infrawrench-sdk 1.15.0 → 1.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9e38a098383f11fdb35de83cb2014267146a3689c00f7b84da86b2c994a01ce1
-  data.tar.gz: aaba5e6be92f922ca34f0436611e30ec26cebb13687d0d454e3f1e987f3fe4f4
+  metadata.gz: 359ea68464e3400d21793fcb623a2f4d3652d4438d0943d15d3a89ed08ba2d40
+  data.tar.gz: d85bcd64441a864f5cc4fa8433242a907fe169f89663e66dd8d81595d42fbe52
 SHA512:
-  metadata.gz: e9371a9e34e0adac31a39ea733dd10c50ffea1b4704726ae163bde10ca694e9cb666412fa48824501a32256098f165c3ada273fcccf0b90fc91851ef32211110
-  data.tar.gz: 65dd789443a52e1bb9368eec4dc7e92db2117850ad45e17645ed0e82f7d1a3367610eff61e92e05aa5c223fb62b493bc15cd2f6b08197a2bd5259a9d018799ec
+  metadata.gz: e2ce4ad9fff0121b54795ee4185628084ae0d7832d9970633a3a0f82ca1f98787c098f17a326ca62b62f88452a4836555fe91abd77302be4ccf00ba45953e002
+  data.tar.gz: 8b216cbe55353f50c523ca02ed4e5c86db7a396f63313b629eed0a5747af7d8ec11640a018fab31a4a975537e38bdd5f6935ba3ad41b58aedf0342f62092ca77

data/README.md

@@ -1,6 +1,6 @@
 # infrawrench-sdk
 
-Generated Ruby client for the Infrawrench API (API version `1.15.0`).
+Generated Ruby client for the Infrawrench API (API version `1.17.0`).
 
 **Do not edit this gem by hand** — it is regenerated from `openapi.json` and is
 not checked into the repository. Run
@@ -41,7 +41,7 @@ Every method takes an optional trailing `request_options:` hash (`:headers`,
 Responses are the plain `Hash`/`Array` that `JSON.parse` returns, with String
 keys spelled exactly as the wire spells them. There are no model classes — see
 [`sig/infrawrench/sdk.rbs`](./sig/infrawrench/sdk.rbs) for the shape of every one of the
-586 schemas, as RBS type aliases that steep and TypeProf can read.
+601 schemas, as RBS type aliases that steep and TypeProf can read.
 
 Non-2xx responses raise `Infrawrench::ApiError`, which carries `#status`,
 the parsed `#body`, and the machine-readable `#code` when the API sends one —

data/infrawrench-sdk.gemspec

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.15.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.17.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.15.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.17.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk
@@ -17,8 +17,8 @@ require_relative "lib/infrawrench/version"
 Gem::Specification.new do |spec|
   spec.name = "infrawrench-sdk"
   spec.version = Infrawrench::VERSION
-  spec.summary = "Generated Ruby client for the Infrawrench API (v1.15.0)."
-  spec.description = "Generated Ruby client for the Infrawrench API (v1.15.0). Covers the published API surface only — operations marked x-internal in the spec are not generated. No runtime dependencies."
+  spec.summary = "Generated Ruby client for the Infrawrench API (v1.17.0)."
+  spec.description = "Generated Ruby client for the Infrawrench API (v1.17.0). Covers the published API surface only — operations marked x-internal in the spec are not generated. No runtime dependencies."
   spec.authors = ["Infrawrench LLC", "Astrid Gealer"]
   spec.email = ["astrid@infrawrench.com"]
   spec.homepage = "https://infrawrench.com/docs/team-and-billing/client-sdks"

data/lib/infrawrench/client.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.15.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.17.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.15.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.17.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk
@@ -246,6 +246,173 @@ module Infrawrench
     end
   end
 
+  # `client.access_review.dismissals`
+  class AccessReviewDismissalsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Dismiss an access review finding
+    #
+    # Accept a finding — that break-glass role really is meant to be admin, that
+    # shared key really is rotated out of band. The finding leaves `findings`
+    # and stops feeding the security alerts, but the rule keeps being evaluated
+    # and the finding is reported back under `dismissed` for as long as it still
+    # matches. The principal itself stays in `principals` either way.
+    # Idempotent: dismissing an already-dismissed finding rewrites the note and
+    # the author.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/access-review/dismissals
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash, nil] Request body, shaped as `AccessReviewDismissalCreate`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `AccessReviewDismissal` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(org_id: nil, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/access-review/dismissals",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Restore a dismissed access review finding
+    #
+    # Undo a dismissal, putting the finding back on the list and back into the
+    # security alerts. The finding is identified by query parameters rather than
+    # path segments because resource ids are provider-native and routinely
+    # contain slashes.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # DELETE /api/org/{orgId}/access-review/dismissals
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param resource_id [String] Infrawrench resource id the finding is on.
+    # @param rule_id [String] Which rule was raised. Half of a dismissal's key, alongside the
+    #   resource id. The `access-review:` prefix is reserved so these can share the posture
+    #   dismissal store without colliding with plugin-declared posture rule ids.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [nil] This endpoint returns no content.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(resource_id:, rule_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/access-review/dismissals",
+        path_params: { "orgId" => org_id },
+        query: { "resourceId" => resource_id, "ruleId" => rule_id },
+        accept: :empty,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.access_review`
+  class AccessReviewNamespace
+    # @return [AccessReviewDismissalsNamespace] `client.access_review.dismissals`
+    attr_reader :dismissals
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @dismissals = AccessReviewDismissalsNamespace.new(@transport)
+    end
+
+    # Export the access review as compliance evidence
+    #
+    # The same review as a downloadable file, one row per finding. `format=csv`
+    # (the default) returns RFC 4180 CSV with every cell quoted and spreadsheet
+    # formulas neutralised; `format=json` returns the full response body
+    # pretty-printed.
+    #
+    # Dismissed findings are included and labelled in both formats, with the
+    # note and the person who accepted them: an evidence pack answers what you
+    # found *and* what you decided. Exports are recorded in the audit log.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/access-review/export
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param format [String, nil] Defaults to "csv".
+    # @param stale_days [Integer, nil] Staleness window in days. Defaults to 90.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `AccessReviewResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def export(org_id: nil, format: nil, stale_days: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/access-review/export",
+        path_params: { "orgId" => org_id },
+        query: { "format" => format, "staleDays" => stale_days },
+        request_options: request_options
+      )
+    end
+
+    # Review the principals inside your connected clouds
+    #
+    # Every IAM user and role, service account, app registration, group, role
+    # binding and long-lived API key your connected accounts have synced, with
+    # the findings that have evidence against them: unused beyond the staleness
+    # window, holding administrative or wildcard permissions, past the rotation
+    # budget their plugin declares, carrying no recorded owner, or signing in
+    # without a second factor.
+    #
+    # This is about principals in **your** clouds — it is neither your
+    # Infrawrench team's roles (`/team`) nor the credentials Infrawrench stores
+    # for you (`/credential-hygiene`).
+    #
+    # No provider API calls are made: everything is computed from already-synced
+    # fields, so a principal whose provider does not report last use is reported
+    # with `activity: "unknown"` and is never called stale. Findings the
+    # organization has dismissed are reported separately under `dismissed` and
+    # are excluded from `findings`, `counts`, `byRule` and the security alerts.
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/access-review
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param stale_days [Integer, nil] Staleness window in days. Defaults to 90.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `AccessReviewResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, stale_days: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/access-review",
+        path_params: { "orgId" => org_id },
+        query: { "staleDays" => stale_days },
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.accounts.credentials`
   class AccountsCredentialsNamespace
     # @api private
@@ -2404,16 +2571,165 @@ module Infrawrench
     end
   end
 
+  # `client.changes.revert`
+  class ChangesRevertNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Revert one change event
+    #
+    # Applies the inverse patch through the plugin's ordinary `updateResource`
+    # path — the same call the Edit form makes — and only for the fields the dry
+    # run marked `revertible`.
+    #
+    # The plan is rebuilt against a fresh live read immediately before the
+    # write, so a field that moved between the preview and the apply becomes a
+    # conflict and drops out of the patch.
+    #
+    # **This is a last-moment re-read, not an atomic compare-and-swap.** The gap
+    # between reading a field and writing it is one provider round-trip wide,
+    # and a third party writing inside that gap will be overwritten without
+    # warning. It cannot be closed generically: the plugin update contract
+    # carries no expected value, ETag or version token, so no conditional write
+    # can be expressed for a provider that supports one. Treat the conflict
+    # detection as a strong guard against stale plans, not as a mutual-exclusion
+    # guarantee against other writers.
+    #
+    # Reverts of the *same event* are mutually exclusive: the event is claimed
+    # with a conditional update under a five-minute lease, so two concurrent
+    # reverts cannot both reach the provider and the loser gets `409`. A
+    # provider failure releases the claim immediately; a process that dies
+    # mid-write leaves a claim that expires, so an interrupted revert is
+    # retryable rather than permanently stuck. `revertedAt` is only set once the
+    # provider accepted the write.
+    #
+    # The claim carries an owner token, and every write that ends a revert is
+    # fenced on it. An attempt whose provider call outlives the lease can
+    # therefore neither release nor complete the claim that replaced it — it
+    # gets `409` with `appliedFields` naming what it did write, so the caller
+    # can reconcile rather than assume. Two attempts can overlap in that case,
+    # but they cannot disagree: both invert the same recorded event to the same
+    # values, so the second one's patch is a subset of the first's.
+    #
+    # If a write reaches the provider but recording it fails, the response is
+    # `500` with `appliedFields` — the resource moved and the timeline has not
+    # caught up. The claim is deliberately held in that case, and the next
+    # attempt after the lease expires finds every field already back and records
+    # the revert without touching the provider again, answering `200` with
+    # `reconciled: true` and an empty `appliedFields`. A resource put back by
+    # hand is not mistaken for this: reconciliation only happens on an event
+    # whose claim was still outstanding, which is the only state in which an
+    # unrecorded write is possible.
+    #
+    # Blocked with `423` while an org change freeze is in effect. Every attempt
+    # whose write reached the provider is audit-logged as
+    # `resource.change_revert`, including one that lost its claim or could not
+    # record — the entry's `outcome` is `recorded`, `superseded`, `unrecorded`
+    # or `reconciled`, so a contested outcome reads as one mutation rather than
+    # as several reverts. An attempt that neither wrote nor recorded anything
+    # logs nothing. Attribution is best-effort: no transaction spans a
+    # third-party cloud API and Infrawrench's database, so if the audit insert
+    # itself fails the response carries `auditRecorded: false` and the details
+    # go to the server log rather than being silently dropped.
+    #
+    # The stored resource snapshot is deliberately left untouched, so the next
+    # poll observes the reverted state and records it as an ordinary change
+    # event.
+    #
+    # POST /api/org/{orgId}/changes/{changeId}/revert
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Already reverted, another revert holds the event, nothing
+    # in the plan is writable, or this attempt was superseded mid-write (its
+    # lease lapsed). The body carries `code: change_revert_conflict` for all but
+    # the writability case, and `appliedFields` when the provider write had
+    # already landed.
+    #
+    # Raises on 423: Blocked by an active change freeze. Retry with the
+    # `x-change-freeze-override: true` header if you hold `freezes:override`;
+    # both blocks and overrides are audit-logged.
+    #
+    # Raises on 500: The provider accepted the write but it could not be
+    # recorded against the event. The resource *has* been put back;
+    # `appliedFields` names what changed. A later retry reconciles the timeline.
+    #
+    # Raises on 502: The provider couldn't be read. Nothing was written.
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param change_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `RevertApplyResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(change_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/changes/{changeId}/revert",
+        path_params: { "orgId" => org_id, "changeId" => change_id },
+        request_options: request_options
+      )
+    end
+
+    # Dry-run a revert of one change event
+    #
+    # Inverts the recorded diff and reconciles it against the resource's
+    # *current* live fields, which is the whole point: the poller may have
+    # recorded this hours ago and the world may have moved on. Read-only — it
+    # reads from the provider and writes nothing.
+    #
+    # Only `updated` events with a field diff can be reverted. `outputs.*`
+    # entries are provider-derived and are never written back, and whether a
+    # field is writable at all is the plugin's own edit-form rule (`editable`,
+    # minus `secret` and `association` kinds), so a revert can never issue a
+    # provider call an edit could not.
+    #
+    # Gated on `resources:write` rather than `resources:read`: the plan names
+    # the write it is offering to make.
+    #
+    # GET /api/org/{orgId}/changes/{changeId}/revert
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 502: The provider couldn't be read, so no plan can be made
+    # safely. Nothing was written.
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param change_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `RevertPreviewResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(change_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/changes/{changeId}/revert",
+        path_params: { "orgId" => org_id, "changeId" => change_id },
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.changes`
   class ChangesNamespace
     # @return [ChangesAlertSettingsNamespace] `client.changes.alert_settings`
     attr_reader :alert_settings
+    # @return [ChangesRevertNamespace] `client.changes.revert`
+    attr_reader :revert
 
     # @api private
     # @param transport [Transport]
     def initialize(transport)
       @transport = transport
       @alert_settings = ChangesAlertSettingsNamespace.new(@transport)
+      @revert = ChangesRevertNamespace.new(@transport)
     end
 
     # Org-wide change timeline (paginated, filterable)
@@ -13552,6 +13868,8 @@ module Infrawrench
     attr_reader :transport
     # @return [AccessRequestsNamespace] `client.access_requests`
     attr_reader :access_requests
+    # @return [AccessReviewNamespace] `client.access_review`
+    attr_reader :access_review
     # @return [AccountsNamespace] `client.accounts`
     attr_reader :accounts
     # @return [AgentsNamespace] `client.agents`
@@ -13723,6 +14041,7 @@ module Infrawrench
     def initialize(**options)
       @transport = Transport.new(**options)
       @access_requests = AccessRequestsNamespace.new(@transport)
+      @access_review = AccessReviewNamespace.new(@transport)
       @accounts = AccountsNamespace.new(@transport)
       @agents = AgentsNamespace.new(@transport)
       @alert_rules = AlertRulesNamespace.new(@transport)

data/lib/infrawrench/sdk.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.15.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.17.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.15.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.17.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk

data/lib/infrawrench/transport.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.15.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.17.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.15.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.17.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk

data/lib/infrawrench/version.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.15.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.17.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.15.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.17.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk
@@ -15,5 +15,5 @@
 # Kept in its own file so the gemspec can read the version without loading the
 # client — a gemspec that pulls in net/http is a gemspec that can fail to parse.
 module Infrawrench
-  VERSION = "1.15.0"
+  VERSION = "1.17.0"
 end

data/lib/infrawrench-sdk.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.15.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.17.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.15.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.17.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk

data/sig/infrawrench/sdk.rbs

@@ -1,7 +1,7 @@
-# infrawrench-sdk v1.15.0 | MIT | Copyright (c) 2026 Infrawrench LLC
+# infrawrench-sdk v1.17.0 | MIT | Copyright (c) 2026 Infrawrench LLC
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.15.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.17.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk
@@ -104,6 +104,57 @@ module Infrawrench
     ?"missing" => Array[String]
   }
 
+  # Spec schema: `AccessFinding`.
+  type access_finding = {
+    "resourceId" => String,
+    "ruleId" => "access-review:stale-principal"
+      | "access-review:admin-principal"
+      | "access-review:key-past-rotation"
+      | "access-review:no-recorded-owner"
+      | "access-review:no-mfa",
+    "title" => String,
+    "severity" => "critical" | "high" | "medium" | "low",
+    "reason" => String,
+    "principal" => access_principal
+  }
+
+  # Spec schema: `AccessPrincipal`.
+  type access_principal = {
+    "resourceId" => String,
+    "pluginId" => plugin_id,
+    "pluginName" => String,
+    "resourceTypeId" => String,
+    "resourceTypeName" => String,
+    "accountId" => String,
+    "accountName" => String,
+    "displayName" => String,
+    "externalId" => String | nil,
+    "role" => "user" | "group" | "role" | "service-account" | "key" | "binding",
+    "lastUsedAt" => String | nil,
+    "daysSinceLastUsed" => Integer | nil,
+    "activity" => "active" | "stale" | "unknown",
+    "createdAt" => String | nil,
+    "ageDays" => Integer | nil,
+    "admin" => bool | nil,
+    "mfa" => bool | nil,
+    "parent" => String | nil,
+    "owner" => access_principal_owner,
+    "revokeActionId" => String | nil
+  }
+
+  # Who owns the resource, from the resource-ownership record. Null when nobody
+  # is named.
+  #
+  # Spec schema: `AccessPrincipalOwner`.
+  type access_principal_owner = {
+      "userId" => String | nil,
+      "displayName" => String,
+      "isLabel" => bool,
+      "ticketUrl" => String | nil,
+      "purpose" => String | nil
+    }
+    | nil
+
   # Spec schema: `AccessRequest`.
   type access_request = {
     "id" => String,
@@ -137,6 +188,63 @@ module Infrawrench
   # Spec schema: `AccessRequestCreate`.
   type access_request_create = { "permissions" => Array[String], "reason" => String, "durationMinutes" => Integer }
 
+  # Spec schema: `AccessReviewDismissal`.
+  type access_review_dismissal = {
+    "resourceId" => String,
+    "ruleId" => String,
+    "dismissedAt" => String,
+    "dismissedBy" => String | nil,
+    "reason" => String | nil
+  }
+
+  # Spec schema: `AccessReviewDismissalCreate`.
+  type access_review_dismissal_create = {
+    "resourceId" => String,
+    "ruleId" => "access-review:stale-principal"
+      | "access-review:admin-principal"
+      | "access-review:key-past-rotation"
+      | "access-review:no-recorded-owner"
+      | "access-review:no-mfa",
+    ?"reason" => String | nil
+  }
+
+  # Spec schema: `AccessReviewResponse`.
+  type access_review_response = {
+    "principals" => Array[access_principal],
+    "findings" => Array[access_finding],
+    "totalCount" => Integer,
+    "counts" => access_review_severity_counts,
+    "byRule" => access_review_rule_counts,
+    "byRole" => access_review_role_counts,
+    "dismissed" => Array[dismissed_access_finding],
+    "dismissedCount" => Integer,
+    "unknownActivityCount" => Integer,
+    "staleDays" => Integer,
+    "generatedAt" => String
+  }
+
+  # Spec schema: `AccessReviewRoleCounts`.
+  type access_review_role_counts = {
+    "user" => Integer,
+    "group" => Integer,
+    "role" => Integer,
+    "service-account" => Integer,
+    "key" => Integer,
+    "binding" => Integer
+  }
+
+  # Spec schema: `AccessReviewRuleCounts`.
+  type access_review_rule_counts = {
+    "access-review:stale-principal" => Integer,
+    "access-review:admin-principal" => Integer,
+    "access-review:key-past-rotation" => Integer,
+    "access-review:no-recorded-owner" => Integer,
+    "access-review:no-mfa" => Integer
+  }
+
+  # Spec schema: `AccessReviewSeverityCounts`.
+  type access_review_severity_counts = { "critical" => Integer, "high" => Integer, "medium" => Integer, "low" => Integer }
+
   # Spec schema: `AccessRevokeConflict`.
   type access_revoke_conflict = { "error" => String }
 
@@ -2178,6 +2286,21 @@ module Infrawrench
   # Spec schema: `DigestTransportResult`.
   type digest_transport_result = { "attempted" => Integer, "succeeded" => Integer }
 
+  # Spec schema: `DismissedAccessFinding`.
+  type dismissed_access_finding = {
+    "resourceId" => String,
+    "ruleId" => "access-review:stale-principal"
+      | "access-review:admin-principal"
+      | "access-review:key-past-rotation"
+      | "access-review:no-recorded-owner"
+      | "access-review:no-mfa",
+    "title" => String,
+    "severity" => "critical" | "high" | "medium" | "low",
+    "reason" => String,
+    "principal" => access_principal,
+    "dismissal" => access_review_dismissal
+  }
+
   # Spec schema: `DismissedPostureFinding`.
   type dismissed_posture_finding = {
     "resourceId" => String,
@@ -4479,7 +4602,8 @@ module Infrawrench
     "changeKind" => resource_change_kind,
     "diff" => Array[resource_field_change],
     ?"origin" => "schedule" | nil,
-    "createdAt" => String
+    "createdAt" => String,
+    ?"revertedAt" => String | nil
   }
 
   # Spec schema: `ResourceChangeFeedEntry`.
@@ -5043,6 +5167,58 @@ module Infrawrench
     ?"schedulable" => bool
   }
 
+  # Spec schema: `RevertApplyResponse`.
+  type revert_apply_response = {
+    "changeId" => String,
+    "resourceId" => resource_id,
+    "appliedFields" => Array[String],
+    "plan" => revert_plan,
+    "revertedAt" => String,
+    ?"reconciled" => bool,
+    ?"auditRecorded" => bool
+  }
+
+  # Spec schema: `RevertFieldPlan`.
+  type revert_field_plan = {
+    "field" => String,
+    ?"revertTo" => untyped,
+    ?"changedTo" => untyped,
+    ?"current" => untyped,
+    "status" => revert_field_status,
+    "reason" => String
+  }
+
+  # What a revert would do to one field. `revertible` — the field still holds
+  # the value the change set, and the plugin's edit form can write the old one
+  # back. `already-reverted` — it is already at the old value; nothing to do.
+  # `conflict` — it changed again since, so reverting would discard the newer
+  # value. `not-writable` — outside the plugin's editable surface, or the old
+  # value is not something the edit form can submit. `provider-derived` — an
+  # `outputs.*` entry, which the provider computes rather than accepts.
+  #
+  # Spec schema: `RevertFieldStatus`.
+  type revert_field_status = "revertible" | "already-reverted" | "conflict" | "not-writable" | "provider-derived"
+
+  # Spec schema: `RevertPlan`.
+  type revert_plan = {
+    "fields" => Array[revert_field_plan],
+    "revertibleFields" => Array[String],
+    "revertible" => bool,
+    "blockedReason" => String | nil
+  }
+
+  # Spec schema: `RevertPreviewResponse`.
+  type revert_preview_response = {
+    "changeId" => String,
+    "resourceId" => resource_id,
+    "displayName" => String,
+    "pluginId" => String,
+    "resourceTypeId" => String,
+    "accountId" => String,
+    "plan" => revert_plan,
+    "revertedAt" => String | nil
+  }
+
   # Spec schema: `RightsizingListResponse`.
   type rightsizing_list_response = {
     "accounts" => Array[oversized_account_group],
@@ -5792,6 +5968,7 @@ module Infrawrench
       | "changes"
       | "expiring"
       | "posture"
+      | "access-review"
       | "dns"
       | "environment-diff"
       | "ssh-fanout"
@@ -6038,6 +6215,19 @@ module Infrawrench
     def withdraw: (request_id: String, ?org_id: String?, ?request_options: Hash[Symbol, untyped]?) -> ok
   end
 
+  class AccessReviewDismissalsNamespace
+    def initialize: (Transport) -> void
+    def create: (?org_id: String?, ?body: access_review_dismissal_create?, ?request_options: Hash[Symbol, untyped]?) -> access_review_dismissal
+    def delete: (resource_id: String, rule_id: "access-review:stale-principal" | "access-review:admin-principal" | "access-review:key-past-rotation" | "access-review:no-recorded-owner" | "access-review:no-mfa", ?org_id: String?, ?request_options: Hash[Symbol, untyped]?) -> nil
+  end
+
+  class AccessReviewNamespace
+    attr_reader dismissals: AccessReviewDismissalsNamespace
+    def initialize: (Transport) -> void
+    def export: (?org_id: String?, ?format: "csv" | "json"?, ?stale_days: Integer?, ?request_options: Hash[Symbol, untyped]?) -> access_review_response
+    def get: (?org_id: String?, ?stale_days: Integer?, ?request_options: Hash[Symbol, untyped]?) -> access_review_response
+  end
+
   class AccountsCredentialsNamespace
     def initialize: (Transport) -> void
     def get: (id: String, ?org_id: String?, ?request_options: Hash[Symbol, untyped]?) -> Hash[String, String]
@@ -6226,8 +6416,15 @@ module Infrawrench
     def update: (?org_id: String?, ?body: drift_alert_settings_update?, ?request_options: Hash[Symbol, untyped]?) -> drift_alert_settings
   end
 
+  class ChangesRevertNamespace
+    def initialize: (Transport) -> void
+    def create: (change_id: String, ?org_id: String?, ?request_options: Hash[Symbol, untyped]?) -> revert_apply_response
+    def get: (change_id: String, ?org_id: String?, ?request_options: Hash[Symbol, untyped]?) -> revert_preview_response
+  end
+
   class ChangesNamespace
     attr_reader alert_settings: ChangesAlertSettingsNamespace
+    attr_reader revert: ChangesRevertNamespace
     def initialize: (Transport) -> void
     def get: (?org_id: String?, ?page: Integer?, ?page_size: Integer?, ?account_id: String?, ?resource_id: String?, ?kind: resource_change_kind?, ?from: String?, ?to: String?, ?request_options: Hash[Symbol, untyped]?) -> resource_change_feed_response
     def resource: (resource_id: String, ?org_id: String?, ?limit: Integer?, ?request_options: Hash[Symbol, untyped]?) -> resource_change_list_response
@@ -7049,6 +7246,7 @@ module Infrawrench
   class APIV1Client
     attr_reader transport: Transport
     attr_reader access_requests: AccessRequestsNamespace
+    attr_reader access_review: AccessReviewNamespace
     attr_reader accounts: AccountsNamespace
     attr_reader agents: AgentsNamespace
     attr_reader alert_rules: AlertRulesNamespace

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: infrawrench-sdk
 version: !ruby/object:Gem::Version
-  version: 1.15.0
+  version: 1.17.0
 platform: ruby
 authors:
 - Infrawrench LLC
@@ -11,7 +11,7 @@ bindir: bin
 cert_chain: []
 date: 2026-08-12 00:00:00.000000000 Z
 dependencies: []
-description: Generated Ruby client for the Infrawrench API (v1.15.0). Covers the published
+description: Generated Ruby client for the Infrawrench API (v1.17.0). Covers the published
   API surface only — operations marked x-internal in the spec are not generated. No
   runtime dependencies.
 email:
@@ -58,5 +58,5 @@ requirements: []
 rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
-summary: Generated Ruby client for the Infrawrench API (v1.15.0).
+summary: Generated Ruby client for the Infrawrench API (v1.17.0).
 test_files: []