late-sdk 0.0.671 → 0.0.673

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6c0dfdce582902a8b185c5d9339855c12f580cdc8d8dd3ade600efdc76dece82
-  data.tar.gz: 9e77888264b5ff38314415235d7d95132a2ecaf663c1f06584d25e04aa43f935
+  metadata.gz: 5b27d36ce41995655fc9626ffadfdd9879d0d9dbfd7ceb99f54a61be865bc02c
+  data.tar.gz: 3fb317a79b764eca697116442c07b47d126e1fe79daad1c3bbb70ab79cd05c56
 SHA512:
-  metadata.gz: 5301b1c7563d56357a963e33b09d72b957dbabfc65a68315d99c841e950f2648d34763e805cfd8711d5ca99d4a2db871871993e0c37eb0d3ba4b34409c58cb58
-  data.tar.gz: 7496f41d301ac4f61d684ca3a21e7194f471e45b4c6409cd4a715fcadad5ef141f5fe474cf309389bad956559c0f3db3c44720034bf3be8604f81d8668bad7cc
+  metadata.gz: a3b8247029842556d16df5f3c8adcc5e2affce302a26965e752982cdf83d81e8986edc2545048941e567e7a0f3cae5944de69a6035f3e44ba0c7ec1dd6f40356
+  data.tar.gz: c7ed556428b888178f6b3d1fe4d7b339aeb938ddf72472a40cfaa5fa00f3a5f91eab195d482d8e204c26cef71f4ee0c2bb39c4a8ab02afe07b38a8780545243e

data/README.md

@@ -1361,7 +1361,8 @@ Class | Method | HTTP request | Description
  - [Zernio::InlineObject](docs/InlineObject.md)
  - [Zernio::InlineObject1](docs/InlineObject1.md)
  - [Zernio::InlineObject2](docs/InlineObject2.md)
- - [Zernio::InlineObject2Details](docs/InlineObject2Details.md)
+ - [Zernio::InlineObject3](docs/InlineObject3.md)
+ - [Zernio::InlineObject3Details](docs/InlineObject3Details.md)
  - [Zernio::InstagramAccountInsightsResponse](docs/InstagramAccountInsightsResponse.md)
  - [Zernio::InstagramAccountInsightsResponseDateRange](docs/InstagramAccountInsightsResponseDateRange.md)
  - [Zernio::InstagramAccountInsightsResponseMetricsValue](docs/InstagramAccountInsightsResponseMetricsValue.md)

data/docs/ApiKey.md

@@ -13,6 +13,7 @@
 | **scope** | **String** | 'full' grants access to all profiles, 'profiles' restricts to specific profiles | [optional][default to 'full'] |
 | **profile_ids** | [**Array<ApiKeyProfileIdsInner>**](ApiKeyProfileIdsInner.md) | Profiles this key can access (populated with name and color). Only present when scope is 'profiles'. | [optional] |
 | **permission** | **String** | 'read-write' allows all operations, 'read' restricts to GET requests only | [optional][default to 'read-write'] |
+| **disabled_resource_groups** | **Array<String>** | Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. | [optional] |
 
 ## Example
 
@@ -28,7 +29,8 @@ instance = Zernio::ApiKey.new(
   key: null,
   scope: null,
   profile_ids: null,
-  permission: null
+  permission: null,
+  disabled_resource_groups: null
 )
 ```
 

data/docs/ConnectedAppsApi.md

@@ -14,7 +14,7 @@ All URIs are relative to *https://zernio.com/api*
 
 List connected apps
 
-Returns the OAuth clients (AI assistants and MCP connectors) the authenticated user has authorized and that still hold a live token.  Requires a session or a full-scope API key. A profile-scoped API key or an OAuth access token is rejected with 403: an app must not be able to enumerate its sibling authorizations. 
+Returns the OAuth clients (AI assistants and MCP connectors) the authenticated user has authorized and that still hold a live token.  Requires a session or a full-access API key. A profile-scoped API key, a restricted (zrk_) API key, or an OAuth access token is rejected with 403: an app must not be able to enumerate its sibling authorizations, and connected-app management is admin-plane. 
 
 ### Examples
 
@@ -80,7 +80,7 @@ This endpoint does not need any parameter.
 
 Revoke connected app
 
-Ends an app's access: invalidates the client's pending authorization codes and revokes every live token it holds for the authenticated user. Takes effect on the app's next request.  Idempotent while the authorization is still on record: revoking an app that was already revoked returns 200 with `revokedTokens: 0`. 
+Ends an app's access: invalidates the client's pending authorization codes and revokes every live token it holds for the authenticated user. Takes effect on the app's next request.  Idempotent while the authorization is still on record: revoking an app that was already revoked returns 200 with `revokedTokens: 0`.  Requires a session or a full-access API key. A profile-scoped API key, a restricted (zrk_) API key, or an OAuth access token is rejected with 403. 
 
 ### Examples
 

data/docs/CreateApiKeyRequest.md

@@ -9,6 +9,7 @@
 | **scope** | **String** | 'full' grants access to all profiles (default), 'profiles' restricts to specific profiles | [optional][default to 'full'] |
 | **profile_ids** | **Array<String>** | Profile IDs this key can access. Required when scope is 'profiles'. | [optional] |
 | **permission** | **String** | 'read-write' allows all operations (default), 'read' restricts to GET requests only | [optional][default to 'read-write'] |
+| **disabled_resource_groups** | **Array<String>** | Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. | [optional] |
 
 ## Example
 
@@ -20,7 +21,8 @@ instance = Zernio::CreateApiKeyRequest.new(
   expires_in: null,
   scope: null,
   profile_ids: null,
-  permission: null
+  permission: null,
+  disabled_resource_groups: null
 )
 ```
 

data/docs/InlineObject2.md

@@ -4,12 +4,9 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **error** | **String** | Human-readable error message suitable for end-user display. |  |
-| **code** | **String** | Machine-readable error code. Stable across versions. |  |
-| **reason** | **String** | Discriminator for which gate fired. |  |
-| **documentation_url** | **String** | Link to the relevant documentation page. | [optional] |
-| **dashboard_url** | **String** | Deep-link to send the end-user to. For `free_tier_exceeded` and `twitter_passthrough` this is the Zernio billing tab. For `enterprise_required` this is the Zernio enterprise contact page.  | [optional] |
-| **details** | [**InlineObject2Details**](InlineObject2Details.md) |  | [optional] |
+| **error** | **String** |  | [optional] |
+| **code** | **String** |  | [optional] |
+| **required_group** | **String** | The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials. | [optional] |
 
 ## Example
 
@@ -17,12 +14,9 @@
 require 'zernio-sdk'
 
 instance = Zernio::InlineObject2.new(
-  error: X (Twitter) requires a payment method due to API pass-through costs. Add a payment method to connect an X account.,
+  error: This API key has the 'messages' resource group disabled. GET /api/v1/inbox/conversations requires it. Create a key with 'messages' enabled in the dashboard API keys tab.,
   code: null,
-  reason: null,
-  documentation_url: https://docs.zernio.com/billing/payment-method-required,
-  dashboard_url: https://zernio.com/dashboard?tab=billing,
-  details: null
+  required_group: null
 )
 ```
 

data/docs/InlineObject3.md

@@ -0,0 +1,28 @@
+# Zernio::InlineObject3
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **error** | **String** | Human-readable error message suitable for end-user display. |  |
+| **code** | **String** | Machine-readable error code. Stable across versions. |  |
+| **reason** | **String** | Discriminator for which gate fired. |  |
+| **documentation_url** | **String** | Link to the relevant documentation page. | [optional] |
+| **dashboard_url** | **String** | Deep-link to send the end-user to. For `free_tier_exceeded` and `twitter_passthrough` this is the Zernio billing tab. For `enterprise_required` this is the Zernio enterprise contact page.  | [optional] |
+| **details** | [**InlineObject3Details**](InlineObject3Details.md) |  | [optional] |
+
+## Example
+
+```ruby
+require 'zernio-sdk'
+
+instance = Zernio::InlineObject3.new(
+  error: X (Twitter) requires a payment method due to API pass-through costs. Add a payment method to connect an X account.,
+  code: null,
+  reason: null,
+  documentation_url: https://docs.zernio.com/billing/payment-method-required,
+  dashboard_url: https://zernio.com/dashboard?tab=billing,
+  details: null
+)
+```
+

data/docs/{InlineObject2Details.md → InlineObject3Details.md}

@@ -1,4 +1,4 @@
-# Zernio::InlineObject2Details
+# Zernio::InlineObject3Details
 
 ## Properties
 
@@ -14,7 +14,7 @@
 ```ruby
 require 'zernio-sdk'
 
-instance = Zernio::InlineObject2Details.new(
+instance = Zernio::InlineObject3Details.new(
   free_tier_account_limit: 2,
   current_account_count: 5,
   has_payment_method: null,

data/docs/InvitesApi.md

@@ -13,7 +13,7 @@ All URIs are relative to *https://zernio.com/api*
 
 Create invite token
 
-Generate a secure invite link to grant team members access to your profiles. Invites expire after 7 days and are single-use. 
+Generate a secure invite link to grant team members access to your profiles. Invites expire after 7 days and are single-use.  Returns 403 when a requested profile is not found or not owned, or when called with a restricted (zrk_) API key: invite management is admin-plane. 
 
 ### Examples
 

data/docs/WebhooksApi.md

@@ -18,7 +18,7 @@ All URIs are relative to *https://zernio.com/api*
 
 Create webhook
 
-Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures. 
+Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403. Note that the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. 
 
 ### Examples
 
@@ -156,7 +156,7 @@ end
 
 List webhook delivery logs
 
-Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination. 
+Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination.  For a restricted (zrk_) API key, rows for events outside the key's resource groups are omitted (`pagination.total` may over-count), and an `event` filter naming such an event is rejected with 403. 
 
 ### Examples
 
@@ -372,7 +372,7 @@ end
 
 Update webhook
 
-Update an existing webhook configuration. All fields except `_id` are optional; only provided fields will be updated.  When provided, `name` must be 1-50 characters, `url` must be a valid URL, and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures. 
+Update an existing webhook configuration. All fields except `_id` are optional; only provided fields will be updated.  When provided, `name` must be 1-50 characters, `url` must be a valid URL, and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only set `events` to events whose resource group the key holds; an event outside the key's groups is rejected with 403. 
 
 ### Examples
 

data/lib/zernio-sdk/api/connected_apps_api.rb

@@ -20,7 +20,7 @@ module Zernio
       @api_client = api_client
     end
     # List connected apps
-    # Returns the OAuth clients (AI assistants and MCP connectors) the authenticated user has authorized and that still hold a live token.  Requires a session or a full-scope API key. A profile-scoped API key or an OAuth access token is rejected with 403: an app must not be able to enumerate its sibling authorizations. 
+    # Returns the OAuth clients (AI assistants and MCP connectors) the authenticated user has authorized and that still hold a live token.  Requires a session or a full-access API key. A profile-scoped API key, a restricted (zrk_) API key, or an OAuth access token is rejected with 403: an app must not be able to enumerate its sibling authorizations, and connected-app management is admin-plane. 
     # @param [Hash] opts the optional parameters
     # @return [ListConnectedApps200Response]
     def list_connected_apps(opts = {})
@@ -29,7 +29,7 @@ module Zernio
     end
 
     # List connected apps
-    # Returns the OAuth clients (AI assistants and MCP connectors) the authenticated user has authorized and that still hold a live token.  Requires a session or a full-scope API key. A profile-scoped API key or an OAuth access token is rejected with 403: an app must not be able to enumerate its sibling authorizations. 
+    # Returns the OAuth clients (AI assistants and MCP connectors) the authenticated user has authorized and that still hold a live token.  Requires a session or a full-access API key. A profile-scoped API key, a restricted (zrk_) API key, or an OAuth access token is rejected with 403: an app must not be able to enumerate its sibling authorizations, and connected-app management is admin-plane. 
     # @param [Hash] opts the optional parameters
     # @return [Array<(ListConnectedApps200Response, Integer, Hash)>] ListConnectedApps200Response data, response status code and response headers
     def list_connected_apps_with_http_info(opts = {})
@@ -77,7 +77,7 @@ module Zernio
     end
 
     # Revoke connected app
-    # Ends an app's access: invalidates the client's pending authorization codes and revokes every live token it holds for the authenticated user. Takes effect on the app's next request.  Idempotent while the authorization is still on record: revoking an app that was already revoked returns 200 with `revokedTokens: 0`. 
+    # Ends an app's access: invalidates the client's pending authorization codes and revokes every live token it holds for the authenticated user. Takes effect on the app's next request.  Idempotent while the authorization is still on record: revoking an app that was already revoked returns 200 with `revokedTokens: 0`.  Requires a session or a full-access API key. A profile-scoped API key, a restricted (zrk_) API key, or an OAuth access token is rejected with 403. 
     # @param client_id [String] OAuth client id, as returned by GET /v1/me/connected-apps.
     # @param [Hash] opts the optional parameters
     # @return [RevokeConnectedApp200Response]
@@ -87,7 +87,7 @@ module Zernio
     end
 
     # Revoke connected app
-    # Ends an app&#39;s access: invalidates the client&#39;s pending authorization codes and revokes every live token it holds for the authenticated user. Takes effect on the app&#39;s next request.  Idempotent while the authorization is still on record: revoking an app that was already revoked returns 200 with &#x60;revokedTokens: 0&#x60;. 
+    # Ends an app&#39;s access: invalidates the client&#39;s pending authorization codes and revokes every live token it holds for the authenticated user. Takes effect on the app&#39;s next request.  Idempotent while the authorization is still on record: revoking an app that was already revoked returns 200 with &#x60;revokedTokens: 0&#x60;.  Requires a session or a full-access API key. A profile-scoped API key, a restricted (zrk_) API key, or an OAuth access token is rejected with 403. 
     # @param client_id [String] OAuth client id, as returned by GET /v1/me/connected-apps.
     # @param [Hash] opts the optional parameters
     # @return [Array<(RevokeConnectedApp200Response, Integer, Hash)>] RevokeConnectedApp200Response data, response status code and response headers

data/lib/zernio-sdk/api/invites_api.rb

@@ -20,7 +20,7 @@ module Zernio
       @api_client = api_client
     end
     # Create invite token
-    # Generate a secure invite link to grant team members access to your profiles. Invites expire after 7 days and are single-use. 
+    # Generate a secure invite link to grant team members access to your profiles. Invites expire after 7 days and are single-use.  Returns 403 when a requested profile is not found or not owned, or when called with a restricted (zrk_) API key: invite management is admin-plane. 
     # @param create_invite_token_request [CreateInviteTokenRequest] 
     # @param [Hash] opts the optional parameters
     # @return [CreateInviteToken201Response]
@@ -30,7 +30,7 @@ module Zernio
     end
 
     # Create invite token
-    # Generate a secure invite link to grant team members access to your profiles. Invites expire after 7 days and are single-use. 
+    # Generate a secure invite link to grant team members access to your profiles. Invites expire after 7 days and are single-use.  Returns 403 when a requested profile is not found or not owned, or when called with a restricted (zrk_) API key: invite management is admin-plane. 
     # @param create_invite_token_request [CreateInviteTokenRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(CreateInviteToken201Response, Integer, Hash)>] CreateInviteToken201Response data, response status code and response headers

data/lib/zernio-sdk/api/webhooks_api.rb

@@ -20,7 +20,7 @@ module Zernio
       @api_client = api_client
     end
     # Create webhook
-    # Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures. 
+    # Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403. Note that the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. 
     # @param create_webhook_settings_request [CreateWebhookSettingsRequest] 
     # @param [Hash] opts the optional parameters
     # @return [UpdateWebhookSettings200Response]
@@ -30,7 +30,7 @@ module Zernio
     end
 
     # Create webhook
-    # Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures. 
+    # Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403. Note that the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. 
     # @param create_webhook_settings_request [CreateWebhookSettingsRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(UpdateWebhookSettings200Response, Integer, Hash)>] UpdateWebhookSettings200Response data, response status code and response headers
@@ -152,7 +152,7 @@ module Zernio
     end
 
     # List webhook delivery logs
-    # Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination. 
+    # Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination.  For a restricted (zrk_) API key, rows for events outside the key's resource groups are omitted (`pagination.total` may over-count), and an `event` filter naming such an event is rejected with 403. 
     # @param [Hash] opts the optional parameters
     # @option opts [Integer] :limit Maximum number of logs to return (default to 50)
     # @option opts [Integer] :skip Number of logs to skip (offset-based pagination) (default to 0)
@@ -167,7 +167,7 @@ module Zernio
     end
 
     # List webhook delivery logs
-    # Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination. 
+    # Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination.  For a restricted (zrk_) API key, rows for events outside the key&#39;s resource groups are omitted (&#x60;pagination.total&#x60; may over-count), and an &#x60;event&#x60; filter naming such an event is rejected with 403. 
     # @param [Hash] opts the optional parameters
     # @option opts [Integer] :limit Maximum number of logs to return (default to 50)
     # @option opts [Integer] :skip Number of logs to skip (offset-based pagination) (default to 0)
@@ -396,7 +396,7 @@ module Zernio
     end
 
     # Update webhook
-    # Update an existing webhook configuration. All fields except `_id` are optional; only provided fields will be updated.  When provided, `name` must be 1-50 characters, `url` must be a valid URL, and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures. 
+    # Update an existing webhook configuration. All fields except `_id` are optional; only provided fields will be updated.  When provided, `name` must be 1-50 characters, `url` must be a valid URL, and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only set `events` to events whose resource group the key holds; an event outside the key's groups is rejected with 403. 
     # @param update_webhook_settings_request [UpdateWebhookSettingsRequest] 
     # @param [Hash] opts the optional parameters
     # @return [UpdateWebhookSettings200Response]
@@ -406,7 +406,7 @@ module Zernio
     end
 
     # Update webhook
-    # Update an existing webhook configuration. All fields except &#x60;_id&#x60; are optional; only provided fields will be updated.  When provided, &#x60;name&#x60; must be 1-50 characters, &#x60;url&#x60; must be a valid URL, and &#x60;events&#x60; must contain at least one event. Whitespace is trimmed from &#x60;url&#x60; before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures. 
+    # Update an existing webhook configuration. All fields except &#x60;_id&#x60; are optional; only provided fields will be updated.  When provided, &#x60;name&#x60; must be 1-50 characters, &#x60;url&#x60; must be a valid URL, and &#x60;events&#x60; must contain at least one event. Whitespace is trimmed from &#x60;url&#x60; before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only set &#x60;events&#x60; to events whose resource group the key holds; an event outside the key&#39;s groups is rejected with 403. 
     # @param update_webhook_settings_request [UpdateWebhookSettingsRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(UpdateWebhookSettings200Response, Integer, Hash)>] UpdateWebhookSettings200Response data, response status code and response headers

data/lib/zernio-sdk/models/api_key.rb

@@ -37,6 +37,9 @@ module Zernio
     # 'read-write' allows all operations, 'read' restricts to GET requests only
     attr_accessor :permission
 
+    # Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+    attr_accessor :disabled_resource_groups
+
     class EnumAttributeValidator
       attr_reader :datatype
       attr_reader :allowable_values
@@ -70,7 +73,8 @@ module Zernio
         :'key' => :'key',
         :'scope' => :'scope',
         :'profile_ids' => :'profileIds',
-        :'permission' => :'permission'
+        :'permission' => :'permission',
+        :'disabled_resource_groups' => :'disabledResourceGroups'
       }
     end
 
@@ -95,7 +99,8 @@ module Zernio
         :'key' => :'String',
         :'scope' => :'String',
         :'profile_ids' => :'Array<ApiKeyProfileIdsInner>',
-        :'permission' => :'String'
+        :'permission' => :'String',
+        :'disabled_resource_groups' => :'Array<String>'
       }
     end
 
@@ -162,6 +167,12 @@ module Zernio
       else
         self.permission = 'read-write'
       end
+
+      if attributes.key?(:'disabled_resource_groups')
+        if (value = attributes[:'disabled_resource_groups']).is_a?(Array)
+          self.disabled_resource_groups = value
+        end
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -216,7 +227,8 @@ module Zernio
           key == o.key &&
           scope == o.scope &&
           profile_ids == o.profile_ids &&
-          permission == o.permission
+          permission == o.permission &&
+          disabled_resource_groups == o.disabled_resource_groups
     end
 
     # @see the `==` method
@@ -228,7 +240,7 @@ module Zernio
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [id, name, key_preview, expires_at, created_at, key, scope, profile_ids, permission].hash
+      [id, name, key_preview, expires_at, created_at, key, scope, profile_ids, permission, disabled_resource_groups].hash
     end
 
     # Builds the object from hash

data/lib/zernio-sdk/models/create_api_key_request.rb

@@ -29,6 +29,9 @@ module Zernio
     # 'read-write' allows all operations (default), 'read' restricts to GET requests only
     attr_accessor :permission
 
+    # Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+    attr_accessor :disabled_resource_groups
+
     class EnumAttributeValidator
       attr_reader :datatype
       attr_reader :allowable_values
@@ -58,7 +61,8 @@ module Zernio
         :'expires_in' => :'expiresIn',
         :'scope' => :'scope',
         :'profile_ids' => :'profileIds',
-        :'permission' => :'permission'
+        :'permission' => :'permission',
+        :'disabled_resource_groups' => :'disabledResourceGroups'
       }
     end
 
@@ -79,7 +83,8 @@ module Zernio
         :'expires_in' => :'Integer',
         :'scope' => :'String',
         :'profile_ids' => :'Array<String>',
-        :'permission' => :'String'
+        :'permission' => :'String',
+        :'disabled_resource_groups' => :'Array<String>'
       }
     end
 
@@ -132,6 +137,12 @@ module Zernio
       else
         self.permission = 'read-write'
       end
+
+      if attributes.key?(:'disabled_resource_groups')
+        if (value = attributes[:'disabled_resource_groups']).is_a?(Array)
+          self.disabled_resource_groups = value
+        end
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -197,7 +208,8 @@ module Zernio
           expires_in == o.expires_in &&
           scope == o.scope &&
           profile_ids == o.profile_ids &&
-          permission == o.permission
+          permission == o.permission &&
+          disabled_resource_groups == o.disabled_resource_groups
     end
 
     # @see the `==` method
@@ -209,7 +221,7 @@ module Zernio
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [name, expires_in, scope, profile_ids, permission].hash
+      [name, expires_in, scope, profile_ids, permission, disabled_resource_groups].hash
     end
 
     # Builds the object from hash

data/lib/zernio-sdk/models/inline_object2.rb

@@ -15,22 +15,12 @@ require 'time'
 
 module Zernio
   class InlineObject2 < ApiModelBase
-    # Human-readable error message suitable for end-user display.
     attr_accessor :error
 
-    # Machine-readable error code. Stable across versions.
     attr_accessor :code
 
-    # Discriminator for which gate fired.
-    attr_accessor :reason
-
-    # Link to the relevant documentation page.
-    attr_accessor :documentation_url
-
-    # Deep-link to send the end-user to. For `free_tier_exceeded` and `twitter_passthrough` this is the Zernio billing tab. For `enterprise_required` this is the Zernio enterprise contact page. 
-    attr_accessor :dashboard_url
-
-    attr_accessor :details
+    # The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+    attr_accessor :required_group
 
     class EnumAttributeValidator
       attr_reader :datatype
@@ -59,10 +49,7 @@ module Zernio
       {
         :'error' => :'error',
         :'code' => :'code',
-        :'reason' => :'reason',
-        :'documentation_url' => :'documentation_url',
-        :'dashboard_url' => :'dashboard_url',
-        :'details' => :'details'
+        :'required_group' => :'required_group'
       }
     end
 
@@ -81,10 +68,7 @@ module Zernio
       {
         :'error' => :'String',
         :'code' => :'String',
-        :'reason' => :'String',
-        :'documentation_url' => :'String',
-        :'dashboard_url' => :'String',
-        :'details' => :'InlineObject2Details'
+        :'required_group' => :'String'
       }
     end
 
@@ -112,32 +96,14 @@ module Zernio
 
       if attributes.key?(:'error')
         self.error = attributes[:'error']
-      else
-        self.error = nil
       end
 
       if attributes.key?(:'code')
         self.code = attributes[:'code']
-      else
-        self.code = nil
-      end
-
-      if attributes.key?(:'reason')
-        self.reason = attributes[:'reason']
-      else
-        self.reason = nil
       end
 
-      if attributes.key?(:'documentation_url')
-        self.documentation_url = attributes[:'documentation_url']
-      end
-
-      if attributes.key?(:'dashboard_url')
-        self.dashboard_url = attributes[:'dashboard_url']
-      end
-
-      if attributes.key?(:'details')
-        self.details = attributes[:'details']
+      if attributes.key?(:'required_group')
+        self.required_group = attributes[:'required_group']
       end
     end
 
@@ -146,18 +112,6 @@ module Zernio
     def list_invalid_properties
       warn '[DEPRECATED] the `list_invalid_properties` method is obsolete'
       invalid_properties = Array.new
-      if @error.nil?
-        invalid_properties.push('invalid value for "error", error cannot be nil.')
-      end
-
-      if @code.nil?
-        invalid_properties.push('invalid value for "code", code cannot be nil.')
-      end
-
-      if @reason.nil?
-        invalid_properties.push('invalid value for "reason", reason cannot be nil.')
-      end
-
       invalid_properties
     end
 
@@ -165,30 +119,17 @@ module Zernio
     # @return true if the model is valid
     def valid?
       warn '[DEPRECATED] the `valid?` method is obsolete'
-      return false if @error.nil?
-      return false if @code.nil?
-      code_validator = EnumAttributeValidator.new('String', ["PAYMENT_REQUIRED"])
+      code_validator = EnumAttributeValidator.new('String', ["insufficient_permissions", "unclassified_resource"])
       return false unless code_validator.valid?(@code)
-      return false if @reason.nil?
-      reason_validator = EnumAttributeValidator.new('String', ["free_tier_exceeded", "twitter_passthrough", "enterprise_required"])
-      return false unless reason_validator.valid?(@reason)
+      required_group_validator = EnumAttributeValidator.new('String', ["publishing", "engagement", "messages", "contacts", "analytics", "ads", "telephony", "accounts", "billing", "webhooks"])
+      return false unless required_group_validator.valid?(@required_group)
       true
     end
 
-    # Custom attribute writer method with validation
-    # @param [Object] error Value to be assigned
-    def error=(error)
-      if error.nil?
-        fail ArgumentError, 'error cannot be nil'
-      end
-
-      @error = error
-    end
-
     # Custom attribute writer method checking allowed values (enum).
     # @param [Object] code Object to be assigned
     def code=(code)
-      validator = EnumAttributeValidator.new('String', ["PAYMENT_REQUIRED"])
+      validator = EnumAttributeValidator.new('String', ["insufficient_permissions", "unclassified_resource"])
       unless validator.valid?(code)
         fail ArgumentError, "invalid value for \"code\", must be one of #{validator.allowable_values}."
       end
@@ -196,13 +137,13 @@ module Zernio
     end
 
     # Custom attribute writer method checking allowed values (enum).
-    # @param [Object] reason Object to be assigned
-    def reason=(reason)
-      validator = EnumAttributeValidator.new('String', ["free_tier_exceeded", "twitter_passthrough", "enterprise_required"])
-      unless validator.valid?(reason)
-        fail ArgumentError, "invalid value for \"reason\", must be one of #{validator.allowable_values}."
+    # @param [Object] required_group Object to be assigned
+    def required_group=(required_group)
+      validator = EnumAttributeValidator.new('String', ["publishing", "engagement", "messages", "contacts", "analytics", "ads", "telephony", "accounts", "billing", "webhooks"])
+      unless validator.valid?(required_group)
+        fail ArgumentError, "invalid value for \"required_group\", must be one of #{validator.allowable_values}."
       end
-      @reason = reason
+      @required_group = required_group
     end
 
     # Checks equality by comparing each attribute.
@@ -212,10 +153,7 @@ module Zernio
       self.class == o.class &&
           error == o.error &&
           code == o.code &&
-          reason == o.reason &&
-          documentation_url == o.documentation_url &&
-          dashboard_url == o.dashboard_url &&
-          details == o.details
+          required_group == o.required_group
     end
 
     # @see the `==` method
@@ -227,7 +165,7 @@ module Zernio
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [error, code, reason, documentation_url, dashboard_url, details].hash
+      [error, code, required_group].hash
     end
 
     # Builds the object from hash