late-sdk 0.0.672 → 0.0.674

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cacfd06d995df70d50a098100eb8a9de74a6427d1dfeb641509589da2e58f672
-  data.tar.gz: c1826f1d7ccd473a444bd3e6af12062d972d37287bb258870ec04ff147bba592
+  metadata.gz: 2f9296d022283f95def0855290cf28b0251301a321d73f7e0363e9c396cb0665
+  data.tar.gz: c7eb3fc66df938994c7f26a83641dbd62816cc88eed971b3edb41512cae6e688
 SHA512:
-  metadata.gz: 652a49fb39d3859a402edbc0791567c642cabe82a2e6bc62973a50132bf39d248584919e7770b0b1ff0689aca9a0a1361b1280a4c50a288a8ee52ad65caf23ae
-  data.tar.gz: 3a954dbdc1d19c66dbf2153f8b8e216840031b6e316cd300f07eda289b6c73e7915a78a46c45300f9fbf784e3d8d72e5ec25a428703fab23302a90c4efabbf14
+  metadata.gz: c12a2ac757d6be0c885422885452b7f15645d66537c19359b9c99cc8d8fef3d3c5062a0d8963a659257396d55e6d84005d3658cc078ee3628aefb53fff0971b2
+  data.tar.gz: a7ce41f8866238b56acc7287a3ccba1c7ef9edebfa89339e730191f24baaa4456a8a2f5a43b12eb858a02a0b7f24d89ad7cb83d02000f4d0cb20e8ea39619e12

data/README.md

@@ -1361,7 +1361,8 @@ Class | Method | HTTP request | Description
  - [Zernio::InlineObject](docs/InlineObject.md)
  - [Zernio::InlineObject1](docs/InlineObject1.md)
  - [Zernio::InlineObject2](docs/InlineObject2.md)
- - [Zernio::InlineObject2Details](docs/InlineObject2Details.md)
+ - [Zernio::InlineObject3](docs/InlineObject3.md)
+ - [Zernio::InlineObject3Details](docs/InlineObject3Details.md)
  - [Zernio::InstagramAccountInsightsResponse](docs/InstagramAccountInsightsResponse.md)
  - [Zernio::InstagramAccountInsightsResponseDateRange](docs/InstagramAccountInsightsResponseDateRange.md)
  - [Zernio::InstagramAccountInsightsResponseMetricsValue](docs/InstagramAccountInsightsResponseMetricsValue.md)

data/docs/ApiKey.md

@@ -13,6 +13,7 @@
 | **scope** | **String** | 'full' grants access to all profiles, 'profiles' restricts to specific profiles | [optional][default to 'full'] |
 | **profile_ids** | [**Array<ApiKeyProfileIdsInner>**](ApiKeyProfileIdsInner.md) | Profiles this key can access (populated with name and color). Only present when scope is 'profiles'. | [optional] |
 | **permission** | **String** | 'read-write' allows all operations, 'read' restricts to GET requests only | [optional][default to 'read-write'] |
+| **disabled_resource_groups** | **Array<String>** | Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. | [optional] |
 
 ## Example
 
@@ -28,7 +29,8 @@ instance = Zernio::ApiKey.new(
   key: null,
   scope: null,
   profile_ids: null,
-  permission: null
+  permission: null,
+  disabled_resource_groups: null
 )
 ```
 

data/docs/ConnectedAppsApi.md

@@ -14,7 +14,7 @@ All URIs are relative to *https://zernio.com/api*
 
 List connected apps
 
-Returns the OAuth clients (AI assistants and MCP connectors) the authenticated user has authorized and that still hold a live token.  Requires a session or a full-scope API key. A profile-scoped API key or an OAuth access token is rejected with 403: an app must not be able to enumerate its sibling authorizations. 
+Returns the OAuth clients (AI assistants and MCP connectors) the authenticated user has authorized and that still hold a live token.  Requires a session or a full-access API key. A profile-scoped API key, a restricted (zrk_) API key, or an OAuth access token is rejected with 403: an app must not be able to enumerate its sibling authorizations, and connected-app management is admin-plane. 
 
 ### Examples
 
@@ -80,7 +80,7 @@ This endpoint does not need any parameter.
 
 Revoke connected app
 
-Ends an app's access: invalidates the client's pending authorization codes and revokes every live token it holds for the authenticated user. Takes effect on the app's next request.  Idempotent while the authorization is still on record: revoking an app that was already revoked returns 200 with `revokedTokens: 0`. 
+Ends an app's access: invalidates the client's pending authorization codes and revokes every live token it holds for the authenticated user. Takes effect on the app's next request.  Idempotent while the authorization is still on record: revoking an app that was already revoked returns 200 with `revokedTokens: 0`.  Requires a session or a full-access API key. A profile-scoped API key, a restricted (zrk_) API key, or an OAuth access token is rejected with 403. 
 
 ### Examples
 

data/docs/CreateApiKeyRequest.md

@@ -9,6 +9,7 @@
 | **scope** | **String** | 'full' grants access to all profiles (default), 'profiles' restricts to specific profiles | [optional][default to 'full'] |
 | **profile_ids** | **Array<String>** | Profile IDs this key can access. Required when scope is 'profiles'. | [optional] |
 | **permission** | **String** | 'read-write' allows all operations (default), 'read' restricts to GET requests only | [optional][default to 'read-write'] |
+| **disabled_resource_groups** | **Array<String>** | Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. | [optional] |
 
 ## Example
 
@@ -20,7 +21,8 @@ instance = Zernio::CreateApiKeyRequest.new(
   expires_in: null,
   scope: null,
   profile_ids: null,
-  permission: null
+  permission: null,
+  disabled_resource_groups: null
 )
 ```
 

data/docs/InlineObject2.md

@@ -4,12 +4,9 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **error** | **String** | Human-readable error message suitable for end-user display. |  |
-| **code** | **String** | Machine-readable error code. Stable across versions. |  |
-| **reason** | **String** | Discriminator for which gate fired. |  |
-| **documentation_url** | **String** | Link to the relevant documentation page. | [optional] |
-| **dashboard_url** | **String** | Deep-link to send the end-user to. For `free_tier_exceeded` and `twitter_passthrough` this is the Zernio billing tab. For `enterprise_required` this is the Zernio enterprise contact page.  | [optional] |
-| **details** | [**InlineObject2Details**](InlineObject2Details.md) |  | [optional] |
+| **error** | **String** |  | [optional] |
+| **code** | **String** |  | [optional] |
+| **required_group** | **String** | The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials. | [optional] |
 
 ## Example
 
@@ -17,12 +14,9 @@
 require 'zernio-sdk'
 
 instance = Zernio::InlineObject2.new(
-  error: X (Twitter) requires a payment method due to API pass-through costs. Add a payment method to connect an X account.,
+  error: This API key has the 'messages' resource group disabled. GET /api/v1/inbox/conversations requires it. Create a key with 'messages' enabled in the dashboard API keys tab.,
   code: null,
-  reason: null,
-  documentation_url: https://docs.zernio.com/billing/payment-method-required,
-  dashboard_url: https://zernio.com/dashboard?tab=billing,
-  details: null
+  required_group: null
 )
 ```
 

data/docs/InlineObject3.md

@@ -0,0 +1,28 @@
+# Zernio::InlineObject3
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **error** | **String** | Human-readable error message suitable for end-user display. |  |
+| **code** | **String** | Machine-readable error code. Stable across versions. |  |
+| **reason** | **String** | Discriminator for which gate fired. |  |
+| **documentation_url** | **String** | Link to the relevant documentation page. | [optional] |
+| **dashboard_url** | **String** | Deep-link to send the end-user to. For `free_tier_exceeded` and `twitter_passthrough` this is the Zernio billing tab. For `enterprise_required` this is the Zernio enterprise contact page.  | [optional] |
+| **details** | [**InlineObject3Details**](InlineObject3Details.md) |  | [optional] |
+
+## Example
+
+```ruby
+require 'zernio-sdk'
+
+instance = Zernio::InlineObject3.new(
+  error: X (Twitter) requires a payment method due to API pass-through costs. Add a payment method to connect an X account.,
+  code: null,
+  reason: null,
+  documentation_url: https://docs.zernio.com/billing/payment-method-required,
+  dashboard_url: https://zernio.com/dashboard?tab=billing,
+  details: null
+)
+```
+

data/docs/{InlineObject2Details.md → InlineObject3Details.md}

@@ -1,4 +1,4 @@
-# Zernio::InlineObject2Details
+# Zernio::InlineObject3Details
 
 ## Properties
 
@@ -14,7 +14,7 @@
 ```ruby
 require 'zernio-sdk'
 
-instance = Zernio::InlineObject2Details.new(
+instance = Zernio::InlineObject3Details.new(
   free_tier_account_limit: 2,
   current_account_count: 5,
   has_payment_method: null,

data/docs/InvitesApi.md

@@ -13,7 +13,7 @@ All URIs are relative to *https://zernio.com/api*
 
 Create invite token
 
-Generate a secure invite link to grant team members access to your profiles. Invites expire after 7 days and are single-use. 
+Generate a secure invite link to grant team members access to your profiles. Invites expire after 7 days and are single-use.  Returns 403 when a requested profile is not found or not owned, or when called with a restricted (zrk_) API key: invite management is admin-plane. 
 
 ### Examples
 

data/docs/PlatformTarget.md

@@ -14,6 +14,7 @@
 | **platform_post_id** | **String** | The native post ID on the platform (populated after successful publish) | [optional] |
 | **platform_post_url** | **String** | Public URL of the published post. Included in the response for immediate posts; for scheduled posts, fetch via GET /v1/posts/{postId} after publish time. | [optional] |
 | **published_at** | **Time** | Timestamp when the post was published to this platform | [optional] |
+| **removed_from_platform_at** | **Time** | Set when a post that was successfully published later disappears from the platform (deleted on-platform or taken down by the platform). status stays \"published\" (it reflects the publish outcome); poll this field to detect post-publish removals. Absent while the post is live, and cleared if the post reappears. Detection runs with the analytics sync, so expect up to a few hours of lag. | [optional] |
 | **is_trial_reel** | **Boolean** | Present and true only when this Instagram reel was launched as a Trial through Zernio (created with platformSpecificData.trialParams). Use it to segment trial reels in analytics. Note: Instagram's Graph API exposes no readable trial field, so this reflects creation-time intent only. It indicates the reel STARTED as a trial, not whether or when it graduated. | [optional] |
 | **trial_graduation_strategy** | **String** | Graduation strategy the trial reel was launched with. Present only when isTrialReel is true. | [optional] |
 | **error_message** | **String** | Human-readable error message when status is failed. Contains platform-specific error details explaining why the publish failed. | [optional] |
@@ -36,6 +37,7 @@ instance = Zernio::PlatformTarget.new(
   platform_post_id: 1234567890123456789,
   platform_post_url: https://twitter.com/acmecorp/status/1234567890123456789,
   published_at: null,
+  removed_from_platform_at: null,
   is_trial_reel: null,
   trial_graduation_strategy: null,
   error_message: null,

data/docs/WebhooksApi.md

@@ -18,7 +18,7 @@ All URIs are relative to *https://zernio.com/api*
 
 Create webhook
 
-Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures. 
+Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403. Note that the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. 
 
 ### Examples
 
@@ -156,7 +156,7 @@ end
 
 List webhook delivery logs
 
-Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination. 
+Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination.  For a restricted (zrk_) API key, rows for events outside the key's resource groups are omitted (`pagination.total` may over-count), and an `event` filter naming such an event is rejected with 403. 
 
 ### Examples
 
@@ -372,7 +372,7 @@ end
 
 Update webhook
 
-Update an existing webhook configuration. All fields except `_id` are optional; only provided fields will be updated.  When provided, `name` must be 1-50 characters, `url` must be a valid URL, and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures. 
+Update an existing webhook configuration. All fields except `_id` are optional; only provided fields will be updated.  When provided, `name` must be 1-50 characters, `url` must be a valid URL, and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only set `events` to events whose resource group the key holds; an event outside the key's groups is rejected with 403. 
 
 ### Examples
 

data/lib/zernio-sdk/api/connected_apps_api.rb

@@ -20,7 +20,7 @@ module Zernio
       @api_client = api_client
     end
     # List connected apps
-    # Returns the OAuth clients (AI assistants and MCP connectors) the authenticated user has authorized and that still hold a live token.  Requires a session or a full-scope API key. A profile-scoped API key or an OAuth access token is rejected with 403: an app must not be able to enumerate its sibling authorizations. 
+    # Returns the OAuth clients (AI assistants and MCP connectors) the authenticated user has authorized and that still hold a live token.  Requires a session or a full-access API key. A profile-scoped API key, a restricted (zrk_) API key, or an OAuth access token is rejected with 403: an app must not be able to enumerate its sibling authorizations, and connected-app management is admin-plane. 
     # @param [Hash] opts the optional parameters
     # @return [ListConnectedApps200Response]
     def list_connected_apps(opts = {})
@@ -29,7 +29,7 @@ module Zernio
     end
 
     # List connected apps
-    # Returns the OAuth clients (AI assistants and MCP connectors) the authenticated user has authorized and that still hold a live token.  Requires a session or a full-scope API key. A profile-scoped API key or an OAuth access token is rejected with 403: an app must not be able to enumerate its sibling authorizations. 
+    # Returns the OAuth clients (AI assistants and MCP connectors) the authenticated user has authorized and that still hold a live token.  Requires a session or a full-access API key. A profile-scoped API key, a restricted (zrk_) API key, or an OAuth access token is rejected with 403: an app must not be able to enumerate its sibling authorizations, and connected-app management is admin-plane. 
     # @param [Hash] opts the optional parameters
     # @return [Array<(ListConnectedApps200Response, Integer, Hash)>] ListConnectedApps200Response data, response status code and response headers
     def list_connected_apps_with_http_info(opts = {})
@@ -77,7 +77,7 @@ module Zernio
     end
 
     # Revoke connected app
-    # Ends an app's access: invalidates the client's pending authorization codes and revokes every live token it holds for the authenticated user. Takes effect on the app's next request.  Idempotent while the authorization is still on record: revoking an app that was already revoked returns 200 with `revokedTokens: 0`. 
+    # Ends an app's access: invalidates the client's pending authorization codes and revokes every live token it holds for the authenticated user. Takes effect on the app's next request.  Idempotent while the authorization is still on record: revoking an app that was already revoked returns 200 with `revokedTokens: 0`.  Requires a session or a full-access API key. A profile-scoped API key, a restricted (zrk_) API key, or an OAuth access token is rejected with 403. 
     # @param client_id [String] OAuth client id, as returned by GET /v1/me/connected-apps.
     # @param [Hash] opts the optional parameters
     # @return [RevokeConnectedApp200Response]
@@ -87,7 +87,7 @@ module Zernio
     end
 
     # Revoke connected app
-    # Ends an app&#39;s access: invalidates the client&#39;s pending authorization codes and revokes every live token it holds for the authenticated user. Takes effect on the app&#39;s next request.  Idempotent while the authorization is still on record: revoking an app that was already revoked returns 200 with &#x60;revokedTokens: 0&#x60;. 
+    # Ends an app&#39;s access: invalidates the client&#39;s pending authorization codes and revokes every live token it holds for the authenticated user. Takes effect on the app&#39;s next request.  Idempotent while the authorization is still on record: revoking an app that was already revoked returns 200 with &#x60;revokedTokens: 0&#x60;.  Requires a session or a full-access API key. A profile-scoped API key, a restricted (zrk_) API key, or an OAuth access token is rejected with 403. 
     # @param client_id [String] OAuth client id, as returned by GET /v1/me/connected-apps.
     # @param [Hash] opts the optional parameters
     # @return [Array<(RevokeConnectedApp200Response, Integer, Hash)>] RevokeConnectedApp200Response data, response status code and response headers

data/lib/zernio-sdk/api/invites_api.rb

@@ -20,7 +20,7 @@ module Zernio
       @api_client = api_client
     end
     # Create invite token
-    # Generate a secure invite link to grant team members access to your profiles. Invites expire after 7 days and are single-use. 
+    # Generate a secure invite link to grant team members access to your profiles. Invites expire after 7 days and are single-use.  Returns 403 when a requested profile is not found or not owned, or when called with a restricted (zrk_) API key: invite management is admin-plane. 
     # @param create_invite_token_request [CreateInviteTokenRequest] 
     # @param [Hash] opts the optional parameters
     # @return [CreateInviteToken201Response]
@@ -30,7 +30,7 @@ module Zernio
     end
 
     # Create invite token
-    # Generate a secure invite link to grant team members access to your profiles. Invites expire after 7 days and are single-use. 
+    # Generate a secure invite link to grant team members access to your profiles. Invites expire after 7 days and are single-use.  Returns 403 when a requested profile is not found or not owned, or when called with a restricted (zrk_) API key: invite management is admin-plane. 
     # @param create_invite_token_request [CreateInviteTokenRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(CreateInviteToken201Response, Integer, Hash)>] CreateInviteToken201Response data, response status code and response headers

data/lib/zernio-sdk/api/webhooks_api.rb

@@ -20,7 +20,7 @@ module Zernio
       @api_client = api_client
     end
     # Create webhook
-    # Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures. 
+    # Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403. Note that the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. 
     # @param create_webhook_settings_request [CreateWebhookSettingsRequest] 
     # @param [Hash] opts the optional parameters
     # @return [UpdateWebhookSettings200Response]
@@ -30,7 +30,7 @@ module Zernio
     end
 
     # Create webhook
-    # Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures. 
+    # Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403. Note that the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. 
     # @param create_webhook_settings_request [CreateWebhookSettingsRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(UpdateWebhookSettings200Response, Integer, Hash)>] UpdateWebhookSettings200Response data, response status code and response headers
@@ -152,7 +152,7 @@ module Zernio
     end
 
     # List webhook delivery logs
-    # Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination. 
+    # Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination.  For a restricted (zrk_) API key, rows for events outside the key's resource groups are omitted (`pagination.total` may over-count), and an `event` filter naming such an event is rejected with 403. 
     # @param [Hash] opts the optional parameters
     # @option opts [Integer] :limit Maximum number of logs to return (default to 50)
     # @option opts [Integer] :skip Number of logs to skip (offset-based pagination) (default to 0)
@@ -167,7 +167,7 @@ module Zernio
     end
 
     # List webhook delivery logs
-    # Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination. 
+    # Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination.  For a restricted (zrk_) API key, rows for events outside the key&#39;s resource groups are omitted (&#x60;pagination.total&#x60; may over-count), and an &#x60;event&#x60; filter naming such an event is rejected with 403. 
     # @param [Hash] opts the optional parameters
     # @option opts [Integer] :limit Maximum number of logs to return (default to 50)
     # @option opts [Integer] :skip Number of logs to skip (offset-based pagination) (default to 0)
@@ -396,7 +396,7 @@ module Zernio
     end
 
     # Update webhook
-    # Update an existing webhook configuration. All fields except `_id` are optional; only provided fields will be updated.  When provided, `name` must be 1-50 characters, `url` must be a valid URL, and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures. 
+    # Update an existing webhook configuration. All fields except `_id` are optional; only provided fields will be updated.  When provided, `name` must be 1-50 characters, `url` must be a valid URL, and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only set `events` to events whose resource group the key holds; an event outside the key's groups is rejected with 403. 
     # @param update_webhook_settings_request [UpdateWebhookSettingsRequest] 
     # @param [Hash] opts the optional parameters
     # @return [UpdateWebhookSettings200Response]
@@ -406,7 +406,7 @@ module Zernio
     end
 
     # Update webhook
-    # Update an existing webhook configuration. All fields except &#x60;_id&#x60; are optional; only provided fields will be updated.  When provided, &#x60;name&#x60; must be 1-50 characters, &#x60;url&#x60; must be a valid URL, and &#x60;events&#x60; must contain at least one event. Whitespace is trimmed from &#x60;url&#x60; before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures. 
+    # Update an existing webhook configuration. All fields except &#x60;_id&#x60; are optional; only provided fields will be updated.  When provided, &#x60;name&#x60; must be 1-50 characters, &#x60;url&#x60; must be a valid URL, and &#x60;events&#x60; must contain at least one event. Whitespace is trimmed from &#x60;url&#x60; before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only set &#x60;events&#x60; to events whose resource group the key holds; an event outside the key&#39;s groups is rejected with 403. 
     # @param update_webhook_settings_request [UpdateWebhookSettingsRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(UpdateWebhookSettings200Response, Integer, Hash)>] UpdateWebhookSettings200Response data, response status code and response headers

data/lib/zernio-sdk/models/api_key.rb

@@ -37,6 +37,9 @@ module Zernio
     # 'read-write' allows all operations, 'read' restricts to GET requests only
     attr_accessor :permission
 
+    # Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+    attr_accessor :disabled_resource_groups
+
     class EnumAttributeValidator
       attr_reader :datatype
       attr_reader :allowable_values
@@ -70,7 +73,8 @@ module Zernio
         :'key' => :'key',
         :'scope' => :'scope',
         :'profile_ids' => :'profileIds',
-        :'permission' => :'permission'
+        :'permission' => :'permission',
+        :'disabled_resource_groups' => :'disabledResourceGroups'
       }
     end
 
@@ -95,7 +99,8 @@ module Zernio
         :'key' => :'String',
         :'scope' => :'String',
         :'profile_ids' => :'Array<ApiKeyProfileIdsInner>',
-        :'permission' => :'String'
+        :'permission' => :'String',
+        :'disabled_resource_groups' => :'Array<String>'
       }
     end
 
@@ -162,6 +167,12 @@ module Zernio
       else
         self.permission = 'read-write'
       end
+
+      if attributes.key?(:'disabled_resource_groups')
+        if (value = attributes[:'disabled_resource_groups']).is_a?(Array)
+          self.disabled_resource_groups = value
+        end
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -216,7 +227,8 @@ module Zernio
           key == o.key &&
           scope == o.scope &&
           profile_ids == o.profile_ids &&
-          permission == o.permission
+          permission == o.permission &&
+          disabled_resource_groups == o.disabled_resource_groups
     end
 
     # @see the `==` method
@@ -228,7 +240,7 @@ module Zernio
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [id, name, key_preview, expires_at, created_at, key, scope, profile_ids, permission].hash
+      [id, name, key_preview, expires_at, created_at, key, scope, profile_ids, permission, disabled_resource_groups].hash
     end
 
     # Builds the object from hash

data/lib/zernio-sdk/models/create_api_key_request.rb

@@ -29,6 +29,9 @@ module Zernio
     # 'read-write' allows all operations (default), 'read' restricts to GET requests only
     attr_accessor :permission
 
+    # Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+    attr_accessor :disabled_resource_groups
+
     class EnumAttributeValidator
       attr_reader :datatype
       attr_reader :allowable_values
@@ -58,7 +61,8 @@ module Zernio
         :'expires_in' => :'expiresIn',
         :'scope' => :'scope',
         :'profile_ids' => :'profileIds',
-        :'permission' => :'permission'
+        :'permission' => :'permission',
+        :'disabled_resource_groups' => :'disabledResourceGroups'
       }
     end
 
@@ -79,7 +83,8 @@ module Zernio
         :'expires_in' => :'Integer',
         :'scope' => :'String',
         :'profile_ids' => :'Array<String>',
-        :'permission' => :'String'
+        :'permission' => :'String',
+        :'disabled_resource_groups' => :'Array<String>'
       }
     end
 
@@ -132,6 +137,12 @@ module Zernio
       else
         self.permission = 'read-write'
       end
+
+      if attributes.key?(:'disabled_resource_groups')
+        if (value = attributes[:'disabled_resource_groups']).is_a?(Array)
+          self.disabled_resource_groups = value
+        end
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -197,7 +208,8 @@ module Zernio
           expires_in == o.expires_in &&
           scope == o.scope &&
           profile_ids == o.profile_ids &&
-          permission == o.permission
+          permission == o.permission &&
+          disabled_resource_groups == o.disabled_resource_groups
     end
 
     # @see the `==` method
@@ -209,7 +221,7 @@ module Zernio
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [name, expires_in, scope, profile_ids, permission].hash
+      [name, expires_in, scope, profile_ids, permission, disabled_resource_groups].hash
     end
 
     # Builds the object from hash

data/lib/zernio-sdk/models/inline_object2.rb

@@ -15,22 +15,12 @@ require 'time'
 
 module Zernio
   class InlineObject2 < ApiModelBase
-    # Human-readable error message suitable for end-user display.
     attr_accessor :error
 
-    # Machine-readable error code. Stable across versions.
     attr_accessor :code
 
-    # Discriminator for which gate fired.
-    attr_accessor :reason
-
-    # Link to the relevant documentation page.
-    attr_accessor :documentation_url
-
-    # Deep-link to send the end-user to. For `free_tier_exceeded` and `twitter_passthrough` this is the Zernio billing tab. For `enterprise_required` this is the Zernio enterprise contact page. 
-    attr_accessor :dashboard_url
-
-    attr_accessor :details
+    # The resource group the key needs for this operation. Absent on admin-plane and unclassified-path denials.
+    attr_accessor :required_group
 
     class EnumAttributeValidator
       attr_reader :datatype
@@ -59,10 +49,7 @@ module Zernio
       {
         :'error' => :'error',
         :'code' => :'code',
-        :'reason' => :'reason',
-        :'documentation_url' => :'documentation_url',
-        :'dashboard_url' => :'dashboard_url',
-        :'details' => :'details'
+        :'required_group' => :'required_group'
       }
     end
 
@@ -81,10 +68,7 @@ module Zernio
       {
         :'error' => :'String',
         :'code' => :'String',
-        :'reason' => :'String',
-        :'documentation_url' => :'String',
-        :'dashboard_url' => :'String',
-        :'details' => :'InlineObject2Details'
+        :'required_group' => :'String'
       }
     end
 
@@ -112,32 +96,14 @@ module Zernio
 
       if attributes.key?(:'error')
         self.error = attributes[:'error']
-      else
-        self.error = nil
       end
 
       if attributes.key?(:'code')
         self.code = attributes[:'code']
-      else
-        self.code = nil
-      end
-
-      if attributes.key?(:'reason')
-        self.reason = attributes[:'reason']
-      else
-        self.reason = nil
       end
 
-      if attributes.key?(:'documentation_url')
-        self.documentation_url = attributes[:'documentation_url']
-      end
-
-      if attributes.key?(:'dashboard_url')
-        self.dashboard_url = attributes[:'dashboard_url']
-      end
-
-      if attributes.key?(:'details')
-        self.details = attributes[:'details']
+      if attributes.key?(:'required_group')
+        self.required_group = attributes[:'required_group']
       end
     end
 
@@ -146,18 +112,6 @@ module Zernio
     def list_invalid_properties
       warn '[DEPRECATED] the `list_invalid_properties` method is obsolete'
       invalid_properties = Array.new
-      if @error.nil?
-        invalid_properties.push('invalid value for "error", error cannot be nil.')
-      end
-
-      if @code.nil?
-        invalid_properties.push('invalid value for "code", code cannot be nil.')
-      end
-
-      if @reason.nil?
-        invalid_properties.push('invalid value for "reason", reason cannot be nil.')
-      end
-
       invalid_properties
     end
 
@@ -165,30 +119,17 @@ module Zernio
     # @return true if the model is valid
     def valid?
       warn '[DEPRECATED] the `valid?` method is obsolete'
-      return false if @error.nil?
-      return false if @code.nil?
-      code_validator = EnumAttributeValidator.new('String', ["PAYMENT_REQUIRED"])
+      code_validator = EnumAttributeValidator.new('String', ["insufficient_permissions", "unclassified_resource"])
       return false unless code_validator.valid?(@code)
-      return false if @reason.nil?
-      reason_validator = EnumAttributeValidator.new('String', ["free_tier_exceeded", "twitter_passthrough", "enterprise_required"])
-      return false unless reason_validator.valid?(@reason)
+      required_group_validator = EnumAttributeValidator.new('String', ["publishing", "engagement", "messages", "contacts", "analytics", "ads", "telephony", "accounts", "billing", "webhooks"])
+      return false unless required_group_validator.valid?(@required_group)
       true
     end
 
-    # Custom attribute writer method with validation
-    # @param [Object] error Value to be assigned
-    def error=(error)
-      if error.nil?
-        fail ArgumentError, 'error cannot be nil'
-      end
-
-      @error = error
-    end
-
     # Custom attribute writer method checking allowed values (enum).
     # @param [Object] code Object to be assigned
     def code=(code)
-      validator = EnumAttributeValidator.new('String', ["PAYMENT_REQUIRED"])
+      validator = EnumAttributeValidator.new('String', ["insufficient_permissions", "unclassified_resource"])
       unless validator.valid?(code)
         fail ArgumentError, "invalid value for \"code\", must be one of #{validator.allowable_values}."
       end
@@ -196,13 +137,13 @@ module Zernio
     end
 
     # Custom attribute writer method checking allowed values (enum).
-    # @param [Object] reason Object to be assigned
-    def reason=(reason)
-      validator = EnumAttributeValidator.new('String', ["free_tier_exceeded", "twitter_passthrough", "enterprise_required"])
-      unless validator.valid?(reason)
-        fail ArgumentError, "invalid value for \"reason\", must be one of #{validator.allowable_values}."
+    # @param [Object] required_group Object to be assigned
+    def required_group=(required_group)
+      validator = EnumAttributeValidator.new('String', ["publishing", "engagement", "messages", "contacts", "analytics", "ads", "telephony", "accounts", "billing", "webhooks"])
+      unless validator.valid?(required_group)
+        fail ArgumentError, "invalid value for \"required_group\", must be one of #{validator.allowable_values}."
       end
-      @reason = reason
+      @required_group = required_group
     end
 
     # Checks equality by comparing each attribute.
@@ -212,10 +153,7 @@ module Zernio
       self.class == o.class &&
           error == o.error &&
           code == o.code &&
-          reason == o.reason &&
-          documentation_url == o.documentation_url &&
-          dashboard_url == o.dashboard_url &&
-          details == o.details
+          required_group == o.required_group
     end
 
     # @see the `==` method
@@ -227,7 +165,7 @@ module Zernio
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [error, code, reason, documentation_url, dashboard_url, details].hash
+      [error, code, required_group].hash
     end
 
     # Builds the object from hash