infrawrench-sdk 1.98.0 → 1.100.0

data/lib/infrawrench/client.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-# infrawrench-sdk v1.98.0 | MIT | Copyright (c) 2026 Infrawrench Services, Inc.
+# infrawrench-sdk v1.100.0 | MIT | Copyright (c) 2026 Infrawrench Services, Inc.
 # https://github.com/Infrawrench/Infrawrench
 #
-# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.98.0).
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 1.100.0).
 #
 # DO NOT EDIT. Regenerate with:
 #   pnpm --filter @infrawrench/web generate:sdk
@@ -38,12 +38,13 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 403: Self-approval, or granting beyond the approver's own
-    # permissions
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: AccessDecisionForbidden
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: Already decided, or the request timed out
+    # Raises on 409: AccessDecisionConflict
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -101,6 +102,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 401: Unauthenticated
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash, nil] Request body, shaped as `AccessRequestCreate`.
@@ -131,12 +134,13 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 403: Self-approval, or granting beyond the approver's own
-    # permissions
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: AccessDecisionForbidden
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: Already decided, or the request timed out
+    # Raises on 409: AccessDecisionConflict
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -197,9 +201,13 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/access-requests/{requestId}/revoke
     #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
-    # Raises on 409: The grant is not active
+    # Raises on 409: AccessRevokeConflict
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -226,9 +234,11 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/access-requests/{requestId}/withdraw
     #
+    # Raises on 401: Unauthenticated
+    #
     # Raises on 404: Not found
     #
-    # Raises on 409: Already decided or expired
+    # Raises on 409: AccessWithdrawConflict
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -687,7 +697,7 @@ module Infrawrench
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `CreateAccountRequest & Hash`.
+    # @param body [Hash] Request body, shaped as `CreateAccountRequest`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `CreateAccountResponse` — see
     #   `sig/infrawrench/sdk.rbs`.
@@ -1399,9 +1409,6 @@ module Infrawrench
     #
     # Raises on 503: A backing service this endpoint depends on is not available
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
-    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
@@ -1440,9 +1447,6 @@ module Infrawrench
     #
     # Raises on 503: A backing service this endpoint depends on is not available
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
-    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
@@ -1493,9 +1497,6 @@ module Infrawrench
     #
     # Raises on 503: A backing service this endpoint depends on is not available
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
-    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
@@ -1534,9 +1535,6 @@ module Infrawrench
     #
     # Raises on 503: A backing service this endpoint depends on is not available
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
-    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
@@ -1579,9 +1577,6 @@ module Infrawrench
     #
     # Raises on 503: A backing service this endpoint depends on is not available
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
-    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
@@ -1745,7 +1740,7 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash, nil] Parsed JSON, shaped as `AgentSettings` — see
+    # @return [Hash, nil] Parsed JSON, shaped as `AgentSettings | nil` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def get(org_id: nil, request_options: nil)
@@ -1765,10 +1760,9 @@ module Infrawrench
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `AgentSettings & Hash`.
+    # @param body [Hash] Request body, shaped as `AgentSettings`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `AgentSettings & Hash` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `AgentSettings` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def update(body:, org_id: nil, request_options: nil)
       @transport.request(
@@ -1800,6 +1794,8 @@ module Infrawrench
     # policy, that the policy does not fit, or that are still setting up are not
     # dialled. Requires `resources:execute`.
     #
+    # _Requires permission: `resources:execute`._
+    #
     # POST /api/org/{orgId}/agents/t3-policy/apply
     #
     # Raises on 400: Bad request
@@ -1897,6 +1893,8 @@ module Infrawrench
 
     # Map request-metadata keys to a caller dimension
     #
+    # _Requires permission: `costs:write`._
+    #
     # POST /api/org/{orgId}/ai-attribution/dimensions
     #
     # Raises on 400: Bad request
@@ -1922,6 +1920,8 @@ module Infrawrench
 
     # Delete a caller dimension
     #
+    # _Requires permission: `costs:write`._
+    #
     # DELETE /api/org/{orgId}/ai-attribution/dimensions/{id}
     #
     # Raises on 403: Forbidden
@@ -1945,6 +1945,8 @@ module Infrawrench
 
     # List caller dimensions
     #
+    # _Requires permission: `costs:read`._
+    #
     # GET /api/org/{orgId}/ai-attribution/dimensions
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -1963,6 +1965,8 @@ module Infrawrench
 
     # Update a caller dimension
     #
+    # _Requires permission: `costs:write`._
+    #
     # PUT /api/org/{orgId}/ai-attribution/dimensions/{id}
     #
     # Raises on 400: Bad request
@@ -2004,6 +2008,8 @@ module Infrawrench
     # org's request logs, and the Bedrock CloudWatch kind runs a Logs Insights
     # query billed to the org's own AWS account per GB scanned. Audit-logged.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/ai-attribution/sources
     #
     # Raises on 400: Bad request
@@ -2030,6 +2036,8 @@ module Infrawrench
 
     # Delete a request-log source
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # DELETE /api/org/{orgId}/ai-attribution/sources/{id}
     #
     # Raises on 403: Forbidden
@@ -2053,6 +2061,8 @@ module Infrawrench
 
     # List request-log sources
     #
+    # _Requires permission: `costs:read`._
+    #
     # GET /api/org/{orgId}/ai-attribution/sources
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -2071,6 +2081,8 @@ module Infrawrench
 
     # Read one request-log source
     #
+    # _Requires permission: `costs:read`._
+    #
     # GET /api/org/{orgId}/ai-attribution/sources/{id}
     #
     # Raises on 404: Not found
@@ -2096,6 +2108,8 @@ module Infrawrench
     # reaches history only by re-reading it. Clamped to the source kind's
     # history limit.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/ai-attribution/sources/{id}/recollect
     #
     # Raises on 400: Bad request
@@ -2123,6 +2137,8 @@ module Infrawrench
     #
     # Pointing a source at a different location restarts its collection history.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # PUT /api/org/{orgId}/ai-attribution/sources/{id}
     #
     # Raises on 400: Bad request
@@ -2166,6 +2182,8 @@ module Infrawrench
 
     # Discover locations (buckets, log groups, gateways) for a source kind
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/ai-attribution/locations
     #
     # Raises on 400: Bad request
@@ -2174,6 +2192,8 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
+    # Raises on 502: Bad gateway: an upstream service failed
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param account_id [String]
@@ -2193,6 +2213,8 @@ module Infrawrench
 
     # Re-split a range of days now
     #
+    # _Requires permission: `costs:write`._
+    #
     # POST /api/org/{orgId}/ai-attribution/reattribute
     #
     # Raises on 400: Bad request
@@ -2217,6 +2239,8 @@ module Infrawrench
 
     # List the request-log source kinds the org can add
     #
+    # _Requires permission: `costs:read`._
+    #
     # GET /api/org/{orgId}/ai-attribution/source-kinds
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -2239,6 +2263,8 @@ module Infrawrench
     # requests that lacked every mapped key. For time series, group a cost
     # report by the tag key `caller:<dimension>`.
     #
+    # _Requires permission: `costs:read`._
+    #
     # GET /api/org/{orgId}/ai-attribution/spend
     #
     # Raises on 400: Bad request
@@ -2263,6 +2289,8 @@ module Infrawrench
 
     # Match-rate statistics per source and coverage per provider
     #
+    # _Requires permission: `costs:read`._
+    #
     # GET /api/org/{orgId}/ai-attribution/stats
     #
     # Raises on 400: Bad request
@@ -2296,6 +2324,8 @@ module Infrawrench
 
     # Get the alert email policy and suppression list
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/alert-email/settings
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -2319,6 +2349,8 @@ module Infrawrench
     # list: an address that no longer passes is skipped at send time, and
     # loosening the policy again brings it back.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # PUT /api/org/{orgId}/alert-email/settings
     #
     # Raises on 400: Bad request
@@ -2351,6 +2383,8 @@ module Infrawrench
 
     # Resume alert email to an unsubscribed address
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # DELETE /api/org/{orgId}/alert-email/suppressions/{id}
     #
     # Raises on 404: Not found
@@ -2394,6 +2428,8 @@ module Infrawrench
     # anomaly settings or efficiency alert settings, or an email destination on
     # an alert routing rule. Requires `costs:read`.
     #
+    # _Requires permission: `costs:read`._
+    #
     # GET /api/org/{orgId}/alert-email
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -2425,6 +2461,8 @@ module Infrawrench
     # two people pressing at once produce one acknowledgement and an alert that
     # already escalated cannot be retroactively silenced.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/alert-rules/deliveries/{id}/ack
     #
     # Raises on 401: Unauthenticated
@@ -2450,6 +2488,8 @@ module Infrawrench
 
     # Drop held or awaiting-acknowledgement deliveries
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/alert-rules/deliveries/cancel
     #
     # Raises on 400: Bad request
@@ -2478,6 +2518,8 @@ module Infrawrench
     # quiet hours, or one waiting on an acknowledgement. An alert that went
     # straight out leaves no row.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/alert-rules/deliveries
     #
     # Raises on 403: Forbidden
@@ -2516,6 +2558,8 @@ module Infrawrench
     #
     # A no-op when the organization already has rules.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/alert-rules/adopt-defaults
     #
     # Raises on 403: Forbidden
@@ -2541,6 +2585,8 @@ module Infrawrench
     # that has saved no rules gets the synthesized default with `usingDefaults:
     # true`.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/alert-rules
     #
     # Raises on 403: Forbidden
@@ -2567,6 +2613,8 @@ module Infrawrench
     # as several requests would leave a window in which alerts route somewhere
     # nobody asked for. Positions are re-derived from array order.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # PUT /api/org/{orgId}/alert-rules
     #
     # Raises on 400: Bad request
@@ -2600,8 +2648,12 @@ module Infrawrench
 
     # Create an API key (plaintext returned once)
     #
+    # _Requires permission: `apikeys:write`._
+    #
     # POST /api/org/{orgId}/api-keys
     #
+    # Raises on 400: Bad request
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `CreateApiKeyRequest`.
@@ -2620,6 +2672,8 @@ module Infrawrench
 
     # List API keys (no plaintext)
     #
+    # _Requires permission: `apikeys:read`._
+    #
     # GET /api/org/{orgId}/api-keys
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -2639,6 +2693,8 @@ module Infrawrench
 
     # Revoke an API key
     #
+    # _Requires permission: `apikeys:write`._
+    #
     # POST /api/org/{orgId}/api-keys/{id}/revoke
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -2658,6 +2714,8 @@ module Infrawrench
 
     # Rotate an API key (revokes old, returns new)
     #
+    # _Requires permission: `apikeys:write`._
+    #
     # POST /api/org/{orgId}/api-keys/{id}/rotate
     #
     # Raises on 404: Not found
@@ -2693,6 +2751,8 @@ module Infrawrench
     # it opens a connection to the named host and must never be cached; its
     # whole value is saying what the host is now.
     #
+    # _Requires permission: `resources:execute`._
+    #
     # POST /api/org/{orgId}/apps/check
     #
     # Raises on 400: Bad request
@@ -2732,14 +2792,17 @@ module Infrawrench
     # as `{"error":"…"}` inside the stream, because the status line has already
     # been sent by then.
     #
+    # _Requires permission: `resources:execute`._
+    #
     # POST /api/org/{orgId}/apps/setup
     #
     # Raises on 400: Bad request
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: A change freeze is in effect, or the host key needs
-    # trusting
+    # Raises on 423: Blocked by an active change freeze. Retry with the
+    # `x-change-freeze-override: true` header if you hold `freezes:override`;
+    # both blocks and overrides are audit-logged.
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -3042,10 +3105,14 @@ module Infrawrench
     # reporting what you did, and the person who spent Saturday restoring a
     # database is rarely the person who set the recovery objective.
     #
+    # _Requires permission: `resources:write`._
+    #
     # POST /api/org/{orgId}/backups/drills
     #
     # Raises on 400: Bad request
     #
+    # Raises on 404: Not found
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash, nil] Request body, shaped as `RestoreDrillCreate`.
@@ -3068,6 +3135,8 @@ module Infrawrench
     # deleting evidence that a restore failed is exactly the edit a reviewer
     # would want to know about.
     #
+    # _Requires permission: `resources:write`._
+    #
     # DELETE /api/org/{orgId}/backups/drills/{drillId}
     #
     # Raises on 404: Not found
@@ -3099,6 +3168,8 @@ module Infrawrench
     # with production, and cannot be generically verified. What the product can
     # do is make the exercise scheduled, recorded and visible when it lapses.
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/backups/drills
     #
     # Raises on 400: Bad request
@@ -3123,6 +3194,8 @@ module Infrawrench
 
     # List recorded restore drills
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/backups/drills/log
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -3157,10 +3230,14 @@ module Infrawrench
     # protection while providing none. An empty `resourceTypeIds` selects every
     # stateful resource type.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/backups/policies
     #
     # Raises on 400: Bad request
     #
+    # Raises on 404: Not found
+    #
     # Raises on 409: Conflict
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -3184,6 +3261,8 @@ module Infrawrench
     # Removes the objective. To stop a policy judging without losing it, set
     # `enabled` to false instead.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # DELETE /api/org/{orgId}/backups/policies/{policyId}
     #
     # Raises on 404: Not found
@@ -3210,6 +3289,8 @@ module Infrawrench
     # resources by type and/or tag and demands a maximum RPO, a minimum
     # retention, or both.
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/backups/policies
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -3233,12 +3314,16 @@ module Infrawrench
     # after merging, so a patch that would leave the policy demanding nothing is
     # rejected.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # PATCH /api/org/{orgId}/backups/policies/{policyId}
     #
     # Raises on 400: Bad request
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param policy_id [String]
@@ -3282,6 +3367,8 @@ module Infrawrench
     # Orphaned backups carry a trailing-30-day spend quote when billing data is
     # available.
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/backups
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -3397,6 +3484,8 @@ module Infrawrench
     # 400 for complimentary organizations, and 503 when the deployment has no
     # one-time capacity price configured.
     #
+    # _Requires permission: `billing:write`._
+    #
     # POST /api/org/{orgId}/billing/capacity/checkout
     #
     # Raises on 400: Bad request
@@ -3811,6 +3900,10 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `PricingPreviewRequest`.
@@ -3914,11 +4007,12 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/blast-radius
     #
-    # Raises on 400: Missing resourceId
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param resource_id [Hash]
+    # @param resource_id [String] The resource to report on. A query parameter rather than a
+    #   path segment because composite resource ids contain slashes and colons.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `BlastRadiusReport` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
@@ -3943,6 +4037,8 @@ module Infrawrench
 
     # Alert event history for a budget
     #
+    # _Requires permission: `budgets:read`._
+    #
     # GET /api/org/{orgId}/budgets/{id}/events
     #
     # Raises on 404: Not found
@@ -3980,6 +4076,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -4016,6 +4114,8 @@ module Infrawrench
 
     # Create a budget
     #
+    # _Requires permission: `budgets:write`._
+    #
     # POST /api/org/{orgId}/budgets
     #
     # Raises on 400: Bad request
@@ -4038,6 +4138,8 @@ module Infrawrench
 
     # Delete a budget
     #
+    # _Requires permission: `budgets:write`._
+    #
     # DELETE /api/org/{orgId}/budgets/{id}
     #
     # Raises on 404: Not found
@@ -4059,6 +4161,8 @@ module Infrawrench
 
     # Get a budget with current-period status
     #
+    # _Requires permission: `budgets:read`._
+    #
     # GET /api/org/{orgId}/budgets/{id}
     #
     # Raises on 404: Not found
@@ -4080,6 +4184,8 @@ module Infrawrench
 
     # List budgets with current-period actuals and forecasts
     #
+    # _Requires permission: `budgets:read`._
+    #
     # GET /api/org/{orgId}/budgets
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -4099,6 +4205,8 @@ module Infrawrench
 
     # Update a budget
     #
+    # _Requires permission: `budgets:write`._
+    #
     # PUT /api/org/{orgId}/budgets/{id}
     #
     # Raises on 400: Bad request
@@ -4350,6 +4458,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -4413,6 +4523,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -4420,7 +4532,7 @@ module Infrawrench
     # @param id [String] Metric id or key
     # @param body [Hash] Request body, shaped as `BusinessMetricImporterInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `BusinessMetricImporter & Hash` — see
+    # @return [Hash] Parsed JSON, shaped as `BusinessMetricImporter` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def update(id:, body:, org_id: nil, request_options: nil)
@@ -4544,6 +4656,8 @@ module Infrawrench
     # bought the denominator. A bucket with no usage is a gap (`no_usage`),
     # never 0. Labels do not apply.
     #
+    # _Requires permission: `costs:read`._
+    #
     # POST /api/org/{orgId}/business-metrics/usage-unit-costs
     #
     # Raises on 400: Bad request
@@ -4712,7 +4826,7 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 409: A live metric already uses this key.
+    # Raises on 409: Conflict
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -4770,6 +4884,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -4801,6 +4917,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -4850,6 +4968,8 @@ module Infrawrench
     # (at most 500) and its cost mapping. A mapped label nobody has reported yet
     # is listed with no values.
     #
+    # _Requires permission: `costs:read`._
+    #
     # GET /api/org/{orgId}/business-metrics/{id}/labels
     #
     # Raises on 404: Not found
@@ -4884,7 +5004,7 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: A live metric already uses this key.
+    # Raises on 409: Conflict
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -4909,6 +5029,8 @@ module Infrawrench
     # 90 days, most spend first, with a few of the services reporting each.
     # Backs the per-usage-unit picker.
     #
+    # _Requires permission: `costs:read`._
+    #
     # GET /api/org/{orgId}/business-metrics/usage-units
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -4943,6 +5065,8 @@ module Infrawrench
     #
     # An organization may hold 25 live subscriptions; revoking makes room.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/calendar/subscriptions
     #
     # Raises on 400: Bad request
@@ -4969,6 +5093,8 @@ module Infrawrench
     # The URL stops working immediately. The row is kept, and revoking twice is
     # not an error.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # DELETE /api/org/{orgId}/calendar/subscriptions/{subscriptionId}
     #
     # Raises on 404: Not found
@@ -4995,6 +5121,8 @@ module Infrawrench
     # kept so the audit trail still resolves. The token itself is never
     # returned.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/calendar/subscriptions
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -5038,6 +5166,8 @@ module Infrawrench
     # 400. Recurring sources are expanded to at most 400 occurrences each, so
     # one nightly schedule cannot flood a year-long query.
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/calendar
     #
     # Raises on 400: Bad request
@@ -5297,6 +5427,8 @@ module Infrawrench
     # Who receives it is the `resourceDrift` opt-in on push preferences, Slack
     # channels and Teams webhooks; off by default on all three.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/changes/alert-settings
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -5321,6 +5453,8 @@ module Infrawrench
     # notification rate would follow the sync rate again, which is what the
     # batching exists to prevent.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # PUT /api/org/{orgId}/changes/alert-settings
     #
     # Raises on 400: Bad request
@@ -5411,27 +5545,23 @@ module Infrawrench
     # poll observes the reverted state and records it as an ordinary change
     # event.
     #
+    # _Requires permission: `resources:write`._
+    #
     # POST /api/org/{orgId}/changes/{changeId}/revert
     #
     # Raises on 400: Bad request
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: Already reverted, another revert holds the event, nothing
-    # in the plan is writable, or this attempt was superseded mid-write (its
-    # lease lapsed). The body carries `code: change_revert_conflict` for all but
-    # the writability case, and `appliedFields` when the provider write had
-    # already landed.
+    # Raises on 409: Conflict
     #
     # Raises on 423: Blocked by an active change freeze. Retry with the
     # `x-change-freeze-override: true` header if you hold `freezes:override`;
     # both blocks and overrides are audit-logged.
     #
-    # Raises on 500: The provider accepted the write but it could not be
-    # recorded against the event. The resource *has* been put back;
-    # `appliedFields` names what changed. A later retry reconciles the timeline.
+    # Raises on 500: Server error
     #
-    # Raises on 502: The provider couldn't be read. Nothing was written.
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -5465,12 +5595,13 @@ module Infrawrench
     # Gated on `resources:write` rather than `resources:read`: the plan names
     # the write it is offering to make.
     #
+    # _Requires permission: `resources:write`._
+    #
     # GET /api/org/{orgId}/changes/{changeId}/revert
     #
     # Raises on 404: Not found
     #
-    # Raises on 502: The provider couldn't be read, so no plan can be made
-    # safely. Nothing was written.
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -5525,6 +5656,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash, nil] Request body, shaped as `ChangeCostImpactsRequest`.
@@ -5677,6 +5810,50 @@ module Infrawrench
         request_options: request_options
       )
     end
+
+    # Approve or reject a pending tool call
+    #
+    # Approving runs the tool now, before answering; a tool that fails answers
+    # 500 with its error and the action is recorded as `errored`. Not for
+    # `ask_question` actions, which take answers instead.
+    #
+    # _Requires permission: `chat:write`._
+    #
+    # POST
+    # /api/org/{orgId}/chat/conversations/{conversationId}/pending/{pendingId}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # Raises on 500: Server error
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param conversation_id [String] Chat conversation id
+    # @param pending_id [String] Pending ask_question action id
+    # @param body [Hash] Request body, shaped as `ChatPendingDecisionInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ChatPendingDecisionResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(conversation_id:, pending_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/chat/conversations/{conversationId}/pending/{pendingId}",
+        path_params: {
+          "orgId" => org_id,
+          "conversationId" => conversation_id,
+          "pendingId" => pending_id
+        },
+        body: body,
+        request_options: request_options
+      )
+    end
   end
 
   # `client.chat.conversations.secret_requests`
@@ -5742,71 +5919,538 @@ module Infrawrench
       @pending = ChatConversationsPendingNamespace.new(@transport)
       @secret_requests = ChatConversationsSecretRequestsNamespace.new(@transport)
     end
-  end
-
-  # `client.chat`
-  class ChatNamespace
-    # @return [ChatConversationsNamespace] `client.chat.conversations`
-    attr_reader :conversations
-
-    # @api private
-    # @param transport [Transport]
-    def initialize(transport)
-      @transport = transport
-      @conversations = ChatConversationsNamespace.new(@transport)
-    end
-  end
-
-  # `client.commitments`
-  class CommitmentsNamespace
-    # @api private
-    # @param transport [Transport]
-    def initialize(transport)
-      @transport = transport
-    end
 
-    # Reservations, savings plans and committed-use discounts
-    #
-    # The organization's purchased commitments (reserved instances, savings
-    # plans, committed-use discounts) with three derived readings.
-    #
-    # **Coverage** is a range, not a number: the broad ratio counts every
-    # uncovered usage dollar in the denominator (a lower bound; egress and
-    # per-request charges can never be committed against), the narrow ratio only
-    # uncovered usage in cells where a commitment demonstrably landed (an upper
-    # bound). Accounts whose plugin cannot distinguish charge types are excluded
-    # and listed; a scope where every account is excluded reports unavailable,
-    # not 0%.
+    # Start a chat conversation
     #
-    # **Utilization** is measured only over days cost data was actually
-    # collected; a collection gap is reported as missing days, never counted as
-    # idle commitment. Unit-denominated commitments (GCP) report null with a
-    # reason, never 0%. Azure's own reported utilization rides on each holding
-    # separately and is never blended with the derived figure.
+    # Creates an empty conversation owned by the caller. Send its first message
+    # with `POST /conversations/{conversationId}/messages`.
     #
-    # **The planner** recommends committing at the p10 floor of daily uncovered
-    # spend, gated on presence, trend, floor and materiality. Savings are quoted
-    # against published "up to" discount rates and marked as such. Nothing is
-    # ever purchased automatically.
+    # _Requires permission: `chat:write`._
     #
-    # _Requires permission: `costs:read`._
+    # POST /api/org/{orgId}/chat/conversations
     #
-    # GET /api/org/{orgId}/commitments
+    # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
+    # @param body [Hash] Request body, shaped as `ChatConversationCreateInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CommitmentsFeed` — see `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `ChatConversationCreated` — see
+    #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def get(org_id: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
-        http_method: "GET",
-        path: "/api/org/{orgId}/commitments",
+        http_method: "POST",
+        path: "/api/org/{orgId}/chat/conversations",
         path_params: { "orgId" => org_id },
+        body: body,
         request_options: request_options
       )
     end
-  end
+
+    # Archive a conversation
+    #
+    # Hides the conversation from the list; its history is kept. Answers `ok`
+    # whether or not the conversation was the caller's.
+    #
+    # _Requires permission: `chat:write`._
+    #
+    # DELETE /api/org/{orgId}/chat/conversations/{conversationId}
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param conversation_id [String] Chat conversation id
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(conversation_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/chat/conversations/{conversationId}",
+        path_params: { "orgId" => org_id, "conversationId" => conversation_id },
+        request_options: request_options
+      )
+    end
+
+    # List the caller's chat conversations
+    #
+    # _Requires permission: `chat:read`._
+    #
+    # GET /api/org/{orgId}/chat/conversations
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ChatConversationList` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/chat/conversations",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # A conversation with its messages and pending items
+    #
+    # _Requires permission: `chat:read`._
+    #
+    # GET /api/org/{orgId}/chat/conversations/{conversationId}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param conversation_id [String] Chat conversation id
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ChatConversationDetail` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get_org_org_id_chat_conversations_conversation_id(
+      conversation_id:,
+      org_id: nil,
+      request_options: nil
+    )
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/chat/conversations/{conversationId}",
+        path_params: { "orgId" => org_id, "conversationId" => conversation_id },
+        request_options: request_options
+      )
+    end
+
+    # Switch a conversation's model
+    #
+    # Takes effect on the conversation's next turn.
+    #
+    # _Requires permission: `chat:write`._
+    #
+    # PATCH /api/org/{orgId}/chat/conversations/{conversationId}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param conversation_id [String] Chat conversation id
+    # @param body [Hash] Request body, shaped as `ChatConversationModelInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(conversation_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PATCH",
+        path: "/api/org/{orgId}/chat/conversations/{conversationId}",
+        path_params: { "orgId" => org_id, "conversationId" => conversation_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.chat`
+  class ChatNamespace
+    # @return [ChatConversationsNamespace] `client.chat.conversations`
+    attr_reader :conversations
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @conversations = ChatConversationsNamespace.new(@transport)
+    end
+
+    # Month-to-date chat spend and cap
+    #
+    # _Requires permission: `chat:read`._
+    #
+    # GET /api/org/{orgId}/chat/spend
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ChatSpendStatus` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def spend(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/chat/spend",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.ci.accounts`
+  class CiAccountsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Run CI, or stop running it, for a connected GitHub account
+    #
+    # _Requires permission: `ci:write`._
+    #
+    # PUT /api/org/{orgId}/ci/accounts/{installationId}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param installation_id [String]
+    # @param body [Hash] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CiAccount` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(installation_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/ci/accounts/{installationId}",
+        path_params: { "orgId" => org_id, "installationId" => installation_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.ci.runs`
+  class CiRunsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Approve a fork's pull request commit
+    #
+    # Runs CI for this one commit of a pull request from a fork, without the
+    # organization's or repository's secrets. A later commit needs approving
+    # again.
+    #
+    # _Requires permission: `ci:approve`._
+    #
+    # POST /api/org/{orgId}/ci/runs/{runId}/approve
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param run_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def approve(run_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/ci/runs/{runId}/approve",
+        path_params: { "orgId" => org_id, "runId" => run_id },
+        request_options: request_options
+      )
+    end
+
+    # List CI runs, newest first
+    #
+    # _Requires permission: `ci:read`._
+    #
+    # GET /api/org/{orgId}/ci/runs
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param status [String, nil]
+    # @param limit [Integer, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, status: nil, limit: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/ci/runs",
+        path_params: { "orgId" => org_id },
+        query: { "status" => status, "limit" => limit },
+        request_options: request_options
+      )
+    end
+
+    # A CI run, with each job's output once it has finished
+    #
+    # _Requires permission: `ci:read`._
+    #
+    # GET /api/org/{orgId}/ci/runs/{runId}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param run_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CiRunDetail` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get_org_org_id_ci_runs_run_id(run_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/ci/runs/{runId}",
+        path_params: { "orgId" => org_id, "runId" => run_id },
+        request_options: request_options
+      )
+    end
+
+    # Decline to run a fork's pull request commit
+    #
+    # _Requires permission: `ci:approve`._
+    #
+    # POST /api/org/{orgId}/ci/runs/{runId}/reject
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param run_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def reject(run_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/ci/runs/{runId}/reject",
+        path_params: { "orgId" => org_id, "runId" => run_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.ci.values`
+  class CiValuesNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Remove a CI secret or variable
+    #
+    # _Requires permission: `ci:write`._
+    #
+    # DELETE /api/org/{orgId}/ci/values/{kind}/{name}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param kind [String]
+    # @param name [String]
+    # @param installation_id [Integer] The GitHub App installation of an account that runs CI.
+    # @param repo [String, nil] A repository's name, for its own values. Omitted: the whole
+    #   account's.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(kind:, name:, installation_id:, org_id: nil, repo: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/ci/values/{kind}/{name}",
+        path_params: { "orgId" => org_id, "kind" => kind, "name" => name },
+        query: { "installationId" => installation_id, "repo" => repo },
+        request_options: request_options
+      )
+    end
+
+    # List an account's or a repository's CI secrets and variables
+    #
+    # A repository's own value overrides the account's of the same name.
+    # Pipelines read them as `${{ secrets.NAME }}` and `${{ vars.NAME }}`; a
+    # fork's pull request gets variables but never secrets.
+    #
+    # _Requires permission: `ci:write`._
+    #
+    # GET /api/org/{orgId}/ci/values
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param installation_id [Integer] The GitHub App installation of an account that runs CI.
+    # @param repo [String, nil] A repository's name, for its own values. Omitted: the whole
+    #   account's.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CiValues` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(installation_id:, org_id: nil, repo: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/ci/values",
+        path_params: { "orgId" => org_id },
+        query: { "installationId" => installation_id, "repo" => repo },
+        request_options: request_options
+      )
+    end
+
+    # Set a CI secret or variable
+    #
+    # _Requires permission: `ci:write`._
+    #
+    # PUT /api/org/{orgId}/ci/values/{kind}/{name}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param kind [String]
+    # @param name [String]
+    # @param installation_id [Integer] The GitHub App installation of an account that runs CI.
+    # @param repo [String, nil] A repository's name, for its own values. Omitted: the whole
+    #   account's.
+    # @param body [Hash] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(kind:, name:, installation_id:, body:, org_id: nil, repo: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/ci/values/{kind}/{name}",
+        path_params: { "orgId" => org_id, "kind" => kind, "name" => name },
+        query: { "installationId" => installation_id, "repo" => repo },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.ci`
+  class CiNamespace
+    # @return [CiAccountsNamespace] `client.ci.accounts`
+    attr_reader :accounts
+    # @return [CiRunsNamespace] `client.ci.runs`
+    attr_reader :runs
+    # @return [CiValuesNamespace] `client.ci.values`
+    attr_reader :values
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @accounts = CiAccountsNamespace.new(@transport)
+      @runs = CiRunsNamespace.new(@transport)
+      @values = CiValuesNamespace.new(@transport)
+    end
+
+    # CI status and the GitHub accounts that run it
+    #
+    # _Requires permission: `ci:read`._
+    #
+    # GET /api/org/{orgId}/ci
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CiStatus` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/ci",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # CI usage in a month: runs, compute and cache storage
+    #
+    # _Requires permission: `ci:read`._
+    #
+    # GET /api/org/{orgId}/ci/usage
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param month [String, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CiUsage` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def usage(org_id: nil, month: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/ci/usage",
+        path_params: { "orgId" => org_id },
+        query: { "month" => month },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.commitments`
+  class CommitmentsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Reservations, savings plans and committed-use discounts
+    #
+    # The organization's purchased commitments (reserved instances, savings
+    # plans, committed-use discounts) with three derived readings.
+    #
+    # **Coverage** is a range, not a number: the broad ratio counts every
+    # uncovered usage dollar in the denominator (a lower bound; egress and
+    # per-request charges can never be committed against), the narrow ratio only
+    # uncovered usage in cells where a commitment demonstrably landed (an upper
+    # bound). Accounts whose plugin cannot distinguish charge types are excluded
+    # and listed; a scope where every account is excluded reports unavailable,
+    # not 0%.
+    #
+    # **Utilization** is measured only over days cost data was actually
+    # collected; a collection gap is reported as missing days, never counted as
+    # idle commitment. Unit-denominated commitments (GCP) report null with a
+    # reason, never 0%. Azure's own reported utilization rides on each holding
+    # separately and is never blended with the derived figure.
+    #
+    # **The planner** recommends committing at the p10 floor of daily uncovered
+    # spend, gated on presence, trend, floor and materiality. Savings are quoted
+    # against published "up to" discount rates and marked as such. Nothing is
+    # ever purchased automatically.
+    #
+    # _Requires permission: `costs:read`._
+    #
+    # GET /api/org/{orgId}/commitments
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CommitmentsFeed` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/commitments",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
 
   # `client.compliance.controls`
   class ComplianceControlsNamespace
@@ -5822,6 +6466,8 @@ module Infrawrench
     #
     # DELETE /api/org/{orgId}/compliance/controls/{frameworkId}/{controlId}
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -5854,6 +6500,8 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/compliance/controls
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -5878,6 +6526,8 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/compliance/controls/{frameworkId}/{controlId}
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -5989,6 +6639,8 @@ module Infrawrench
     #
     # DELETE /api/org/{orgId}/compliance/schedules/{id}
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -6013,6 +6665,8 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/compliance/schedules/{id}
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -6192,8 +6846,8 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param framework [String] Framework registry id: `soc2` or `iso27001`.
-    # @param from [String, nil] First day of the period (UTC). Defaults to 90 days before `to`.
-    # @param to [String, nil] Last day of the period, inclusive (UTC). Defaults to today.
+    # @param from [Object, nil]
+    # @param to [Object, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `ComplianceStatus` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
@@ -6226,8 +6880,8 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param framework [String] Framework registry id: `soc2` or `iso27001`.
-    # @param from [String, nil] First day of the period (UTC). Defaults to 90 days before `to`.
-    # @param to [String, nil] Last day of the period, inclusive (UTC). Defaults to today.
+    # @param from [Object, nil]
+    # @param to [Object, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [String] Raw response bytes.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
@@ -6379,6 +7033,8 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: The host key is new or has changed; trust it and retry
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `ConnectEnvDeployRequest`.
@@ -6960,6 +7616,10 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/cost-canvases/{id}/conversation
     #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -7041,6 +7701,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `CostCanvasDraftInput`.
@@ -8834,6 +9496,8 @@ module Infrawrench
     #
     # DELETE /api/org/{orgId}/cost-visibility/{principalKind}/{principalId}
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 403: Forbidden
     #
     # Raises on 404: Not found
@@ -9027,6 +9691,8 @@ module Infrawrench
     # again on a later day, that is a new anomaly and it is detected and alerted
     # on as normal.
     #
+    # _Requires permission: `costs:write`._
+    #
     # POST /api/org/{orgId}/costs/anomalies/{anomalyId}/acknowledge
     #
     # Raises on 400: Bad request
@@ -9174,13 +9840,15 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 404: Not found
+    #
     # Raises on 409: Conflict
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `CostAnomalySuppressionInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CostAnomalySuppression & Hash` — see
+    # @return [Hash] Parsed JSON, shaped as `CostAnomalySuppression` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def create(body:, org_id: nil, request_options: nil)
@@ -9257,7 +9925,7 @@ module Infrawrench
     #   constructed with.
     # @param suppression_id [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CostAnomalySuppression & Hash` — see
+    # @return [Hash] Parsed JSON, shaped as `CostAnomalySuppression` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def get_org_org_id_costs_anomaly_suppressions_suppression_id(
@@ -9285,12 +9953,14 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param suppression_id [String]
     # @param body [Hash] Request body, shaped as `CostAnomalySuppressionInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `CostAnomalySuppression & Hash` — see
+    # @return [Hash] Parsed JSON, shaped as `CostAnomalySuppression` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def update(suppression_id:, body:, org_id: nil, request_options: nil)
@@ -10151,6 +10821,8 @@ module Infrawrench
     # display currency, else EUR), plus the feed's state. Readable whether or
     # not the organization has automatic rates on.
     #
+    # _Requires permission: `costs:read`._
+    #
     # GET /api/org/{orgId}/currency/feed
     #
     # Raises on 400: Bad request
@@ -10205,6 +10877,8 @@ module Infrawrench
     # `rateBasis`) and explains the outcome. `to` defaults to the display
     # currency; `date` defaults to today.
     #
+    # _Requires permission: `costs:read`._
+    #
     # GET /api/org/{orgId}/currency/lookup
     #
     # Raises on 400: Bad request
@@ -10277,7 +10951,7 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/custom-cost-sources/{id}/uploads/{uploadId}/complete
     #
-    # Raises on 400: Already complete
+    # Raises on 400: Bad request
     #
     # Raises on 404: Not found
     #
@@ -10868,6 +11542,8 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/dashboards/default/full
     #
+    # Raises on 404: Not found
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
@@ -11148,6 +11824,8 @@ module Infrawrench
     # auto-routes between raw, 1-minute, and 1-hour rollups based on span: ≤2h
     # raw, ≤7d 1m, >7d 1h.
     #
+    # _Requires permission: `dashboards:read`._
+    #
     # GET /api/org/{orgId}/dashboards/pin/{pinId}/range
     #
     # Raises on 400: Bad request
@@ -11157,8 +11835,8 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param pin_id [String]
-    # @param from_ms [Integer, nil, nil]
-    # @param to_ms [Integer, nil, nil]
+    # @param from_ms [Integer, nil]
+    # @param to_ms [Integer, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `PinRangeResponse` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
@@ -11272,6 +11950,8 @@ module Infrawrench
 
     # Add a widget (cost graph, report, budget, KPI, text, ...) to a dashboard
     #
+    # _Requires permission: `dashboards:write`._
+    #
     # POST /api/org/{orgId}/dashboards/widgets
     #
     # Raises on 400: Bad request
@@ -11297,6 +11977,8 @@ module Infrawrench
 
     # Remove a widget from a dashboard
     #
+    # _Requires permission: `dashboards:write`._
+    #
     # DELETE /api/org/{orgId}/dashboards/widgets/{widgetId}
     #
     # Raises on 404: Not found
@@ -11323,6 +12005,8 @@ module Infrawrench
     # or report card is a second view onto the same budget or report.
     # Audit-logged.
     #
+    # _Requires permission: `dashboards:write`._
+    #
     # POST /api/org/{orgId}/dashboards/widgets/{widgetId}/duplicate
     #
     # Raises on 400: Bad request
@@ -11347,6 +12031,8 @@ module Infrawrench
 
     # Update a widget's title, config, or layout
     #
+    # _Requires permission: `dashboards:write`._
+    #
     # PATCH /api/org/{orgId}/dashboards/widgets/{widgetId}
     #
     # Raises on 400: Bad request
@@ -11474,6 +12160,8 @@ module Infrawrench
     # preview it. Needs `costs:read`, plus `budgets:read` for a budget source;
     # figures are measured inside the caller's cost visibility scope.
     #
+    # _Requires permission: `dashboards:read`._
+    #
     # POST /api/org/{orgId}/dashboards/kpi
     #
     # Raises on 400: Bad request
@@ -11582,6 +12270,8 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/dashboards/{id}/rename
     #
+    # Raises on 404: Not found
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
@@ -11609,6 +12299,8 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/dashboards/{id}/reorder
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -11677,6 +12369,8 @@ module Infrawrench
 
     # Pin a workflow's metrics to a dashboard
     #
+    # _Requires permission: `dashboards:write`._
+    #
     # POST /api/org/{orgId}/dashboards/workflow-pin
     #
     # Raises on 404: Not found
@@ -11699,6 +12393,8 @@ module Infrawrench
 
     # Unpin a workflow from a dashboard
     #
+    # _Requires permission: `dashboards:write`._
+    #
     # POST /api/org/{orgId}/dashboards/workflow-unpin
     #
     # Raises on 404: Not found
@@ -11737,7 +12433,9 @@ module Infrawrench
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param resource_id [Hash, nil]
+    # @param resource_id [String, nil] Narrow the graph to this resource's direct neighbourhood;
+    #   only edges with it at one end, and only the nodes those edges touch. Omit for the whole
+    #   org.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `DependencyGraphResponse` — see
     #   `sig/infrawrench/sdk.rbs`.
@@ -11773,18 +12471,15 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
     # @param window_days [Integer, nil]
-    # @param cost_basis [String, nil] Which charge-type basis both windows are read on. `cash`
-    #   (the default) is what the provider charged on the day it charged it; `amortized` spreads a
-    #   commitment's up-front fee across the term it buys; `blended` also spreads each
-    #   commitment's discount evenly over the usage it could cover. It is echoed on every response
-    #   because a delta whose basis is unstated is unreadable: an amortized 'after' against a cash
-    #   'before' looks exactly like a saving.
+    # @param cost_basis [String, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `DeploymentCostImpact` — see
     #   `sig/infrawrench/sdk.rbs`.
@@ -12034,6 +12729,8 @@ module Infrawrench
     #
     # PATCH /api/org/{orgId}/deployments/triggers/{id}
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 401: Unauthenticated
     #
     # Raises on 403: Forbidden
@@ -12181,6 +12878,8 @@ module Infrawrench
     # Adding an address the organization already has is a no-op that returns the
     # existing entry, so a double submit cannot double-deliver.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/digest/recipients
     #
     # Raises on 400: Bad request
@@ -12204,6 +12903,8 @@ module Infrawrench
 
     # Remove a digest email recipient
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # DELETE /api/org/{orgId}/digest/recipients/{recipientId}
     #
     # Raises on 404: Not found
@@ -12230,6 +12931,8 @@ module Infrawrench
     # Addresses need not belong to Infrawrench users; a finance alias is a valid
     # recipient.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/digest/recipients
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -12269,6 +12972,8 @@ module Infrawrench
     # The response also carries the outcome of the most recent delivery attempt
     # so a silently failing digest is visible.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/digest
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -12293,6 +12998,8 @@ module Infrawrench
     # is never retried automatically. Fails when nothing is routed to receive
     # the digest, or when every destination rejected it.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/digest/send
     #
     # Raises on 400: Bad request
@@ -12320,6 +13027,8 @@ module Infrawrench
     # Monday-to-Sunday week. Changing the schedule clears any parked failure
     # state but never replays a week that already went out.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # PUT /api/org/{orgId}/digest
     #
     # Raises on 400: Bad request
@@ -12884,9 +13593,11 @@ module Infrawrench
     #
     # PUT /api/org/{orgId}/environments/settings
     #
+    # Raises on 400: Bad request
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `EnvironmentSettings`.
+    # @param body [Hash, nil] Request body, shaped as `Hash`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `EnvironmentSettings` — see
     #   `sig/infrawrench/sdk.rbs`.
@@ -13070,6 +13781,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # Raises on 409: The organization is at its live-environment limit
@@ -13200,6 +13913,8 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/event-subscriptions/deliveries
     #
+    # Raises on 400: Bad request
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param subscription_id [String, nil]
@@ -13243,8 +13958,14 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/event-subscriptions/deliveries/{id}/redeliver
     #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
@@ -13362,6 +14083,8 @@ module Infrawrench
     #
     # Raises on 403: Forbidden
     #
+    # Raises on 404: Not found
+    #
     # Raises on 409: Conflict
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -13441,8 +14164,12 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
@@ -13469,8 +14196,14 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/event-subscriptions/{id}/test
     #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
@@ -13501,6 +14234,8 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
@@ -13729,6 +14464,147 @@ module Infrawrench
     end
   end
 
+  # `client.features`
+  class FeaturesNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # List the organization's rolled-out features
+    #
+    # Features still being rolled out are turned on per organization by a
+    # platform admin. A feature not listed here is refused by its own routes.
+    #
+    # GET /api/org/{orgId}/features
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `OrgFeatureList` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/features",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.github.installations`
+  class GithubInstallationsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Disconnect a GitHub App installation
+    #
+    # Drops the connection here; the app stays installed on GitHub until
+    # uninstalled there.
+    #
+    # _Requires permission: `dashboards:write`._
+    #
+    # DELETE /api/org/{orgId}/github/installations/{installationId}
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param installation_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(installation_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/github/installations/{installationId}",
+        path_params: { "orgId" => org_id, "installationId" => installation_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.github`
+  class GithubNamespace
+    # @return [GithubInstallationsNamespace] `client.github.installations`
+    attr_reader :installations
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @installations = GithubInstallationsNamespace.new(@transport)
+    end
+
+    # GitHub App install URL
+    #
+    # _Requires permission: `dashboards:write`._
+    #
+    # GET /api/org/{orgId}/github/install-url
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param return_param [String, nil] The page (under the organization) the install flow
+    #   returns to. Anything else: `agents`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `GithubInstallUrl` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def install_url(org_id: nil, return_param: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/github/install-url",
+        path_params: { "orgId" => org_id },
+        query: { "return" => return_param },
+        request_options: request_options
+      )
+    end
+
+    # Repositories the organization's installations can access
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # GET /api/org/{orgId}/github/repos
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `GithubAppRepos` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def repos(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/github/repos",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # GitHub App connection status
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # GET /api/org/{orgId}/github/status
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `GithubAppStatus` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def status(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/github/status",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
   # `client.github_issues.links`
   class GithubIssuesLinksNamespace
     # @api private
@@ -13776,10 +14652,10 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 409: The GitHub App installation needs a permission an owner has
-    # not approved yet
+    # Raises on 409: The installation has not accepted the permission this
+    # needs. An owner of the GitHub account approves it from `manageUrl`.
     #
-    # Raises on 502: GitHub refused the request or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -13816,10 +14692,10 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 409: The GitHub App installation needs a permission an owner has
-    # not approved yet
+    # Raises on 409: The installation has not accepted the permission this
+    # needs. An owner of the GitHub account approves it from `manageUrl`.
     #
-    # Raises on 502: GitHub refused the request or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -13849,10 +14725,10 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 409: The GitHub App installation needs a permission an owner has
-    # not approved yet
+    # Raises on 409: The installation has not accepted the permission this
+    # needs. An owner of the GitHub account approves it from `manageUrl`.
     #
-    # Raises on 502: GitHub refused the request or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -13897,10 +14773,10 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 409: The GitHub App installation needs a permission an owner has
-    # not approved yet
+    # Raises on 409: The installation has not accepted the permission this
+    # needs. An owner of the GitHub account approves it from `manageUrl`.
     #
-    # Raises on 502: GitHub refused the request or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -13930,10 +14806,10 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 409: The GitHub App installation needs a permission an owner has
-    # not approved yet
+    # Raises on 409: The installation has not accepted the permission this
+    # needs. An owner of the GitHub account approves it from `manageUrl`.
     #
-    # Raises on 502: GitHub refused the request or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -13986,10 +14862,10 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 409: The GitHub App installation needs a permission an owner has
-    # not approved yet
+    # Raises on 409: The installation has not accepted the permission this
+    # needs. An owner of the GitHub account approves it from `manageUrl`.
     #
-    # Raises on 502: GitHub refused the request or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -14018,10 +14894,10 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 409: The GitHub App installation needs a permission an owner has
-    # not approved yet
+    # Raises on 409: The installation has not accepted the permission this
+    # needs. An owner of the GitHub account approves it from `manageUrl`.
     #
-    # Raises on 502: GitHub refused the request or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -14075,6 +14951,11 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 409: The installation has not accepted the permission this
+    # needs. An owner of the GitHub account approves it from `manageUrl`.
+    #
+    # Raises on 502: Bad gateway: an upstream service failed
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `GithubIssueSettingsInput`.
@@ -14109,6 +14990,8 @@ module Infrawrench
     # written. The format version is checked, not assumed: an unsupported
     # version is a 400 rather than a partial read.
     #
+    # _Requires permission: `iac:write`._
+    #
     # POST /api/org/{orgId}/iac/states
     #
     # Raises on 400: Bad request
@@ -14133,6 +15016,8 @@ module Infrawrench
 
     # Delete an uploaded state document
     #
+    # _Requires permission: `iac:write`._
+    #
     # DELETE /api/org/{orgId}/iac/states/{stateId}
     #
     # Raises on 404: Not found
@@ -14159,6 +15044,8 @@ module Infrawrench
     # documents themselves are never stored; only the parsed, redacted
     # projection.
     #
+    # _Requires permission: `iac:read`._
+    #
     # GET /api/org/{orgId}/iac/states
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -14196,6 +15083,8 @@ module Infrawrench
     # "Export to Terraform…". Resources no plugin can express are returned in
     # `unsupported` with a reason, never dropped.
     #
+    # _Requires permission: `iac:read`._
+    #
     # POST /api/org/{orgId}/iac/import-plan
     #
     # Raises on 400: Bad request
@@ -14226,6 +15115,8 @@ module Infrawrench
     # resources carry the ownership and first-seen join that answers "who made
     # this by hand, and when".
     #
+    # _Requires permission: `iac:read`._
+    #
     # GET /api/org/{orgId}/iac/reconciliation
     #
     # Raises on 400: Bad request
@@ -14257,6 +15148,8 @@ module Infrawrench
     # parameter rather than a path segment because composite resource ids
     # contain slashes.
     #
+    # _Requires permission: `iac:read`._
+    #
     # GET /api/org/{orgId}/iac/resource
     #
     # Raises on 400: Bad request
@@ -14423,6 +15316,12 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/incidents
     #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param status [String, nil] `open`, `mitigated`, `resolved`, or `all` (the default).
@@ -14486,14 +15385,16 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param incident_id [String]
-    # @param body [Hash, nil] Request body, shaped as `IncidentNoteCreate`.
+    # @param body [Hash] Request body, shaped as `IncidentNoteCreate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `IncidentNote` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(incident_id:, org_id: nil, body: nil, request_options: nil)
+    def create(incident_id:, body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
         path: "/api/org/{orgId}/incidents/{incidentId}/notes",
@@ -14559,13 +15460,17 @@ module Infrawrench
     #
     # Raises on 403: Forbidden
     #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `IncidentDeclare`.
+    # @param body [Hash] Request body, shaped as `IncidentDeclare`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `Incident` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(org_id: nil, body: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
         path: "/api/org/{orgId}/incidents",
@@ -14615,8 +15520,12 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/incidents/{incidentId}/postmortem
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param incident_id [String]
@@ -14648,8 +15557,12 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/incidents/{incidentId}/retry-artifacts
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param incident_id [String]
@@ -14683,8 +15596,12 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/incidents/{incidentId}/timeline
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param incident_id [String]
@@ -14716,14 +15633,16 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param incident_id [String]
-    # @param body [Hash, nil] Request body, shaped as `IncidentPatch`.
+    # @param body [Hash] Request body, shaped as `IncidentPatch`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `Incident` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(incident_id:, org_id: nil, body: nil, request_options: nil)
+    def update(incident_id:, body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "PATCH",
         path: "/api/org/{orgId}/incidents/{incidentId}",
@@ -15222,7 +16141,7 @@ module Infrawrench
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param managed_account_id [String, nil]
+    # @param managed_account_id [Object, nil]
     # @param status [String, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Array<Hash>] Parsed JSON, shaped as `Array<InvoiceSummary>` — see
@@ -15493,13 +16412,12 @@ module Infrawrench
     # Raises on 500: Processing failed; the tracker retries
     #
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [nil] This endpoint returns no content.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def github(request_options: nil)
       @transport.request(
         http_method: "POST",
         path: "/api/issue-webhooks/github",
-        accept: :empty,
         request_options: request_options
       )
     end
@@ -15552,7 +16470,7 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 502: Jira refused or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -15590,6 +16508,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 502: Bad gateway: an upstream service failed
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param key [String]
@@ -15616,6 +16536,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 502: Bad gateway: an upstream service failed
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
@@ -15655,7 +16577,7 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 502: Jira refused or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -15683,9 +16605,11 @@ module Infrawrench
     #
     # DELETE /api/org/{orgId}/jira/webhook
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
-    # Raises on 502: Jira refused or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -15779,7 +16703,7 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 502: Jira refused to create the issue, or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -15806,12 +16730,13 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 502: Bad gateway: an upstream service failed
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `JiraIntegrationInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `JiraIntegration & Hash` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `JiraIntegration` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def update(body:, org_id: nil, request_options: nil)
       @transport.request(
@@ -15835,7 +16760,7 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 502: Jira rejected the credentials or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -15892,7 +16817,9 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/jit-access/accounts/{accountId}/roles
     #
-    # Raises on 502: Provider error
+    # Raises on 400: Bad request
+    #
+    # Raises on 502: JitError
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -15921,7 +16848,7 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/jit-access/accounts/{accountId}/scopes
     #
-    # Raises on 502: Provider error
+    # Raises on 502: JitError
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -16053,7 +16980,9 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/jit-access/policies/{policyId}/principal
     #
-    # Raises on 403: Not a requester
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: JitError
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -16077,12 +17006,14 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/jit-access/policies/{policyId}/principals
     #
+    # Raises on 401: Unauthenticated
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param policy_id [String]
     # @param q [String, nil]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Array<Hash>] Parsed JSON, shaped as `Array<JitPrincipalOption & Hash>` — see
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<JitPrincipalOption>` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def principals(policy_id:, org_id: nil, q: nil, request_options: nil)
@@ -16145,11 +17076,15 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/jit-access/requests/{requestId}/approve
     #
-    # Raises on 403: Not allowed
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: JitError
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: Already decided, timed out, or not in a state for this
+    # Raises on 409: JitError
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -16176,11 +17111,15 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/jit-access/requests/{requestId}/cancel
     #
-    # Raises on 403: Not allowed
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: JitError
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: Already decided, timed out, or not in a state for this
+    # Raises on 409: JitError
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -16209,11 +17148,13 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/jit-access/requests
     #
-    # Raises on 400: Invalid
+    # Raises on 400: JitError
+    #
+    # Raises on 401: Unauthenticated
     #
-    # Raises on 403: Not a requester under this policy
+    # Raises on 403: JitError
     #
-    # Raises on 409: A pending or active request already covers this
+    # Raises on 409: JitError
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -16240,11 +17181,15 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/jit-access/requests/{requestId}/deny
     #
-    # Raises on 403: Not allowed
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: JitError
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: Already decided, timed out, or not in a state for this
+    # Raises on 409: JitError
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -16273,11 +17218,13 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/jit-access/requests/{requestId}/extend
     #
-    # Raises on 400: Beyond the policy maximum
+    # Raises on 400: JitError
+    #
+    # Raises on 401: Unauthenticated
     #
-    # Raises on 403: Not an approver
+    # Raises on 403: JitError
     #
-    # Raises on 409: Not active
+    # Raises on 409: JitError
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -16307,6 +17254,8 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/jit-access/requests/{requestId}
     #
+    # Raises on 401: Unauthenticated
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -16334,6 +17283,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 401: Unauthenticated
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param status [String, nil]
@@ -16360,11 +17311,15 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/jit-access/requests/{requestId}/revoke
     #
-    # Raises on 403: Not allowed
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: JitError
     #
     # Raises on 404: Not found
     #
-    # Raises on 409: Already decided, timed out, or not in a state for this
+    # Raises on 409: JitError
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -16755,6 +17710,8 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/leaked-secrets
     #
+    # Raises on 400: Bad request
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param status [String, nil] `open` needs rotating; `rotated` was rotated through
@@ -16952,6 +17909,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # Raises on 409: The resource already has an active lease
@@ -17062,6 +18021,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -17129,7 +18090,7 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 502: Linear refused or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -17169,7 +18130,7 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 502: Linear refused or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -17197,9 +18158,11 @@ module Infrawrench
     #
     # DELETE /api/org/{orgId}/linear/webhook
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
-    # Raises on 502: Linear refused or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -17227,6 +18190,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 502: Bad gateway: an upstream service failed
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
@@ -17316,7 +18281,7 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 502: Linear refused to create the issue, or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -17346,6 +18311,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 502: Bad gateway: an upstream service failed
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
@@ -17369,12 +18336,13 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 502: Bad gateway: an upstream service failed
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `LinearIntegrationInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `LinearIntegration & Hash` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `LinearIntegration` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def update(body:, org_id: nil, request_options: nil)
       @transport.request(
@@ -17398,7 +18366,7 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
-    # Raises on 502: Linear rejected the key or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -17625,6 +18593,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `ManagedAccountAssignmentPreviewRequest`.
@@ -17774,6 +18744,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param from [String, nil] Defaults, with `to`, to the last full calendar month.
@@ -17842,6 +18814,8 @@ module Infrawrench
     # written. The poller evaluates enabled rules about once a minute and alerts
     # when the condition held for the whole trailing window.
     #
+    # _Requires permission: `metric-alerts:write`._
+    #
     # POST /api/org/{orgId}/metric-alerts
     #
     # Raises on 400: Bad request
@@ -17867,6 +18841,8 @@ module Infrawrench
     # Soft delete. The rule's firing history stays readable via
     # /metric-alerts/events.
     #
+    # _Requires permission: `metric-alerts:write`._
+    #
     # DELETE /api/org/{orgId}/metric-alerts/{id}
     #
     # Raises on 404: Not found
@@ -17888,6 +18864,8 @@ module Infrawrench
 
     # Recent metric alert firings
     #
+    # _Requires permission: `metric-alerts:read`._
+    #
     # GET /api/org/{orgId}/metric-alerts/events
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -17910,6 +18888,8 @@ module Infrawrench
 
     # Get a metric alert rule
     #
+    # _Requires permission: `metric-alerts:read`._
+    #
     # GET /api/org/{orgId}/metric-alerts/{id}
     #
     # Raises on 404: Not found
@@ -17931,6 +18911,8 @@ module Infrawrench
 
     # List metric alert rules with live firing status
     #
+    # _Requires permission: `metric-alerts:read`._
+    #
     # GET /api/org/{orgId}/metric-alerts
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -17954,6 +18936,8 @@ module Infrawrench
     # narrowed to one plugin and resource type; what the rule builder's metric
     # picker is fed from.
     #
+    # _Requires permission: `metric-alerts:read`._
+    #
     # GET /api/org/{orgId}/metric-alerts/metric-keys
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -17976,6 +18960,8 @@ module Infrawrench
 
     # List what the organization's resources offer to select on
     #
+    # _Requires permission: `metric-alerts:read`._
+    #
     # GET /api/org/{orgId}/metric-alerts/selector-options
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -17995,6 +18981,8 @@ module Infrawrench
 
     # Preview which resources a selector matches right now
     #
+    # _Requires permission: `metric-alerts:read`._
+    #
     # GET /api/org/{orgId}/metric-alerts/selector-preview
     #
     # Raises on 400: Bad request
@@ -18033,6 +19021,8 @@ module Infrawrench
 
     # Update a metric alert rule
     #
+    # _Requires permission: `metric-alerts:write`._
+    #
     # PUT /api/org/{orgId}/metric-alerts/{id}
     #
     # Raises on 400: Bad request
@@ -18083,6 +19073,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param at [String, nil] Centre of the window. Defaults to now.
@@ -18117,6 +19109,8 @@ module Infrawrench
     # channel routes nothing to it on its own. Responds 400 when the URL is not
     # https or its host is not Microsoft-operated.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/msteams/webhooks
     #
     # Raises on 400: Bad request
@@ -18139,6 +19133,8 @@ module Infrawrench
 
     # Disconnect a Teams channel
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # DELETE /api/org/{orgId}/msteams/webhooks/{id}
     #
     # Raises on 404: Not found
@@ -18163,6 +19159,8 @@ module Infrawrench
     # The webhook URL is immutable; remove the channel and re-add it to change
     # it.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # PATCH /api/org/{orgId}/msteams/webhooks/{id}
     #
     # Raises on 400: Bad request
@@ -18204,6 +19202,8 @@ module Infrawrench
     # Returns the Teams channels alerts can be routed to. Which alerts reach
     # each one is decided by /alert-rules. Webhook URLs are never included.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/msteams/status
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -18226,6 +19226,8 @@ module Infrawrench
     # Microsoft returned when nothing could be delivered (HTTP 404 usually means
     # the Workflow was deleted or turned off).
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/msteams/test
     #
     # Raises on 400: Bad request
@@ -18568,7 +19570,7 @@ module Infrawrench
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash] Request body, shaped as `NetworkFlowSettings`.
+    # @param body [Hash] Request body, shaped as `NetworkFlowSettingsInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `NetworkFlowSettings` — see
     #   `sig/infrawrench/sdk.rbs`.
@@ -18735,19 +19737,23 @@ module Infrawrench
     # cover is audit-logged, which is the control that makes the looser
     # permission safe.
     #
+    # _Requires permission: `team:read`._
+    #
     # POST /api/org/{orgId}/on-call/overrides
     #
     # Raises on 400: Bad request
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `OnCallOverrideCreate`.
+    # @param body [Hash] Request body, shaped as `OnCallOverrideCreate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `OnCallOverride` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(org_id: nil, body: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
         path: "/api/org/{orgId}/on-call/overrides",
@@ -18759,6 +19765,8 @@ module Infrawrench
 
     # Cancel a cover
     #
+    # _Requires permission: `team:read`._
+    #
     # DELETE /api/org/{orgId}/on-call/overrides/{overrideId}
     #
     # Raises on 404: Not found
@@ -18781,6 +19789,8 @@ module Infrawrench
 
     # List covers
     #
+    # _Requires permission: `team:read`._
+    #
     # GET /api/org/{orgId}/on-call/overrides
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -18817,19 +19827,23 @@ module Infrawrench
     #
     # Writing takes `org:settings:write`: a rotation decides who gets woken up.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/on-call/schedules
     #
     # Raises on 400: Bad request
     #
+    # Raises on 404: Not found
+    #
     # Raises on 409: Conflict
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `OnCallScheduleCreate`.
+    # @param body [Hash] Request body, shaped as `OnCallScheduleCreate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `OnCallSchedule` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(org_id: nil, body: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
         path: "/api/org/{orgId}/on-call/schedules",
@@ -18844,6 +19858,8 @@ module Infrawrench
     # Takes its covers with it. Routing rules naming it resolve to nobody
     # afterwards.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # DELETE /api/org/{orgId}/on-call/schedules/{scheduleId}
     #
     # Raises on 404: Not found
@@ -18866,6 +19882,8 @@ module Infrawrench
 
     # List on-call rotations
     #
+    # _Requires permission: `team:read`._
+    #
     # GET /api/org/{orgId}/on-call/schedules
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -18888,6 +19906,8 @@ module Infrawrench
     # The same computation the alert path resolves with, so a preview can never
     # disagree with who actually gets woken up.
     #
+    # _Requires permission: `team:read`._
+    #
     # GET /api/org/{orgId}/on-call/schedules/{scheduleId}/shifts
     #
     # Raises on 400: Bad request
@@ -18918,6 +19938,8 @@ module Infrawrench
     # Sending `participantUserIds` replaces the list wholesale; position is
     # rotation order, so reordering re-plans the future.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # PATCH /api/org/{orgId}/on-call/schedules/{scheduleId}
     #
     # Raises on 400: Bad request
@@ -18929,11 +19951,11 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param schedule_id [String]
-    # @param body [Hash, nil] Request body, shaped as `OnCallScheduleUpdate`.
+    # @param body [Hash] Request body, shaped as `OnCallScheduleUpdate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `OnCallSchedule` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(schedule_id:, org_id: nil, body: nil, request_options: nil)
+    def update(schedule_id:, body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "PATCH",
         path: "/api/org/{orgId}/on-call/schedules/{scheduleId}",
@@ -18965,6 +19987,8 @@ module Infrawrench
     # rotation. Takes `team:read`: knowing who is on call is something every
     # member needs and nobody should have to ask an admin for.
     #
+    # _Requires permission: `team:read`._
+    #
     # GET /api/org/{orgId}/on-call/now
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -19191,7 +20215,7 @@ module Infrawrench
     #   constructed with.
     # @param body [Hash, nil] Request body, shaped as `ResourceOwnershipPatch`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `ResourceOwnership & Hash | nil` — see
+    # @return [Hash, nil] Parsed JSON, shaped as `ResourceOwnership | nil` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def update(org_id: nil, body: nil, request_options: nil)
@@ -19300,6 +20324,8 @@ module Infrawrench
     # default user. The returned state is the provider's answer, not an
     # assumption.
     #
+    # _Requires permission: `incidents:write`._
+    #
     # POST /api/org/{orgId}/paging-incidents/{id}/acknowledge
     #
     # Raises on 400: Bad request
@@ -19317,10 +20343,9 @@ module Infrawrench
     #
     # Raises on 500: Server error
     #
-    # Raises on 503: A backing service this endpoint depends on is not available
+    # Raises on 502: Bad gateway: an upstream service failed
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
+    # Raises on 503: A backing service this endpoint depends on is not available
     #
     # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
     # @param id [String]
@@ -19342,6 +20367,8 @@ module Infrawrench
     # by default; `status=all` includes resolved ones. These are a provider's
     # pages, distinct from incidents declared in Infrawrench (`/incidents`).
     #
+    # _Requires permission: `incidents:read`._
+    #
     # GET /api/org/{orgId}/paging-incidents
     #
     # Raises on 400: Bad request
@@ -19359,10 +20386,9 @@ module Infrawrench
     #
     # Raises on 500: Server error
     #
-    # Raises on 503: A backing service this endpoint depends on is not available
+    # Raises on 502: Bad gateway: an upstream service failed
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
+    # Raises on 503: A backing service this endpoint depends on is not available
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -19388,6 +20414,8 @@ module Infrawrench
     # default user. The returned state is the provider's answer, not an
     # assumption.
     #
+    # _Requires permission: `incidents:write`._
+    #
     # POST /api/org/{orgId}/paging-incidents/{id}/resolve
     #
     # Raises on 400: Bad request
@@ -19405,10 +20433,9 @@ module Infrawrench
     #
     # Raises on 500: Server error
     #
-    # Raises on 503: A backing service this endpoint depends on is not available
+    # Raises on 502: Bad gateway: an upstream service failed
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
+    # Raises on 503: A backing service this endpoint depends on is not available
     #
     # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
     # @param id [String]
@@ -19439,6 +20466,8 @@ module Infrawrench
     # organization member by email; `memberUserId` is null for somebody who is
     # on call upstream but not a member here.
     #
+    # _Requires permission: `team:read`._
+    #
     # GET /api/org/{orgId}/paging-providers/{accountId}/on-call/{sourceId}
     #
     # Raises on 400: Bad request
@@ -19456,10 +20485,9 @@ module Infrawrench
     #
     # Raises on 500: Server error
     #
-    # Raises on 503: A backing service this endpoint depends on is not available
+    # Raises on 502: Bad gateway: an upstream service failed
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
+    # Raises on 503: A backing service this endpoint depends on is not available
     #
     # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
     # @param account_id [String] A connected account whose plugin can page
@@ -19496,6 +20524,8 @@ module Infrawrench
     # failure is reported per account in `error` rather than failing the
     # response.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/paging-providers/destinations
     #
     # Raises on 400: Bad request
@@ -19513,10 +20543,9 @@ module Infrawrench
     #
     # Raises on 500: Server error
     #
-    # Raises on 503: A backing service this endpoint depends on is not available
+    # Raises on 502: Bad gateway: an upstream service failed
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
+    # Raises on 503: A backing service this endpoint depends on is not available
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -19539,6 +20568,8 @@ module Infrawrench
     # and its resolution are one alert upstream. `pendingAction` is set while a
     # send is queued or being retried.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/paging-providers/events
     #
     # Raises on 400: Bad request
@@ -19556,10 +20587,9 @@ module Infrawrench
     #
     # Raises on 500: Server error
     #
-    # Raises on 503: A backing service this endpoint depends on is not available
+    # Raises on 502: Bad gateway: an upstream service failed
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
+    # Raises on 503: A backing service this endpoint depends on is not available
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -19580,6 +20610,8 @@ module Infrawrench
 
     # List paging provider accounts and their settings
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/paging-providers
     #
     # Raises on 400: Bad request
@@ -19597,10 +20629,9 @@ module Infrawrench
     #
     # Raises on 500: Server error
     #
-    # Raises on 503: A backing service this endpoint depends on is not available
+    # Raises on 502: Bad gateway: an upstream service failed
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
+    # Raises on 503: A backing service this endpoint depends on is not available
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -19624,6 +20655,8 @@ module Infrawrench
     # mirrored incidents. A webhook that cannot be subscribed is reported in
     # `warning` and mirroring falls back to reconciling on a timer.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # PUT /api/org/{orgId}/paging-providers/{accountId}/settings
     #
     # Raises on 400: Bad request
@@ -19641,19 +20674,18 @@ module Infrawrench
     #
     # Raises on 500: Server error
     #
-    # Raises on 503: A backing service this endpoint depends on is not available
+    # Raises on 502: Bad gateway: an upstream service failed
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
+    # Raises on 503: A backing service this endpoint depends on is not available
     #
     # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
     # @param account_id [String] A connected account whose plugin can page
-    # @param body [Hash, nil] Request body, shaped as `PagingProviderSettingsInput`.
+    # @param body [Hash] Request body, shaped as `PagingProviderSettingsInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `PagingProviderSettingsResult` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def settings(account_id:, org_id: nil, body: nil, request_options: nil)
+    def settings(account_id:, body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "PUT",
         path: "/api/org/{orgId}/paging-providers/{accountId}/settings",
@@ -19665,6 +20697,8 @@ module Infrawrench
 
     # Reconcile an account's incidents now
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/paging-providers/{accountId}/sync
     #
     # Raises on 400: Bad request
@@ -19682,10 +20716,9 @@ module Infrawrench
     #
     # Raises on 500: Server error
     #
-    # Raises on 503: A backing service this endpoint depends on is not available
+    # Raises on 502: Bad gateway: an upstream service failed
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
+    # Raises on 503: A backing service this endpoint depends on is not available
     #
     # @param org_id [String, nil] Defaults to the `org_id` the client was constructed with.
     # @param account_id [String] A connected account whose plugin can page
@@ -19723,6 +20756,8 @@ module Infrawrench
     #
     # Raises on 404: Unknown token
     #
+    # Raises on 500: Processing failed; the provider retries
+    #
     # @param token [String]
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [nil] This endpoint returns no content.
@@ -20096,7 +21131,7 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
-    # Raises on 502: GitHub refused the request or was unreachable
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -20120,6 +21155,8 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/pr-checks/runs
     #
+    # Raises on 400: Bad request
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param repository_id [String, nil]
@@ -20175,9 +21212,6 @@ module Infrawrench
     #
     # Raises on 503: A backing service this endpoint depends on is not available
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
-    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param vcpus [String, nil] Minimum vCPUs.
@@ -20255,9 +21289,6 @@ module Infrawrench
     #
     # Raises on 503: A backing service this endpoint depends on is not available
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
-    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
@@ -20300,9 +21331,6 @@ module Infrawrench
     #
     # Raises on 503: A backing service this endpoint depends on is not available
     #
-    # Raises on reauth: Recent sign-in required. Send the user through sign-in
-    # again and retry; the request itself was well-formed.
-    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param q [String, nil] Free text over SKU, name, series and GPU model.
@@ -20406,6 +21434,8 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash, nil] Request body, shaped as `SyntheticProbeCreate`.
@@ -20431,8 +21461,12 @@ module Infrawrench
     #
     # DELETE /api/org/{orgId}/probes/{probeId}
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param probe_id [String]
@@ -20547,6 +21581,8 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param probe_id [String]
@@ -21001,6 +22037,8 @@ module Infrawrench
     # 400 when the plugin has no OAuth flow or this server has no client
     # configured for it.
     #
+    # _Requires permission: `accounts:write`._
+    #
     # POST /api/org/{orgId}/provider-oauth/{pluginId}/authorize
     #
     # Raises on 400: Bad request
@@ -21036,6 +22074,8 @@ module Infrawrench
 
     # List query monitors
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/query-monitors
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -21054,6 +22094,8 @@ module Infrawrench
 
     # Get one query monitor
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/query-monitors/{monitorId}
     #
     # Raises on 404: Not found
@@ -21100,6 +22142,8 @@ module Infrawrench
     # for a query to run against a customer database on a schedule, forever,
     # which is a strictly larger act than running one while watching it.
     #
+    # _Requires permission: `resources:execute`._
+    #
     # POST /api/org/{orgId}/query-monitors
     #
     # Raises on 400: Bad request
@@ -21110,11 +22154,11 @@ module Infrawrench
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `QueryMonitorCreate`.
+    # @param body [Hash] Request body, shaped as `QueryMonitorCreate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `QueryMonitor` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(org_id: nil, body: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
         path: "/api/org/{orgId}/query-monitors",
@@ -21126,6 +22170,8 @@ module Infrawrench
 
     # Delete a query monitor
     #
+    # _Requires permission: `resources:execute`._
+    #
     # DELETE /api/org/{orgId}/query-monitors/{monitorId}
     #
     # Raises on 404: Not found
@@ -21157,6 +22203,8 @@ module Infrawrench
     # fills it from the synced resource either way) when creating a monitor to
     # scope the query to that resource.
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/query-monitors/targets
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -21182,18 +22230,20 @@ module Infrawrench
     # the answer says whether it *would* be breaching rather than leaving the
     # reader to compare two numbers.
     #
+    # _Requires permission: `resources:execute`._
+    #
     # POST /api/org/{orgId}/query-monitors/test
     #
     # Raises on 400: Bad request
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `QueryMonitorCreate`.
+    # @param body [Hash] Request body, shaped as `Hash`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `QueryMonitorTestResult` — see
     #   `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def test(org_id: nil, body: nil, request_options: nil)
+    def test(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
         path: "/api/org/{orgId}/query-monitors/test",
@@ -21211,6 +22261,8 @@ module Infrawrench
     # question, and carrying it forward would fire an alert on the first run of
     # a rule nobody has tested.
     #
+    # _Requires permission: `resources:execute`._
+    #
     # PATCH /api/org/{orgId}/query-monitors/{monitorId}
     #
     # Raises on 400: Bad request
@@ -21222,11 +22274,11 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param monitor_id [String]
-    # @param body [Hash, nil] Request body, shaped as `QueryMonitorUpdate`.
+    # @param body [Hash] Request body, shaped as `QueryMonitorUpdate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `QueryMonitor` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(monitor_id:, org_id: nil, body: nil, request_options: nil)
+    def update(monitor_id:, body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "PATCH",
         path: "/api/org/{orgId}/query-monitors/{monitorId}",
@@ -21618,7 +22670,7 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
-    # @param offset [Integer, nil, nil]
+    # @param offset [Integer, nil]
     # @param limit [Integer, nil]
     # @param sort [String, nil] `<kind>:<key>`.
     #   `core:name|type|provider|account|region|status|created|external_id`; `field:<key>` a key
@@ -22090,6 +23142,8 @@ module Infrawrench
     # with the `x-tag-policy-override: true` header if you hold
     # `tag-policy:override`; both blocks and overrides are audit-logged.
     #
+    # Raises on 500: Server error
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `CreateResourceRequest`.
@@ -22142,6 +23196,8 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/resources/create-pricing
     #
+    # Raises on 404: Not found
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `CreatePricingRequest`.
@@ -22345,6 +23401,8 @@ module Infrawrench
     # the field; for `select` fields the optional `option` should be spliced
     # into the options list so the new value can be displayed.
     #
+    # _Requires permission: `resources:write`._
+    #
     # POST /api/org/{orgId}/resources/field-action
     #
     # Raises on 400: Bad request
@@ -22564,6 +23622,37 @@ module Infrawrench
       )
     end
 
+    # Serve a host over a Cloudflare Tunnel
+    #
+    # Points the tunnel's ingress at the host's service, creates the routing DNS
+    # record in `zoneId`, then connects to the host over SSH and installs and
+    # runs cloudflared. A DNS record that could not be created (one may already
+    # exist) is reported and the setup carries on; any other failed step is the
+    # last of `steps`, and `connectCommand` is only sent when every step ran.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/resources/tunnel-ssh-attach
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `TunnelSshAttachRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `TunnelSshAttachResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def tunnel_ssh_attach(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/tunnel-ssh-attach",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
     # Update a resource via its plugin
     #
     # Applies the supplied field changes upstream and persists the refreshed
@@ -22572,6 +23661,8 @@ module Infrawrench
     # freeze is in effect (this is also the path that applies right-sizing
     # recommendations); every applied update is audit-logged.
     #
+    # _Requires permission: `resources:write`._
+    #
     # POST /api/org/{orgId}/resources/update
     #
     # Raises on 400: Bad request
@@ -22656,6 +23747,8 @@ module Infrawrench
     # used. Reading takes `resources:read`: the person who can see the
     # infrastructure is the person who will be woken up about it.
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/runbooks
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -22674,6 +23767,8 @@ module Infrawrench
 
     # Get one runbook
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/runbooks/{runbookId}
     #
     # Raises on 404: Not found
@@ -22711,21 +23806,25 @@ module Infrawrench
     # A closed run refuses updates, and reopening is not offered: a run is a
     # record of what happened. Start another run to record another attempt.
     #
+    # _Requires permission: `resources:read`._
+    #
     # PATCH /api/org/{orgId}/runbooks/runs/{runId}/steps/{stepId}
     #
     # Raises on 400: Bad request
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param run_id [String]
     # @param step_id [String]
-    # @param body [Hash, nil] Request body, shaped as `RunbookStepUpdate`.
+    # @param body [Hash] Request body, shaped as `RunbookStepUpdate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `RunbookRun` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(run_id:, step_id:, org_id: nil, body: nil, request_options: nil)
+    def update(run_id:, step_id:, body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "PATCH",
         path: "/api/org/{orgId}/runbooks/runs/{runId}/steps/{stepId}",
@@ -22755,6 +23854,8 @@ module Infrawrench
     # ended before the checklist did) and quietly marking them done would erase
     # the one thing a postmortem wants to know.
     #
+    # _Requires permission: `resources:read`._
+    #
     # POST /api/org/{orgId}/runbooks/runs/{runId}/close
     #
     # Raises on 400: Bad request
@@ -22766,11 +23867,11 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param run_id [String]
-    # @param body [Hash, nil] Request body, shaped as `RunbookRunClose`.
+    # @param body [Hash] Request body, shaped as `RunbookRunClose`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `RunbookRun` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def close(run_id:, org_id: nil, body: nil, request_options: nil)
+    def close(run_id:, body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
         path: "/api/org/{orgId}/runbooks/runs/{runId}/close",
@@ -22792,12 +23893,16 @@ module Infrawrench
     # and refusing the second would mean it goes unrecorded rather than not
     # happening.
     #
+    # _Requires permission: `resources:read`._
+    #
     # POST /api/org/{orgId}/runbooks/{runbookId}/runs
     #
     # Raises on 400: Bad request
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param runbook_id [String]
@@ -22819,6 +23924,8 @@ module Infrawrench
     #
     # Newest first, optionally narrowed to one runbook or one incident.
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/runbooks/runs
     #
     # Raises on 400: Bad request
@@ -22843,6 +23950,8 @@ module Infrawrench
 
     # Get one runbook run
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/runbooks/runs/{runId}
     #
     # Raises on 404: Not found
@@ -22885,19 +23994,23 @@ module Infrawrench
     # Names are unique within an organization: two runbooks called "Failover" is
     # how the wrong one gets run.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/runbooks
     #
     # Raises on 400: Bad request
     #
+    # Raises on 404: Not found
+    #
     # Raises on 409: Conflict
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
-    # @param body [Hash, nil] Request body, shaped as `RunbookCreate`.
+    # @param body [Hash] Request body, shaped as `RunbookCreate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `Runbook` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def create(org_id: nil, body: nil, request_options: nil)
+    def create(body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "POST",
         path: "/api/org/{orgId}/runbooks",
@@ -22912,6 +24025,8 @@ module Infrawrench
     # Takes its run history with it. To retire a procedure without losing the
     # record of the runs performed against it, set `enabled` to false instead.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # DELETE /api/org/{orgId}/runbooks/{runbookId}
     #
     # Raises on 404: Not found
@@ -22939,6 +24054,8 @@ module Infrawrench
     # is valid as a whole. A step sent with its `id` keeps its identity, so a
     # run in progress still matches it.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # PATCH /api/org/{orgId}/runbooks/{runbookId}
     #
     # Raises on 400: Bad request
@@ -22950,11 +24067,11 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param runbook_id [String]
-    # @param body [Hash, nil] Request body, shaped as `RunbookUpdate`.
+    # @param body [Hash] Request body, shaped as `RunbookUpdate`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
     # @return [Hash] Parsed JSON, shaped as `Runbook` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
-    def update(runbook_id:, org_id: nil, body: nil, request_options: nil)
+    def update(runbook_id:, body:, org_id: nil, request_options: nil)
       @transport.request(
         http_method: "PATCH",
         path: "/api/org/{orgId}/runbooks/{runbookId}",
@@ -23161,6 +24278,8 @@ module Infrawrench
     # override, or an end date. The facts of an automatic event (what was done,
     # when, the projection) stay as observed.
     #
+    # _Requires permission: `costs:write`._
+    #
     # PATCH /api/org/{orgId}/savings/events/{id}
     #
     # Raises on 400: Bad request
@@ -23188,6 +24307,8 @@ module Infrawrench
     #
     # Full replace of a manual entry. Automatic events are a 400; use PATCH.
     #
+    # _Requires permission: `costs:write`._
+    #
     # PUT /api/org/{orgId}/savings/events/{id}
     #
     # Raises on 400: Bad request
@@ -23229,6 +24350,8 @@ module Infrawrench
     # Record a saving by hand, with the monthly amount and the day it began.
     # Leaves an org-wide cost annotation on that day. Requires `costs:write`.
     #
+    # _Requires permission: `costs:write`._
+    #
     # POST /api/org/{orgId}/savings/events
     #
     # Raises on 400: Bad request
@@ -23254,6 +24377,8 @@ module Infrawrench
     # Hard delete, together with the cost annotation the event left on the
     # charts.
     #
+    # _Requires permission: `costs:write`._
+    #
     # DELETE /api/org/{orgId}/savings/events/{id}
     #
     # Raises on 404: Not found
@@ -23303,12 +24428,13 @@ module Infrawrench
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param view [String, nil] Apply a saved view, by id or name. Explicit params override it.
-    # @param status [String, nil] A status, `open` (Ready or In progress), or `all`.
+    # @param status [String, nil] Status tab. Defaults to `all` (or the view's).
     # @param kind [String, nil] Comma-separated finding kinds.
     # @param provider [String, nil] Comma-separated plugin ids.
     # @param account [String, nil] Comma-separated account ids.
     # @param region [String, nil] Comma-separated regions.
-    # @param tag [String, nil] `key` or `key=value`; repeat for more terms (all must match).
+    # @param tag [Array<String>, nil] `key` or `key=value`; repeat for more terms (all must
+    #   match).
     # @param min_savings [String, nil] Minimum monthly savings, in each finding's own currency.
     #   Unpriced findings never pass.
     # @param detected_from [String, nil] Detected on or after (UTC day).
@@ -23406,6 +24532,8 @@ module Infrawrench
     # The org's horizon, shortfall threshold and baseline window; defaults when
     # never saved.
     #
+    # _Requires permission: `costs:read`._
+    #
     # GET /api/org/{orgId}/savings/settings
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -23427,6 +24555,8 @@ module Infrawrench
     #
     # Requires `costs:write`. Changes every figure in the report, retroactively.
     #
+    # _Requires permission: `costs:write`._
+    #
     # PUT /api/org/{orgId}/savings/settings
     #
     # Raises on 400: Bad request
@@ -23475,6 +24605,8 @@ module Infrawrench
     # as restated billing lands. Days collection has not covered are not
     # accrued. Per-currency throughout; never converted or merged.
     #
+    # _Requires permission: `costs:read`._
+    #
     # GET /api/org/{orgId}/savings/realized
     #
     # Raises on 400: Bad request
@@ -23877,6 +25009,8 @@ module Infrawrench
     # the poller records; days when nothing could be graded are absent rather
     # than zero. Does not seed the default scorecard.
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/scorecards/org
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -23898,6 +25032,8 @@ module Infrawrench
     # The daily history alone, without computing the grade: the cheap read for a
     # sparkline.
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/scorecards/org/history
     #
     # Raises on 400: Bad request
@@ -23947,6 +25083,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 404: Not found
+    #
     # Raises on 409: Conflict
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -23973,8 +25111,12 @@ module Infrawrench
     #
     # DELETE /api/org/{orgId}/scorecards/{scorecardId}
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param scorecard_id [String]
@@ -24000,8 +25142,12 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/scorecards/{scorecardId}/evaluate
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param scorecard_id [String]
@@ -24101,6 +25247,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param q [String, nil]
@@ -24253,6 +25401,10 @@ module Infrawrench
     #
     # Raises on 409: Conflict
     #
+    # Raises on 423: Blocked by an active change freeze. Retry with the
+    # `x-change-freeze-override: true` header if you hold `freezes:override`;
+    # both blocks and overrides are audit-logged.
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param seat_id [String]
@@ -24345,6 +25497,8 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param service_id [String] Service id or slug.
@@ -24372,8 +25526,12 @@ module Infrawrench
     #
     # DELETE /api/org/{orgId}/services/{serviceId}/members/{resourceId}
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param service_id [String] Service id or slug.
@@ -24448,8 +25606,12 @@ module Infrawrench
     #
     # DELETE /api/org/{orgId}/services/{serviceId}
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param service_id [String] Service id or slug.
@@ -24839,6 +26001,8 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: The host key is new or has changed; trust it and retry
+    #
     # Raises on 500: Server error
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -24942,6 +26106,8 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: The host key is new or has changed; trust it and retry
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Sent as `multipart/form-data`; `file` carries the file bytes.
@@ -24976,6 +26142,8 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/shared-consoles/{consoleId}/invites
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 403: Forbidden
     #
     # Raises on 404: Not found
@@ -25405,6 +26573,8 @@ module Infrawrench
     #
     # DELETE /api/org/{orgId}/sharing/{objectType}/{objectId}
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 403: Forbidden
     #
     # Raises on 404: Not found
@@ -25433,6 +26603,10 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/sharing/{objectType}/{objectId}
     #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -25499,6 +26673,8 @@ module Infrawrench
     # drift, everywhere), so a freshly added channel starts receiving alerts
     # without a second step.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/slack/channels
     #
     # Raises on 400: Bad request
@@ -25523,6 +26699,8 @@ module Infrawrench
 
     # Disconnect a channel
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # DELETE /api/org/{orgId}/slack/channels/{id}
     #
     # Raises on 404: Not found
@@ -25544,8 +26722,12 @@ module Infrawrench
 
     # Refresh a channel's cached name
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # PATCH /api/org/{orgId}/slack/channels/{id}
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -25579,6 +26761,8 @@ module Infrawrench
     # Live call to Slack's conversations.list, for populating a channel picker.
     # Returns non-archived public and private channels visible to the bot.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET
     # /api/org/{orgId}/slack/installations/{installationId}/available-channels
     #
@@ -25604,6 +26788,8 @@ module Infrawrench
     # Stops all delivery to this workspace. The channel routing is retained, so
     # re-installing restores it.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # DELETE /api/org/{orgId}/slack/installations/{installationId}
     #
     # Raises on 404: Not found
@@ -25648,6 +26834,8 @@ module Infrawrench
     # Slack redirects back to /api/slack/oauth/callback. The install only
     # completes in the browser that opened the link as that user.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/slack/install-url
     #
     # Raises on 400: Bad request
@@ -25671,6 +26859,8 @@ module Infrawrench
     # Reports whether the server has a Slack app registered, which workspaces
     # this organization has connected, and which channels alerts are routed to.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/slack/status
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -25693,6 +26883,8 @@ module Infrawrench
     # error when nothing could be delivered (`not_in_channel` means the bot
     # needs inviting to a private channel).
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # POST /api/org/{orgId}/slack/test
     #
     # Raises on 400: Bad request
@@ -25824,8 +27016,12 @@ module Infrawrench
     #
     # DELETE /api/org/{orgId}/slos/{sloId}
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
+    # Raises on 409: Conflict
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param slo_id [String]
@@ -25861,8 +27057,7 @@ module Infrawrench
     # @param slo_id [String]
     # @param body [Hash, nil] Request body, shaped as `SloFreezeRequest`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `SloActiveFreeze & Hash` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `SloActiveFreeze` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def post_org_org_id_slos_slo_id_freeze(slo_id:, org_id: nil, body: nil, request_options: nil)
       @transport.request(
@@ -26243,6 +27438,8 @@ module Infrawrench
     #
     # DELETE /api/org/{orgId}/ssh-keys/{id}
     #
+    # Raises on 404: Not found
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
@@ -26312,6 +27509,8 @@ module Infrawrench
     # authority as opening a shell. Imported keys cannot sign (only their public
     # half is stored). Every call is audited.
     #
+    # _Requires permission: `resources:execute`._
+    #
     # POST /api/org/{orgId}/ssh-keys/{id}/sign
     #
     # Raises on 400: Bad request
@@ -26399,6 +27598,8 @@ module Infrawrench
     #
     # Raises on 404: Not found
     #
+    # Raises on 409: The host key is new or has changed; trust it and retry
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `SshTunnelCreateAccountRequest`.
@@ -26424,8 +27625,12 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
+    # Raises on 409: The host key is new or has changed; trust it and retry
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `SshExecRequest`.
@@ -26448,8 +27653,12 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/ssh-tunnels/open
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
+    # Raises on 409: The host key is new or has changed; trust it and retry
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `Hash`.
@@ -27116,15 +28325,18 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/team/invitations
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 402: Payment required: the organization's plan does not include
     # this
     #
-    # Raises on 403: The role would grant permissions the caller does not hold,
-    # or the caller is not an owner and tried to invite an owner
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
     #
-    # Raises on 409: All seats are in use; retry with addSeat to buy one more
+    # Raises on 409: SeatLimitResponse
     #
-    # Raises on 502: Buying the extra seat failed; the invitation was not sent
+    # Raises on 502: Bad gateway: an upstream service failed
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -27201,6 +28413,10 @@ module Infrawrench
     #
     # DELETE /api/org/{orgId}/team/members/{id}
     #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
@@ -27243,6 +28459,12 @@ module Infrawrench
     #
     # PATCH /api/org/{orgId}/team/members/{id}/role
     #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param id [String]
@@ -27275,6 +28497,10 @@ module Infrawrench
     #
     # POST /api/org/{orgId}/team/roles
     #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
     # @param body [Hash] Request body, shaped as `RoleCreateRequest`.
@@ -27301,7 +28527,8 @@ module Infrawrench
     #
     # Raises on 409: Conflict
     #
-    # Raises on 422: Bad request
+    # Raises on 422: Unprocessable: the request is well formed but cannot be
+    # acted on
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -27345,9 +28572,14 @@ module Infrawrench
     #
     # PATCH /api/org/{orgId}/team/roles/{id}
     #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
-    # Raises on 422: Bad request
+    # Raises on 422: Unprocessable: the request is well formed but cannot be
+    # acted on
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
     #   constructed with.
@@ -27559,8 +28791,7 @@ module Infrawrench
     #   constructed with.
     # @param body [Hash] Request body, shaped as `VirtualTagInput`.
     # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
-    # @return [Hash] Parsed JSON, shaped as `VirtualTagStats & Hash` — see
-    #   `sig/infrawrench/sdk.rbs`.
+    # @return [Hash] Parsed JSON, shaped as `VirtualTagStats` — see `sig/infrawrench/sdk.rbs`.
     # @raise [Infrawrench::ApiError] On any non-2xx response.
     def preview(body:, org_id: nil, request_options: nil)
       @transport.request(
@@ -27640,6 +28871,8 @@ module Infrawrench
     # repository, so it survives rebuilds) or, with `artifactKey: "*"`,
     # everywhere. Idempotent.
     #
+    # _Requires permission: `resources:write`._
+    #
     # POST /api/org/{orgId}/vulnerabilities/dismissals
     #
     # Raises on 400: Bad request
@@ -27665,6 +28898,8 @@ module Infrawrench
     #
     # The key is in the query string because artifact keys contain slashes.
     #
+    # _Requires permission: `resources:write`._
+    #
     # DELETE /api/org/{orgId}/vulnerabilities/dismissals
     #
     # Raises on 400: Bad request
@@ -27702,6 +28937,8 @@ module Infrawrench
     #
     # Defaults when never saved: alerts on, critical only, running only.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # GET /api/org/{orgId}/vulnerabilities/settings
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -27723,6 +28960,8 @@ module Infrawrench
     #
     # Saving never resets the alert cooldown.
     #
+    # _Requires permission: `org:settings:write`._
+    #
     # PUT /api/org/{orgId}/vulnerabilities/settings
     #
     # Raises on 400: Bad request
@@ -27774,6 +29013,8 @@ module Infrawrench
     # those running there and recompute the counts; `sources` always describes
     # every scanner.
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/vulnerabilities
     #
     # Raises on 400: Bad request
@@ -27824,6 +29065,8 @@ module Infrawrench
     # and a screen in an office is exactly what a visitor photographs. The
     # machine driving the wall signs in once.
     #
+    # _Requires permission: `resources:read`._
+    #
     # GET /api/org/{orgId}/wallboard
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -28129,6 +29372,8 @@ module Infrawrench
     #
     # DELETE /api/org/{orgId}/workflows/{id}/schedule
     #
+    # Raises on 400: Bad request
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -28190,6 +29435,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -28253,6 +29500,8 @@ module Infrawrench
     #
     # Raises on 400: Bad request
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -28289,6 +29538,216 @@ module Infrawrench
       @secrets = WorkflowsSecretsNamespace.new(@transport)
     end
 
+    # Type-check workflow source
+    #
+    # Checks `source` (or the stored source) against the workflow's generated
+    # typings, the same check the editor runs. Needs `secrets:read` as well,
+    # since the typings name the assigned secrets.
+    #
+    # _Requires permission: `workflows:read`._
+    #
+    # POST /api/org/{orgId}/workflows/{id}/check
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String] Workflow id
+    # @param body [Hash] Request body, shaped as `WorkflowCheckInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `WorkflowTypecheckResult` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def check(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/workflows/{id}/check",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Create a workflow
+    #
+    # Every field is optional: an empty body creates an enabled, manually
+    # triggered workflow with no source. Assigning secrets (`secretIds`) also
+    # needs `secrets:read`.
+    #
+    # _Requires permission: `workflows:write`._
+    #
+    # POST /api/org/{orgId}/workflows
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `WorkflowInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Workflow` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/workflows",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete a workflow
+    #
+    # _Requires permission: `workflows:write`._
+    #
+    # DELETE /api/org/{orgId}/workflows/{id}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String] Workflow id
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/workflows/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Get a workflow
+    #
+    # _Requires permission: `workflows:read`._
+    #
+    # GET /api/org/{orgId}/workflows/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String] Workflow id
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Workflow` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/workflows/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List workflows
+    #
+    # _Requires permission: `workflows:read`._
+    #
+    # GET /api/org/{orgId}/workflows
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<Workflow>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/workflows",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # A workflow's metric values
+    #
+    # _Requires permission: `workflows:read`._
+    #
+    # GET /api/org/{orgId}/workflows/{id}/metrics
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String] Workflow id
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<WorkflowMetric>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def metrics(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/workflows/{id}/metrics",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Run a workflow now
+    #
+    # Runs the workflow to completion with the caller's permissions and answers
+    # its outcome. Non-interactive: an `infra.prompt` gets no answer.
+    #
+    # _Requires permission: `workflows:write`._
+    #
+    # POST /api/org/{orgId}/workflows/{id}/run
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String] Workflow id
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `WorkflowRunOutcome` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def run(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/workflows/{id}/run",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # A workflow's recent runs
+    #
+    # _Requires permission: `workflows:read`._
+    #
+    # GET /api/org/{orgId}/workflows/{id}/runs
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String] Workflow id
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<WorkflowRun>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def runs(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/workflows/{id}/runs",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
     # Generated infra.d.ts for a workflow
     #
     # The ambient TypeScript declarations workflow source is written against,
@@ -28303,6 +29762,8 @@ module Infrawrench
     #
     # GET /api/org/{orgId}/workflows/{id}/typings
     #
+    # Raises on 403: Forbidden
+    #
     # Raises on 404: Not found
     #
     # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
@@ -28323,6 +29784,40 @@ module Infrawrench
         request_options: request_options
       )
     end
+
+    # Update a workflow
+    #
+    # An omitted field keeps its stored value. Changing the source, trigger or
+    # assigned secrets makes automated runs act with the caller's permissions
+    # from then on; when the workflow has secrets assigned, any edit also needs
+    # `secrets:read`.
+    #
+    # _Requires permission: `workflows:write`._
+    #
+    # PUT /api/org/{orgId}/workflows/{id}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String] Workflow id
+    # @param body [Hash] Request body, shaped as `WorkflowInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Workflow` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/workflows/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
   end
 
   # A client for the Infrawrench API.
@@ -28399,6 +29894,8 @@ module Infrawrench
     attr_reader :changes
     # @return [ChatNamespace] `client.chat`
     attr_reader :chat
+    # @return [CiNamespace] `client.ci`
+    attr_reader :ci
     # @return [CommitmentsNamespace] `client.commitments`
     attr_reader :commitments
     # @return [ComplianceNamespace] `client.compliance`
@@ -28467,6 +29964,10 @@ module Infrawrench
     attr_reader :expiring
     # @return [ExtendedSupportNamespace] `client.extended_support`
     attr_reader :extended_support
+    # @return [FeaturesNamespace] `client.features`
+    attr_reader :features
+    # @return [GithubNamespace] `client.github`
+    attr_reader :github
     # @return [GithubIssuesNamespace] `client.github_issues`
     attr_reader :github_issues
     # @return [IacNamespace] `client.iac`
@@ -28652,6 +30153,7 @@ module Infrawrench
       @change_freezes = ChangeFreezesNamespace.new(@transport)
       @changes = ChangesNamespace.new(@transport)
       @chat = ChatNamespace.new(@transport)
+      @ci = CiNamespace.new(@transport)
       @commitments = CommitmentsNamespace.new(@transport)
       @compliance = ComplianceNamespace.new(@transport)
       @config = ConfigNamespace.new(@transport)
@@ -28686,6 +30188,8 @@ module Infrawrench
       @event_subscriptions = EventSubscriptionsNamespace.new(@transport)
       @expiring = ExpiringNamespace.new(@transport)
       @extended_support = ExtendedSupportNamespace.new(@transport)
+      @features = FeaturesNamespace.new(@transport)
+      @github = GithubNamespace.new(@transport)
       @github_issues = GithubIssuesNamespace.new(@transport)
       @iac = IacNamespace.new(@transport)
       @idle_findings = IdleFindingsNamespace.new(@transport)