RubyGems - ory-client - Versions diffs - 1.22.62 → 1.22.64 - Mend

ory-client 1.22.62 → 1.22.64

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (924) hide show

data/docs/NormalizedProjectRevision.md CHANGED Viewed

@@ -4,6 +4,7 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
+| **account_experience_contact_url** | **String** | Holds the URL to the account experience&#39;s Contact page. This governs the \&quot;contact_url\&quot; setting. | [optional] |
 | **account_experience_custom_translations** | [**Array&lt;RevisionAccountExperienceCustomTranslation&gt;**](RevisionAccountExperienceCustomTranslation.md) | The Account Experience&#39;s Custom Translations  Contains all Custom Translations for this project. | [optional] |
 | **account_experience_default_locale** | **String** | Holds the default locale for the account experience. This governs the \&quot;default_locale\&quot; setting. | [optional] |
 | **account_experience_enabled_locales** | **Array&lt;String&gt;** | The Account Experience&#39;s Enabled Locales  This governs the locales that are available in the account experience. This governs the \&quot;enabled_locales\&quot; setting. | [optional] |
@@ -14,6 +15,8 @@
 | **account_experience_locale_behavior** | **String** | Holds the URL to the account experience&#39;s language behavior.  Can be one of: &#x60;respect_accept_language&#x60;: Respect the &#x60;Accept-Language&#x60; header. &#x60;force_default&#x60;: Force the default language. This governs the \&quot;locale_behavior\&quot; setting. | [optional] |
 | **account_experience_logo_dark** | **String** | Holds the URL to the account experience&#39;s dark theme logo (currently unused). This governs the \&quot;logo_dark\&quot; setting. | [optional] |
 | **account_experience_logo_light** | **String** | Holds the URL to the account experience&#39;s logo. This governs the \&quot;logo_light\&quot; setting. | [optional] |
+| **account_experience_privacy_policy_url** | **String** | Holds the URL to the account experience&#39;s Privacy Policy page. This governs the \&quot;privacy_policy_url\&quot; setting. | [optional] |
+| **account_experience_terms_of_service_url** | **String** | Holds the URL to the account experience&#39;s Terms of Service page. This governs the \&quot;terms_of_service_url\&quot; setting. | [optional] |
 | **account_experience_theme_variables_dark** | **String** | Holds the URL to the account experience&#39;s dark theme variables. This governs the \&quot;theme_variables_dark\&quot; setting. | [optional] |
 | **account_experience_theme_variables_light** | **String** | Holds the URL to the account experience&#39;s light theme variables. This governs the \&quot;theme_variables_light\&quot; setting. | [optional] |
 | **created_at** | **Time** | The Project&#39;s Revision Creation Date | [optional][readonly] |
@@ -21,6 +24,8 @@
 | **enable_ax_v2** | **Boolean** | Whether the new account experience is enabled and reachable. This governs the \&quot;enable_ax_v2\&quot; setting. | [optional] |
 | **hydra_oauth2_allowed_top_level_claims** | **Array&lt;String&gt;** | A list of custom claims which are allowed to be added top level to the Access Token. They cannot override reserved claims.  This governs the \&quot;oauth2.allowed_top_level_claims\&quot; setting. | [optional] |
 | **hydra_oauth2_client_credentials_default_grant_allowed_scope** | **Boolean** | Automatically grant authorized OAuth2 Scope in OAuth2 Client Credentials Flow.  Each OAuth2 Client is allowed to request a predefined OAuth2 Scope (for example &#x60;read write&#x60;). If this option is enabled, the full scope is automatically granted when performing the OAuth2 Client Credentials flow.  If disabled, the OAuth2 Client has to request the scope in the OAuth2 request by providing the &#x60;scope&#x60; query parameter.  Setting this option to true is common if you need compatibility with MITREid.  This governs the \&quot;oauth2.client_credentials.default_grant_allowed_scope\&quot; setting. | [optional] |
+| **hydra_oauth2_device_authorization_token_polling_interval** | **String** | Configures how often a non-interactive device should poll the OAuth 2.0 Device Authorization Grant token endpoint. Purely informational — the value is reported to the device in the \&quot;interval\&quot; response field of the device authorization response. Hydra defaults to 5s when this is left empty.  This is an Enterprise feature.  This governs the \&quot;oauth2.device_authorization.token_polling_interval\&quot; setting. | [optional] |
+| **hydra_oauth2_device_authorization_user_code_entropy_preset** | **String** | Picks a preset for the OAuth 2.0 Device Authorization Grant user_code length and character set. \&quot;high\&quot; produces the longest codes (most resistant to brute force); \&quot;low\&quot; the shortest (easiest for the end user to read and enter). Leave empty to keep Hydra&#39;s default preset.  This is an Enterprise feature.  This governs the \&quot;oauth2.device_authorization.user_code.entropy_preset\&quot; setting. | [optional] |
 | **hydra_oauth2_exclude_not_before_claim** | **Boolean** | Set to true if you want to omit the &#x60;nbf&#x60; (not valid before) claim in the access token.  This governs the \&quot;oauth2.exclude_not_before_claim\&quot; setting. | [optional] |
 | **hydra_oauth2_grant_jwt_iat_optional** | **Boolean** | Configures if the issued at (&#x60;iat&#x60;) claim is required in the JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants (RFC7523).  If set to &#x60;false&#x60;, the &#x60;iat&#x60; claim is required. Set this value to &#x60;true&#x60; only after careful consideration.  This governs the \&quot;oauth2.grant.jwt.iat_optional\&quot; setting. | [optional] |
 | **hydra_oauth2_grant_jwt_jti_optional** | **Boolean** | Configures if the JSON Web Token ID (&#x60;jti&#x60;) claim is required in the JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants (RFC7523).  If set to &#x60;false&#x60;, the &#x60;jti&#x60; claim is required. Set this value to &#x60;true&#x60; only after careful consideration.  This governs the \&quot;oauth2.grant.jwt.jti_optional\&quot; setting. | [optional] |
@@ -49,10 +54,13 @@
 | **hydra_strategies_scope** | **String** | Defines how scopes are matched. For more details have a look at https://github.com/ory/fosite#scopes  This governs the \&quot;strategies.scope\&quot; setting. exact Oauth2ScopeStrategyExact wildcard Oauth2ScopeStrategyWildcard | [optional][default to &#39;wildcard&#39;] |
 | **hydra_ttl_access_token** | **String** | This governs the \&quot;ttl.access_token\&quot; setting. | [optional][default to &#39;30m&#39;] |
 | **hydra_ttl_auth_code** | **String** | Configures how long refresh tokens are valid.  Set to -1 for refresh tokens to never expire. This is not recommended!  This governs the \&quot;ttl.auth_code\&quot; setting. | [optional][default to &#39;720h&#39;] |
+| **hydra_ttl_device_user_code** | **String** | Configures how long the device_code and user_code in the OAuth 2.0 Device Authorization Grant remain valid. Larger values mean more database storage; shorter values mean users have less time to complete the second-device verification. Hydra defaults to 10m when this is left empty.  This is an Enterprise feature.  This governs the \&quot;ttl.device_user_code\&quot; setting. | [optional] |
 | **hydra_ttl_id_token** | **String** | This governs the \&quot;ttl.id_token\&quot; setting. | [optional][default to &#39;30m&#39;] |
 | **hydra_ttl_login_consent_request** | **String** | Configures how long a user login and consent flow may take.  This governs the \&quot;ttl.login_consent_request\&quot; setting. | [optional][default to &#39;30m&#39;] |
 | **hydra_ttl_refresh_token** | **String** | Configures how long refresh tokens are valid.  Set to -1 for refresh tokens to never expire. This is not recommended!  This governs the \&quot;ttl.refresh_token\&quot; setting. | [optional][default to &#39;720h&#39;] |
 | **hydra_urls_consent** | **String** | Sets the OAuth2 Consent Endpoint URL of the OAuth2 User Login &amp; Consent flow.  Defaults to the Ory Account Experience if left empty.  This governs the \&quot;urls.consent\&quot; setting. | [optional] |
+| **hydra_urls_device_success** | **String** | Sets the URL the user is redirected to after successfully completing the OAuth 2.0 Device Authorization Grant user verification step. Defaults to the Ory Account Experience fallback page if left empty.  This is an Enterprise feature.  This governs the \&quot;urls.device.success\&quot; setting. | [optional] |
+| **hydra_urls_device_verification** | **String** | Sets the URL of the user verification page for the OAuth 2.0 Device Authorization Grant (RFC 8628). End users are redirected to this URL to enter the user_code shown on their device. Defaults to the Ory Account Experience fallback page if left empty.  This is an Enterprise feature.  This governs the \&quot;urls.device.verification\&quot; setting. | [optional] |
 | **hydra_urls_error** | **String** | Sets the OAuth2 Error URL of the OAuth2 User Login &amp; Consent flow.  Defaults to the Ory Account Experience if left empty.  This governs the \&quot;urls.error\&quot; setting. | [optional] |
 | **hydra_urls_login** | **String** | Sets the OAuth2 Login Endpoint URL of the OAuth2 User Login &amp; Consent flow.  Defaults to the Ory Account Experience if left empty.  This governs the \&quot;urls.login\&quot; setting. | [optional] |
 | **hydra_urls_logout** | **String** | Sets the logout endpoint.  Defaults to the Ory Account Experience if left empty.  This governs the \&quot;urls.logout\&quot; setting. | [optional] |
@@ -62,6 +70,7 @@
 | **hydra_webfinger_jwks_broadcast_keys** | **Array&lt;String&gt;** | A list of JSON Web Keys that should be exposed at that endpoint. This is usually the public key for verifying OpenID Connect ID Tokens. However, you might want to add additional keys here as well.  This governs the \&quot;webfinger.jwks.broadcast_keys\&quot; setting. | [optional] |
 | **hydra_webfinger_oidc_discovery_auth_url** | **String** | Configures OpenID Connect Discovery and overwrites the OAuth2 Authorization URL.  This governs the \&quot;webfinger.oidc_discovery.auth_url\&quot; setting. | [optional] |
 | **hydra_webfinger_oidc_discovery_client_registration_url** | **String** | Configures OpenID Connect Discovery and overwrites the OpenID Connect Dynamic Client Registration Endpoint.  This governs the \&quot;webfinger.oidc_discovery.client_registration_url\&quot; setting. | [optional] |
+| **hydra_webfinger_oidc_discovery_device_authorization_url** | **String** | Override the OAuth 2.0 Device Authorization Endpoint URL that is advertised in the OpenID Connect discovery document (/.well-known/openid-configuration). Defaults to the project&#39;s public base URL + /oauth2/device/auth.  This is an Enterprise feature.  This governs the \&quot;webfinger.oidc_discovery.device_authorization_url\&quot; setting. | [optional] |
 | **hydra_webfinger_oidc_discovery_jwks_url** | **String** | Configures OpenID Connect Discovery and overwrites the JWKS URL.  This governs the \&quot;webfinger.oidc_discovery.jwks_url\&quot; setting. | [optional] |
 | **hydra_webfinger_oidc_discovery_supported_claims** | **Array&lt;String&gt;** | Configures OpenID Connect Discovery and overwrites a list of supported claims to be broadcasted. Claim \&quot;sub\&quot; is always included.  This governs the \&quot;webfinger.oidc_discovery.supported_claims\&quot; setting. | [optional] |
 | **hydra_webfinger_oidc_discovery_supported_scope** | **Array&lt;String&gt;** | Configures OpenID Connect Discovery and overwrites the scope OAuth 2.0 Clients may request. Scope &#x60;offline&#x60;, &#x60;offline_access&#x60;, and &#x60;openid&#x60; are always included.  This governs the \&quot;webfinger.oidc_discovery.supported_scope\&quot; setting. | [optional] |
@@ -212,11 +221,11 @@
 | **kratos_selfservice_methods_code_passwordless_enabled** | **Boolean** | Configures whether Ory Kratos Passwordless should use the Code Method  This governs the \&quot;selfservice.methods.code.passwordless_enabled\&quot; setting. | [optional] |
 | **kratos_selfservice_methods_code_passwordless_login_fallback_enabled** | **Boolean** | This setting allows the code method to always login a user with code if they have registered with another authentication method such as password or social sign in.  This governs the \&quot;selfservice.methods.code.passwordless_login_fallback_enabled\&quot; setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_android_app_ids** | **Array&lt;String&gt;** | Configures the allow-list of Android app signing-certificate digests that a device key may be bound to.  This governs the \&quot;selfservice.methods.deviceauthn.config.android_app_ids\&quot; setting. | [optional] |
-| **kratos_selfservice_methods_deviceauthn_config_first_factor** | **Boolean** | Configures whether device authentication may be used as the sole first factor.  This governs the \&quot;selfservice.methods.deviceauthn.config.first_factor\&quot; setting. | [optional] |
+| **kratos_selfservice_methods_deviceauthn_config_first_factor** | **Boolean** | Configures whether device authentication may be used as the sole first factor.  When enabled, a confirmed device key with PIN or platform user verification can complete an AAL2 login in a single submission, without a password or code. Defaults to false, which keeps device keys usable only as a second factor (step-up).  This governs the \&quot;selfservice.methods.deviceauthn.config.first_factor\&quot; setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_insecure_allow_relaxed_attestation** | **Boolean** | Configures whether Ory Kratos Device authentication accepts relaxed attestations for testing  Only allowed on development projects and forced off otherwise. Keys enrolled under relaxation are short-lived and refused once this is turned off.  This governs the \&quot;selfservice.methods.deviceauthn.config.insecure_allow_relaxed_attestation\&quot; setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_ios_app_ids** | **Array&lt;String&gt;** | Configures the allow-list of Apple App IDs that a device key may be bound to.  This governs the \&quot;selfservice.methods.deviceauthn.config.ios_app_ids\&quot; setting. | [optional] |
-| **kratos_selfservice_methods_deviceauthn_config_ios_biometric_first_factor** | **Boolean** | Configures whether an iOS biometric device key may be used as the sole first factor.  This governs the \&quot;selfservice.methods.deviceauthn.config.ios_biometric_first_factor\&quot; setting. | [optional] |
-| **kratos_selfservice_methods_deviceauthn_config_pin_max_attempts** | **Integer** | Configures the consecutive wrong-PIN limit before a device key is locked.  This governs the \&quot;selfservice.methods.deviceauthn.config.pin_max_attempts\&quot; setting. | [optional] |
+| **kratos_selfservice_methods_deviceauthn_config_ios_biometric_first_factor** | **Boolean** | Configures whether an iOS biometric device key may be used as the sole first factor.  Apple App Attest cannot prove biometric gating, so iOS keys with \&quot;platform\&quot; user verification count as a first factor only with this explicit opt-in. Android keys are unaffected, as their user verification is attestation-verified. Defaults to false.  This governs the \&quot;selfservice.methods.deviceauthn.config.ios_biometric_first_factor\&quot; setting. | [optional] |
+| **kratos_selfservice_methods_deviceauthn_config_pin_max_attempts** | **Integer** | Configures the number of consecutive wrong-PIN attempts before a device key is locked.  Defaults to 5; must be between 1 and 10. Once locked, the key&#39;s pin_secret is invalidated and the key can no longer be used to log in until the user rotates its secret through the fallback login.  This governs the \&quot;selfservice.methods.deviceauthn.config.pin_max_attempts\&quot; setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_enabled** | **Boolean** | Configures whether Ory Kratos Device authentication is enabled  This governs the \&quot;selfservice.methods.deviceauthn.enabled\&quot; setting. | [optional] |
 | **kratos_selfservice_methods_link_config_base_url** | **String** | Configures the Base URL which Recovery, Verification, and Login Links Point to  It is recommended to leave this value empty. It will be appropriately configured to the best matching domain (e.g. when using custom domains) automatically.  This governs the \&quot;selfservice.methods.link.config.base_url\&quot; setting. | [optional] |
 | **kratos_selfservice_methods_link_config_lifespan** | **String** | Configures the Ory Kratos Link Method&#39;s lifespan  This governs the \&quot;selfservice.methods.link.config.lifespan\&quot; setting. | [optional] |
@@ -276,10 +285,12 @@
 | **talos_credentials_derived_tokens_macaroon_prefix_current** | **String** | Talos derived tokens macaroon prefix (current). | [optional] |
 | **talos_credentials_derived_tokens_macaroon_prefix_retired** | **Array&lt;String&gt;** | Talos derived tokens macaroon prefix (retired).  Previously active macaroon prefixes kept for verification of outstanding tokens. The first element of this list was the most recently retired active prefix. | [optional] |
 | **talos_credentials_issuer** | **String** | Talos credentials issuer URL. | [optional] |
-| **talos_credentials_issuer_retired** | **Array&lt;String&gt;** | Talos credentials retired issuer URLs.  Previously active issuer URLs kept for verification of outstanding tokens. Tokens signed with these issuers remain valid; new tokens use the current issuer. | [optional] |
+| **talos_credentials_issuer_retired** | **Array&lt;String&gt;** | Talos credentials retired issuer URLs (deprecated).  Deprecated: values-only view of talos_credentials_issuer_retired_entries, kept so already-released SDKs that decode this field as an array of strings keep working. It is output only: reads are derived from the entries field and writes to it are ignored. Use talos_credentials_issuer_retired_entries instead. | [optional][readonly] |
+| **talos_credentials_issuer_retired_entries** | [**Array&lt;TalosRetiredValue&gt;**](TalosRetiredValue.md) | TalosRetiredValues is the list of retired values — retired HMAC secrets or retired issuer URLs — for a Talos project. A retired value stays valid for verification until its optional expiry passes, so operators can bound how long an old credential keeps working after a rotation instead of keeping it forever. Legacy bare-string entries are accepted on write and normalized to the object form. | [optional] |
 | **talos_rate_limit_enabled** | **Boolean** | Talos rate limit enabled.  When true, server-side rate limiting is enforced for API key verifications. | [optional] |
-| **talos_secrets_hmac_current** | **String** | TalosSecretsHMACCurrent stores the current HMAC symmetric key as a plain secret string. Application-layer encryption is handled upstream; SanitizeModel (MarshalJSON) redacts this field from API responses. | [optional] |
-| **talos_secrets_hmac_retired** | **Array&lt;String&gt;** | TalosSecretsHMACRetired stores previously active HMAC symmetric keys as a JSON array of plain secret strings. Application-layer encryption is handled upstream; SanitizeModel (MarshalJSON) redacts this field from API responses. The verifier tries all retired secrets when the current key does not produce a matching HMAC. | [optional] |
+| **talos_secrets_hmac_current** | **String** | TalosSecretsHMACCurrent stores the current HMAC symmetric key as a plain secret string. | [optional] |
+| **talos_secrets_hmac_retired** | **Array&lt;String&gt;** | TalosSecretsHMACRetired stores previously active HMAC symmetric keys as an array of strings (deprecated).  Deprecated: values-only view of talos_secrets_hmac_retired_entries, kept so already-released SDKs that decode this field as an array of strings keep working. It is output only and writes to it are ignored. HMAC secrets are server-managed and redacted on output, so this field is always empty on the wire. Use talos_secrets_hmac_retired_entries instead. | [optional][readonly] |
+| **talos_secrets_hmac_retired_entries** | [**Array&lt;TalosRetiredValue&gt;**](TalosRetiredValue.md) | TalosRetiredValues is the list of retired values — retired HMAC secrets or retired issuer URLs — for a Talos project. A retired value stays valid for verification until its optional expiry passes, so operators can bound how long an old credential keeps working after a rotation instead of keeping it forever. Legacy bare-string entries are accepted on write and normalized to the object form. | [optional] |
 | **updated_at** | **Time** | Last Time Project&#39;s Revision was Updated | [optional][readonly] |
 ## Example
@@ -288,6 +299,7 @@
 require 'ory-client'
 instance = OryClient::NormalizedProjectRevision.new(
+  account_experience_contact_url: null,
   account_experience_custom_translations: null,
   account_experience_default_locale: null,
   account_experience_enabled_locales: null,
@@ -298,6 +310,8 @@ instance = OryClient::NormalizedProjectRevision.new(
   account_experience_locale_behavior: null,
   account_experience_logo_dark: null,
   account_experience_logo_light: null,
+  account_experience_privacy_policy_url: null,
+  account_experience_terms_of_service_url: null,
   account_experience_theme_variables_dark: null,
   account_experience_theme_variables_light: null,
   created_at: null,
@@ -305,6 +319,8 @@ instance = OryClient::NormalizedProjectRevision.new(
   enable_ax_v2: null,
   hydra_oauth2_allowed_top_level_claims: null,
   hydra_oauth2_client_credentials_default_grant_allowed_scope: null,
+  hydra_oauth2_device_authorization_token_polling_interval: 15s,
+  hydra_oauth2_device_authorization_user_code_entropy_preset: null,
   hydra_oauth2_exclude_not_before_claim: null,
   hydra_oauth2_grant_jwt_iat_optional: null,
   hydra_oauth2_grant_jwt_jti_optional: null,
@@ -333,10 +349,13 @@ instance = OryClient::NormalizedProjectRevision.new(
   hydra_strategies_scope: null,
   hydra_ttl_access_token: 1h,
   hydra_ttl_auth_code: 30m,
+  hydra_ttl_device_user_code: 30m,
   hydra_ttl_id_token: 1h,
   hydra_ttl_login_consent_request: 1h,
   hydra_ttl_refresh_token: 30m,
   hydra_urls_consent: null,
+  hydra_urls_device_success: null,
+  hydra_urls_device_verification: null,
   hydra_urls_error: null,
   hydra_urls_login: null,
   hydra_urls_logout: null,
@@ -346,6 +365,7 @@ instance = OryClient::NormalizedProjectRevision.new(
   hydra_webfinger_jwks_broadcast_keys: null,
   hydra_webfinger_oidc_discovery_auth_url: null,
   hydra_webfinger_oidc_discovery_client_registration_url: null,
+  hydra_webfinger_oidc_discovery_device_authorization_url: null,
   hydra_webfinger_oidc_discovery_jwks_url: null,
   hydra_webfinger_oidc_discovery_supported_claims: null,
   hydra_webfinger_oidc_discovery_supported_scope: null,
@@ -561,9 +581,11 @@ instance = OryClient::NormalizedProjectRevision.new(
   talos_credentials_derived_tokens_macaroon_prefix_retired: null,
   talos_credentials_issuer: null,
   talos_credentials_issuer_retired: null,
+  talos_credentials_issuer_retired_entries: null,
   talos_rate_limit_enabled: null,
   talos_secrets_hmac_current: null,
   talos_secrets_hmac_retired: null,
+  talos_secrets_hmac_retired_entries: null,
   updated_at: null
 )
 ```

data/docs/OAuth2Api.md CHANGED Viewed

@@ -11,6 +11,7 @@ All URIs are relative to *https://playground.projects.oryapis.com*
 | [**create_o_auth2_client**](OAuth2Api.md#create_o_auth2_client) | **POST** /admin/clients | Create OAuth 2.0 Client |
 | [**delete_o_auth2_client**](OAuth2Api.md#delete_o_auth2_client) | **DELETE** /admin/clients/{id} | Delete OAuth 2.0 Client |
 | [**delete_o_auth2_token**](OAuth2Api.md#delete_o_auth2_token) | **DELETE** /admin/oauth2/tokens | Delete OAuth 2.0 Access Tokens from specific OAuth 2.0 Client |
+| [**delete_rotated_o_auth2_client_secrets**](OAuth2Api.md#delete_rotated_o_auth2_client_secrets) | **DELETE** /admin/clients/{id}/secrets/rotate | Delete Rotated OAuth 2.0 Client Secrets |
 | [**delete_trusted_o_auth2_jwt_grant_issuer**](OAuth2Api.md#delete_trusted_o_auth2_jwt_grant_issuer) | **DELETE** /admin/trust/grants/jwt-bearer/issuers/{id} | Delete Trusted OAuth2 JWT Bearer Grant Type Issuer |
 | [**get_o_auth2_client**](OAuth2Api.md#get_o_auth2_client) | **GET** /admin/clients/{id} | Get an OAuth 2.0 Client |
 | [**get_o_auth2_consent_request**](OAuth2Api.md#get_o_auth2_consent_request) | **GET** /admin/oauth2/auth/requests/consent | Get OAuth 2.0 Consent Request |
@@ -32,6 +33,7 @@ All URIs are relative to *https://playground.projects.oryapis.com*
 | [**revoke_o_auth2_consent_sessions**](OAuth2Api.md#revoke_o_auth2_consent_sessions) | **DELETE** /admin/oauth2/auth/sessions/consent | Revoke OAuth 2.0 Consent Sessions of a Subject |
 | [**revoke_o_auth2_login_sessions**](OAuth2Api.md#revoke_o_auth2_login_sessions) | **DELETE** /admin/oauth2/auth/sessions/login | Revokes OAuth 2.0 Login Sessions by either a Subject or a SessionID |
 | [**revoke_o_auth2_token**](OAuth2Api.md#revoke_o_auth2_token) | **POST** /oauth2/revoke | Revoke OAuth 2.0 Access or Refresh Token |
+| [**rotate_o_auth2_client_secret**](OAuth2Api.md#rotate_o_auth2_client_secret) | **POST** /admin/clients/{id}/secrets/rotate | Rotate OAuth 2.0 Client Secret |
 | [**set_o_auth2_client**](OAuth2Api.md#set_o_auth2_client) | **PUT** /admin/clients/{id} | Set OAuth 2.0 Client |
 | [**set_o_auth2_client_lifespans**](OAuth2Api.md#set_o_auth2_client_lifespans) | **PUT** /admin/clients/{id}/lifespans | Set OAuth2 Client Token Lifespans |
 | [**trust_o_auth2_jwt_grant_issuer**](OAuth2Api.md#trust_o_auth2_jwt_grant_issuer) | **POST** /admin/trust/grants/jwt-bearer/issuers | Trust OAuth2 JWT Bearer Grant Type Issuer |
@@ -530,6 +532,75 @@ nil (empty response body)
 - **Accept**: application/json
+## delete_rotated_o_auth2_client_secrets
+> <OAuth2Client> delete_rotated_o_auth2_client_secrets(id)
+Delete Rotated OAuth 2.0 Client Secrets
+Removes all rotated secrets from an OAuth 2.0 client. This should be called after all services have been updated to use the new secret and the old secrets are no longer needed.
+### Examples
+```ruby
+require 'time'
+require 'ory-client'
+# setup authorization
+OryClient.configure do |config|
+  # Configure Bearer authorization: oryAccessToken
+  config.access_token = 'YOUR_BEARER_TOKEN'
+end
+api_instance = OryClient::OAuth2Api.new
+id = 'id_example' # String | OAuth 2.0 Client ID
+begin
+  # Delete Rotated OAuth 2.0 Client Secrets
+  result = api_instance.delete_rotated_o_auth2_client_secrets(id)
+  p result
+rescue OryClient::ApiError => e
+  puts "Error when calling OAuth2Api->delete_rotated_o_auth2_client_secrets: #{e}"
+end
+```
+#### Using the delete_rotated_o_auth2_client_secrets_with_http_info variant
+This returns an Array which contains the response data, status code and headers.
+> <Array(<OAuth2Client>, Integer, Hash)> delete_rotated_o_auth2_client_secrets_with_http_info(id)
+```ruby
+begin
+  # Delete Rotated OAuth 2.0 Client Secrets
+  data, status_code, headers = api_instance.delete_rotated_o_auth2_client_secrets_with_http_info(id)
+  p status_code # => 2xx
+  p headers # => { ... }
+  p data # => <OAuth2Client>
+rescue OryClient::ApiError => e
+  puts "Error when calling OAuth2Api->delete_rotated_o_auth2_client_secrets_with_http_info: #{e}"
+end
+```
+### Parameters
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **id** | **String** | OAuth 2.0 Client ID |  |
+### Return type
+[**OAuth2Client**](OAuth2Client.md)
+### Authorization
+[oryAccessToken](../README.md#oryAccessToken)
+### HTTP request headers
+- **Content-Type**: Not defined
+- **Accept**: application/json
 ## delete_trusted_o_auth2_jwt_grant_issuer
 > delete_trusted_o_auth2_jwt_grant_issuer(id)
@@ -1456,7 +1527,7 @@ end
 Patch OAuth 2.0 Client
-Patch an existing OAuth 2.0 Client using JSON Patch. If you pass `client_secret` the secret will be updated and returned via the API. This is the only time you will be able to retrieve the client secret, so write it down and keep it safe.  OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.
+Patch an existing OAuth 2.0 Client using JSON Patch. If you update `client_secret`, the secret will be updated and returned via the API. This is the only time you will be able to retrieve the client secret. Passing a new `client_secret` will clear all rotated secrets.  To perform a seamless client secret rotation, use the `rotateOAuth2ClientSecret` endpoint instead.  OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.
 ### Examples
@@ -2022,13 +2093,82 @@ nil (empty response body)
 - **Accept**: application/json
+## rotate_o_auth2_client_secret
+> <OAuth2Client> rotate_o_auth2_client_secret(id)
+Rotate OAuth 2.0 Client Secret
+Rotates an OAuth 2.0 client's secrets. The old secret will remain valid for authentication, allowing for zero-downtime secret rotations. A new secret will be generated and returned in the response.  Up to five rotated secrets are retained. Use the `deleteRotatedOAuth2ClientSecrets` endpoint to remove old rotated secrets when they are no longer needed.
+### Examples
+```ruby
+require 'time'
+require 'ory-client'
+# setup authorization
+OryClient.configure do |config|
+  # Configure Bearer authorization: oryAccessToken
+  config.access_token = 'YOUR_BEARER_TOKEN'
+end
+api_instance = OryClient::OAuth2Api.new
+id = 'id_example' # String | OAuth 2.0 Client ID
+begin
+  # Rotate OAuth 2.0 Client Secret
+  result = api_instance.rotate_o_auth2_client_secret(id)
+  p result
+rescue OryClient::ApiError => e
+  puts "Error when calling OAuth2Api->rotate_o_auth2_client_secret: #{e}"
+end
+```
+#### Using the rotate_o_auth2_client_secret_with_http_info variant
+This returns an Array which contains the response data, status code and headers.
+> <Array(<OAuth2Client>, Integer, Hash)> rotate_o_auth2_client_secret_with_http_info(id)
+```ruby
+begin
+  # Rotate OAuth 2.0 Client Secret
+  data, status_code, headers = api_instance.rotate_o_auth2_client_secret_with_http_info(id)
+  p status_code # => 2xx
+  p headers # => { ... }
+  p data # => <OAuth2Client>
+rescue OryClient::ApiError => e
+  puts "Error when calling OAuth2Api->rotate_o_auth2_client_secret_with_http_info: #{e}"
+end
+```
+### Parameters
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **id** | **String** | OAuth 2.0 Client ID |  |
+### Return type
+[**OAuth2Client**](OAuth2Client.md)
+### Authorization
+[oryAccessToken](../README.md#oryAccessToken)
+### HTTP request headers
+- **Content-Type**: Not defined
+- **Accept**: application/json
 ## set_o_auth2_client
 > <OAuth2Client> set_o_auth2_client(id, o_auth2_client)
 Set OAuth 2.0 Client
-Replaces an existing OAuth 2.0 Client with the payload you send. If you pass `client_secret` the secret is used, otherwise the existing secret is used.  If set, the secret is echoed in the response. It is not possible to retrieve it later on.  OAuth 2.0 Clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.
+Replaces an existing OAuth 2.0 Client with the payload you send. If you pass `client_secret` the secret is used, otherwise the existing secret is used. Rotated secrets will be cleared if you pass a new `client_secret`.  If set, the secret is echoed in the response. It is not possible to retrieve it later on.  To perform a seamless client secret rotation, use the `rotateOAuth2ClientSecret` endpoint instead.  OAuth 2.0 Clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.
 ### Examples

data/docs/OAuth2Client.md CHANGED Viewed

@@ -44,7 +44,7 @@
 | **registration_client_uri** | **String** | OpenID Connect Dynamic Client Registration URL  RegistrationClientURI is the URL used to update, get, or delete the OAuth2 Client. | [optional] |
 | **request_object_signing_alg** | **String** | OpenID Connect Request Object Signing Algorithm  JWS [JWS] alg algorithm [JWA] that MUST be used for signing Request Objects sent to the OP. All Request Objects from this Client MUST be rejected, if not signed with this algorithm. | [optional] |
 | **request_uris** | **Array&lt;String&gt;** | OpenID Connect Request URIs  Array of request_uri values that are pre-registered by the RP for use at the OP. Servers MAY cache the contents of the files referenced by these URIs and not retrieve them at the time they are used in a request. OPs can require that request_uri values used be pre-registered with the require_request_uri_registration discovery parameter. | [optional] |
-| **response_types** | **Array&lt;String&gt;** | OAuth 2.0 Client Response Types  An array of the OAuth 2.0 response type strings that the client can use at the authorization endpoint. Can be one of:  Needed for OpenID Connect Implicit Grant: Returns ID Token to redirect URI: &#x60;id_token&#x60; Returns Access token redirect URI: &#x60;token&#x60; Needed for Authorization Code Grant: &#x60;code&#x60; | [optional] |
+| **response_types** | **Array&lt;String&gt;** | OAuth 2.0 Client Response Types  An array of the OAuth 2.0 response type strings that the client can use at the authorization endpoint. Possible values are:  &#x60;code&#x60; for Authorization Code Grant. &#x60;token&#x60; or &#x60;id_token&#x60; or &#x60;token id_token&#x60; for OpenID Connect Implicit Grant (not recommended). &#x60;code token&#x60; or &#x60;code id_token&#x60; or &#x60;code token id_token&#x60; for OpenID Connect Hybrid Flow (not recommended). | [optional] |
 | **scope** | **String** | OAuth 2.0 Client Scope  Scope is a string containing a space-separated list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client can use when requesting access tokens. | [optional] |
 | **sector_identifier_uri** | **String** | OpenID Connect Sector Identifier URI  URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a file with a single JSON array of redirect_uri values. | [optional] |
 | **skip_consent** | **Boolean** | SkipConsent skips the consent screen for this client. This field can only be set from the admin API. | [optional] |

data/docs/OrganizationByHostname.md ADDED Viewed

@@ -0,0 +1,20 @@
+# OryClient::OrganizationByHostname
+## Properties
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **domains** | **Array&lt;String&gt;** | Domains are the organization&#39;s SSO domains. |  |
+| **id** | **String** | ID is the organization&#39;s unique identifier. |  |
+## Example
+```ruby
+require 'ory-client'
+instance = OryClient::OrganizationByHostname.new(
+  domains: null,
+  id: null
+)
+```

data/docs/PINConfig.md CHANGED Viewed

@@ -4,10 +4,10 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **created_at** | **Time** | CreatedAt is when the pin_secret was first issued. | [optional] |
-| **failed_attempts** | **Integer** | FailedAttempts counts consecutive wrong-PIN attempts; the key locks when it reaches the configured maximum. | [optional] |
-| **pin_secret** | **String** | PINSecret is the at-rest pin_secret ciphertext. Server-internal: never logged or transmitted. Empty once the key locks. | [optional] |
-| **rotated_at** | **Time** | RotatedAt is when the pin_secret was last rotated; the zero value means never rotated. omitzero (not omitempty) drops the zero timestamp from the JSON, since omitempty never treats a time.Time value as empty. | [optional] |
+| **created_at** | **Time** | When the pin_secret was first issued. | [optional] |
+| **failed_attempts** | **Integer** | The number of consecutive wrong-PIN attempts so far; the key locks when it reaches the configured maximum (pin_max_attempts, default 5). | [optional] |
+| **pin_secret** | **String** | The at-rest ciphertext of the pin_secret. It never leaves the server and is cleared once the key locks. | [optional] |
+| **rotated_at** | **Time** | When the pin_secret was last rotated. Omitted if the secret was never rotated. | [optional] |
 ## Example

data/docs/QuotaUsage.md CHANGED Viewed

@@ -6,7 +6,7 @@
 | ---- | ---- | ----------- | ----- |
 | **additional_price** | **String** | The additional price per unit in cents. |  |
 | **can_use_more** | **Boolean** |  |  |
-| **feature** | **String** |  production_projects ProductionProjects staging_projects StagingProjects development_projects DevelopmentProjects daily_active_users DailyActiveUsers custom_domains CustomDomains event_streams EventStreams event_stream_events EventStreamEvents sla SLA collaborator_seats CollaboratorSeats edge_cache EdgeCache branding_themes BrandingThemes zendesk_support ZendeskSupport zendesk_support_on_call ZendeskSupportOnCall project_metrics ProjectMetrics project_metrics_time_window ProjectMetricsTimeWindow project_metrics_events_history ProjectMetricsEventsHistory organizations Organizations rop_grant ResourceOwnerPasswordGrant concierge_onboarding ConciergeOnboarding credit Credit data_location_global DataLocationGlobal data_location_us DataLocationUS data_location_asiane DataLocationAsiaNorthEast m2m_token_issuance M2MTokenIssuance permission_checks PermissionChecks captcha Captcha captcha_byo CaptchaBYO hide_ory_branding HideOryBranding identity_search_api IdentitySearchAPI saml_sp SAMLSP saml_idp SAMLIDP auto_link_policy AutoLinkPolicy scim_clients SCIMClients default_smtp_email_customization DefaultSMTPEmailCustomization onboarding_portal OnboardingPortal console_organization_sso ConsoleOrganizationSSO talos_api_keys TalosAPIKeys talos_rate_limit TalosRateLimit talos_cache TalosCache graceful_refresh_token_count GracefulRefreshTokenCount hydra_token_prefix HydraTokenPrefix deviceauthn Deviceauthn allow_insecure_origins AllowInsecureOrigins  AllowInsecureOrigins grandfathers a project past strict wildcard  enforcement (CORS origins + return URLs). Override-only; never sold. update_self_service_registration_rate_limit_tier RateLimitTierUpdateSelfServiceRegistration  Self-service rate limits update_self_service_recovery_rate_limit_tier RateLimitTierUpdateSelfServiceRecovery update_self_service_settings_rate_limit_tier RateLimitTierUpdateSelfServiceSettings update_self_service_verification_rate_limit_tier RateLimitTierUpdateSelfServiceVerification identities_create_rate_limit_tier RateLimitTierIdentitiesCreate identities_import_rate_limit_tier RateLimitTierIdentitiesImport fed_cm_parameters_rate_limit_tier RateLimitTierFedCMParameters data_location_regional DataLocationRegional  Required Features rate_limit_tier RateLimitTier session_rate_limit_tier RateLimitTierSessions identities_list_rate_limit_tier RateLimitTierIdentitiesList permission_checks_rate_limit_tier RateLimitTierPermissionChecks oauth2_introspect_rate_limit_tier RateLimitTierOAuth2Introspect create_recovery_admin_rate_limit_tier RateLimitTierCreateAdminRecovery scim_rate_limit_tier RateLimitTierSCIM hydra_admin_high_rate_limit_tier RateLimitTierHydraAdminHigh  Bucket-specific rate limit tiers hydra_admin_medium_rate_limit_tier RateLimitTierHydraAdminMedium hydra_admin_low_rate_limit_tier RateLimitTierHydraAdminLow hydra_public_high_rate_limit_tier RateLimitTierHydraPublicHigh hydra_public_medium_rate_limit_tier RateLimitTierHydraPublicMedium hydra_public_low_rate_limit_tier RateLimitTierHydraPublicLow keto_admin_low_rate_limit_tier RateLimitTierKetoAdminLow keto_admin_medium_rate_limit_tier RateLimitTierKetoAdminMedium keto_public_high_rate_limit_tier RateLimitTierKetoPublicHigh kratos_admin_high_rate_limit_tier RateLimitTierKratosAdminHigh kratos_admin_medium_rate_limit_tier RateLimitTierKratosAdminMedium kratos_admin_low_rate_limit_tier RateLimitTierKratosAdminLow kratos_public_high_rate_limit_tier RateLimitTierKratosPublicHigh kratos_public_medium_rate_limit_tier RateLimitTierKratosPublicMedium kratos_public_low_rate_limit_tier RateLimitTierKratosPublicLow polis_public_high_rate_limit_tier RateLimitTierPolisPublicHigh polis_public_medium_rate_limit_tier RateLimitTierPolisPublicMedium talos_admin_high_rate_limit_tier RateLimitTierTalosAdminHigh talos_admin_medium_rate_limit_tier RateLimitTierTalosAdminMedium talos_admin_low_rate_limit_tier RateLimitTierTalosAdminLow talos_public_high_rate_limit_tier RateLimitTierTalosPublicHigh talos_public_low_rate_limit_tier RateLimitTierTalosPublicLow unassigned_rate_limit_tier RateLimitTierUnassigned |  |
+| **feature** | **String** |  production_projects ProductionProjects staging_projects StagingProjects development_projects DevelopmentProjects daily_active_users DailyActiveUsers custom_domains CustomDomains event_streams EventStreams event_stream_events EventStreamEvents sla SLA collaborator_seats CollaboratorSeats edge_cache EdgeCache branding_themes BrandingThemes zendesk_support ZendeskSupport zendesk_support_on_call ZendeskSupportOnCall project_metrics ProjectMetrics project_metrics_time_window ProjectMetricsTimeWindow project_metrics_events_history ProjectMetricsEventsHistory organizations Organizations rop_grant ResourceOwnerPasswordGrant concierge_onboarding ConciergeOnboarding credit Credit data_location_global DataLocationGlobal data_location_us DataLocationUS data_location_asiane DataLocationAsiaNorthEast m2m_token_issuance M2MTokenIssuance permission_checks PermissionChecks captcha Captcha captcha_byo CaptchaBYO hide_ory_branding HideOryBranding identity_search_api IdentitySearchAPI saml_sp SAMLSP saml_idp SAMLIDP auto_link_policy AutoLinkPolicy scim_clients SCIMClients default_smtp_email_customization DefaultSMTPEmailCustomization onboarding_portal OnboardingPortal console_organization_sso ConsoleOrganizationSSO talos_api_keys TalosAPIKeys talos_rate_limit TalosRateLimit talos_cache TalosCache graceful_refresh_token_count GracefulRefreshTokenCount hydra_token_prefix HydraTokenPrefix hydra_device_authorization HydraDeviceAuthorization deviceauthn Deviceauthn allow_insecure_origins AllowInsecureOrigins  AllowInsecureOrigins grandfathers a project past strict wildcard  enforcement (CORS origins + return URLs). Override-only; never sold. update_self_service_registration_rate_limit_tier RateLimitTierUpdateSelfServiceRegistration  Self-service rate limits update_self_service_recovery_rate_limit_tier RateLimitTierUpdateSelfServiceRecovery update_self_service_settings_rate_limit_tier RateLimitTierUpdateSelfServiceSettings update_self_service_verification_rate_limit_tier RateLimitTierUpdateSelfServiceVerification identities_create_rate_limit_tier RateLimitTierIdentitiesCreate identities_import_rate_limit_tier RateLimitTierIdentitiesImport fed_cm_parameters_rate_limit_tier RateLimitTierFedCMParameters data_location_regional DataLocationRegional  Required Features rate_limit_tier RateLimitTier session_rate_limit_tier RateLimitTierSessions identities_list_rate_limit_tier RateLimitTierIdentitiesList permission_checks_rate_limit_tier RateLimitTierPermissionChecks oauth2_introspect_rate_limit_tier RateLimitTierOAuth2Introspect create_recovery_admin_rate_limit_tier RateLimitTierCreateAdminRecovery scim_rate_limit_tier RateLimitTierSCIM hydra_admin_high_rate_limit_tier RateLimitTierHydraAdminHigh  Bucket-specific rate limit tiers hydra_admin_medium_rate_limit_tier RateLimitTierHydraAdminMedium hydra_admin_low_rate_limit_tier RateLimitTierHydraAdminLow hydra_public_high_rate_limit_tier RateLimitTierHydraPublicHigh hydra_public_medium_rate_limit_tier RateLimitTierHydraPublicMedium hydra_public_low_rate_limit_tier RateLimitTierHydraPublicLow keto_admin_low_rate_limit_tier RateLimitTierKetoAdminLow keto_admin_medium_rate_limit_tier RateLimitTierKetoAdminMedium keto_public_high_rate_limit_tier RateLimitTierKetoPublicHigh kratos_admin_high_rate_limit_tier RateLimitTierKratosAdminHigh kratos_admin_medium_rate_limit_tier RateLimitTierKratosAdminMedium kratos_admin_low_rate_limit_tier RateLimitTierKratosAdminLow kratos_public_high_rate_limit_tier RateLimitTierKratosPublicHigh kratos_public_medium_rate_limit_tier RateLimitTierKratosPublicMedium kratos_public_low_rate_limit_tier RateLimitTierKratosPublicLow polis_public_high_rate_limit_tier RateLimitTierPolisPublicHigh polis_public_medium_rate_limit_tier RateLimitTierPolisPublicMedium talos_admin_high_rate_limit_tier RateLimitTierTalosAdminHigh talos_admin_medium_rate_limit_tier RateLimitTierTalosAdminMedium talos_admin_low_rate_limit_tier RateLimitTierTalosAdminLow talos_public_high_rate_limit_tier RateLimitTierTalosPublicHigh talos_public_low_rate_limit_tier RateLimitTierTalosPublicLow unassigned_rate_limit_tier RateLimitTierUnassigned |  |
 | **feature_available** | **Boolean** |  |  |
 | **included** | **Integer** |  |  |
 | **is_unlimited** | **Boolean** |  |  |

data/docs/TalosRetiredValue.md ADDED Viewed

@@ -0,0 +1,20 @@
+# OryClient::TalosRetiredValue
+## Properties
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **expires_at** | **Time** | Optional RFC 3339 UTC timestamp after which Talos stops accepting this retired value during verification. Omit to never expire. | [optional] |
+| **value** | **String** | The retired secret or issuer URL. |  |
+## Example
+```ruby
+require 'ory-client'
+instance = OryClient::TalosRetiredValue.new(
+  expires_at: 2026-08-01T00:00Z,
+  value: null
+)
+```

data/docs/UpdateLoginFlowWithDeviceAuthnMethod.md CHANGED Viewed

@@ -4,10 +4,10 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **client_key_id** | **String** | ClientKeyID identifies the DeviceAuthn key to authenticate with.  It is the key&#39;s deterministic fingerprint — the lowercase-hex SHA-256 of the device public key in PKIX, ASN.1 DER (SubjectPublicKeyInfo) form — which the device recomputes locally after enrollment. Keys enrolled before the server derived the id use their original client-chosen value. | [optional] |
+| **client_key_id** | **String** | The client_key_id of the enrolled key to authenticate with.  It is the key&#39;s deterministic fingerprint: the lowercase-hex SHA-256 of the device public key in PKIX, ASN.1 DER (SubjectPublicKeyInfo) form, which the device can recompute locally after enrollment. Keys enrolled before the server derived the id use their original client-chosen value. |  |
 | **method** | **String** | Method should be set to \&quot;deviceauthn\&quot; when logging in using the DeviceAuthn strategy. |  |
-| **pin_proof** | **String** | PINProof is an HMAC the client computes using the pin_secret when the key is PIN-protected. It proves possession of the PIN without revealing it.  Sensitive: a proof of the PIN secret, do not log or transmit. It is marked write-only in the spec via the OpenAPI patch in .schema/openapi/patches/selfservice.yaml. | [optional] |
-| **signature** | **String** | Signature is a ES256 signature of the server-provided challenge. | [optional] |
+| **pin_proof** | **String** | The proof of the PIN, required if and only if the key is PIN-protected.  To compute it:  1. Recover the 32-byte pin_secret on the device. It was delivered HPKE-sealed exactly once at enrollment or rotation and is bound to the user&#39;s PIN locally. 2. Compute HMAC-SHA256, keyed with the pin_secret, over the concatenation of three byte strings: the ASCII domain prefix \&quot;ory/deviceauthn/pin-proof/v1\&quot;, the client_key_id exactly as sent (its 64-character lowercase-hex ASCII form, not hex-decoded), and the raw challenge bytes also covered by &#x60;signature&#x60;. 3. Submit the 32-byte MAC output.  The proof shows knowledge of the PIN without transmitting the PIN or the pin_secret. After too many wrong attempts (pin_max_attempts, default 5) the key locks and can no longer be used to log in. | [optional] |
+| **signature** | **String** | The device&#39;s signature over the challenge nonce carried by the login flow&#39;s hidden &#x60;deviceauthn_nonce&#x60; UI node.  To compute it:  1. Base64-decode the &#x60;deviceauthn_nonce&#x60; node&#39;s value and parse the result as JSON. 2. Base64-decode the JSON&#39;s &#x60;nonce&#x60; field. The decoded raw bytes are the challenge. 3. On Android, sign the challenge with the enrolled hardware-backed key using &#x60;Signature.getInstance(\&quot;SHA256withECDSA\&quot;)&#x60; (it hashes internally) and submit the resulting ASN.1 DER-encoded ECDSA signature. On iOS, call &#x60;DCAppAttestService.generateAssertion&#x60;, passing the raw challenge bytes as the &#x60;clientDataHash&#x60; argument — do not hash them again — and submit the returned CBOR-encoded App Attest assertion unchanged. |  |
 | **transient_payload** | **Object** | Transient data to pass along to any webhooks | [optional] |
 ## Example

data/docs/UpdateSettingsFlowWithDeviceAuthnMethod.md CHANGED Viewed

@@ -4,11 +4,11 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **add** | [**UpdateSettingsFlowWithDeviceAuthnMethodAdd**](UpdateSettingsFlowWithDeviceAuthnMethodAdd.md) |  | [optional] |
-| **csrf_token** | **String** | CSRFToken is the anti-CSRF token It only is required to remove a key from the browser. | [optional] |
-| **delete** | [**UpdateSettingsFlowWithDeviceAuthnMethodDelete**](UpdateSettingsFlowWithDeviceAuthnMethodDelete.md) |  | [optional] |
-| **method** | **String** | Method  Should be set to \&quot;deviceauthn\&quot; when trying to add or remove a DeviceAuthn key. |  |
-| **rotate_secret** | [**UpdateSettingsFlowWithDeviceAuthnMethodRotateSecret**](UpdateSettingsFlowWithDeviceAuthnMethodRotateSecret.md) |  | [optional] |
+| **csrf_token** | **String** | CSRFToken is the anti-CSRF token. It is only required to remove a key from the browser. | [optional] |
+| **deviceauthn_register** | [**UpdateSettingsFlowWithDeviceAuthnMethodRegister**](UpdateSettingsFlowWithDeviceAuthnMethodRegister.md) | Enrolls a new device key. Set exactly one of deviceauthn_register, deviceauthn_remove, or rotate_secret. | [optional] |
+| **deviceauthn_remove** | **String** | The client_key_id of the key to remove: the key&#39;s deterministic fingerprint, the lowercase-hex SHA-256 of the device public key in PKIX, ASN.1 DER (SubjectPublicKeyInfo) form. Keys enrolled before the server derived the id use their original client-chosen value. | [optional] |
+| **method** | **String** | Method  Should be set to \&quot;deviceauthn\&quot; when adding, removing, or rotating the secret of a DeviceAuthn key. |  |
+| **rotate_secret** | [**UpdateSettingsFlowWithDeviceAuthnMethodRotateSecret**](UpdateSettingsFlowWithDeviceAuthnMethodRotateSecret.md) | Re-issues the pin_secret of an existing PIN-protected device key. Set exactly one of deviceauthn_register, deviceauthn_remove, or rotate_secret. | [optional] |
 | **transient_payload** | **Object** | Transient data to pass along to any webhooks | [optional] |
 ## Example
@@ -17,9 +17,9 @@
 require 'ory-client'
 instance = OryClient::UpdateSettingsFlowWithDeviceAuthnMethod.new(
-  add: null,
   csrf_token: null,
-  delete: null,
+  deviceauthn_register: null,
+  deviceauthn_remove: null,
   method: null,
   rotate_secret: null,
   transient_payload: null

data/docs/UpdateSettingsFlowWithDeviceAuthnMethodRegister.md ADDED Viewed

@@ -0,0 +1,30 @@
+# OryClient::UpdateSettingsFlowWithDeviceAuthnMethodRegister
+## Properties
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **attestation_ios** | **String** | The CBOR-encoded Apple App Attest attestation object for the new key. Generate the key with &#x60;DCAppAttestService.generateKey&#x60;, then obtain the attestation with &#x60;DCAppAttestService.attestKey&#x60;, passing the enrollment challenge described above as the &#x60;clientDataHash&#x60; argument — do not hash it again — and submit the result unchanged. Set exactly one of certificate_chain_android or attestation_ios. | [optional] |
+| **certificate_chain_android** | **Array&lt;String&gt;** | The Android Key Attestation certificate chain for the new key, one base64-encoded DER certificate per element, leaf first: the first element certifies the on-device key, the last is the Google attestation root.  Generate the key on-device (imported keys are rejected) in the hardware-backed keystore as an elliptic-curve (P-224, P-256, P-384, or P-521) signing key: &#x60;KeyGenParameterSpec.Builder(alias, PURPOSE_SIGN)&#x60; with &#x60;DIGEST_SHA256&#x60; and &#x60;setAttestationChallenge(challenge)&#x60;, where challenge is the enrollment challenge described above. Then submit the chain returned by &#x60;KeyStore.getCertificateChain&#x60;. Set exactly one of certificate_chain_android or attestation_ios. | [optional] |
+| **device_name** | **String** | A human-readable name for the device, e.g. &#39;My work phone&#39;. It helps the user tell this key apart from others. |  |
+| **pin_protected** | **Boolean** | Set to true to enroll the key as PIN-protected. The server then mints a 32-byte pin_secret and returns it exactly once, in the settings-flow response: the &#x60;continue_with&#x60; array contains an item with action &#x60;show_pin_entry_ui&#x60; whose &#x60;data.enc&#x60; (HPKE encapsulated key) and &#x60;data.ciphertext&#x60; (sealed pin_secret) fields are base64-encoded and sealed to transport_public_key. Open them on the device with the transport private key using HPKE with DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, AES-128-GCM, the ASCII info string \&quot;ory/deviceauthn/pin-secret/v1\&quot;, and the client_key_id (its ASCII hex form) as the AAD, then bind the secret to the user&#39;s PIN locally. The sealed secret is never delivered again; logins with the key must then include a pin_proof. | [optional] |
+| **transport_public_key** | **String** | The device&#39;s X25519 transport public key (32 bytes, base64-encoded) used to seal the returned pin_secret so only this device can open it. Required when pin_protected is true, ignored otherwise.  Generate a fresh, random X25519 key pair for each request — for example with CryptoKit&#39;s &#x60;Curve25519.KeyAgreement.PrivateKey()&#x60; on iOS or &#x60;KeyPairGenerator.getInstance(\&quot;XDH\&quot;)&#x60; on Android — and submit the raw 32-byte public key. It is a transport-encryption key, distinct from the attested signing key. Keep the private key only until the sealed pin_secret from the response has been opened, then discard it. The HPKE suite is DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, AES-128-GCM. | [optional] |
+| **user_verification** | [**UserVerification**](UserVerification.md) | Declares how the key&#39;s holder is verified at use time. One of \&quot;pin\&quot;, \&quot;platform\&quot;, or \&quot;none\&quot; (or empty, which maps to \&quot;none\&quot;). \&quot;pin\&quot; is implied by pin_protected and need not be set explicitly.  For \&quot;platform\&quot; on Android, generate the key with &#x60;setUserAuthenticationRequired(true)&#x60;: the server rejects the claim unless the attestation shows user-authentication gating (KeyMint user_auth_type). On iOS the declaration is trusted, since App Attest cannot prove biometric gating; iOS platform keys therefore count as a sole first factor only when the project enables ios_biometric_first_factor. | [optional] |
+| **version** | **Integer** | The cryptography version to enroll the key with. Only &#x60;1&#x60; is currently supported, which corresponds to ECDSA with SHA-256 on an elliptic curve (P-224, P-256, P-384, or P-521). |  |
+## Example
+```ruby
+require 'ory-client'
+instance = OryClient::UpdateSettingsFlowWithDeviceAuthnMethodRegister.new(
+  attestation_ios: null,
+  certificate_chain_android: null,
+  device_name: null,
+  pin_protected: null,
+  transport_public_key: null,
+  user_verification: null,
+  version: null
+)
+```

data/docs/UpdateSettingsFlowWithDeviceAuthnMethodRotateSecret.md CHANGED Viewed

@@ -4,9 +4,9 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **client_key_id** | **String** | ClientKeyID identifies the existing PIN key whose pin_secret should be rotated: the lowercase-hex SHA-256 of the device public key in PKIX, ASN.1 DER (SubjectPublicKeyInfo) form. The device signing key is unchanged by the rotation. |  |
-| **signature** | **String** | Signature proves current possession of the enrolled device signing key: the device signs the concatenation of the settings-flow nonce and the transport public key with the key identified by client_key_id — a plain ECDSA signature over the SHA-256 of that challenge on Android, an App Attest assertion over it on iOS, exactly as at login. Binding the transport key into the signed challenge ensures a session-level attacker (stolen token, XSS) cannot rotate the secret and have it sealed to a transport key they control. |  |
-| **transport_public_key** | **String** | TransportPubKey is the transport public key (HPKE) used to seal the returned, freshly issued pin_secret so only this device can open it. It is base64-encoded in JSON and decoded to raw bytes here. | [optional] |
+| **client_key_id** | **String** | The client_key_id of the existing PIN-protected key whose pin_secret to rotate: the lowercase-hex SHA-256 of the device public key in PKIX, ASN.1 DER (SubjectPublicKeyInfo) form. The device signing key is unchanged by the rotation. |  |
+| **signature** | **String** | Proves current possession of the enrolled device signing key.  To compute it:  1. Base64-decode the settings flow&#39;s hidden &#x60;deviceauthn_nonce&#x60; UI node value, parse the result as JSON, and base64-decode its &#x60;nonce&#x60; field. 2. Concatenate the raw nonce bytes and the raw transport_public_key bytes; this is the challenge. 3. Sign the challenge exactly as at login: on Android with &#x60;Signature.getInstance(\&quot;SHA256withECDSA\&quot;)&#x60;, submitting the resulting ASN.1 DER-encoded ECDSA signature; on iOS with &#x60;DCAppAttestService.generateAssertion&#x60;, passing the challenge bytes as the &#x60;clientDataHash&#x60; argument — do not hash them again — and submitting the returned CBOR-encoded App Attest assertion unchanged.  Binding the transport key into the signed challenge ensures a hijacked session (stolen token, XSS) cannot rotate the secret and have it sealed to a transport key it controls. |  |
+| **transport_public_key** | **String** | The device&#39;s X25519 transport public key (32 bytes, base64-encoded) used to seal the freshly issued pin_secret so only this device can open it.  Generate a fresh, random X25519 key pair for each rotation — it is a transport-encryption key, distinct from the attested signing key — and submit the raw 32-byte public key. Keep the private key only until the sealed pin_secret from the response has been opened, then discard it. The HPKE suite is DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, AES-128-GCM. |  |
 ## Example

data/docs/UpdateWorkspaceOrganizationBody.md ADDED Viewed

@@ -0,0 +1,18 @@
+# OryClient::UpdateWorkspaceOrganizationBody
+## Properties
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **session_lifespan** | **String** | SessionLifespan overrides the project-level session lifespan for sessions issued for this organization. A Go duration string between 1m and 8760h. An empty string clears the override so the project default applies. When the field is omitted, the stored value is left unchanged. | [optional] |
+## Example
+```ruby
+require 'ory-client'
+instance = OryClient::UpdateWorkspaceOrganizationBody.new(
+  session_lifespan: 24h
+)
+```

data/lib/ory-client/api/api_keys_api.rb CHANGED Viewed

@@ -3,7 +3,7 @@
 ## Introduction Documentation for all public and administrative Ory APIs. Administrative APIs can only be accessed with a valid Personal Access Token. Public APIs are mostly used in browsers.  ## SDKs This document describes the APIs available in the Ory Network. The APIs are available as SDKs for the following languages:  | Language       | Download SDK                                                     | Documentation                                                                        | | -------------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------ | | Dart           | [pub.dev](https://pub.dev/packages/ory_client)                   | [README](https://github.com/ory/sdk/blob/master/clients/client/dart/README.md)       | | .NET           | [nuget.org](https://www.nuget.org/packages/Ory.Client/)          | [README](https://github.com/ory/sdk/blob/master/clients/client/dotnet/README.md)     | | Elixir         | [hex.pm](https://hex.pm/packages/ory_client)                     | [README](https://github.com/ory/sdk/blob/master/clients/client/elixir/README.md)     | | Go             | [github.com](https://github.com/ory/client-go)                   | [README](https://github.com/ory/sdk/blob/master/clients/client/go/README.md)         | | Java           | [maven.org](https://search.maven.org/artifact/sh.ory/ory-client) | [README](https://github.com/ory/sdk/blob/master/clients/client/java/README.md)       | | JavaScript     | [npmjs.com](https://www.npmjs.com/package/@ory/client)           | [README](https://github.com/ory/sdk/blob/master/clients/client/typescript/README.md) | | JavaScript (With fetch) | [npmjs.com](https://www.npmjs.com/package/@ory/client-fetch)           | [README](https://github.com/ory/sdk/blob/master/clients/client/typescript-fetch/README.md) |  | PHP            | [packagist.org](https://packagist.org/packages/ory/client)       | [README](https://github.com/ory/sdk/blob/master/clients/client/php/README.md)        | | Python         | [pypi.org](https://pypi.org/project/ory-client/)                 | [README](https://github.com/ory/sdk/blob/master/clients/client/python/README.md)     | | Ruby           | [rubygems.org](https://rubygems.org/gems/ory-client)             | [README](https://github.com/ory/sdk/blob/master/clients/client/ruby/README.md)       | | Rust           | [crates.io](https://crates.io/crates/ory-client)                 | [README](https://github.com/ory/sdk/blob/master/clients/client/rust/README.md)       |
-The version of the OpenAPI document: v1.22.62
+The version of the OpenAPI document: v1.22.64
 Contact: support@ory.sh
 Generated by: https://openapi-generator.tech
 Generator version: 7.17.0

data/lib/ory-client/api/courier_api.rb CHANGED Viewed

@@ -3,7 +3,7 @@
 ## Introduction Documentation for all public and administrative Ory APIs. Administrative APIs can only be accessed with a valid Personal Access Token. Public APIs are mostly used in browsers.  ## SDKs This document describes the APIs available in the Ory Network. The APIs are available as SDKs for the following languages:  | Language       | Download SDK                                                     | Documentation                                                                        | | -------------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------ | | Dart           | [pub.dev](https://pub.dev/packages/ory_client)                   | [README](https://github.com/ory/sdk/blob/master/clients/client/dart/README.md)       | | .NET           | [nuget.org](https://www.nuget.org/packages/Ory.Client/)          | [README](https://github.com/ory/sdk/blob/master/clients/client/dotnet/README.md)     | | Elixir         | [hex.pm](https://hex.pm/packages/ory_client)                     | [README](https://github.com/ory/sdk/blob/master/clients/client/elixir/README.md)     | | Go             | [github.com](https://github.com/ory/client-go)                   | [README](https://github.com/ory/sdk/blob/master/clients/client/go/README.md)         | | Java           | [maven.org](https://search.maven.org/artifact/sh.ory/ory-client) | [README](https://github.com/ory/sdk/blob/master/clients/client/java/README.md)       | | JavaScript     | [npmjs.com](https://www.npmjs.com/package/@ory/client)           | [README](https://github.com/ory/sdk/blob/master/clients/client/typescript/README.md) | | JavaScript (With fetch) | [npmjs.com](https://www.npmjs.com/package/@ory/client-fetch)           | [README](https://github.com/ory/sdk/blob/master/clients/client/typescript-fetch/README.md) |  | PHP            | [packagist.org](https://packagist.org/packages/ory/client)       | [README](https://github.com/ory/sdk/blob/master/clients/client/php/README.md)        | | Python         | [pypi.org](https://pypi.org/project/ory-client/)                 | [README](https://github.com/ory/sdk/blob/master/clients/client/python/README.md)     | | Ruby           | [rubygems.org](https://rubygems.org/gems/ory-client)             | [README](https://github.com/ory/sdk/blob/master/clients/client/ruby/README.md)       | | Rust           | [crates.io](https://crates.io/crates/ory-client)                 | [README](https://github.com/ory/sdk/blob/master/clients/client/rust/README.md)       |
-The version of the OpenAPI document: v1.22.62
+The version of the OpenAPI document: v1.22.64
 Contact: support@ory.sh
 Generated by: https://openapi-generator.tech
 Generator version: 7.17.0