, device_type_restrictions, max_attempts].hash
+      [name, configure_flow, friendly_name, user_verification, authenticator_attachment, resident_key_requirement, hints, device_type_restrictions, prevent_duplicate_devices, max_attempts].hash
     end
 
     # Builds the object from hash

data/lib/authentik/api/models/patched_brand_request.rb

@@ -37,6 +37,8 @@ module Authentik::Api
 
     attr_accessor :flow_device_code
 
+    attr_accessor :flow_lockdown
+
     # When set, external users will be redirected to this application after authenticating.
     attr_accessor :default_application
 
@@ -64,6 +66,7 @@ module Authentik::Api
         :'flow_unenrollment' => :'flow_unenrollment',
         :'flow_user_settings' => :'flow_user_settings',
         :'flow_device_code' => :'flow_device_code',
+        :'flow_lockdown' => :'flow_lockdown',
         :'default_application' => :'default_application',
         :'web_certificate' => :'web_certificate',
         :'client_certificates' => :'client_certificates',
@@ -97,6 +100,7 @@ module Authentik::Api
         :'flow_unenrollment' => :'String',
         :'flow_user_settings' => :'String',
         :'flow_device_code' => :'String',
+        :'flow_lockdown' => :'String',
         :'default_application' => :'String',
         :'web_certificate' => :'String',
         :'client_certificates' => :'Array<String>',
@@ -113,6 +117,7 @@ module Authentik::Api
         :'flow_unenrollment',
         :'flow_user_settings',
         :'flow_device_code',
+        :'flow_lockdown',
         :'default_application',
         :'web_certificate',
       ])
@@ -186,6 +191,10 @@ module Authentik::Api
         self.flow_device_code = attributes[:'flow_device_code']
       end
 
+      if attributes.key?(:'flow_lockdown')
+        self.flow_lockdown = attributes[:'flow_lockdown']
+      end
+
       if attributes.key?(:'default_application')
         self.default_application = attributes[:'default_application']
       end
@@ -335,6 +344,7 @@ module Authentik::Api
           flow_unenrollment == o.flow_unenrollment &&
           flow_user_settings == o.flow_user_settings &&
           flow_device_code == o.flow_device_code &&
+          flow_lockdown == o.flow_lockdown &&
           default_application == o.default_application &&
           web_certificate == o.web_certificate &&
           client_certificates == o.client_certificates &&
@@ -350,7 +360,7 @@ module Authentik::Api
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [domain, default, branding_title, branding_logo, branding_favicon, branding_custom_css, branding_default_flow_background, flow_authentication, flow_invalidation, flow_recovery, flow_unenrollment, flow_user_settings, flow_device_code, default_application, web_certificate, client_certificates, attributes].hash
+      [domain, default, branding_title, branding_logo, branding_favicon, branding_custom_css, branding_default_flow_background, flow_authentication, flow_invalidation, flow_recovery, flow_unenrollment, flow_user_settings, flow_device_code, flow_lockdown, default_application, web_certificate, client_certificates, attributes].hash
     end
 
     # Builds the object from hash

data/lib/authentik/api/models/patched_consent_stage_request.rb

@@ -62,7 +62,7 @@ module Authentik::Api
     def self.openapi_types
       {
         :'name' => :'String',
-        :'mode' => :'ConsentStageModeEnum',
+        :'mode' => :'ConsentModeEnum',
         :'consent_expire_in' => :'String'
       }
     end

data/lib/authentik/api/models/patched_event_matcher_policy_request.rb

@@ -27,6 +27,8 @@ module Authentik::Api
     # Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
     attr_accessor :model
 
+    attr_accessor :query
+
     class EnumAttributeValidator
       attr_reader :datatype
       attr_reader :allowable_values
@@ -57,7 +59,8 @@ module Authentik::Api
         :'action' => :'action',
         :'client_ip' => :'client_ip',
         :'app' => :'app',
-        :'model' => :'model'
+        :'model' => :'model',
+        :'query' => :'query'
       }
     end
 
@@ -79,7 +82,8 @@ module Authentik::Api
         :'action' => :'EventActions',
         :'client_ip' => :'String',
         :'app' => :'AppEnum',
-        :'model' => :'ModelEnum'
+        :'model' => :'ModelEnum',
+        :'query' => :'String'
       }
     end
 
@@ -89,7 +93,8 @@ module Authentik::Api
         :'action',
         :'client_ip',
         :'app',
-        :'model'
+        :'model',
+        :'query'
       ])
     end
 
@@ -132,6 +137,10 @@ module Authentik::Api
       if attributes.key?(:'model')
         self.model = attributes[:'model']
       end
+
+      if attributes.key?(:'query')
+        self.query = attributes[:'query']
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -147,6 +156,10 @@ module Authentik::Api
         invalid_properties.push('invalid value for "client_ip", the character length must be greater than or equal to 1.')
       end
 
+      if !@query.nil? && @query.to_s.length < 1
+        invalid_properties.push('invalid value for "query", the character length must be greater than or equal to 1.')
+      end
+
       invalid_properties
     end
 
@@ -156,6 +169,7 @@ module Authentik::Api
       warn '[DEPRECATED] the `valid?` method is obsolete'
       return false if !@name.nil? && @name.to_s.length < 1
       return false if !@client_ip.nil? && @client_ip.to_s.length < 1
+      return false if !@query.nil? && @query.to_s.length < 1
       true
     end
 
@@ -183,6 +197,16 @@ module Authentik::Api
       @client_ip = client_ip
     end
 
+    # Custom attribute writer method with validation
+    # @param [Object] query Value to be assigned
+    def query=(query)
+      if !query.nil? && query.to_s.length < 1
+        fail ArgumentError, 'invalid value for "query", the character length must be greater than or equal to 1.'
+      end
+
+      @query = query
+    end
+
     # Checks equality by comparing each attribute.
     # @param [Object] Object to be compared
     def ==(o)
@@ -193,7 +217,8 @@ module Authentik::Api
           action == o.action &&
           client_ip == o.client_ip &&
           app == o.app &&
-          model == o.model
+          model == o.model &&
+          query == o.query
     end
 
     # @see the `==` method
@@ -205,7 +230,7 @@ module Authentik::Api
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [name, execution_logging, action, client_ip, app, model].hash
+      [name, execution_logging, action, client_ip, app, model, query].hash
     end
 
     # Builds the object from hash