RubyGems - ory-client - Versions diffs - 1.22.62 → 1.22.64 - Mend

ory-client 1.22.62 → 1.22.64

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (924) hide show

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5f2e095872adf11a7d18442fa673f50d15053e3ff74142b397d247439278a88c
-  data.tar.gz: d1781264f3238a911054345c9b7eb752ac47c431cb476ae898be95f0c4432d6a
+  metadata.gz: fe23dc2241e92552911e6d05edb1c1f24512f262c4d9652a7d9a2cf90ea82de4
+  data.tar.gz: 3df07a2892af9b88d7e9a2bac713278f6dff8c22db4611c6f08f21844c96840a
 SHA512:
-  metadata.gz: 93e97bf29ccb6fb69c78591a7613c054d5767ff1ce9fdaf3ae23ffccb712a5bb8fe4c39f70dd3bca8ec45d9da693e51e57f3901643b53f606620ae1411417eae
-  data.tar.gz: 9a90012a2fd703ffb29f7a206466f5b89bbca92dbfe84428209eeb3d03c0b354a698cfc7bc6e2443f807ef42c3ba38c83392d6fda8b102d7e5ae1472c0a3d40c
+  metadata.gz: d4beb11f7731c633a419f744951b8ad7d3c7fb1dbb5ae4d88b62c1cef8eb5b4d3c1dee7424557d380a0ed65447404debc3bd5232a44a6b46108c070451bef11c
+  data.tar.gz: 2b0cce03d34480b5fff00606c5693e31ad63493e32079fa1892382670de2097dc54c494ab4277b88f54ec429694dc607db41fabbe747bb07337a2f4d1436e838

data/Gemfile.lock CHANGED Viewed

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    ory-client (1.22.62)
+    ory-client (1.22.64)
       typhoeus (~> 1.0, >= 1.0.1)
 GEM
@@ -21,7 +21,7 @@ GEM
     logger (1.7.0)
     method_source (1.1.0)
     parallel (1.28.0)
-    parser (3.3.11.1)
+    parser (3.3.12.0)
       ast (~> 2.4.1)
       racc
     pry (0.16.0)

data/README.md CHANGED Viewed

@@ -26,8 +26,8 @@ This document describes the APIs available in the Ory Network. The APIs are avai
 This SDK is automatically generated by the [OpenAPI Generator](https://openapi-generator.tech) project:
-- API version: v1.22.62
-- Package version: v1.22.62
+- API version: v1.22.64
+- Package version: v1.22.64
 - Generator version: 7.17.0
 - Build package: org.openapitools.codegen.languages.RubyClientCodegen
@@ -44,16 +44,16 @@ gem build ory-client.gemspec
 Then either install the gem locally:
 ```shell
-gem install ./ory-client-v1.22.62.gem
+gem install ./ory-client-v1.22.64.gem
 ```
-(for development, run `gem install --dev ./ory-client-v1.22.62.gem` to install the development dependencies)
+(for development, run `gem install --dev ./ory-client-v1.22.64.gem` to install the development dependencies)
 or publish the gem to a gem hosting service, e.g. [RubyGems](https://rubygems.org/).
 Finally add this to the Gemfile:
-    gem 'ory-client', '~> v1.22.62'
+    gem 'ory-client', '~> v1.22.64'
 ### Install from Git
@@ -199,6 +199,7 @@ Class | Method | HTTP request | Description
 *OryClient::OAuth2Api* | [**create_o_auth2_client**](docs/OAuth2Api.md#create_o_auth2_client) | **POST** /admin/clients | Create OAuth 2.0 Client
 *OryClient::OAuth2Api* | [**delete_o_auth2_client**](docs/OAuth2Api.md#delete_o_auth2_client) | **DELETE** /admin/clients/{id} | Delete OAuth 2.0 Client
 *OryClient::OAuth2Api* | [**delete_o_auth2_token**](docs/OAuth2Api.md#delete_o_auth2_token) | **DELETE** /admin/oauth2/tokens | Delete OAuth 2.0 Access Tokens from specific OAuth 2.0 Client
+*OryClient::OAuth2Api* | [**delete_rotated_o_auth2_client_secrets**](docs/OAuth2Api.md#delete_rotated_o_auth2_client_secrets) | **DELETE** /admin/clients/{id}/secrets/rotate | Delete Rotated OAuth 2.0 Client Secrets
 *OryClient::OAuth2Api* | [**delete_trusted_o_auth2_jwt_grant_issuer**](docs/OAuth2Api.md#delete_trusted_o_auth2_jwt_grant_issuer) | **DELETE** /admin/trust/grants/jwt-bearer/issuers/{id} | Delete Trusted OAuth2 JWT Bearer Grant Type Issuer
 *OryClient::OAuth2Api* | [**get_o_auth2_client**](docs/OAuth2Api.md#get_o_auth2_client) | **GET** /admin/clients/{id} | Get an OAuth 2.0 Client
 *OryClient::OAuth2Api* | [**get_o_auth2_consent_request**](docs/OAuth2Api.md#get_o_auth2_consent_request) | **GET** /admin/oauth2/auth/requests/consent | Get OAuth 2.0 Consent Request
@@ -220,6 +221,7 @@ Class | Method | HTTP request | Description
 *OryClient::OAuth2Api* | [**revoke_o_auth2_consent_sessions**](docs/OAuth2Api.md#revoke_o_auth2_consent_sessions) | **DELETE** /admin/oauth2/auth/sessions/consent | Revoke OAuth 2.0 Consent Sessions of a Subject
 *OryClient::OAuth2Api* | [**revoke_o_auth2_login_sessions**](docs/OAuth2Api.md#revoke_o_auth2_login_sessions) | **DELETE** /admin/oauth2/auth/sessions/login | Revokes OAuth 2.0 Login Sessions by either a Subject or a SessionID
 *OryClient::OAuth2Api* | [**revoke_o_auth2_token**](docs/OAuth2Api.md#revoke_o_auth2_token) | **POST** /oauth2/revoke | Revoke OAuth 2.0 Access or Refresh Token
+*OryClient::OAuth2Api* | [**rotate_o_auth2_client_secret**](docs/OAuth2Api.md#rotate_o_auth2_client_secret) | **POST** /admin/clients/{id}/secrets/rotate | Rotate OAuth 2.0 Client Secret
 *OryClient::OAuth2Api* | [**set_o_auth2_client**](docs/OAuth2Api.md#set_o_auth2_client) | **PUT** /admin/clients/{id} | Set OAuth 2.0 Client
 *OryClient::OAuth2Api* | [**set_o_auth2_client_lifespans**](docs/OAuth2Api.md#set_o_auth2_client_lifespans) | **PUT** /admin/clients/{id}/lifespans | Set OAuth2 Client Token Lifespans
 *OryClient::OAuth2Api* | [**trust_o_auth2_jwt_grant_issuer**](docs/OAuth2Api.md#trust_o_auth2_jwt_grant_issuer) | **POST** /admin/trust/grants/jwt-bearer/issuers | Trust OAuth2 JWT Bearer Grant Type Issuer
@@ -364,6 +366,7 @@ Class | Method | HTTP request | Description
  - [OryClient::DeviceAuthnIOSAttestation](docs/DeviceAuthnIOSAttestation.md)
  - [OryClient::DeviceAuthnKey](docs/DeviceAuthnKey.md)
  - [OryClient::DeviceAuthorization](docs/DeviceAuthorization.md)
+ - [OryClient::DeviceType](docs/DeviceType.md)
  - [OryClient::DeviceUserAuthRequest](docs/DeviceUserAuthRequest.md)
  - [OryClient::ElementsConfiguration](docs/ElementsConfiguration.md)
  - [OryClient::EmailTemplateData](docs/EmailTemplateData.md)
@@ -389,6 +392,7 @@ Class | Method | HTTP request | Description
  - [OryClient::GetMetricsEventAttributes](docs/GetMetricsEventAttributes.md)
  - [OryClient::GetMetricsEventTypes](docs/GetMetricsEventTypes.md)
  - [OryClient::GetOrganizationResponse](docs/GetOrganizationResponse.md)
+ - [OryClient::GetOrganizationsByHostnameResponse](docs/GetOrganizationsByHostnameResponse.md)
  - [OryClient::GetProjectEvents](docs/GetProjectEvents.md)
  - [OryClient::GetProjectEventsBody](docs/GetProjectEventsBody.md)
  - [OryClient::GetProjectMetrics](docs/GetProjectMetrics.md)
@@ -446,6 +450,7 @@ Class | Method | HTTP request | Description
  - [OryClient::JsonWebKey](docs/JsonWebKey.md)
  - [OryClient::JsonWebKeySet](docs/JsonWebKeySet.md)
  - [OryClient::KetoNamespace](docs/KetoNamespace.md)
+ - [OryClient::KeyState](docs/KeyState.md)
  - [OryClient::KeyStatus](docs/KeyStatus.md)
  - [OryClient::KeyVisibility](docs/KeyVisibility.md)
  - [OryClient::KeysetPaginationRequestParameters](docs/KeysetPaginationRequestParameters.md)
@@ -501,6 +506,7 @@ Class | Method | HTTP request | Description
  - [OryClient::OnboardingPortalTestLoginFlow](docs/OnboardingPortalTestLoginFlow.md)
  - [OryClient::Organization](docs/Organization.md)
  - [OryClient::OrganizationBody](docs/OrganizationBody.md)
+ - [OryClient::OrganizationByHostname](docs/OrganizationByHostname.md)
  - [OryClient::OrganizationOnboardingPortalLinksResponse](docs/OrganizationOnboardingPortalLinksResponse.md)
  - [OryClient::PINConfig](docs/PINConfig.md)
  - [OryClient::ParseError](docs/ParseError.md)
@@ -571,6 +577,7 @@ Class | Method | HTTP request | Description
  - [OryClient::SuccessfulNativeLogin](docs/SuccessfulNativeLogin.md)
  - [OryClient::SuccessfulNativeRegistration](docs/SuccessfulNativeRegistration.md)
  - [OryClient::SuccessfulProjectUpdate](docs/SuccessfulProjectUpdate.md)
+ - [OryClient::TalosRetiredValue](docs/TalosRetiredValue.md)
  - [OryClient::TaxLineItem](docs/TaxLineItem.md)
  - [OryClient::TimeInterval](docs/TimeInterval.md)
  - [OryClient::Token](docs/Token.md)
@@ -621,8 +628,7 @@ Class | Method | HTTP request | Description
  - [OryClient::UpdateRegistrationFlowWithWebAuthnMethod](docs/UpdateRegistrationFlowWithWebAuthnMethod.md)
  - [OryClient::UpdateSettingsFlowBody](docs/UpdateSettingsFlowBody.md)
  - [OryClient::UpdateSettingsFlowWithDeviceAuthnMethod](docs/UpdateSettingsFlowWithDeviceAuthnMethod.md)
- - [OryClient::UpdateSettingsFlowWithDeviceAuthnMethodAdd](docs/UpdateSettingsFlowWithDeviceAuthnMethodAdd.md)
- - [OryClient::UpdateSettingsFlowWithDeviceAuthnMethodDelete](docs/UpdateSettingsFlowWithDeviceAuthnMethodDelete.md)
+ - [OryClient::UpdateSettingsFlowWithDeviceAuthnMethodRegister](docs/UpdateSettingsFlowWithDeviceAuthnMethodRegister.md)
  - [OryClient::UpdateSettingsFlowWithDeviceAuthnMethodRotateSecret](docs/UpdateSettingsFlowWithDeviceAuthnMethodRotateSecret.md)
  - [OryClient::UpdateSettingsFlowWithLookupMethod](docs/UpdateSettingsFlowWithLookupMethod.md)
  - [OryClient::UpdateSettingsFlowWithOidcMethod](docs/UpdateSettingsFlowWithOidcMethod.md)
@@ -637,6 +643,7 @@ Class | Method | HTTP request | Description
  - [OryClient::UpdateVerificationFlowWithCodeMethod](docs/UpdateVerificationFlowWithCodeMethod.md)
  - [OryClient::UpdateVerificationFlowWithLinkMethod](docs/UpdateVerificationFlowWithLinkMethod.md)
  - [OryClient::UpdateWorkspaceBody](docs/UpdateWorkspaceBody.md)
+ - [OryClient::UpdateWorkspaceOrganizationBody](docs/UpdateWorkspaceOrganizationBody.md)
  - [OryClient::Usage](docs/Usage.md)
  - [OryClient::UserVerification](docs/UserVerification.md)
  - [OryClient::ValidateBaseURLRewriteRequest](docs/ValidateBaseURLRewriteRequest.md)

data/docs/AccountExperienceConfiguration.md CHANGED Viewed

@@ -4,6 +4,7 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
+| **contact_url** | **String** | The URL to the project&#39;s Contact page. | [optional] |
 | **default_locale** | **String** |  |  |
 | **default_redirect_url** | **String** |  |  |
 | **enabled_locales** | **Array&lt;String&gt;** |  |  |
@@ -17,12 +18,14 @@
 | **logo_dark_url** | **String** |  | [optional] |
 | **logo_light_url** | **String** |  | [optional] |
 | **name** | **String** |  |  |
+| **privacy_policy_url** | **String** | The URL to the project&#39;s Privacy Policy page. | [optional] |
 | **recovery_enabled** | **Boolean** |  |  |
 | **recovery_ui_url** | **String** |  |  |
 | **registration_enabled** | **Boolean** |  |  |
 | **registration_ui_url** | **String** |  |  |
 | **settings_ui_url** | **String** |  |  |
 | **stylesheet** | **String** |  | [optional] |
+| **terms_of_service_url** | **String** | The URL to the project&#39;s Terms of Service page. | [optional] |
 | **translations** | [**Array&lt;RevisionAccountExperienceCustomTranslation&gt;**](RevisionAccountExperienceCustomTranslation.md) |  |  |
 | **verification_enabled** | **Boolean** |  |  |
 | **verification_ui_url** | **String** |  |  |
@@ -33,6 +36,7 @@
 require 'ory-client'
 instance = OryClient::AccountExperienceConfiguration.new(
+  contact_url: null,
   default_locale: null,
   default_redirect_url: null,
   enabled_locales: null,
@@ -46,12 +50,14 @@ instance = OryClient::AccountExperienceConfiguration.new(
   logo_dark_url: null,
   logo_light_url: null,
   name: null,
+  privacy_policy_url: null,
   recovery_enabled: null,
   recovery_ui_url: null,
   registration_enabled: null,
   registration_ui_url: null,
   settings_ui_url: null,
   stylesheet: null,
+  terms_of_service_url: null,
   translations: null,
   verification_enabled: null,
   verification_ui_url: null

data/docs/ContinueWithDeviceAuthnPinEntryUiData.md CHANGED Viewed

@@ -4,8 +4,8 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **ciphertext** | **String** | Ciphertext is the base64-encoded HPKE-sealed pin_secret. |  |
-| **enc** | **String** | Enc is the base64-encoded HPKE encapsulated key. |  |
+| **ciphertext** | **String** | The base64-encoded HPKE ciphertext of the sealed pin_secret. |  |
+| **enc** | **String** | The base64-encoded HPKE encapsulated key (the &#x60;enc&#x60; output of the seal operation). |  |
 ## Example

data/docs/CreateProjectNormalizedPayload.md CHANGED Viewed

@@ -4,6 +4,7 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
+| **account_experience_contact_url** | **String** | Holds the URL to the account experience&#39;s Contact page. This governs the \&quot;contact_url\&quot; setting. | [optional] |
 | **account_experience_custom_translations** | [**Array&lt;RevisionAccountExperienceCustomTranslation&gt;**](RevisionAccountExperienceCustomTranslation.md) | The Account Experience&#39;s Custom Translations  Contains all Custom Translations for this project. | [optional] |
 | **account_experience_default_locale** | **String** | Holds the default locale for the account experience. This governs the \&quot;default_locale\&quot; setting. | [optional] |
 | **account_experience_enabled_locales** | **Array&lt;String&gt;** | The Account Experience&#39;s Enabled Locales  This governs the locales that are available in the account experience. This governs the \&quot;enabled_locales\&quot; setting. | [optional] |
@@ -14,6 +15,8 @@
 | **account_experience_locale_behavior** | **String** | Holds the URL to the account experience&#39;s language behavior.  Can be one of: &#x60;respect_accept_language&#x60;: Respect the &#x60;Accept-Language&#x60; header. &#x60;force_default&#x60;: Force the default language. This governs the \&quot;locale_behavior\&quot; setting. | [optional] |
 | **account_experience_logo_dark** | **String** | Holds the URL to the account experience&#39;s dark theme logo (currently unused). This governs the \&quot;logo_dark\&quot; setting. | [optional] |
 | **account_experience_logo_light** | **String** | Holds the URL to the account experience&#39;s logo. This governs the \&quot;logo_light\&quot; setting. | [optional] |
+| **account_experience_privacy_policy_url** | **String** | Holds the URL to the account experience&#39;s Privacy Policy page. This governs the \&quot;privacy_policy_url\&quot; setting. | [optional] |
+| **account_experience_terms_of_service_url** | **String** | Holds the URL to the account experience&#39;s Terms of Service page. This governs the \&quot;terms_of_service_url\&quot; setting. | [optional] |
 | **account_experience_theme_variables_dark** | **String** | Holds the URL to the account experience&#39;s dark theme variables. This governs the \&quot;theme_variables_dark\&quot; setting. | [optional] |
 | **account_experience_theme_variables_light** | **String** | Holds the URL to the account experience&#39;s light theme variables. This governs the \&quot;theme_variables_light\&quot; setting. | [optional] |
 | **created_at** | **Time** | The Project&#39;s Revision Creation Date | [optional][readonly] |
@@ -23,6 +26,8 @@
 | **home_region** | **String** |  eu-central EUCentral asia-northeast AsiaNorthEast us-east USEast us-west USWest eu EU asia Asia us US global Global | [optional] |
 | **hydra_oauth2_allowed_top_level_claims** | **Array&lt;String&gt;** | A list of custom claims which are allowed to be added top level to the Access Token. They cannot override reserved claims.  This governs the \&quot;oauth2.allowed_top_level_claims\&quot; setting. | [optional] |
 | **hydra_oauth2_client_credentials_default_grant_allowed_scope** | **Boolean** | Automatically grant authorized OAuth2 Scope in OAuth2 Client Credentials Flow.  Each OAuth2 Client is allowed to request a predefined OAuth2 Scope (for example &#x60;read write&#x60;). If this option is enabled, the full scope is automatically granted when performing the OAuth2 Client Credentials flow.  If disabled, the OAuth2 Client has to request the scope in the OAuth2 request by providing the &#x60;scope&#x60; query parameter.  Setting this option to true is common if you need compatibility with MITREid.  This governs the \&quot;oauth2.client_credentials.default_grant_allowed_scope\&quot; setting. | [optional] |
+| **hydra_oauth2_device_authorization_token_polling_interval** | **String** | Configures how often a non-interactive device should poll the OAuth 2.0 Device Authorization Grant token endpoint. Purely informational — the value is reported to the device in the \&quot;interval\&quot; response field of the device authorization response. Hydra defaults to 5s when this is left empty.  This is an Enterprise feature.  This governs the \&quot;oauth2.device_authorization.token_polling_interval\&quot; setting. | [optional] |
+| **hydra_oauth2_device_authorization_user_code_entropy_preset** | **String** | Picks a preset for the OAuth 2.0 Device Authorization Grant user_code length and character set. \&quot;high\&quot; produces the longest codes (most resistant to brute force); \&quot;low\&quot; the shortest (easiest for the end user to read and enter). Leave empty to keep Hydra&#39;s default preset.  This is an Enterprise feature.  This governs the \&quot;oauth2.device_authorization.user_code.entropy_preset\&quot; setting. | [optional] |
 | **hydra_oauth2_exclude_not_before_claim** | **Boolean** | Set to true if you want to omit the &#x60;nbf&#x60; (not valid before) claim in the access token.  This governs the \&quot;oauth2.exclude_not_before_claim\&quot; setting. | [optional] |
 | **hydra_oauth2_grant_jwt_iat_optional** | **Boolean** | Configures if the issued at (&#x60;iat&#x60;) claim is required in the JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants (RFC7523).  If set to &#x60;false&#x60;, the &#x60;iat&#x60; claim is required. Set this value to &#x60;true&#x60; only after careful consideration.  This governs the \&quot;oauth2.grant.jwt.iat_optional\&quot; setting. | [optional] |
 | **hydra_oauth2_grant_jwt_jti_optional** | **Boolean** | Configures if the JSON Web Token ID (&#x60;jti&#x60;) claim is required in the JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants (RFC7523).  If set to &#x60;false&#x60;, the &#x60;jti&#x60; claim is required. Set this value to &#x60;true&#x60; only after careful consideration.  This governs the \&quot;oauth2.grant.jwt.jti_optional\&quot; setting. | [optional] |
@@ -51,10 +56,13 @@
 | **hydra_strategies_scope** | **String** | Defines how scopes are matched. For more details have a look at https://github.com/ory/fosite#scopes  This governs the \&quot;strategies.scope\&quot; setting. exact Oauth2ScopeStrategyExact wildcard Oauth2ScopeStrategyWildcard | [optional][default to &#39;wildcard&#39;] |
 | **hydra_ttl_access_token** | **String** | This governs the \&quot;ttl.access_token\&quot; setting. | [optional][default to &#39;30m&#39;] |
 | **hydra_ttl_auth_code** | **String** | Configures how long refresh tokens are valid.  Set to -1 for refresh tokens to never expire. This is not recommended!  This governs the \&quot;ttl.auth_code\&quot; setting. | [optional][default to &#39;720h&#39;] |
+| **hydra_ttl_device_user_code** | **String** | Configures how long the device_code and user_code in the OAuth 2.0 Device Authorization Grant remain valid. Larger values mean more database storage; shorter values mean users have less time to complete the second-device verification. Hydra defaults to 10m when this is left empty.  This is an Enterprise feature.  This governs the \&quot;ttl.device_user_code\&quot; setting. | [optional] |
 | **hydra_ttl_id_token** | **String** | This governs the \&quot;ttl.id_token\&quot; setting. | [optional][default to &#39;30m&#39;] |
 | **hydra_ttl_login_consent_request** | **String** | Configures how long a user login and consent flow may take.  This governs the \&quot;ttl.login_consent_request\&quot; setting. | [optional][default to &#39;30m&#39;] |
 | **hydra_ttl_refresh_token** | **String** | Configures how long refresh tokens are valid.  Set to -1 for refresh tokens to never expire. This is not recommended!  This governs the \&quot;ttl.refresh_token\&quot; setting. | [optional][default to &#39;720h&#39;] |
 | **hydra_urls_consent** | **String** | Sets the OAuth2 Consent Endpoint URL of the OAuth2 User Login &amp; Consent flow.  Defaults to the Ory Account Experience if left empty.  This governs the \&quot;urls.consent\&quot; setting. | [optional] |
+| **hydra_urls_device_success** | **String** | Sets the URL the user is redirected to after successfully completing the OAuth 2.0 Device Authorization Grant user verification step. Defaults to the Ory Account Experience fallback page if left empty.  This is an Enterprise feature.  This governs the \&quot;urls.device.success\&quot; setting. | [optional] |
+| **hydra_urls_device_verification** | **String** | Sets the URL of the user verification page for the OAuth 2.0 Device Authorization Grant (RFC 8628). End users are redirected to this URL to enter the user_code shown on their device. Defaults to the Ory Account Experience fallback page if left empty.  This is an Enterprise feature.  This governs the \&quot;urls.device.verification\&quot; setting. | [optional] |
 | **hydra_urls_error** | **String** | Sets the OAuth2 Error URL of the OAuth2 User Login &amp; Consent flow.  Defaults to the Ory Account Experience if left empty.  This governs the \&quot;urls.error\&quot; setting. | [optional] |
 | **hydra_urls_login** | **String** | Sets the OAuth2 Login Endpoint URL of the OAuth2 User Login &amp; Consent flow.  Defaults to the Ory Account Experience if left empty.  This governs the \&quot;urls.login\&quot; setting. | [optional] |
 | **hydra_urls_logout** | **String** | Sets the logout endpoint.  Defaults to the Ory Account Experience if left empty.  This governs the \&quot;urls.logout\&quot; setting. | [optional] |
@@ -64,6 +72,7 @@
 | **hydra_webfinger_jwks_broadcast_keys** | **Array&lt;String&gt;** | A list of JSON Web Keys that should be exposed at that endpoint. This is usually the public key for verifying OpenID Connect ID Tokens. However, you might want to add additional keys here as well.  This governs the \&quot;webfinger.jwks.broadcast_keys\&quot; setting. | [optional] |
 | **hydra_webfinger_oidc_discovery_auth_url** | **String** | Configures OpenID Connect Discovery and overwrites the OAuth2 Authorization URL.  This governs the \&quot;webfinger.oidc_discovery.auth_url\&quot; setting. | [optional] |
 | **hydra_webfinger_oidc_discovery_client_registration_url** | **String** | Configures OpenID Connect Discovery and overwrites the OpenID Connect Dynamic Client Registration Endpoint.  This governs the \&quot;webfinger.oidc_discovery.client_registration_url\&quot; setting. | [optional] |
+| **hydra_webfinger_oidc_discovery_device_authorization_url** | **String** | Override the OAuth 2.0 Device Authorization Endpoint URL that is advertised in the OpenID Connect discovery document (/.well-known/openid-configuration). Defaults to the project&#39;s public base URL + /oauth2/device/auth.  This is an Enterprise feature.  This governs the \&quot;webfinger.oidc_discovery.device_authorization_url\&quot; setting. | [optional] |
 | **hydra_webfinger_oidc_discovery_jwks_url** | **String** | Configures OpenID Connect Discovery and overwrites the JWKS URL.  This governs the \&quot;webfinger.oidc_discovery.jwks_url\&quot; setting. | [optional] |
 | **hydra_webfinger_oidc_discovery_supported_claims** | **Array&lt;String&gt;** | Configures OpenID Connect Discovery and overwrites a list of supported claims to be broadcasted. Claim \&quot;sub\&quot; is always included.  This governs the \&quot;webfinger.oidc_discovery.supported_claims\&quot; setting. | [optional] |
 | **hydra_webfinger_oidc_discovery_supported_scope** | **Array&lt;String&gt;** | Configures OpenID Connect Discovery and overwrites the scope OAuth 2.0 Clients may request. Scope &#x60;offline&#x60;, &#x60;offline_access&#x60;, and &#x60;openid&#x60; are always included.  This governs the \&quot;webfinger.oidc_discovery.supported_scope\&quot; setting. | [optional] |
@@ -214,11 +223,11 @@
 | **kratos_selfservice_methods_code_passwordless_enabled** | **Boolean** | Configures whether Ory Kratos Passwordless should use the Code Method  This governs the \&quot;selfservice.methods.code.passwordless_enabled\&quot; setting. | [optional] |
 | **kratos_selfservice_methods_code_passwordless_login_fallback_enabled** | **Boolean** | This setting allows the code method to always login a user with code if they have registered with another authentication method such as password or social sign in.  This governs the \&quot;selfservice.methods.code.passwordless_login_fallback_enabled\&quot; setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_android_app_ids** | **Array&lt;String&gt;** | Configures the allow-list of Android app signing-certificate digests that a device key may be bound to.  This governs the \&quot;selfservice.methods.deviceauthn.config.android_app_ids\&quot; setting. | [optional] |
-| **kratos_selfservice_methods_deviceauthn_config_first_factor** | **Boolean** | Configures whether device authentication may be used as the sole first factor.  This governs the \&quot;selfservice.methods.deviceauthn.config.first_factor\&quot; setting. | [optional] |
+| **kratos_selfservice_methods_deviceauthn_config_first_factor** | **Boolean** | Configures whether device authentication may be used as the sole first factor.  When enabled, a confirmed device key with PIN or platform user verification can complete an AAL2 login in a single submission, without a password or code. Defaults to false, which keeps device keys usable only as a second factor (step-up).  This governs the \&quot;selfservice.methods.deviceauthn.config.first_factor\&quot; setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_insecure_allow_relaxed_attestation** | **Boolean** | Configures whether Ory Kratos Device authentication accepts relaxed attestations for testing  Only allowed on development projects and forced off otherwise. Keys enrolled under relaxation are short-lived and refused once this is turned off.  This governs the \&quot;selfservice.methods.deviceauthn.config.insecure_allow_relaxed_attestation\&quot; setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_ios_app_ids** | **Array&lt;String&gt;** | Configures the allow-list of Apple App IDs that a device key may be bound to.  This governs the \&quot;selfservice.methods.deviceauthn.config.ios_app_ids\&quot; setting. | [optional] |
-| **kratos_selfservice_methods_deviceauthn_config_ios_biometric_first_factor** | **Boolean** | Configures whether an iOS biometric device key may be used as the sole first factor.  This governs the \&quot;selfservice.methods.deviceauthn.config.ios_biometric_first_factor\&quot; setting. | [optional] |
-| **kratos_selfservice_methods_deviceauthn_config_pin_max_attempts** | **Integer** | Configures the consecutive wrong-PIN limit before a device key is locked.  This governs the \&quot;selfservice.methods.deviceauthn.config.pin_max_attempts\&quot; setting. | [optional] |
+| **kratos_selfservice_methods_deviceauthn_config_ios_biometric_first_factor** | **Boolean** | Configures whether an iOS biometric device key may be used as the sole first factor.  Apple App Attest cannot prove biometric gating, so iOS keys with \&quot;platform\&quot; user verification count as a first factor only with this explicit opt-in. Android keys are unaffected, as their user verification is attestation-verified. Defaults to false.  This governs the \&quot;selfservice.methods.deviceauthn.config.ios_biometric_first_factor\&quot; setting. | [optional] |
+| **kratos_selfservice_methods_deviceauthn_config_pin_max_attempts** | **Integer** | Configures the number of consecutive wrong-PIN attempts before a device key is locked.  Defaults to 5; must be between 1 and 10. Once locked, the key&#39;s pin_secret is invalidated and the key can no longer be used to log in until the user rotates its secret through the fallback login.  This governs the \&quot;selfservice.methods.deviceauthn.config.pin_max_attempts\&quot; setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_enabled** | **Boolean** | Configures whether Ory Kratos Device authentication is enabled  This governs the \&quot;selfservice.methods.deviceauthn.enabled\&quot; setting. | [optional] |
 | **kratos_selfservice_methods_link_config_base_url** | **String** | Configures the Base URL which Recovery, Verification, and Login Links Point to  It is recommended to leave this value empty. It will be appropriately configured to the best matching domain (e.g. when using custom domains) automatically.  This governs the \&quot;selfservice.methods.link.config.base_url\&quot; setting. | [optional] |
 | **kratos_selfservice_methods_link_config_lifespan** | **String** | Configures the Ory Kratos Link Method&#39;s lifespan  This governs the \&quot;selfservice.methods.link.config.lifespan\&quot; setting. | [optional] |
@@ -278,10 +287,12 @@
 | **talos_credentials_derived_tokens_macaroon_prefix_current** | **String** | Talos derived tokens macaroon prefix (current). | [optional] |
 | **talos_credentials_derived_tokens_macaroon_prefix_retired** | **Array&lt;String&gt;** | Talos derived tokens macaroon prefix (retired).  Previously active macaroon prefixes kept for verification of outstanding tokens. The first element of this list was the most recently retired active prefix. | [optional] |
 | **talos_credentials_issuer** | **String** | Talos credentials issuer URL. | [optional] |
-| **talos_credentials_issuer_retired** | **Array&lt;String&gt;** | Talos credentials retired issuer URLs.  Previously active issuer URLs kept for verification of outstanding tokens. Tokens signed with these issuers remain valid; new tokens use the current issuer. | [optional] |
+| **talos_credentials_issuer_retired** | **Array&lt;String&gt;** | Talos credentials retired issuer URLs (deprecated).  Deprecated: values-only view of talos_credentials_issuer_retired_entries, kept so already-released SDKs that decode this field as an array of strings keep working. It is output only: reads are derived from the entries field and writes to it are ignored. Use talos_credentials_issuer_retired_entries instead. | [optional][readonly] |
+| **talos_credentials_issuer_retired_entries** | [**Array&lt;TalosRetiredValue&gt;**](TalosRetiredValue.md) | TalosRetiredValues is the list of retired values — retired HMAC secrets or retired issuer URLs — for a Talos project. A retired value stays valid for verification until its optional expiry passes, so operators can bound how long an old credential keeps working after a rotation instead of keeping it forever. Legacy bare-string entries are accepted on write and normalized to the object form. | [optional] |
 | **talos_rate_limit_enabled** | **Boolean** | Talos rate limit enabled.  When true, server-side rate limiting is enforced for API key verifications. | [optional] |
-| **talos_secrets_hmac_current** | **String** | TalosSecretsHMACCurrent stores the current HMAC symmetric key as a plain secret string. Application-layer encryption is handled upstream; SanitizeModel (MarshalJSON) redacts this field from API responses. | [optional] |
-| **talos_secrets_hmac_retired** | **Array&lt;String&gt;** | TalosSecretsHMACRetired stores previously active HMAC symmetric keys as a JSON array of plain secret strings. Application-layer encryption is handled upstream; SanitizeModel (MarshalJSON) redacts this field from API responses. The verifier tries all retired secrets when the current key does not produce a matching HMAC. | [optional] |
+| **talos_secrets_hmac_current** | **String** | TalosSecretsHMACCurrent stores the current HMAC symmetric key as a plain secret string. | [optional] |
+| **talos_secrets_hmac_retired** | **Array&lt;String&gt;** | TalosSecretsHMACRetired stores previously active HMAC symmetric keys as an array of strings (deprecated).  Deprecated: values-only view of talos_secrets_hmac_retired_entries, kept so already-released SDKs that decode this field as an array of strings keep working. It is output only and writes to it are ignored. HMAC secrets are server-managed and redacted on output, so this field is always empty on the wire. Use talos_secrets_hmac_retired_entries instead. | [optional][readonly] |
+| **talos_secrets_hmac_retired_entries** | [**Array&lt;TalosRetiredValue&gt;**](TalosRetiredValue.md) | TalosRetiredValues is the list of retired values — retired HMAC secrets or retired issuer URLs — for a Talos project. A retired value stays valid for verification until its optional expiry passes, so operators can bound how long an old credential keeps working after a rotation instead of keeping it forever. Legacy bare-string entries are accepted on write and normalized to the object form. | [optional] |
 | **updated_at** | **Time** | Last Time Project&#39;s Revision was Updated | [optional][readonly] |
 | **workspace_id** | **String** |  | [optional] |
@@ -291,6 +302,7 @@
 require 'ory-client'
 instance = OryClient::CreateProjectNormalizedPayload.new(
+  account_experience_contact_url: null,
   account_experience_custom_translations: null,
   account_experience_default_locale: null,
   account_experience_enabled_locales: null,
@@ -301,6 +313,8 @@ instance = OryClient::CreateProjectNormalizedPayload.new(
   account_experience_locale_behavior: null,
   account_experience_logo_dark: null,
   account_experience_logo_light: null,
+  account_experience_privacy_policy_url: null,
+  account_experience_terms_of_service_url: null,
   account_experience_theme_variables_dark: null,
   account_experience_theme_variables_light: null,
   created_at: null,
@@ -310,6 +324,8 @@ instance = OryClient::CreateProjectNormalizedPayload.new(
   home_region: null,
   hydra_oauth2_allowed_top_level_claims: null,
   hydra_oauth2_client_credentials_default_grant_allowed_scope: null,
+  hydra_oauth2_device_authorization_token_polling_interval: 15s,
+  hydra_oauth2_device_authorization_user_code_entropy_preset: null,
   hydra_oauth2_exclude_not_before_claim: null,
   hydra_oauth2_grant_jwt_iat_optional: null,
   hydra_oauth2_grant_jwt_jti_optional: null,
@@ -338,10 +354,13 @@ instance = OryClient::CreateProjectNormalizedPayload.new(
   hydra_strategies_scope: null,
   hydra_ttl_access_token: 1h,
   hydra_ttl_auth_code: 30m,
+  hydra_ttl_device_user_code: 30m,
   hydra_ttl_id_token: 1h,
   hydra_ttl_login_consent_request: 1h,
   hydra_ttl_refresh_token: 30m,
   hydra_urls_consent: null,
+  hydra_urls_device_success: null,
+  hydra_urls_device_verification: null,
   hydra_urls_error: null,
   hydra_urls_login: null,
   hydra_urls_logout: null,
@@ -351,6 +370,7 @@ instance = OryClient::CreateProjectNormalizedPayload.new(
   hydra_webfinger_jwks_broadcast_keys: null,
   hydra_webfinger_oidc_discovery_auth_url: null,
   hydra_webfinger_oidc_discovery_client_registration_url: null,
+  hydra_webfinger_oidc_discovery_device_authorization_url: null,
   hydra_webfinger_oidc_discovery_jwks_url: null,
   hydra_webfinger_oidc_discovery_supported_claims: null,
   hydra_webfinger_oidc_discovery_supported_scope: null,
@@ -566,9 +586,11 @@ instance = OryClient::CreateProjectNormalizedPayload.new(
   talos_credentials_derived_tokens_macaroon_prefix_retired: null,
   talos_credentials_issuer: null,
   talos_credentials_issuer_retired: null,
+  talos_credentials_issuer_retired_entries: null,
   talos_rate_limit_enabled: null,
   talos_secrets_hmac_current: null,
   talos_secrets_hmac_retired: null,
+  talos_secrets_hmac_retired_entries: null,
   updated_at: null,
   workspace_id: null
 )

data/docs/DeviceAuthnKey.md CHANGED Viewed

@@ -5,16 +5,16 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
 | **attestation** | [**DeviceAuthnAttestation**](DeviceAuthnAttestation.md) |  | [optional] |
-| **client_key_id** | **String** | ClientKeyID is the key&#39;s stable, unique-per-identity id, computed as hex(SHA-256(PublicKey)) — the lowercase-hex SHA-256 digest of the public key&#39;s PKIX, ASN.1 DER (SubjectPublicKeyInfo) encoding, exactly the bytes stored in PublicKey. It is a deterministic fingerprint of the enrolled signing key, so the device recomputes the identical value locally instead of receiving it from the server. Keys enrolled before the server derived the id keep their original client-chosen value. | [optional] |
-| **created_at** | **Time** | CreatedAt is the timestamp of when the key was created. Only used for troubleshooting/UI. | [optional] |
-| **device_name** | **String** | DeviceName is a human readable name for the device, helping the user to distinguish it from others. | [optional] |
-| **device_type** | **String** |  | [optional] |
+| **client_key_id** | **String** | The key&#39;s stable id, unique per identity. Submit it as the &#x60;client_key_id&#x60; when logging in with the key, deleting it, or rotating its pin_secret.  The device can also compute the id without reading it back from the server: it is the lowercase-hex SHA-256 of &#x60;public_key&#x60; (the key&#39;s PKIX, ASN.1 DER encoding). Keys enrolled before the server derived the id keep their original client-chosen value, so prefer reading this field over recomputing it for older keys. | [optional] |
+| **created_at** | **Time** | When the key was enrolled. Only used for troubleshooting and UI. | [optional] |
+| **device_name** | **String** | A human-readable name for the device, helping the user tell this key apart from others. | [optional] |
+| **device_type** | [**DeviceType**](DeviceType.md) |  | [optional] |
 | **pin** | [**PINConfig**](PINConfig.md) |  | [optional] |
-| **public_key** | **Array&lt;Integer&gt;** | PublicKey is the device&#39;s public key (EC P-256 in v1), used to verify signatures. It is stored in PKIX, ASN.1 DER form (the SubjectPublicKeyInfo encoding produced by x509.MarshalPKIXPublicKey). The private key resides inside the device and does not exist on the server. | [optional] |
-| **relaxed_attestation_expires_at** | **Time** | RelaxedAttestationExpiresAt is set only when the key&#39;s attestation chain validated because relaxed attestation was allowed (software roots, expired certs, software security level) rather than under strict rules. Such keys are second-class: they are refused at login after this time, or immediately if relaxed attestation is turned off. It is nil for hardware-attested keys that pass strict validation. | [optional] |
-| **state** | **String** |  | [optional] |
+| **public_key** | **String** | The device&#39;s public key (an elliptic-curve key on P-224, P-256, P-384, or P-521 in version 1) in PKIX, ASN.1 DER (SubjectPublicKeyInfo) form, base64-encoded. Signatures are verified against this key. | [optional] |
+| **relaxed_attestation_expires_at** | **Time** | Set only when the key&#39;s attestation chain was accepted under relaxed rules (software roots, expired certificates, software security level) rather than strict hardware attestation. Such keys are refused at login after this time, or immediately once relaxed attestation is turned off. Absent for hardware-attested keys that pass strict validation. | [optional] |
+| **state** | [**KeyState**](KeyState.md) |  | [optional] |
 | **user_verification** | [**UserVerification**](UserVerification.md) |  | [optional] |
-| **version** | **Integer** | v1 uses SHA256 + EC256. v2 (in the future) may use ML-DSA which is post-quantum resistant. This requires Android/iOS support so we have to wait. We intentionally avoid storing the cryptographic algorithm here a la JWT/TLS to avoid security issues and algorithm negotiation. | [optional] |
+| **version** | **Integer** | The cryptography version of the key. Version 1 uses ECDSA with SHA-256 on an elliptic curve (P-224, P-256, P-384, or P-521); further versions are reserved for future signature suites. | [optional] |
 ## Example

data/docs/DeviceType.md ADDED Viewed

@@ -0,0 +1,15 @@
+# OryClient::DeviceType
+## Properties
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+## Example
+```ruby
+require 'ory-client'
+instance = OryClient::DeviceType.new()
+```

data/docs/ElementsConfiguration.md CHANGED Viewed

@@ -4,6 +4,7 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
+| **contact_url** | **String** | The URL to the project&#39;s Contact page. | [optional] |
 | **default_redirect_url** | **String** | The default redirect URL. |  |
 | **error_ui_url** | **String** | The URL for the error UI. |  |
 | **hide_ory_branding** | **Boolean** | Whether to hide the Ory branding badge. |  |
@@ -12,11 +13,13 @@
 | **logo_dark_url** | **String** | The URL for the dark logo. | [optional] |
 | **logo_light_url** | **String** | The URL for the light logo on the auth card. | [optional] |
 | **name** | **String** | The name of the project displayed on the auth card. |  |
+| **privacy_policy_url** | **String** | The URL to the project&#39;s Privacy Policy page. | [optional] |
 | **recovery_enabled** | **Boolean** | Whether recovery is enabled. |  |
 | **recovery_ui_url** | **String** | The URL for the recovery UI. |  |
 | **registration_enabled** | **Boolean** | Whether registration is enabled. |  |
 | **registration_ui_url** | **String** | The URL for the registration UI. |  |
 | **settings_ui_url** | **String** | The URL for the settings UI. |  |
+| **terms_of_service_url** | **String** | The URL to the project&#39;s Terms of Service page. | [optional] |
 | **verification_enabled** | **Boolean** | Whether verification is enabled. |  |
 | **verification_ui_url** | **String** | The URL for the verification UI. |  |
@@ -26,6 +29,7 @@
 require 'ory-client'
 instance = OryClient::ElementsConfiguration.new(
+  contact_url: null,
   default_redirect_url: null,
   error_ui_url: null,
   hide_ory_branding: null,
@@ -34,11 +38,13 @@ instance = OryClient::ElementsConfiguration.new(
   logo_dark_url: null,
   logo_light_url: null,
   name: null,
+  privacy_policy_url: null,
   recovery_enabled: null,
   recovery_ui_url: null,
   registration_enabled: null,
   registration_ui_url: null,
   settings_ui_url: null,
+  terms_of_service_url: null,
   verification_enabled: null,
   verification_ui_url: null
 )

data/docs/GetOrganizationsByHostnameResponse.md ADDED Viewed

@@ -0,0 +1,18 @@
+# OryClient::GetOrganizationsByHostnameResponse
+## Properties
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **organizations** | [**Array&lt;OrganizationByHostname&gt;**](OrganizationByHostname.md) | Organizations is the list of organizations for the project. |  |
+## Example
+```ruby
+require 'ory-client'
+instance = OryClient::GetOrganizationsByHostnameResponse.new(
+  organizations: null
+)
+```

data/docs/IdentityApi.md CHANGED Viewed

@@ -473,7 +473,7 @@ api_instance = OryClient::IdentityApi.new
 id = 'id_example' # String | ID is the identity's ID.
 type = 'password' # String | Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML deviceauthn CredentialsTypeDeviceAuthn identifier_first CredentialsTypeIdentifierFirst link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
 opts = {
-  identifier: 'identifier_example' # String | Identifier is the identifier of the OIDC/SAML credential to delete. Find the identifier by calling the `GET /admin/identities/{id}?include_credential={oidc,saml}` endpoint.
+  identifier: 'identifier_example' # String | Identifier is the identifier of the credential to delete. It is required for the `oidc`, `saml`, and `deviceauthn` credential types: for `oidc` and `saml` it selects the provider link to remove, for `deviceauthn` it is the `client_key_id` of the device key to revoke. Find the identifier by calling the `GET /admin/identities/{id}?include_credential={type}` endpoint.
 }
 begin
@@ -508,7 +508,7 @@ end
 | ---- | ---- | ----------- | ----- |
 | **id** | **String** | ID is the identity&#39;s ID. |  |
 | **type** | **String** | Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML deviceauthn CredentialsTypeDeviceAuthn identifier_first CredentialsTypeIdentifierFirst link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode |  |
-| **identifier** | **String** | Identifier is the identifier of the OIDC/SAML credential to delete. Find the identifier by calling the &#x60;GET /admin/identities/{id}?include_credential&#x3D;{oidc,saml}&#x60; endpoint. | [optional] |
+| **identifier** | **String** | Identifier is the identifier of the credential to delete. It is required for the &#x60;oidc&#x60;, &#x60;saml&#x60;, and &#x60;deviceauthn&#x60; credential types: for &#x60;oidc&#x60; and &#x60;saml&#x60; it selects the provider link to remove, for &#x60;deviceauthn&#x60; it is the &#x60;client_key_id&#x60; of the device key to revoke. Find the identifier by calling the &#x60;GET /admin/identities/{id}?include_credential&#x3D;{type}&#x60; endpoint. | [optional] |
 ### Return type

data/docs/JwkApi.md CHANGED Viewed

@@ -19,7 +19,7 @@ All URIs are relative to *https://playground.projects.oryapis.com*
 Create JSON Web Key
-This endpoint is capable of generating JSON Web Key Sets for you. There are different strategies available, such as symmetric cryptographic keys (HS256, HS512) and asymmetric cryptographic keys (RS256, ECDSA). If the specified JSON Web Key Set does not exist, it will be created.  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
+This endpoint is capable of generating JSON Web Key Sets for you. There are different strategies available, such as symmetric cryptographic keys (HS256, HS512) and asymmetric cryptographic keys (RS256, ECDSA). If the specified JSON Web Key Set does not exist, it will be created.  If the set already exists, the newly generated key is added to it and all existing keys are kept. This allows you to rotate keys: tokens signed with an older key in the set remain verifiable. Exception: when Ory Hydra is configured to use a Hardware Security Module (HSM), generating a key replaces the set, which then contains only the new key. To replace a set and all of its keys instead, use the `setJsonWebKeySet` operation (`PUT /admin/keys/{set}`).  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
 ### Examples
@@ -368,7 +368,7 @@ end
 Set JSON Web Key
-Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
+Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.  Warning: the key is created or updated under the `kid` given in the request body. The `{kid}` path parameter exists for historical reasons only: it is ignored and not validated against the body.  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
 ### Examples
@@ -443,7 +443,7 @@ end
 Update a JSON Web Key Set
-Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
+Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.  This operation replaces the entire JSON Web Key Set: keys that exist in the set but are not part of the request body are deleted. To add a newly generated key to the set while keeping the existing keys, use the `createJsonWebKeySet` operation (`POST /admin/keys/{set}`).  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
 ### Examples

data/docs/KeyState.md ADDED Viewed

@@ -0,0 +1,15 @@
+# OryClient::KeyState
+## Properties
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+## Example
+```ruby
+require 'ory-client'
+instance = OryClient::KeyState.new()
+```