late-sdk 0.0.674 → 0.0.676

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2f9296d022283f95def0855290cf28b0251301a321d73f7e0363e9c396cb0665
-  data.tar.gz: c7eb3fc66df938994c7f26a83641dbd62816cc88eed971b3edb41512cae6e688
+  metadata.gz: f8213ad5b1bbfc775119fa239570f310749ef52ab9d1d91dd1193f969e87611a
+  data.tar.gz: 1d279b6c16eadb852fd06dcb153a97ad2c7bd4350c7f978fc977f2950ab72c48
 SHA512:
-  metadata.gz: c12a2ac757d6be0c885422885452b7f15645d66537c19359b9c99cc8d8fef3d3c5062a0d8963a659257396d55e6d84005d3658cc078ee3628aefb53fff0971b2
-  data.tar.gz: a7ce41f8866238b56acc7287a3ccba1c7ef9edebfa89339e730191f24baaa4456a8a2f5a43b12eb858a02a0b7f24d89ad7cb83d02000f4d0cb20e8ea39619e12
+  metadata.gz: ade71dde38ef0917cf5def307099b7ad424bf6e64defc1e3cbfa288ed149c0eb2c13b01156a9e2f02f67fc84f36dd819f47427cb136905fe654a6c2cc48cd8db
+  data.tar.gz: 5bc548ae525d00d0d7e5f7f7526eb7b524cea57d20eafba38c136a842b4213d79e880d9d20f744eb0ace33d6792167d9eb2ba048dc6ae3b7c37dd47be301b556

data/docs/ApiKey.md

@@ -13,7 +13,7 @@
 | **scope** | **String** | 'full' grants access to all profiles, 'profiles' restricts to specific profiles | [optional][default to 'full'] |
 | **profile_ids** | [**Array<ApiKeyProfileIdsInner>**](ApiKeyProfileIdsInner.md) | Profiles this key can access (populated with name and color). Only present when scope is 'profiles'. | [optional] |
 | **permission** | **String** | 'read-write' allows all operations, 'read' restricts to GET requests only | [optional][default to 'read-write'] |
-| **disabled_resource_groups** | **Array<String>** | Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. | [optional] |
+| **disabled_resource_groups** | **Array<String>** | Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the key cannot read or send private messages through any API surface, and it cannot create or edit a webhook subscription broader than itself: it cannot subscribe to, test-fire, redeliver, or read delivery logs for message events. Subscriptions created earlier, from the dashboard, or with a full-access key keep delivering whatever their own `disabledResourceGroups` allows, so restricting an existing integration end to end means restricting the subscription too. OAuth connector tokens (AI assistants and MCP clients) resolve against the same registry, but their groups are not settable yet: treat an authorized connector as full access. | [optional] |
 
 ## Example
 

data/docs/CreateApiKeyRequest.md

@@ -9,7 +9,7 @@
 | **scope** | **String** | 'full' grants access to all profiles (default), 'profiles' restricts to specific profiles | [optional][default to 'full'] |
 | **profile_ids** | **Array<String>** | Profile IDs this key can access. Required when scope is 'profiles'. | [optional] |
 | **permission** | **String** | 'read-write' allows all operations (default), 'read' restricts to GET requests only | [optional][default to 'read-write'] |
-| **disabled_resource_groups** | **Array<String>** | Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. | [optional] |
+| **disabled_resource_groups** | **Array<String>** | Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the key cannot read or send private messages through any API surface and cannot create or edit a webhook subscription broader than itself. Subscriptions that already exist are governed by their own `disabledResourceGroups`, not by this key's. OAuth connector tokens resolve against the same registry, but their groups are not settable yet. | [optional] |
 
 ## Example
 

data/docs/CreateWebhookSettingsRequest.md

@@ -10,6 +10,7 @@
 | **events** | **Array<String>** | Events to subscribe to (at least one required) |  |
 | **is_active** | **Boolean** | Enable or disable webhook delivery. Defaults to `true` when omitted. | [optional][default to true] |
 | **custom_headers** | **Hash<String, String>** | Custom headers to include in webhook requests | [optional] |
+| **disabled_resource_groups** | **Array<String>** | Resource groups this subscription does not receive (opt-out denylist). Omit or send an empty array to receive every event in `events`. Listing a group here drops its events before delivery and on every replay path. Set at creation it applies to everything this subscription ever receives; changed later via PUT it applies to events emitted after the change, with a five-minute tail for events already queued (see that operation). When the caller is a restricted (zrk_) key, that key's own disabled groups are unioned into whatever you send here, so a restricted key can never create a subscription wider than itself. | [optional] |
 
 ## Example
 
@@ -22,7 +23,8 @@ instance = Zernio::CreateWebhookSettingsRequest.new(
   secret: null,
   events: null,
   is_active: null,
-  custom_headers: null
+  custom_headers: null,
+  disabled_resource_groups: null
 )
 ```
 

data/docs/UpdateWebhookSettingsRequest.md

@@ -11,6 +11,7 @@
 | **events** | **Array<String>** | Events to subscribe to. Must contain at least one event if provided. | [optional] |
 | **is_active** | **Boolean** | Enable or disable webhook delivery | [optional] |
 | **custom_headers** | **Hash<String, String>** | Custom headers to include in webhook requests | [optional] |
+| **disabled_resource_groups** | **Array<String>** | Replaces the subscription's denylist. Send an empty array to clear it and receive every event in `events` again. Omitting the field leaves the current denylist untouched. Applies to events emitted after the update; already-queued events can still deliver for up to five minutes after they were enqueued. When the caller is a restricted (zrk_) key, that key's own disabled groups are unioned back in either way, so a restricted key can neither clear nor widen a subscription past its own groups. | [optional] |
 
 ## Example
 
@@ -24,7 +25,8 @@ instance = Zernio::UpdateWebhookSettingsRequest.new(
   secret: null,
   events: null,
   is_active: null,
-  custom_headers: null
+  custom_headers: null,
+  disabled_resource_groups: null
 )
 ```
 

data/docs/Webhook.md

@@ -13,6 +13,7 @@
 | **last_fired_at** | **Time** | Timestamp of last successful webhook delivery | [optional] |
 | **failure_count** | **Integer** | Consecutive delivery failures (resets on success, webhook disabled at 10) | [optional] |
 | **custom_headers** | **Hash<String, String>** | Custom headers included in webhook requests | [optional] |
+| **disabled_resource_groups** | **Array<String>** | Resource groups this subscription does not receive (opt-out denylist, same vocabulary and same semantics as the field on API keys). Absent or empty means the subscription receives every event listed in `events`, which is how every subscription created before this field existed behaves. An event whose group is listed here is dropped before delivery even when it is still present in `events`, and the same check runs on every replay path (test fire, redelivery, dead-letter requeue). Editing the denylist applies to every event emitted afterwards; events already queued when the edit landed can still be delivered for up to five minutes after they were enqueued. | [optional] |
 
 ## Example
 
@@ -28,7 +29,8 @@ instance = Zernio::Webhook.new(
   is_active: null,
   last_fired_at: null,
   failure_count: null,
-  custom_headers: null
+  custom_headers: null,
+  disabled_resource_groups: null
 )
 ```
 

data/docs/WebhooksApi.md

@@ -18,7 +18,7 @@ All URIs are relative to *https://zernio.com/api*
 
 Create webhook
 
-Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403. Note that the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. 
+Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403, so a restricted key can never create a subscription broader than itself.  `disabledResourceGroups` restricts the subscription itself, independently of which key or session later reads it. Events in a disabled group are dropped before delivery to this endpoint, on live delivery and on every replay path (test fire, redelivery, dead-letter requeue), even if they are listed in `events`. Omit it to receive everything in `events`, which is how existing subscriptions behave. A restricted key's own disabled groups are always unioned in. 
 
 ### Examples
 
@@ -156,7 +156,7 @@ end
 
 List webhook delivery logs
 
-Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination.  For a restricted (zrk_) API key, rows for events outside the key's resource groups are omitted (`pagination.total` may over-count), and an `event` filter naming such an event is rejected with 403. 
+Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination.  For a restricted (zrk_) API key, rows for events outside the key's resource groups are omitted (`pagination.total` may over-count), and an `event` filter naming such an event is rejected with 403. Events blocked by a subscription's own `disabledResourceGroups` are dropped before delivery, so they produce no log rows for anyone; the exception is the five-minute tail after a denylist change, where an already-queued event can still be delivered and logged. 
 
 ### Examples
 
@@ -303,7 +303,7 @@ This endpoint does not need any parameter.
 
 Send test webhook
 
-Send a test webhook to verify your endpoint is configured correctly. The test payload includes event: \"webhook.test\" to distinguish it from real events. 
+Send a test webhook to verify your endpoint is configured correctly. The test payload includes event: \"webhook.test\" to distinguish it from real events.  `webhook.test` belongs to the `webhooks` resource group, so a key with that group disabled is rejected with 403, as is a test fire on a subscription that lists `webhooks` in its own `disabledResourceGroups` (a 403, not a reported delivery failure). Replays of real events (redelivery, dead-letter requeue) run the same checks as live delivery, against both the key's groups and the subscription's. 
 
 ### Examples
 
@@ -372,7 +372,7 @@ end
 
 Update webhook
 
-Update an existing webhook configuration. All fields except `_id` are optional; only provided fields will be updated.  When provided, `name` must be 1-50 characters, `url` must be a valid URL, and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only set `events` to events whose resource group the key holds; an event outside the key's groups is rejected with 403. 
+Update an existing webhook configuration. All fields except `_id` are optional; only provided fields will be updated.  When provided, `name` must be 1-50 characters, `url` must be a valid URL, and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only set `events` to events whose resource group the key holds; an event outside the key's groups is rejected with 403. It also cannot widen an existing subscription past its own groups.  `disabledResourceGroups` replaces the subscription's own denylist, which applies to delivery regardless of which key or session created it. Send an empty array to clear it. A restricted key's own disabled groups are unioned into the stored value on every update, so repointing a legacy unrestricted subscription with a restricted key also narrows it.  Timing: the new denylist applies to every event emitted after the update. Events already queued for delivery when the update landed were filtered against the previous denylist and can still arrive at your endpoint for up to five minutes after they were enqueued, because the delivery worker trusts a five-minute enqueue-time snapshot before re-checking the subscription. Retries beyond that window, dead-letter replays, test fires, and redeliveries are all checked against the current denylist. 
 
 ### Examples
 

data/lib/zernio-sdk/api/webhooks_api.rb

@@ -20,7 +20,7 @@ module Zernio
       @api_client = api_client
     end
     # Create webhook
-    # Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403. Note that the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. 
+    # Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403, so a restricted key can never create a subscription broader than itself.  `disabledResourceGroups` restricts the subscription itself, independently of which key or session later reads it. Events in a disabled group are dropped before delivery to this endpoint, on live delivery and on every replay path (test fire, redelivery, dead-letter requeue), even if they are listed in `events`. Omit it to receive everything in `events`, which is how existing subscriptions behave. A restricted key's own disabled groups are always unioned in. 
     # @param create_webhook_settings_request [CreateWebhookSettingsRequest] 
     # @param [Hash] opts the optional parameters
     # @return [UpdateWebhookSettings200Response]
@@ -30,7 +30,7 @@ module Zernio
     end
 
     # Create webhook
-    # Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403. Note that the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. 
+    # Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403, so a restricted key can never create a subscription broader than itself.  `disabledResourceGroups` restricts the subscription itself, independently of which key or session later reads it. Events in a disabled group are dropped before delivery to this endpoint, on live delivery and on every replay path (test fire, redelivery, dead-letter requeue), even if they are listed in `events`. Omit it to receive everything in `events`, which is how existing subscriptions behave. A restricted key's own disabled groups are always unioned in. 
     # @param create_webhook_settings_request [CreateWebhookSettingsRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(UpdateWebhookSettings200Response, Integer, Hash)>] UpdateWebhookSettings200Response data, response status code and response headers
@@ -152,7 +152,7 @@ module Zernio
     end
 
     # List webhook delivery logs
-    # Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination.  For a restricted (zrk_) API key, rows for events outside the key's resource groups are omitted (`pagination.total` may over-count), and an `event` filter naming such an event is rejected with 403. 
+    # Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination.  For a restricted (zrk_) API key, rows for events outside the key's resource groups are omitted (`pagination.total` may over-count), and an `event` filter naming such an event is rejected with 403. Events blocked by a subscription's own `disabledResourceGroups` are dropped before delivery, so they produce no log rows for anyone; the exception is the five-minute tail after a denylist change, where an already-queued event can still be delivered and logged. 
     # @param [Hash] opts the optional parameters
     # @option opts [Integer] :limit Maximum number of logs to return (default to 50)
     # @option opts [Integer] :skip Number of logs to skip (offset-based pagination) (default to 0)
@@ -167,7 +167,7 @@ module Zernio
     end
 
     # List webhook delivery logs
-    # Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination.  For a restricted (zrk_) API key, rows for events outside the key&#39;s resource groups are omitted (&#x60;pagination.total&#x60; may over-count), and an &#x60;event&#x60; filter naming such an event is rejected with 403. 
+    # Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination.  For a restricted (zrk_) API key, rows for events outside the key&#39;s resource groups are omitted (&#x60;pagination.total&#x60; may over-count), and an &#x60;event&#x60; filter naming such an event is rejected with 403. Events blocked by a subscription&#39;s own &#x60;disabledResourceGroups&#x60; are dropped before delivery, so they produce no log rows for anyone; the exception is the five-minute tail after a denylist change, where an already-queued event can still be delivered and logged. 
     # @param [Hash] opts the optional parameters
     # @option opts [Integer] :limit Maximum number of logs to return (default to 50)
     # @option opts [Integer] :skip Number of logs to skip (offset-based pagination) (default to 0)
@@ -328,7 +328,7 @@ module Zernio
     end
 
     # Send test webhook
-    # Send a test webhook to verify your endpoint is configured correctly. The test payload includes event: \"webhook.test\" to distinguish it from real events. 
+    # Send a test webhook to verify your endpoint is configured correctly. The test payload includes event: \"webhook.test\" to distinguish it from real events.  `webhook.test` belongs to the `webhooks` resource group, so a key with that group disabled is rejected with 403, as is a test fire on a subscription that lists `webhooks` in its own `disabledResourceGroups` (a 403, not a reported delivery failure). Replays of real events (redelivery, dead-letter requeue) run the same checks as live delivery, against both the key's groups and the subscription's. 
     # @param test_webhook_request [TestWebhookRequest] 
     # @param [Hash] opts the optional parameters
     # @return [UnpublishPost200Response]
@@ -338,7 +338,7 @@ module Zernio
     end
 
     # Send test webhook
-    # Send a test webhook to verify your endpoint is configured correctly. The test payload includes event: \&quot;webhook.test\&quot; to distinguish it from real events. 
+    # Send a test webhook to verify your endpoint is configured correctly. The test payload includes event: \&quot;webhook.test\&quot; to distinguish it from real events.  &#x60;webhook.test&#x60; belongs to the &#x60;webhooks&#x60; resource group, so a key with that group disabled is rejected with 403, as is a test fire on a subscription that lists &#x60;webhooks&#x60; in its own &#x60;disabledResourceGroups&#x60; (a 403, not a reported delivery failure). Replays of real events (redelivery, dead-letter requeue) run the same checks as live delivery, against both the key&#39;s groups and the subscription&#39;s. 
     # @param test_webhook_request [TestWebhookRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(UnpublishPost200Response, Integer, Hash)>] UnpublishPost200Response data, response status code and response headers
@@ -396,7 +396,7 @@ module Zernio
     end
 
     # Update webhook
-    # Update an existing webhook configuration. All fields except `_id` are optional; only provided fields will be updated.  When provided, `name` must be 1-50 characters, `url` must be a valid URL, and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only set `events` to events whose resource group the key holds; an event outside the key's groups is rejected with 403. 
+    # Update an existing webhook configuration. All fields except `_id` are optional; only provided fields will be updated.  When provided, `name` must be 1-50 characters, `url` must be a valid URL, and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only set `events` to events whose resource group the key holds; an event outside the key's groups is rejected with 403. It also cannot widen an existing subscription past its own groups.  `disabledResourceGroups` replaces the subscription's own denylist, which applies to delivery regardless of which key or session created it. Send an empty array to clear it. A restricted key's own disabled groups are unioned into the stored value on every update, so repointing a legacy unrestricted subscription with a restricted key also narrows it.  Timing: the new denylist applies to every event emitted after the update. Events already queued for delivery when the update landed were filtered against the previous denylist and can still arrive at your endpoint for up to five minutes after they were enqueued, because the delivery worker trusts a five-minute enqueue-time snapshot before re-checking the subscription. Retries beyond that window, dead-letter replays, test fires, and redeliveries are all checked against the current denylist. 
     # @param update_webhook_settings_request [UpdateWebhookSettingsRequest] 
     # @param [Hash] opts the optional parameters
     # @return [UpdateWebhookSettings200Response]
@@ -406,7 +406,7 @@ module Zernio
     end
 
     # Update webhook
-    # Update an existing webhook configuration. All fields except &#x60;_id&#x60; are optional; only provided fields will be updated.  When provided, &#x60;name&#x60; must be 1-50 characters, &#x60;url&#x60; must be a valid URL, and &#x60;events&#x60; must contain at least one event. Whitespace is trimmed from &#x60;url&#x60; before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only set &#x60;events&#x60; to events whose resource group the key holds; an event outside the key&#39;s groups is rejected with 403. 
+    # Update an existing webhook configuration. All fields except &#x60;_id&#x60; are optional; only provided fields will be updated.  When provided, &#x60;name&#x60; must be 1-50 characters, &#x60;url&#x60; must be a valid URL, and &#x60;events&#x60; must contain at least one event. Whitespace is trimmed from &#x60;url&#x60; before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only set &#x60;events&#x60; to events whose resource group the key holds; an event outside the key&#39;s groups is rejected with 403. It also cannot widen an existing subscription past its own groups.  &#x60;disabledResourceGroups&#x60; replaces the subscription&#39;s own denylist, which applies to delivery regardless of which key or session created it. Send an empty array to clear it. A restricted key&#39;s own disabled groups are unioned into the stored value on every update, so repointing a legacy unrestricted subscription with a restricted key also narrows it.  Timing: the new denylist applies to every event emitted after the update. Events already queued for delivery when the update landed were filtered against the previous denylist and can still arrive at your endpoint for up to five minutes after they were enqueued, because the delivery worker trusts a five-minute enqueue-time snapshot before re-checking the subscription. Retries beyond that window, dead-letter replays, test fires, and redeliveries are all checked against the current denylist. 
     # @param update_webhook_settings_request [UpdateWebhookSettingsRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(UpdateWebhookSettings200Response, Integer, Hash)>] UpdateWebhookSettings200Response data, response status code and response headers

data/lib/zernio-sdk/models/api_key.rb

@@ -37,7 +37,7 @@ module Zernio
     # 'read-write' allows all operations, 'read' restricts to GET requests only
     attr_accessor :permission
 
-    # Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+    # Resource groups this key can NOT access (opt-out denylist). Absent or empty means legacy full access. A key with any group disabled is a restricted key (zrk_ prefix) and can never manage API keys, invites, or member identity. Each operation's group is published as x-resource-group. With 'messages' disabled, the key cannot read or send private messages through any API surface, and it cannot create or edit a webhook subscription broader than itself: it cannot subscribe to, test-fire, redeliver, or read delivery logs for message events. Subscriptions created earlier, from the dashboard, or with a full-access key keep delivering whatever their own `disabledResourceGroups` allows, so restricting an existing integration end to end means restricting the subscription too. OAuth connector tokens (AI assistants and MCP clients) resolve against the same registry, but their groups are not settable yet: treat an authorized connector as full access.
     attr_accessor :disabled_resource_groups
 
     class EnumAttributeValidator

data/lib/zernio-sdk/models/create_api_key_request.rb

@@ -29,7 +29,7 @@ module Zernio
     # 'read-write' allows all operations (default), 'read' restricts to GET requests only
     attr_accessor :permission
 
-    # Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface.
+    # Resource groups to DISABLE on this key (opt-out denylist). Omit for a legacy full-access key. A key with any group disabled mints with the zrk_ prefix, gets 403 with code=insufficient_permissions and required_group on operations in disabled groups (each operation's group is published as x-resource-group), and can never manage API keys, invites, or member identity. With 'messages' disabled, the key cannot read or send private messages through any API surface and cannot create or edit a webhook subscription broader than itself. Subscriptions that already exist are governed by their own `disabledResourceGroups`, not by this key's. OAuth connector tokens resolve against the same registry, but their groups are not settable yet.
     attr_accessor :disabled_resource_groups
 
     class EnumAttributeValidator

data/lib/zernio-sdk/models/create_webhook_settings_request.rb

@@ -33,6 +33,9 @@ module Zernio
     # Custom headers to include in webhook requests
     attr_accessor :custom_headers
 
+    # Resource groups this subscription does not receive (opt-out denylist). Omit or send an empty array to receive every event in `events`. Listing a group here drops its events before delivery and on every replay path. Set at creation it applies to everything this subscription ever receives; changed later via PUT it applies to events emitted after the change, with a five-minute tail for events already queued (see that operation). When the caller is a restricted (zrk_) key, that key's own disabled groups are unioned into whatever you send here, so a restricted key can never create a subscription wider than itself.
+    attr_accessor :disabled_resource_groups
+
     class EnumAttributeValidator
       attr_reader :datatype
       attr_reader :allowable_values
@@ -63,7 +66,8 @@ module Zernio
         :'secret' => :'secret',
         :'events' => :'events',
         :'is_active' => :'isActive',
-        :'custom_headers' => :'customHeaders'
+        :'custom_headers' => :'customHeaders',
+        :'disabled_resource_groups' => :'disabledResourceGroups'
       }
     end
 
@@ -85,7 +89,8 @@ module Zernio
         :'secret' => :'String',
         :'events' => :'Array<String>',
         :'is_active' => :'Boolean',
-        :'custom_headers' => :'Hash<String, String>'
+        :'custom_headers' => :'Hash<String, String>',
+        :'disabled_resource_groups' => :'Array<String>'
       }
     end
 
@@ -146,6 +151,12 @@ module Zernio
           self.custom_headers = value
         end
       end
+
+      if attributes.key?(:'disabled_resource_groups')
+        if (value = attributes[:'disabled_resource_groups']).is_a?(Array)
+          self.disabled_resource_groups = value
+        end
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -231,7 +242,8 @@ module Zernio
           secret == o.secret &&
           events == o.events &&
           is_active == o.is_active &&
-          custom_headers == o.custom_headers
+          custom_headers == o.custom_headers &&
+          disabled_resource_groups == o.disabled_resource_groups
     end
 
     # @see the `==` method
@@ -243,7 +255,7 @@ module Zernio
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [name, url, secret, events, is_active, custom_headers].hash
+      [name, url, secret, events, is_active, custom_headers, disabled_resource_groups].hash
     end
 
     # Builds the object from hash

data/lib/zernio-sdk/models/update_webhook_settings_request.rb

@@ -36,6 +36,9 @@ module Zernio
     # Custom headers to include in webhook requests
     attr_accessor :custom_headers
 
+    # Replaces the subscription's denylist. Send an empty array to clear it and receive every event in `events` again. Omitting the field leaves the current denylist untouched. Applies to events emitted after the update; already-queued events can still deliver for up to five minutes after they were enqueued. When the caller is a restricted (zrk_) key, that key's own disabled groups are unioned back in either way, so a restricted key can neither clear nor widen a subscription past its own groups.
+    attr_accessor :disabled_resource_groups
+
     class EnumAttributeValidator
       attr_reader :datatype
       attr_reader :allowable_values
@@ -67,7 +70,8 @@ module Zernio
         :'secret' => :'secret',
         :'events' => :'events',
         :'is_active' => :'isActive',
-        :'custom_headers' => :'customHeaders'
+        :'custom_headers' => :'customHeaders',
+        :'disabled_resource_groups' => :'disabledResourceGroups'
       }
     end
 
@@ -90,7 +94,8 @@ module Zernio
         :'secret' => :'String',
         :'events' => :'Array<String>',
         :'is_active' => :'Boolean',
-        :'custom_headers' => :'Hash<String, String>'
+        :'custom_headers' => :'Hash<String, String>',
+        :'disabled_resource_groups' => :'Array<String>'
       }
     end
 
@@ -149,6 +154,12 @@ module Zernio
           self.custom_headers = value
         end
       end
+
+      if attributes.key?(:'disabled_resource_groups')
+        if (value = attributes[:'disabled_resource_groups']).is_a?(Array)
+          self.disabled_resource_groups = value
+        end
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -225,7 +236,8 @@ module Zernio
           secret == o.secret &&
           events == o.events &&
           is_active == o.is_active &&
-          custom_headers == o.custom_headers
+          custom_headers == o.custom_headers &&
+          disabled_resource_groups == o.disabled_resource_groups
     end
 
     # @see the `==` method
@@ -237,7 +249,7 @@ module Zernio
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [_id, name, url, secret, events, is_active, custom_headers].hash
+      [_id, name, url, secret, events, is_active, custom_headers, disabled_resource_groups].hash
     end
 
     # Builds the object from hash

data/lib/zernio-sdk/models/webhook.rb

@@ -43,6 +43,9 @@ module Zernio
     # Custom headers included in webhook requests
     attr_accessor :custom_headers
 
+    # Resource groups this subscription does not receive (opt-out denylist, same vocabulary and same semantics as the field on API keys). Absent or empty means the subscription receives every event listed in `events`, which is how every subscription created before this field existed behaves. An event whose group is listed here is dropped before delivery even when it is still present in `events`, and the same check runs on every replay path (test fire, redelivery, dead-letter requeue). Editing the denylist applies to every event emitted afterwards; events already queued when the edit landed can still be delivered for up to five minutes after they were enqueued.
+    attr_accessor :disabled_resource_groups
+
     class EnumAttributeValidator
       attr_reader :datatype
       attr_reader :allowable_values
@@ -76,7 +79,8 @@ module Zernio
         :'is_active' => :'isActive',
         :'last_fired_at' => :'lastFiredAt',
         :'failure_count' => :'failureCount',
-        :'custom_headers' => :'customHeaders'
+        :'custom_headers' => :'customHeaders',
+        :'disabled_resource_groups' => :'disabledResourceGroups'
       }
     end
 
@@ -101,7 +105,8 @@ module Zernio
         :'is_active' => :'Boolean',
         :'last_fired_at' => :'Time',
         :'failure_count' => :'Integer',
-        :'custom_headers' => :'Hash<String, String>'
+        :'custom_headers' => :'Hash<String, String>',
+        :'disabled_resource_groups' => :'Array<String>'
       }
     end
 
@@ -166,6 +171,12 @@ module Zernio
           self.custom_headers = value
         end
       end
+
+      if attributes.key?(:'disabled_resource_groups')
+        if (value = attributes[:'disabled_resource_groups']).is_a?(Array)
+          self.disabled_resource_groups = value
+        end
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -215,7 +226,8 @@ module Zernio
           is_active == o.is_active &&
           last_fired_at == o.last_fired_at &&
           failure_count == o.failure_count &&
-          custom_headers == o.custom_headers
+          custom_headers == o.custom_headers &&
+          disabled_resource_groups == o.disabled_resource_groups
     end
 
     # @see the `==` method
@@ -227,7 +239,7 @@ module Zernio
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [_id, name, url, secret, events, is_active, last_fired_at, failure_count, custom_headers].hash
+      [_id, name, url, secret, events, is_active, last_fired_at, failure_count, custom_headers, disabled_resource_groups].hash
     end
 
     # Builds the object from hash

data/lib/zernio-sdk/version.rb

@@ -11,5 +11,5 @@ Generator version: 7.19.0
 =end
 
 module Zernio
-  VERSION = '0.0.674'
+  VERSION = '0.0.676'
 end

data/openapi.yaml

@@ -15,10 +15,10 @@ info:
     url: https://zernio.com/icon.png?v=3
   x-long-description: |
     Zernio is the social media API that replaces 16 integrations. Schedule posts, retrieve analytics,
-    manage DMs, comments, and reviews across Twitter/X, Instagram, TikTok, LinkedIn, Facebook,
-    YouTube, Threads, Reddit, Pinterest, Bluesky, Telegram, Google Business, Snapchat, Discord,
-    and Slack, all from a single REST API. Run paid ads on Meta (Facebook + Instagram), Google, TikTok,
-    LinkedIn, Pinterest, X, and OpenAI from the same account.
+    manage DMs, comments, and reviews across Twitter/X, Instagram, WhatsApp, TikTok, LinkedIn,
+    Facebook, YouTube, Threads, Reddit, Pinterest, Bluesky, Telegram, Google Business, Snapchat,
+    Discord, and Slack, all from a single REST API. Run paid ads on Meta (Facebook + Instagram), Google,
+    TikTok, LinkedIn, Pinterest, X, and OpenAI from the same account.
 
     Key features: Unified posting to 16 platforms, ads management on 7 ad networks (via /v1/ads), aggregated analytics, unified inbox (DMs, comments, reviews), webhooks, OAuth connect, queue scheduling, and white-label support for agencies managing unlimited accounts.
 
@@ -226,10 +226,14 @@ tags:
   - name: API Keys
     description: |
       Create, list, and revoke API keys used to authenticate requests.
+
+      Resource groups. A key can opt out of any of the ten groups (publishing, engagement, messages, contacts, analytics, ads, telephony, accounts, billing, webhooks) via `disabledResourceGroups` at creation. Omit the field for a legacy full-access key. A key with any group disabled mints with the `zrk_` prefix, is refused on operations in those groups with 403 `insufficient_permissions` plus `required_group`, and can never manage API keys, invites, connected apps, or member identity. Each operation publishes its group as `x-resource-group`. There is no update endpoint: duplicate the key with different groups and revoke the old one.
   - name: Connected Apps
     description: |
       List and revoke the OAuth clients (AI assistants and MCP connectors) authorized
       on the account.
+
+      Connector tokens resolve against the same resource-group registry as API keys, but there is no way to narrow a connector's groups yet. Treat an authorized connector as full account access and revoke it if that is not what you want.
   - name: Invites
     description: |
       Generate invite tokens for adding members to a team.
@@ -410,6 +414,8 @@ tags:
       Configure webhooks for real-time notifications. Webhooks can be created from the dashboard (Settings → Webhooks) or via this API.
       Events: post.scheduled, post.published, post.failed, post.partial, post.cancelled, post.recycled, post.platform.published, post.platform.failed, post.platform.deleted, post.tiktok.url_resolved, post.external.created, post.external.updated, post.external.deleted, account.connected, account.disconnected, account.ads.initial_sync_completed, message.received, conversation.started, call.received, call.ended, call.failed, call.permission_request, message.sent, message.edited, message.deleted, message.delivered, message.read, message.failed, reaction.received, comment.received, review.new, review.updated, lead.received, ad.status_changed, whatsapp.template.status_updated, whatsapp.automatic_event, whatsapp.number.activated, whatsapp.number.declined, whatsapp.number.action_required, whatsapp.number.verification_required, whatsapp.number.suspended, whatsapp.number.reactivated, whatsapp.number.released, whatsapp.number.kyc_submitted, verification.approved, verification.failed, webhook.test.
       Security: optional HMAC-SHA256 signature in X-Zernio-Signature header. Configure a secret key to enable verification. Custom headers supported.
+
+      Resource groups. Every event belongs to one group: post.* to publishing, message.*, reaction.*, conversation.*, call.* and whatsapp.automatic_event to messages, comment.* and review.* to engagement, lead.* to contacts, ad.* to ads, account.* and whatsapp.template.* to accounts, whatsapp.number.* and verification.* to telephony, webhook.test to webhooks. Two independent controls use that mapping. (1) A restricted (zrk_) API key can only subscribe to, test-fire, redeliver, or read delivery logs for events in the groups it holds, so it can never create a subscription broader than itself. (2) Each subscription carries its own `disabledResourceGroups` denylist: events in a disabled group are dropped before delivery to that endpoint, on live delivery and on every replay path, no matter which key or session created the subscription. Changing that denylist applies to every event emitted after the change; events already queued when it landed can still be delivered for up to five minutes after they were enqueued, because the delivery worker trusts a five-minute enqueue-time snapshot before re-checking. Absent or empty on a subscription means it receives everything it subscribes to, which is the behavior of every subscription created before the field existed.
   - name: Webhook Events
     description: |
       Incoming webhook deliveries sent by Zernio to your configured endpoint URL.
@@ -554,10 +560,11 @@ components:
         member identity), which is never grantable to restricted keys; the
         error reads "Restricted API keys cannot manage API keys, invites, or
         member identity." and the fix is a full-access key or the dashboard,
-        never a new restricted key. (3) On webhook subscription writes and
-        delivery-log reads, a named event maps to a resource group the key
-        does not hold (a no-messages key cannot subscribe to or replay
-        message.* events).
+        never a new restricted key. (3) On webhook subscription writes,
+        delivery-log reads and replays, a named event maps to a resource group
+        the key does not hold, so a restricted key can never create or edit a
+        subscription broader than itself (a no-messages key cannot subscribe
+        to, test-fire, redeliver or read logs for message.* events).
       content:
         application/json:
           schema:
@@ -2239,6 +2246,23 @@ components:
           additionalProperties:
             type: string
           description: Custom headers included in webhook requests
+        disabledResourceGroups:
+          type: array
+          items:
+            type: string
+            enum: [publishing, engagement, messages, contacts, analytics, ads, telephony, accounts, billing, webhooks]
+          description: >-
+            Resource groups this subscription does not receive (opt-out
+            denylist, same vocabulary and same semantics as the field on API
+            keys). Absent or empty means the subscription receives every event
+            listed in `events`, which is how every subscription created before
+            this field existed behaves. An event whose group is listed here is
+            dropped before delivery even when it is still present in `events`,
+            and the same check runs on every replay path (test fire,
+            redelivery, dead-letter requeue). Editing the denylist applies to
+            every event emitted afterwards; events already queued when the edit
+            landed can still be delivered for up to five minutes after they
+            were enqueued.
     WebhookLog:
       type: object
       description: A single webhook delivery attempt recorded by Zernio (30-day retention).
@@ -5832,9 +5856,17 @@ components:
             or empty means legacy full access. A key with any group disabled is
             a restricted key (zrk_ prefix) and can never manage API keys,
             invites, or member identity. Each operation's group is published as
-            x-resource-group. With 'messages' disabled, the KEY cannot access
-            private messages; the ACCOUNT's pre-existing webhook subscriptions
-            are a separate grant surface.
+            x-resource-group. With 'messages' disabled, the key cannot read or
+            send private messages through any API surface, and it cannot create
+            or edit a webhook subscription broader than itself: it cannot
+            subscribe to, test-fire, redeliver, or read delivery logs for
+            message events. Subscriptions created earlier, from the dashboard,
+            or with a full-access key keep delivering whatever their own
+            `disabledResourceGroups` allows, so restricting an existing
+            integration end to end means restricting the subscription too.
+            OAuth connector tokens (AI assistants and MCP clients) resolve
+            against the same registry, but their groups are not settable yet:
+            treat an authorized connector as full access.
     ConnectedApp:
       type: object
       description: |
@@ -15146,9 +15178,13 @@ paths:
                     operations in disabled groups (each operation's group is
                     published as x-resource-group), and can never manage API
                     keys, invites, or member identity. With 'messages'
-                    disabled, the KEY cannot access private messages; the
-                    ACCOUNT's pre-existing webhook subscriptions are a
-                    separate grant surface.
+                    disabled, the key cannot read or send private messages
+                    through any API surface and cannot create or edit a
+                    webhook subscription broader than itself. Subscriptions
+                    that already exist are governed by their own
+                    `disabledResourceGroups`, not by this key's. OAuth
+                    connector tokens resolve against the same registry, but
+                    their groups are not settable yet.
             example:
               name: "No Private Messages Key"
               disabledResourceGroups: ["messages", "contacts", "webhooks"]
@@ -22510,6 +22546,7 @@ paths:
                     isActive: true
                     failureCount: 0
         '401': { $ref: '#/components/responses/Unauthorized' }
+        '403': { $ref: '#/components/responses/ResourceGroupForbidden' }
     post:
       x-resource-group: "webhooks"
       operationId: createWebhookSettings
@@ -22523,9 +22560,16 @@ paths:
         Webhooks are automatically disabled after 10 consecutive delivery failures.
 
         A restricted (zrk_) API key can only subscribe to events whose resource group
-        the key holds; an event outside the key's groups is rejected with 403. Note
-        that the KEY cannot access private messages; the ACCOUNT's pre-existing
-        webhook subscriptions are a separate grant surface.
+        the key holds; an event outside the key's groups is rejected with 403, so a
+        restricted key can never create a subscription broader than itself.
+
+        `disabledResourceGroups` restricts the subscription itself, independently of
+        which key or session later reads it. Events in a disabled group are dropped
+        before delivery to this endpoint, on live delivery and on every replay path
+        (test fire, redelivery, dead-letter requeue), even if they are listed in
+        `events`. Omit it to receive everything in `events`, which is how existing
+        subscriptions behave. A restricted key's own disabled groups are always
+        unioned in.
       security:
         - bearerAuth: []
       requestBody:
@@ -22567,6 +22611,23 @@ paths:
                   additionalProperties:
                     type: string
                   description: Custom headers to include in webhook requests
+                disabledResourceGroups:
+                  type: array
+                  items:
+                    type: string
+                    enum: [publishing, engagement, messages, contacts, analytics, ads, telephony, accounts, billing, webhooks]
+                  description: >-
+                    Resource groups this subscription does not receive
+                    (opt-out denylist). Omit or send an empty array to receive
+                    every event in `events`. Listing a group here drops its
+                    events before delivery and on every replay path. Set at
+                    creation it applies to everything this subscription ever
+                    receives; changed later via PUT it applies to events
+                    emitted after the change, with a five-minute tail for
+                    events already queued (see that operation). When the caller
+                    is a restricted (zrk_) key, that key's own disabled groups
+                    are unioned into whatever you send here, so a restricted
+                    key can never create a subscription wider than itself.
             examples:
               createWebhook:
                 summary: Create webhook with all events
@@ -22576,6 +22637,14 @@ paths:
                   secret: "your-secret-key"
                   events: ["post.scheduled", "post.published", "post.failed", "post.partial", "post.cancelled", "post.recycled", "account.connected", "account.disconnected", "account.ads.initial_sync_completed", "message.received", "message.sent", "message.edited", "message.deleted", "message.delivered", "message.read", "message.failed", "comment.received", "review.new", "review.updated", "ad.status_changed"]
                   isActive: true
+              createWebhookWithoutMessages:
+                summary: Subscription that does not receive private message payloads
+                value:
+                  name: "Publishing Webhook"
+                  url: "https://example.com/webhook"
+                  events: ["post.published", "post.failed", "comment.received"]
+                  disabledResourceGroups: ["messages", "contacts"]
+                  isActive: true
       responses:
         '200':
           description: Webhook created successfully
@@ -22604,6 +22673,21 @@ paths:
 
         A restricted (zrk_) API key can only set `events` to events whose resource
         group the key holds; an event outside the key's groups is rejected with 403.
+        It also cannot widen an existing subscription past its own groups.
+
+        `disabledResourceGroups` replaces the subscription's own denylist, which
+        applies to delivery regardless of which key or session created it. Send an
+        empty array to clear it. A restricted key's own disabled groups are unioned
+        into the stored value on every update, so repointing a legacy unrestricted
+        subscription with a restricted key also narrows it.
+
+        Timing: the new denylist applies to every event emitted after the update.
+        Events already queued for delivery when the update landed were filtered
+        against the previous denylist and can still arrive at your endpoint for up
+        to five minutes after they were enqueued, because the delivery worker
+        trusts a five-minute enqueue-time snapshot before re-checking the
+        subscription. Retries beyond that window, dead-letter replays, test fires,
+        and redeliveries are all checked against the current denylist.
       security:
         - bearerAuth: []
       requestBody:
@@ -22645,6 +22729,21 @@ paths:
                   additionalProperties:
                     type: string
                   description: Custom headers to include in webhook requests
+                disabledResourceGroups:
+                  type: array
+                  items:
+                    type: string
+                    enum: [publishing, engagement, messages, contacts, analytics, ads, telephony, accounts, billing, webhooks]
+                  description: >-
+                    Replaces the subscription's denylist. Send an empty array
+                    to clear it and receive every event in `events` again.
+                    Omitting the field leaves the current denylist untouched.
+                    Applies to events emitted after the update; already-queued
+                    events can still deliver for up to five minutes after they
+                    were enqueued. When the caller is a restricted (zrk_) key,
+                    that key's own disabled groups are unioned back in either
+                    way, so a restricted key can neither clear nor widen a
+                    subscription past its own groups.
             examples:
               updateWebhook:
                 summary: Update webhook URL and events
@@ -22698,6 +22797,7 @@ paths:
                   success: { type: boolean }
         '400': { description: Webhook ID required }
         '401': { $ref: '#/components/responses/Unauthorized' }
+        '403': { $ref: '#/components/responses/ResourceGroupForbidden' }
 
   /v1/webhooks/logs:
     get:
@@ -22712,7 +22812,10 @@ paths:
 
         For a restricted (zrk_) API key, rows for events outside the key's resource
         groups are omitted (`pagination.total` may over-count), and an `event` filter
-        naming such an event is rejected with 403.
+        naming such an event is rejected with 403. Events blocked by a subscription's
+        own `disabledResourceGroups` are dropped before delivery, so they produce no
+        log rows for anyone; the exception is the five-minute tail after a denylist
+        change, where an already-queued event can still be delivered and logged.
       security:
         - bearerAuth: []
       parameters:
@@ -22801,6 +22904,13 @@ paths:
       summary: Send test webhook
       description: |
         Send a test webhook to verify your endpoint is configured correctly. The test payload includes event: "webhook.test" to distinguish it from real events.
+
+        `webhook.test` belongs to the `webhooks` resource group, so a key with that
+        group disabled is rejected with 403, as is a test fire on a subscription that
+        lists `webhooks` in its own `disabledResourceGroups` (a 403, not a reported
+        delivery failure). Replays of real events (redelivery, dead-letter requeue) run
+        the same checks as live delivery, against both the key's groups and the
+        subscription's.
       security:
         - bearerAuth: []
       requestBody:
@@ -22832,6 +22942,7 @@ paths:
                 message: "Test webhook sent successfully"
         '400': { description: Webhook ID required }
         '401': { $ref: '#/components/responses/Unauthorized' }
+        '403': { $ref: '#/components/responses/ResourceGroupForbidden' }
         '404': { description: Webhook not found }
         '500':
           description: Test webhook failed to deliver

data/spec/api/webhooks_api_spec.rb

@@ -34,7 +34,7 @@ describe 'WebhooksApi' do
 
   # unit tests for create_webhook_settings
   # Create webhook
-  # Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403. Note that the KEY cannot access private messages; the ACCOUNT's pre-existing webhook subscriptions are a separate grant surface. 
+  # Create a new webhook configuration. Maximum 50 webhooks per user.  `name`, `url` and `events` are required. `url` must be a valid URL and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403, so a restricted key can never create a subscription broader than itself.  `disabledResourceGroups` restricts the subscription itself, independently of which key or session later reads it. Events in a disabled group are dropped before delivery to this endpoint, on live delivery and on every replay path (test fire, redelivery, dead-letter requeue), even if they are listed in `events`. Omit it to receive everything in `events`, which is how existing subscriptions behave. A restricted key's own disabled groups are always unioned in. 
   # @param create_webhook_settings_request 
   # @param [Hash] opts the optional parameters
   # @return [UpdateWebhookSettings200Response]
@@ -58,7 +58,7 @@ describe 'WebhooksApi' do
 
   # unit tests for get_webhook_logs
   # List webhook delivery logs
-  # Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination.  For a restricted (zrk_) API key, rows for events outside the key's resource groups are omitted (`pagination.total` may over-count), and an `event` filter naming such an event is rejected with 403. 
+  # Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination.  For a restricted (zrk_) API key, rows for events outside the key's resource groups are omitted (`pagination.total` may over-count), and an `event` filter naming such an event is rejected with 403. Events blocked by a subscription's own `disabledResourceGroups` are dropped before delivery, so they produce no log rows for anyone; the exception is the five-minute tail after a denylist change, where an already-queued event can still be delivered and logged. 
   # @param [Hash] opts the optional parameters
   # @option opts [Integer] :limit Maximum number of logs to return
   # @option opts [Integer] :skip Number of logs to skip (offset-based pagination)
@@ -86,7 +86,7 @@ describe 'WebhooksApi' do
 
   # unit tests for test_webhook
   # Send test webhook
-  # Send a test webhook to verify your endpoint is configured correctly. The test payload includes event: \"webhook.test\" to distinguish it from real events. 
+  # Send a test webhook to verify your endpoint is configured correctly. The test payload includes event: \"webhook.test\" to distinguish it from real events.  `webhook.test` belongs to the `webhooks` resource group, so a key with that group disabled is rejected with 403, as is a test fire on a subscription that lists `webhooks` in its own `disabledResourceGroups` (a 403, not a reported delivery failure). Replays of real events (redelivery, dead-letter requeue) run the same checks as live delivery, against both the key's groups and the subscription's. 
   # @param test_webhook_request 
   # @param [Hash] opts the optional parameters
   # @return [UnpublishPost200Response]
@@ -98,7 +98,7 @@ describe 'WebhooksApi' do
 
   # unit tests for update_webhook_settings
   # Update webhook
-  # Update an existing webhook configuration. All fields except `_id` are optional; only provided fields will be updated.  When provided, `name` must be 1-50 characters, `url` must be a valid URL, and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only set `events` to events whose resource group the key holds; an event outside the key's groups is rejected with 403. 
+  # Update an existing webhook configuration. All fields except `_id` are optional; only provided fields will be updated.  When provided, `name` must be 1-50 characters, `url` must be a valid URL, and `events` must contain at least one event. Whitespace is trimmed from `url` before validation.  Webhooks are automatically disabled after 10 consecutive delivery failures.  A restricted (zrk_) API key can only set `events` to events whose resource group the key holds; an event outside the key's groups is rejected with 403. It also cannot widen an existing subscription past its own groups.  `disabledResourceGroups` replaces the subscription's own denylist, which applies to delivery regardless of which key or session created it. Send an empty array to clear it. A restricted key's own disabled groups are unioned into the stored value on every update, so repointing a legacy unrestricted subscription with a restricted key also narrows it.  Timing: the new denylist applies to every event emitted after the update. Events already queued for delivery when the update landed were filtered against the previous denylist and can still arrive at your endpoint for up to five minutes after they were enqueued, because the delivery worker trusts a five-minute enqueue-time snapshot before re-checking the subscription. Retries beyond that window, dead-letter replays, test fires, and redeliveries are all checked against the current denylist. 
   # @param update_webhook_settings_request 
   # @param [Hash] opts the optional parameters
   # @return [UpdateWebhookSettings200Response]

data/spec/models/create_webhook_settings_request_spec.rb

@@ -67,4 +67,14 @@ describe Zernio::CreateWebhookSettingsRequest do
     end
   end
 
+  describe 'test attribute "disabled_resource_groups"' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+      # validator = Petstore::EnumTest::EnumAttributeValidator.new('Array<String>', ["publishing", "engagement", "messages", "contacts", "analytics", "ads", "telephony", "accounts", "billing", "webhooks"])
+      # validator.allowable_values.each do |value|
+      #   expect { instance.disabled_resource_groups = value }.not_to raise_error
+      # end
+    end
+  end
+
 end

data/spec/models/update_webhook_settings_request_spec.rb

@@ -73,4 +73,14 @@ describe Zernio::UpdateWebhookSettingsRequest do
     end
   end
 
+  describe 'test attribute "disabled_resource_groups"' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+      # validator = Petstore::EnumTest::EnumAttributeValidator.new('Array<String>', ["publishing", "engagement", "messages", "contacts", "analytics", "ads", "telephony", "accounts", "billing", "webhooks"])
+      # validator.allowable_values.each do |value|
+      #   expect { instance.disabled_resource_groups = value }.not_to raise_error
+      # end
+    end
+  end
+
 end

data/spec/models/webhook_spec.rb

@@ -85,4 +85,14 @@ describe Zernio::Webhook do
     end
   end
 
+  describe 'test attribute "disabled_resource_groups"' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+      # validator = Petstore::EnumTest::EnumAttributeValidator.new('Array<String>', ["publishing", "engagement", "messages", "contacts", "analytics", "ads", "telephony", "accounts", "billing", "webhooks"])
+      # validator.allowable_values.each do |value|
+      #   expect { instance.disabled_resource_groups = value }.not_to raise_error
+      # end
+    end
+  end
+
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: late-sdk
 version: !ruby/object:Gem::Version
-  version: 0.0.674
+  version: 0.0.676
 platform: ruby
 authors:
 - OpenAPI-Generator
@@ -4985,7 +4985,7 @@ files:
 - spec/models/you_tube_video_retention_response_retention_curve_inner_spec.rb
 - spec/models/you_tube_video_retention_response_spec.rb
 - spec/spec_helper.rb
-- zernio-sdk-0.0.674.gem
+- zernio-sdk-0.0.676.gem
 - zernio-sdk.gemspec
 homepage: https://openapi-generator.tech
 licenses: