ory-client 1.22.63 → 1.22.64

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d5fb15eaeb2b84cced07109479844562e5ff010b90ed5fde4b517d51cc96b312
-  data.tar.gz: c95516e46fb71126cb19127b845515e1a31ba9637091b3090a966157be1f3495
+  metadata.gz: fe23dc2241e92552911e6d05edb1c1f24512f262c4d9652a7d9a2cf90ea82de4
+  data.tar.gz: 3df07a2892af9b88d7e9a2bac713278f6dff8c22db4611c6f08f21844c96840a
 SHA512:
-  metadata.gz: 2deca2a34b96df65c3e2af76a02a29690782553b3cd3bbe9d327844c2bf88a9f9aa94c1a29bcad2ffe8c0c4d88ce00ee7cc050bd9dec4a65206259d07e7474c8
-  data.tar.gz: 4ffc72ef921fe01c09fbbc4148a88096b253c25bbb5f6b4afdb96889408f23fb004cc053d8d63b9d4cf48d8ccb619d897156321006c7a89983c1810ab9f6bb09
+  metadata.gz: d4beb11f7731c633a419f744951b8ad7d3c7fb1dbb5ae4d88b62c1cef8eb5b4d3c1dee7424557d380a0ed65447404debc3bd5232a44a6b46108c070451bef11c
+  data.tar.gz: 2b0cce03d34480b5fff00606c5693e31ad63493e32079fa1892382670de2097dc54c494ab4277b88f54ec429694dc607db41fabbe747bb07337a2f4d1436e838

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    ory-client (1.22.63)
+    ory-client (1.22.64)
       typhoeus (~> 1.0, >= 1.0.1)
 
 GEM
@@ -21,7 +21,7 @@ GEM
     logger (1.7.0)
     method_source (1.1.0)
     parallel (1.28.0)
-    parser (3.3.11.1)
+    parser (3.3.12.0)
       ast (~> 2.4.1)
       racc
     pry (0.16.0)

data/README.md

@@ -26,8 +26,8 @@ This document describes the APIs available in the Ory Network. The APIs are avai
 
 This SDK is automatically generated by the [OpenAPI Generator](https://openapi-generator.tech) project:
 
-- API version: v1.22.63
-- Package version: v1.22.63
+- API version: v1.22.64
+- Package version: v1.22.64
 - Generator version: 7.17.0
 - Build package: org.openapitools.codegen.languages.RubyClientCodegen
 
@@ -44,16 +44,16 @@ gem build ory-client.gemspec
 Then either install the gem locally:
 
 ```shell
-gem install ./ory-client-v1.22.63.gem
+gem install ./ory-client-v1.22.64.gem
 ```
 
-(for development, run `gem install --dev ./ory-client-v1.22.63.gem` to install the development dependencies)
+(for development, run `gem install --dev ./ory-client-v1.22.64.gem` to install the development dependencies)
 
 or publish the gem to a gem hosting service, e.g. [RubyGems](https://rubygems.org/).
 
 Finally add this to the Gemfile:
 
-    gem 'ory-client', '~> v1.22.63'
+    gem 'ory-client', '~> v1.22.64'
 
 ### Install from Git
 
@@ -199,6 +199,7 @@ Class | Method | HTTP request | Description
 *OryClient::OAuth2Api* | [**create_o_auth2_client**](docs/OAuth2Api.md#create_o_auth2_client) | **POST** /admin/clients | Create OAuth 2.0 Client
 *OryClient::OAuth2Api* | [**delete_o_auth2_client**](docs/OAuth2Api.md#delete_o_auth2_client) | **DELETE** /admin/clients/{id} | Delete OAuth 2.0 Client
 *OryClient::OAuth2Api* | [**delete_o_auth2_token**](docs/OAuth2Api.md#delete_o_auth2_token) | **DELETE** /admin/oauth2/tokens | Delete OAuth 2.0 Access Tokens from specific OAuth 2.0 Client
+*OryClient::OAuth2Api* | [**delete_rotated_o_auth2_client_secrets**](docs/OAuth2Api.md#delete_rotated_o_auth2_client_secrets) | **DELETE** /admin/clients/{id}/secrets/rotate | Delete Rotated OAuth 2.0 Client Secrets
 *OryClient::OAuth2Api* | [**delete_trusted_o_auth2_jwt_grant_issuer**](docs/OAuth2Api.md#delete_trusted_o_auth2_jwt_grant_issuer) | **DELETE** /admin/trust/grants/jwt-bearer/issuers/{id} | Delete Trusted OAuth2 JWT Bearer Grant Type Issuer
 *OryClient::OAuth2Api* | [**get_o_auth2_client**](docs/OAuth2Api.md#get_o_auth2_client) | **GET** /admin/clients/{id} | Get an OAuth 2.0 Client
 *OryClient::OAuth2Api* | [**get_o_auth2_consent_request**](docs/OAuth2Api.md#get_o_auth2_consent_request) | **GET** /admin/oauth2/auth/requests/consent | Get OAuth 2.0 Consent Request
@@ -220,6 +221,7 @@ Class | Method | HTTP request | Description
 *OryClient::OAuth2Api* | [**revoke_o_auth2_consent_sessions**](docs/OAuth2Api.md#revoke_o_auth2_consent_sessions) | **DELETE** /admin/oauth2/auth/sessions/consent | Revoke OAuth 2.0 Consent Sessions of a Subject
 *OryClient::OAuth2Api* | [**revoke_o_auth2_login_sessions**](docs/OAuth2Api.md#revoke_o_auth2_login_sessions) | **DELETE** /admin/oauth2/auth/sessions/login | Revokes OAuth 2.0 Login Sessions by either a Subject or a SessionID
 *OryClient::OAuth2Api* | [**revoke_o_auth2_token**](docs/OAuth2Api.md#revoke_o_auth2_token) | **POST** /oauth2/revoke | Revoke OAuth 2.0 Access or Refresh Token
+*OryClient::OAuth2Api* | [**rotate_o_auth2_client_secret**](docs/OAuth2Api.md#rotate_o_auth2_client_secret) | **POST** /admin/clients/{id}/secrets/rotate | Rotate OAuth 2.0 Client Secret
 *OryClient::OAuth2Api* | [**set_o_auth2_client**](docs/OAuth2Api.md#set_o_auth2_client) | **PUT** /admin/clients/{id} | Set OAuth 2.0 Client
 *OryClient::OAuth2Api* | [**set_o_auth2_client_lifespans**](docs/OAuth2Api.md#set_o_auth2_client_lifespans) | **PUT** /admin/clients/{id}/lifespans | Set OAuth2 Client Token Lifespans
 *OryClient::OAuth2Api* | [**trust_o_auth2_jwt_grant_issuer**](docs/OAuth2Api.md#trust_o_auth2_jwt_grant_issuer) | **POST** /admin/trust/grants/jwt-bearer/issuers | Trust OAuth2 JWT Bearer Grant Type Issuer
@@ -364,6 +366,7 @@ Class | Method | HTTP request | Description
  - [OryClient::DeviceAuthnIOSAttestation](docs/DeviceAuthnIOSAttestation.md)
  - [OryClient::DeviceAuthnKey](docs/DeviceAuthnKey.md)
  - [OryClient::DeviceAuthorization](docs/DeviceAuthorization.md)
+ - [OryClient::DeviceType](docs/DeviceType.md)
  - [OryClient::DeviceUserAuthRequest](docs/DeviceUserAuthRequest.md)
  - [OryClient::ElementsConfiguration](docs/ElementsConfiguration.md)
  - [OryClient::EmailTemplateData](docs/EmailTemplateData.md)
@@ -389,6 +392,7 @@ Class | Method | HTTP request | Description
  - [OryClient::GetMetricsEventAttributes](docs/GetMetricsEventAttributes.md)
  - [OryClient::GetMetricsEventTypes](docs/GetMetricsEventTypes.md)
  - [OryClient::GetOrganizationResponse](docs/GetOrganizationResponse.md)
+ - [OryClient::GetOrganizationsByHostnameResponse](docs/GetOrganizationsByHostnameResponse.md)
  - [OryClient::GetProjectEvents](docs/GetProjectEvents.md)
  - [OryClient::GetProjectEventsBody](docs/GetProjectEventsBody.md)
  - [OryClient::GetProjectMetrics](docs/GetProjectMetrics.md)
@@ -446,6 +450,7 @@ Class | Method | HTTP request | Description
  - [OryClient::JsonWebKey](docs/JsonWebKey.md)
  - [OryClient::JsonWebKeySet](docs/JsonWebKeySet.md)
  - [OryClient::KetoNamespace](docs/KetoNamespace.md)
+ - [OryClient::KeyState](docs/KeyState.md)
  - [OryClient::KeyStatus](docs/KeyStatus.md)
  - [OryClient::KeyVisibility](docs/KeyVisibility.md)
  - [OryClient::KeysetPaginationRequestParameters](docs/KeysetPaginationRequestParameters.md)
@@ -501,6 +506,7 @@ Class | Method | HTTP request | Description
  - [OryClient::OnboardingPortalTestLoginFlow](docs/OnboardingPortalTestLoginFlow.md)
  - [OryClient::Organization](docs/Organization.md)
  - [OryClient::OrganizationBody](docs/OrganizationBody.md)
+ - [OryClient::OrganizationByHostname](docs/OrganizationByHostname.md)
  - [OryClient::OrganizationOnboardingPortalLinksResponse](docs/OrganizationOnboardingPortalLinksResponse.md)
  - [OryClient::PINConfig](docs/PINConfig.md)
  - [OryClient::ParseError](docs/ParseError.md)
@@ -571,6 +577,7 @@ Class | Method | HTTP request | Description
  - [OryClient::SuccessfulNativeLogin](docs/SuccessfulNativeLogin.md)
  - [OryClient::SuccessfulNativeRegistration](docs/SuccessfulNativeRegistration.md)
  - [OryClient::SuccessfulProjectUpdate](docs/SuccessfulProjectUpdate.md)
+ - [OryClient::TalosRetiredValue](docs/TalosRetiredValue.md)
  - [OryClient::TaxLineItem](docs/TaxLineItem.md)
  - [OryClient::TimeInterval](docs/TimeInterval.md)
  - [OryClient::Token](docs/Token.md)
@@ -621,8 +628,7 @@ Class | Method | HTTP request | Description
  - [OryClient::UpdateRegistrationFlowWithWebAuthnMethod](docs/UpdateRegistrationFlowWithWebAuthnMethod.md)
  - [OryClient::UpdateSettingsFlowBody](docs/UpdateSettingsFlowBody.md)
  - [OryClient::UpdateSettingsFlowWithDeviceAuthnMethod](docs/UpdateSettingsFlowWithDeviceAuthnMethod.md)
- - [OryClient::UpdateSettingsFlowWithDeviceAuthnMethodAdd](docs/UpdateSettingsFlowWithDeviceAuthnMethodAdd.md)
- - [OryClient::UpdateSettingsFlowWithDeviceAuthnMethodDelete](docs/UpdateSettingsFlowWithDeviceAuthnMethodDelete.md)
+ - [OryClient::UpdateSettingsFlowWithDeviceAuthnMethodRegister](docs/UpdateSettingsFlowWithDeviceAuthnMethodRegister.md)
  - [OryClient::UpdateSettingsFlowWithDeviceAuthnMethodRotateSecret](docs/UpdateSettingsFlowWithDeviceAuthnMethodRotateSecret.md)
  - [OryClient::UpdateSettingsFlowWithLookupMethod](docs/UpdateSettingsFlowWithLookupMethod.md)
  - [OryClient::UpdateSettingsFlowWithOidcMethod](docs/UpdateSettingsFlowWithOidcMethod.md)
@@ -637,6 +643,7 @@ Class | Method | HTTP request | Description
  - [OryClient::UpdateVerificationFlowWithCodeMethod](docs/UpdateVerificationFlowWithCodeMethod.md)
  - [OryClient::UpdateVerificationFlowWithLinkMethod](docs/UpdateVerificationFlowWithLinkMethod.md)
  - [OryClient::UpdateWorkspaceBody](docs/UpdateWorkspaceBody.md)
+ - [OryClient::UpdateWorkspaceOrganizationBody](docs/UpdateWorkspaceOrganizationBody.md)
  - [OryClient::Usage](docs/Usage.md)
  - [OryClient::UserVerification](docs/UserVerification.md)
  - [OryClient::ValidateBaseURLRewriteRequest](docs/ValidateBaseURLRewriteRequest.md)

data/docs/ContinueWithDeviceAuthnPinEntryUiData.md

@@ -4,8 +4,8 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **ciphertext** | **String** | Ciphertext is the base64-encoded HPKE-sealed pin_secret. |  |
-| **enc** | **String** | Enc is the base64-encoded HPKE encapsulated key. |  |
+| **ciphertext** | **String** | The base64-encoded HPKE ciphertext of the sealed pin_secret. |  |
+| **enc** | **String** | The base64-encoded HPKE encapsulated key (the `enc` output of the seal operation). |  |
 
 ## Example
 

data/docs/CreateProjectNormalizedPayload.md

@@ -223,11 +223,11 @@
 | **kratos_selfservice_methods_code_passwordless_enabled** | **Boolean** | Configures whether Ory Kratos Passwordless should use the Code Method  This governs the \"selfservice.methods.code.passwordless_enabled\" setting. | [optional] |
 | **kratos_selfservice_methods_code_passwordless_login_fallback_enabled** | **Boolean** | This setting allows the code method to always login a user with code if they have registered with another authentication method such as password or social sign in.  This governs the \"selfservice.methods.code.passwordless_login_fallback_enabled\" setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_android_app_ids** | **Array<String>** | Configures the allow-list of Android app signing-certificate digests that a device key may be bound to.  This governs the \"selfservice.methods.deviceauthn.config.android_app_ids\" setting. | [optional] |
-| **kratos_selfservice_methods_deviceauthn_config_first_factor** | **Boolean** | Configures whether device authentication may be used as the sole first factor.  This governs the \"selfservice.methods.deviceauthn.config.first_factor\" setting. | [optional] |
+| **kratos_selfservice_methods_deviceauthn_config_first_factor** | **Boolean** | Configures whether device authentication may be used as the sole first factor.  When enabled, a confirmed device key with PIN or platform user verification can complete an AAL2 login in a single submission, without a password or code. Defaults to false, which keeps device keys usable only as a second factor (step-up).  This governs the \"selfservice.methods.deviceauthn.config.first_factor\" setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_insecure_allow_relaxed_attestation** | **Boolean** | Configures whether Ory Kratos Device authentication accepts relaxed attestations for testing  Only allowed on development projects and forced off otherwise. Keys enrolled under relaxation are short-lived and refused once this is turned off.  This governs the \"selfservice.methods.deviceauthn.config.insecure_allow_relaxed_attestation\" setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_ios_app_ids** | **Array<String>** | Configures the allow-list of Apple App IDs that a device key may be bound to.  This governs the \"selfservice.methods.deviceauthn.config.ios_app_ids\" setting. | [optional] |
-| **kratos_selfservice_methods_deviceauthn_config_ios_biometric_first_factor** | **Boolean** | Configures whether an iOS biometric device key may be used as the sole first factor.  This governs the \"selfservice.methods.deviceauthn.config.ios_biometric_first_factor\" setting. | [optional] |
-| **kratos_selfservice_methods_deviceauthn_config_pin_max_attempts** | **Integer** | Configures the consecutive wrong-PIN limit before a device key is locked.  This governs the \"selfservice.methods.deviceauthn.config.pin_max_attempts\" setting. | [optional] |
+| **kratos_selfservice_methods_deviceauthn_config_ios_biometric_first_factor** | **Boolean** | Configures whether an iOS biometric device key may be used as the sole first factor.  Apple App Attest cannot prove biometric gating, so iOS keys with \"platform\" user verification count as a first factor only with this explicit opt-in. Android keys are unaffected, as their user verification is attestation-verified. Defaults to false.  This governs the \"selfservice.methods.deviceauthn.config.ios_biometric_first_factor\" setting. | [optional] |
+| **kratos_selfservice_methods_deviceauthn_config_pin_max_attempts** | **Integer** | Configures the number of consecutive wrong-PIN attempts before a device key is locked.  Defaults to 5; must be between 1 and 10. Once locked, the key's pin_secret is invalidated and the key can no longer be used to log in until the user rotates its secret through the fallback login.  This governs the \"selfservice.methods.deviceauthn.config.pin_max_attempts\" setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_enabled** | **Boolean** | Configures whether Ory Kratos Device authentication is enabled  This governs the \"selfservice.methods.deviceauthn.enabled\" setting. | [optional] |
 | **kratos_selfservice_methods_link_config_base_url** | **String** | Configures the Base URL which Recovery, Verification, and Login Links Point to  It is recommended to leave this value empty. It will be appropriately configured to the best matching domain (e.g. when using custom domains) automatically.  This governs the \"selfservice.methods.link.config.base_url\" setting. | [optional] |
 | **kratos_selfservice_methods_link_config_lifespan** | **String** | Configures the Ory Kratos Link Method's lifespan  This governs the \"selfservice.methods.link.config.lifespan\" setting. | [optional] |
@@ -287,10 +287,12 @@
 | **talos_credentials_derived_tokens_macaroon_prefix_current** | **String** | Talos derived tokens macaroon prefix (current). | [optional] |
 | **talos_credentials_derived_tokens_macaroon_prefix_retired** | **Array<String>** | Talos derived tokens macaroon prefix (retired).  Previously active macaroon prefixes kept for verification of outstanding tokens. The first element of this list was the most recently retired active prefix. | [optional] |
 | **talos_credentials_issuer** | **String** | Talos credentials issuer URL. | [optional] |
-| **talos_credentials_issuer_retired** | **Array<String>** | Talos credentials retired issuer URLs.  Previously active issuer URLs kept for verification of outstanding tokens. Tokens signed with these issuers remain valid; new tokens use the current issuer. | [optional] |
+| **talos_credentials_issuer_retired** | **Array<String>** | Talos credentials retired issuer URLs (deprecated).  Deprecated: values-only view of talos_credentials_issuer_retired_entries, kept so already-released SDKs that decode this field as an array of strings keep working. It is output only: reads are derived from the entries field and writes to it are ignored. Use talos_credentials_issuer_retired_entries instead. | [optional][readonly] |
+| **talos_credentials_issuer_retired_entries** | [**Array<TalosRetiredValue>**](TalosRetiredValue.md) | TalosRetiredValues is the list of retired values — retired HMAC secrets or retired issuer URLs — for a Talos project. A retired value stays valid for verification until its optional expiry passes, so operators can bound how long an old credential keeps working after a rotation instead of keeping it forever. Legacy bare-string entries are accepted on write and normalized to the object form. | [optional] |
 | **talos_rate_limit_enabled** | **Boolean** | Talos rate limit enabled.  When true, server-side rate limiting is enforced for API key verifications. | [optional] |
-| **talos_secrets_hmac_current** | **String** | TalosSecretsHMACCurrent stores the current HMAC symmetric key as a plain secret string. Application-layer encryption is handled upstream; SanitizeModel (MarshalJSON) redacts this field from API responses. | [optional] |
-| **talos_secrets_hmac_retired** | **Array<String>** | TalosSecretsHMACRetired stores previously active HMAC symmetric keys as a JSON array of plain secret strings. Application-layer encryption is handled upstream; SanitizeModel (MarshalJSON) redacts this field from API responses. The verifier tries all retired secrets when the current key does not produce a matching HMAC. | [optional] |
+| **talos_secrets_hmac_current** | **String** | TalosSecretsHMACCurrent stores the current HMAC symmetric key as a plain secret string. | [optional] |
+| **talos_secrets_hmac_retired** | **Array<String>** | TalosSecretsHMACRetired stores previously active HMAC symmetric keys as an array of strings (deprecated).  Deprecated: values-only view of talos_secrets_hmac_retired_entries, kept so already-released SDKs that decode this field as an array of strings keep working. It is output only and writes to it are ignored. HMAC secrets are server-managed and redacted on output, so this field is always empty on the wire. Use talos_secrets_hmac_retired_entries instead. | [optional][readonly] |
+| **talos_secrets_hmac_retired_entries** | [**Array<TalosRetiredValue>**](TalosRetiredValue.md) | TalosRetiredValues is the list of retired values — retired HMAC secrets or retired issuer URLs — for a Talos project. A retired value stays valid for verification until its optional expiry passes, so operators can bound how long an old credential keeps working after a rotation instead of keeping it forever. Legacy bare-string entries are accepted on write and normalized to the object form. | [optional] |
 | **updated_at** | **Time** | Last Time Project's Revision was Updated | [optional][readonly] |
 | **workspace_id** | **String** |  | [optional] |
 
@@ -584,9 +586,11 @@ instance = OryClient::CreateProjectNormalizedPayload.new(
   talos_credentials_derived_tokens_macaroon_prefix_retired: null,
   talos_credentials_issuer: null,
   talos_credentials_issuer_retired: null,
+  talos_credentials_issuer_retired_entries: null,
   talos_rate_limit_enabled: null,
   talos_secrets_hmac_current: null,
   talos_secrets_hmac_retired: null,
+  talos_secrets_hmac_retired_entries: null,
   updated_at: null,
   workspace_id: null
 )

data/docs/DeviceAuthnKey.md

@@ -5,16 +5,16 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
 | **attestation** | [**DeviceAuthnAttestation**](DeviceAuthnAttestation.md) |  | [optional] |
-| **client_key_id** | **String** | ClientKeyID is the key's stable, unique-per-identity id, computed as hex(SHA-256(PublicKey)) — the lowercase-hex SHA-256 digest of the public key's PKIX, ASN.1 DER (SubjectPublicKeyInfo) encoding, exactly the bytes stored in PublicKey. It is a deterministic fingerprint of the enrolled signing key, so the device recomputes the identical value locally instead of receiving it from the server. Keys enrolled before the server derived the id keep their original client-chosen value. | [optional] |
-| **created_at** | **Time** | CreatedAt is the timestamp of when the key was created. Only used for troubleshooting/UI. | [optional] |
-| **device_name** | **String** | DeviceName is a human readable name for the device, helping the user to distinguish it from others. | [optional] |
-| **device_type** | **String** |  | [optional] |
+| **client_key_id** | **String** | The key's stable id, unique per identity. Submit it as the `client_key_id` when logging in with the key, deleting it, or rotating its pin_secret.  The device can also compute the id without reading it back from the server: it is the lowercase-hex SHA-256 of `public_key` (the key's PKIX, ASN.1 DER encoding). Keys enrolled before the server derived the id keep their original client-chosen value, so prefer reading this field over recomputing it for older keys. | [optional] |
+| **created_at** | **Time** | When the key was enrolled. Only used for troubleshooting and UI. | [optional] |
+| **device_name** | **String** | A human-readable name for the device, helping the user tell this key apart from others. | [optional] |
+| **device_type** | [**DeviceType**](DeviceType.md) |  | [optional] |
 | **pin** | [**PINConfig**](PINConfig.md) |  | [optional] |
-| **public_key** | **Array<Integer>** | PublicKey is the device's public key (EC P-256 in v1), used to verify signatures. It is stored in PKIX, ASN.1 DER form (the SubjectPublicKeyInfo encoding produced by x509.MarshalPKIXPublicKey). The private key resides inside the device and does not exist on the server. | [optional] |
-| **relaxed_attestation_expires_at** | **Time** | RelaxedAttestationExpiresAt is set only when the key's attestation chain validated because relaxed attestation was allowed (software roots, expired certs, software security level) rather than under strict rules. Such keys are second-class: they are refused at login after this time, or immediately if relaxed attestation is turned off. It is nil for hardware-attested keys that pass strict validation. | [optional] |
-| **state** | **String** |  | [optional] |
+| **public_key** | **String** | The device's public key (an elliptic-curve key on P-224, P-256, P-384, or P-521 in version 1) in PKIX, ASN.1 DER (SubjectPublicKeyInfo) form, base64-encoded. Signatures are verified against this key. | [optional] |
+| **relaxed_attestation_expires_at** | **Time** | Set only when the key's attestation chain was accepted under relaxed rules (software roots, expired certificates, software security level) rather than strict hardware attestation. Such keys are refused at login after this time, or immediately once relaxed attestation is turned off. Absent for hardware-attested keys that pass strict validation. | [optional] |
+| **state** | [**KeyState**](KeyState.md) |  | [optional] |
 | **user_verification** | [**UserVerification**](UserVerification.md) |  | [optional] |
-| **version** | **Integer** | v1 uses SHA256 + EC256. v2 (in the future) may use ML-DSA which is post-quantum resistant. This requires Android/iOS support so we have to wait. We intentionally avoid storing the cryptographic algorithm here a la JWT/TLS to avoid security issues and algorithm negotiation. | [optional] |
+| **version** | **Integer** | The cryptography version of the key. Version 1 uses ECDSA with SHA-256 on an elliptic curve (P-224, P-256, P-384, or P-521); further versions are reserved for future signature suites. | [optional] |
 
 ## Example
 

data/docs/DeviceType.md

@@ -0,0 +1,15 @@
+# OryClient::DeviceType
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+
+## Example
+
+```ruby
+require 'ory-client'
+
+instance = OryClient::DeviceType.new()
+```
+

data/docs/GetOrganizationsByHostnameResponse.md

@@ -0,0 +1,18 @@
+# OryClient::GetOrganizationsByHostnameResponse
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **organizations** | [**Array<OrganizationByHostname>**](OrganizationByHostname.md) | Organizations is the list of organizations for the project. |  |
+
+## Example
+
+```ruby
+require 'ory-client'
+
+instance = OryClient::GetOrganizationsByHostnameResponse.new(
+  organizations: null
+)
+```
+

data/docs/IdentityApi.md

@@ -473,7 +473,7 @@ api_instance = OryClient::IdentityApi.new
 id = 'id_example' # String | ID is the identity's ID.
 type = 'password' # String | Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML deviceauthn CredentialsTypeDeviceAuthn identifier_first CredentialsTypeIdentifierFirst link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
 opts = {
-  identifier: 'identifier_example' # String | Identifier is the identifier of the OIDC/SAML credential to delete. Find the identifier by calling the `GET /admin/identities/{id}?include_credential={oidc,saml}` endpoint.
+  identifier: 'identifier_example' # String | Identifier is the identifier of the credential to delete. It is required for the `oidc`, `saml`, and `deviceauthn` credential types: for `oidc` and `saml` it selects the provider link to remove, for `deviceauthn` it is the `client_key_id` of the device key to revoke. Find the identifier by calling the `GET /admin/identities/{id}?include_credential={type}` endpoint.
 }
 
 begin
@@ -508,7 +508,7 @@ end
 | ---- | ---- | ----------- | ----- |
 | **id** | **String** | ID is the identity's ID. |  |
 | **type** | **String** | Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML deviceauthn CredentialsTypeDeviceAuthn identifier_first CredentialsTypeIdentifierFirst link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode |  |
-| **identifier** | **String** | Identifier is the identifier of the OIDC/SAML credential to delete. Find the identifier by calling the `GET /admin/identities/{id}?include_credential={oidc,saml}` endpoint. | [optional] |
+| **identifier** | **String** | Identifier is the identifier of the credential to delete. It is required for the `oidc`, `saml`, and `deviceauthn` credential types: for `oidc` and `saml` it selects the provider link to remove, for `deviceauthn` it is the `client_key_id` of the device key to revoke. Find the identifier by calling the `GET /admin/identities/{id}?include_credential={type}` endpoint. | [optional] |
 
 ### Return type
 

data/docs/JwkApi.md

@@ -19,7 +19,7 @@ All URIs are relative to *https://playground.projects.oryapis.com*
 
 Create JSON Web Key
 
-This endpoint is capable of generating JSON Web Key Sets for you. There are different strategies available, such as symmetric cryptographic keys (HS256, HS512) and asymmetric cryptographic keys (RS256, ECDSA). If the specified JSON Web Key Set does not exist, it will be created.  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
+This endpoint is capable of generating JSON Web Key Sets for you. There are different strategies available, such as symmetric cryptographic keys (HS256, HS512) and asymmetric cryptographic keys (RS256, ECDSA). If the specified JSON Web Key Set does not exist, it will be created.  If the set already exists, the newly generated key is added to it and all existing keys are kept. This allows you to rotate keys: tokens signed with an older key in the set remain verifiable. Exception: when Ory Hydra is configured to use a Hardware Security Module (HSM), generating a key replaces the set, which then contains only the new key. To replace a set and all of its keys instead, use the `setJsonWebKeySet` operation (`PUT /admin/keys/{set}`).  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
 
 ### Examples
 
@@ -368,7 +368,7 @@ end
 
 Set JSON Web Key
 
-Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
+Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.  Warning: the key is created or updated under the `kid` given in the request body. The `{kid}` path parameter exists for historical reasons only: it is ignored and not validated against the body.  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
 
 ### Examples
 
@@ -443,7 +443,7 @@ end
 
 Update a JSON Web Key Set
 
-Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
+Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.  This operation replaces the entire JSON Web Key Set: keys that exist in the set but are not part of the request body are deleted. To add a newly generated key to the set while keeping the existing keys, use the `createJsonWebKeySet` operation (`POST /admin/keys/{set}`).  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
 
 ### Examples
 

data/docs/KeyState.md

@@ -0,0 +1,15 @@
+# OryClient::KeyState
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+
+## Example
+
+```ruby
+require 'ory-client'
+
+instance = OryClient::KeyState.new()
+```
+

data/docs/NormalizedProjectRevision.md

@@ -221,11 +221,11 @@
 | **kratos_selfservice_methods_code_passwordless_enabled** | **Boolean** | Configures whether Ory Kratos Passwordless should use the Code Method  This governs the \"selfservice.methods.code.passwordless_enabled\" setting. | [optional] |
 | **kratos_selfservice_methods_code_passwordless_login_fallback_enabled** | **Boolean** | This setting allows the code method to always login a user with code if they have registered with another authentication method such as password or social sign in.  This governs the \"selfservice.methods.code.passwordless_login_fallback_enabled\" setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_android_app_ids** | **Array<String>** | Configures the allow-list of Android app signing-certificate digests that a device key may be bound to.  This governs the \"selfservice.methods.deviceauthn.config.android_app_ids\" setting. | [optional] |
-| **kratos_selfservice_methods_deviceauthn_config_first_factor** | **Boolean** | Configures whether device authentication may be used as the sole first factor.  This governs the \"selfservice.methods.deviceauthn.config.first_factor\" setting. | [optional] |
+| **kratos_selfservice_methods_deviceauthn_config_first_factor** | **Boolean** | Configures whether device authentication may be used as the sole first factor.  When enabled, a confirmed device key with PIN or platform user verification can complete an AAL2 login in a single submission, without a password or code. Defaults to false, which keeps device keys usable only as a second factor (step-up).  This governs the \"selfservice.methods.deviceauthn.config.first_factor\" setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_insecure_allow_relaxed_attestation** | **Boolean** | Configures whether Ory Kratos Device authentication accepts relaxed attestations for testing  Only allowed on development projects and forced off otherwise. Keys enrolled under relaxation are short-lived and refused once this is turned off.  This governs the \"selfservice.methods.deviceauthn.config.insecure_allow_relaxed_attestation\" setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_ios_app_ids** | **Array<String>** | Configures the allow-list of Apple App IDs that a device key may be bound to.  This governs the \"selfservice.methods.deviceauthn.config.ios_app_ids\" setting. | [optional] |
-| **kratos_selfservice_methods_deviceauthn_config_ios_biometric_first_factor** | **Boolean** | Configures whether an iOS biometric device key may be used as the sole first factor.  This governs the \"selfservice.methods.deviceauthn.config.ios_biometric_first_factor\" setting. | [optional] |
-| **kratos_selfservice_methods_deviceauthn_config_pin_max_attempts** | **Integer** | Configures the consecutive wrong-PIN limit before a device key is locked.  This governs the \"selfservice.methods.deviceauthn.config.pin_max_attempts\" setting. | [optional] |
+| **kratos_selfservice_methods_deviceauthn_config_ios_biometric_first_factor** | **Boolean** | Configures whether an iOS biometric device key may be used as the sole first factor.  Apple App Attest cannot prove biometric gating, so iOS keys with \"platform\" user verification count as a first factor only with this explicit opt-in. Android keys are unaffected, as their user verification is attestation-verified. Defaults to false.  This governs the \"selfservice.methods.deviceauthn.config.ios_biometric_first_factor\" setting. | [optional] |
+| **kratos_selfservice_methods_deviceauthn_config_pin_max_attempts** | **Integer** | Configures the number of consecutive wrong-PIN attempts before a device key is locked.  Defaults to 5; must be between 1 and 10. Once locked, the key's pin_secret is invalidated and the key can no longer be used to log in until the user rotates its secret through the fallback login.  This governs the \"selfservice.methods.deviceauthn.config.pin_max_attempts\" setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_enabled** | **Boolean** | Configures whether Ory Kratos Device authentication is enabled  This governs the \"selfservice.methods.deviceauthn.enabled\" setting. | [optional] |
 | **kratos_selfservice_methods_link_config_base_url** | **String** | Configures the Base URL which Recovery, Verification, and Login Links Point to  It is recommended to leave this value empty. It will be appropriately configured to the best matching domain (e.g. when using custom domains) automatically.  This governs the \"selfservice.methods.link.config.base_url\" setting. | [optional] |
 | **kratos_selfservice_methods_link_config_lifespan** | **String** | Configures the Ory Kratos Link Method's lifespan  This governs the \"selfservice.methods.link.config.lifespan\" setting. | [optional] |
@@ -285,10 +285,12 @@
 | **talos_credentials_derived_tokens_macaroon_prefix_current** | **String** | Talos derived tokens macaroon prefix (current). | [optional] |
 | **talos_credentials_derived_tokens_macaroon_prefix_retired** | **Array<String>** | Talos derived tokens macaroon prefix (retired).  Previously active macaroon prefixes kept for verification of outstanding tokens. The first element of this list was the most recently retired active prefix. | [optional] |
 | **talos_credentials_issuer** | **String** | Talos credentials issuer URL. | [optional] |
-| **talos_credentials_issuer_retired** | **Array<String>** | Talos credentials retired issuer URLs.  Previously active issuer URLs kept for verification of outstanding tokens. Tokens signed with these issuers remain valid; new tokens use the current issuer. | [optional] |
+| **talos_credentials_issuer_retired** | **Array<String>** | Talos credentials retired issuer URLs (deprecated).  Deprecated: values-only view of talos_credentials_issuer_retired_entries, kept so already-released SDKs that decode this field as an array of strings keep working. It is output only: reads are derived from the entries field and writes to it are ignored. Use talos_credentials_issuer_retired_entries instead. | [optional][readonly] |
+| **talos_credentials_issuer_retired_entries** | [**Array<TalosRetiredValue>**](TalosRetiredValue.md) | TalosRetiredValues is the list of retired values — retired HMAC secrets or retired issuer URLs — for a Talos project. A retired value stays valid for verification until its optional expiry passes, so operators can bound how long an old credential keeps working after a rotation instead of keeping it forever. Legacy bare-string entries are accepted on write and normalized to the object form. | [optional] |
 | **talos_rate_limit_enabled** | **Boolean** | Talos rate limit enabled.  When true, server-side rate limiting is enforced for API key verifications. | [optional] |
-| **talos_secrets_hmac_current** | **String** | TalosSecretsHMACCurrent stores the current HMAC symmetric key as a plain secret string. Application-layer encryption is handled upstream; SanitizeModel (MarshalJSON) redacts this field from API responses. | [optional] |
-| **talos_secrets_hmac_retired** | **Array<String>** | TalosSecretsHMACRetired stores previously active HMAC symmetric keys as a JSON array of plain secret strings. Application-layer encryption is handled upstream; SanitizeModel (MarshalJSON) redacts this field from API responses. The verifier tries all retired secrets when the current key does not produce a matching HMAC. | [optional] |
+| **talos_secrets_hmac_current** | **String** | TalosSecretsHMACCurrent stores the current HMAC symmetric key as a plain secret string. | [optional] |
+| **talos_secrets_hmac_retired** | **Array<String>** | TalosSecretsHMACRetired stores previously active HMAC symmetric keys as an array of strings (deprecated).  Deprecated: values-only view of talos_secrets_hmac_retired_entries, kept so already-released SDKs that decode this field as an array of strings keep working. It is output only and writes to it are ignored. HMAC secrets are server-managed and redacted on output, so this field is always empty on the wire. Use talos_secrets_hmac_retired_entries instead. | [optional][readonly] |
+| **talos_secrets_hmac_retired_entries** | [**Array<TalosRetiredValue>**](TalosRetiredValue.md) | TalosRetiredValues is the list of retired values — retired HMAC secrets or retired issuer URLs — for a Talos project. A retired value stays valid for verification until its optional expiry passes, so operators can bound how long an old credential keeps working after a rotation instead of keeping it forever. Legacy bare-string entries are accepted on write and normalized to the object form. | [optional] |
 | **updated_at** | **Time** | Last Time Project's Revision was Updated | [optional][readonly] |
 
 ## Example
@@ -579,9 +581,11 @@ instance = OryClient::NormalizedProjectRevision.new(
   talos_credentials_derived_tokens_macaroon_prefix_retired: null,
   talos_credentials_issuer: null,
   talos_credentials_issuer_retired: null,
+  talos_credentials_issuer_retired_entries: null,
   talos_rate_limit_enabled: null,
   talos_secrets_hmac_current: null,
   talos_secrets_hmac_retired: null,
+  talos_secrets_hmac_retired_entries: null,
   updated_at: null
 )
 ```

data/docs/OAuth2Api.md

@@ -11,6 +11,7 @@ All URIs are relative to *https://playground.projects.oryapis.com*
 | [**create_o_auth2_client**](OAuth2Api.md#create_o_auth2_client) | **POST** /admin/clients | Create OAuth 2.0 Client |
 | [**delete_o_auth2_client**](OAuth2Api.md#delete_o_auth2_client) | **DELETE** /admin/clients/{id} | Delete OAuth 2.0 Client |
 | [**delete_o_auth2_token**](OAuth2Api.md#delete_o_auth2_token) | **DELETE** /admin/oauth2/tokens | Delete OAuth 2.0 Access Tokens from specific OAuth 2.0 Client |
+| [**delete_rotated_o_auth2_client_secrets**](OAuth2Api.md#delete_rotated_o_auth2_client_secrets) | **DELETE** /admin/clients/{id}/secrets/rotate | Delete Rotated OAuth 2.0 Client Secrets |
 | [**delete_trusted_o_auth2_jwt_grant_issuer**](OAuth2Api.md#delete_trusted_o_auth2_jwt_grant_issuer) | **DELETE** /admin/trust/grants/jwt-bearer/issuers/{id} | Delete Trusted OAuth2 JWT Bearer Grant Type Issuer |
 | [**get_o_auth2_client**](OAuth2Api.md#get_o_auth2_client) | **GET** /admin/clients/{id} | Get an OAuth 2.0 Client |
 | [**get_o_auth2_consent_request**](OAuth2Api.md#get_o_auth2_consent_request) | **GET** /admin/oauth2/auth/requests/consent | Get OAuth 2.0 Consent Request |
@@ -32,6 +33,7 @@ All URIs are relative to *https://playground.projects.oryapis.com*
 | [**revoke_o_auth2_consent_sessions**](OAuth2Api.md#revoke_o_auth2_consent_sessions) | **DELETE** /admin/oauth2/auth/sessions/consent | Revoke OAuth 2.0 Consent Sessions of a Subject |
 | [**revoke_o_auth2_login_sessions**](OAuth2Api.md#revoke_o_auth2_login_sessions) | **DELETE** /admin/oauth2/auth/sessions/login | Revokes OAuth 2.0 Login Sessions by either a Subject or a SessionID |
 | [**revoke_o_auth2_token**](OAuth2Api.md#revoke_o_auth2_token) | **POST** /oauth2/revoke | Revoke OAuth 2.0 Access or Refresh Token |
+| [**rotate_o_auth2_client_secret**](OAuth2Api.md#rotate_o_auth2_client_secret) | **POST** /admin/clients/{id}/secrets/rotate | Rotate OAuth 2.0 Client Secret |
 | [**set_o_auth2_client**](OAuth2Api.md#set_o_auth2_client) | **PUT** /admin/clients/{id} | Set OAuth 2.0 Client |
 | [**set_o_auth2_client_lifespans**](OAuth2Api.md#set_o_auth2_client_lifespans) | **PUT** /admin/clients/{id}/lifespans | Set OAuth2 Client Token Lifespans |
 | [**trust_o_auth2_jwt_grant_issuer**](OAuth2Api.md#trust_o_auth2_jwt_grant_issuer) | **POST** /admin/trust/grants/jwt-bearer/issuers | Trust OAuth2 JWT Bearer Grant Type Issuer |
@@ -530,6 +532,75 @@ nil (empty response body)
 - **Accept**: application/json
 
 
+## delete_rotated_o_auth2_client_secrets
+
+> <OAuth2Client> delete_rotated_o_auth2_client_secrets(id)
+
+Delete Rotated OAuth 2.0 Client Secrets
+
+Removes all rotated secrets from an OAuth 2.0 client. This should be called after all services have been updated to use the new secret and the old secrets are no longer needed.
+
+### Examples
+
+```ruby
+require 'time'
+require 'ory-client'
+# setup authorization
+OryClient.configure do |config|
+  # Configure Bearer authorization: oryAccessToken
+  config.access_token = 'YOUR_BEARER_TOKEN'
+end
+
+api_instance = OryClient::OAuth2Api.new
+id = 'id_example' # String | OAuth 2.0 Client ID
+
+begin
+  # Delete Rotated OAuth 2.0 Client Secrets
+  result = api_instance.delete_rotated_o_auth2_client_secrets(id)
+  p result
+rescue OryClient::ApiError => e
+  puts "Error when calling OAuth2Api->delete_rotated_o_auth2_client_secrets: #{e}"
+end
+```
+
+#### Using the delete_rotated_o_auth2_client_secrets_with_http_info variant
+
+This returns an Array which contains the response data, status code and headers.
+
+> <Array(<OAuth2Client>, Integer, Hash)> delete_rotated_o_auth2_client_secrets_with_http_info(id)
+
+```ruby
+begin
+  # Delete Rotated OAuth 2.0 Client Secrets
+  data, status_code, headers = api_instance.delete_rotated_o_auth2_client_secrets_with_http_info(id)
+  p status_code # => 2xx
+  p headers # => { ... }
+  p data # => <OAuth2Client>
+rescue OryClient::ApiError => e
+  puts "Error when calling OAuth2Api->delete_rotated_o_auth2_client_secrets_with_http_info: #{e}"
+end
+```
+
+### Parameters
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **id** | **String** | OAuth 2.0 Client ID |  |
+
+### Return type
+
+[**OAuth2Client**](OAuth2Client.md)
+
+### Authorization
+
+[oryAccessToken](../README.md#oryAccessToken)
+
+### HTTP request headers
+
+- **Content-Type**: Not defined
+- **Accept**: application/json
+
+
 ## delete_trusted_o_auth2_jwt_grant_issuer
 
 > delete_trusted_o_auth2_jwt_grant_issuer(id)
@@ -1456,7 +1527,7 @@ end
 
 Patch OAuth 2.0 Client
 
-Patch an existing OAuth 2.0 Client using JSON Patch. If you pass `client_secret` the secret will be updated and returned via the API. This is the only time you will be able to retrieve the client secret, so write it down and keep it safe.  OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.
+Patch an existing OAuth 2.0 Client using JSON Patch. If you update `client_secret`, the secret will be updated and returned via the API. This is the only time you will be able to retrieve the client secret. Passing a new `client_secret` will clear all rotated secrets.  To perform a seamless client secret rotation, use the `rotateOAuth2ClientSecret` endpoint instead.  OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.
 
 ### Examples
 
@@ -2022,13 +2093,82 @@ nil (empty response body)
 - **Accept**: application/json
 
 
+## rotate_o_auth2_client_secret
+
+> <OAuth2Client> rotate_o_auth2_client_secret(id)
+
+Rotate OAuth 2.0 Client Secret
+
+Rotates an OAuth 2.0 client's secrets. The old secret will remain valid for authentication, allowing for zero-downtime secret rotations. A new secret will be generated and returned in the response.  Up to five rotated secrets are retained. Use the `deleteRotatedOAuth2ClientSecrets` endpoint to remove old rotated secrets when they are no longer needed.
+
+### Examples
+
+```ruby
+require 'time'
+require 'ory-client'
+# setup authorization
+OryClient.configure do |config|
+  # Configure Bearer authorization: oryAccessToken
+  config.access_token = 'YOUR_BEARER_TOKEN'
+end
+
+api_instance = OryClient::OAuth2Api.new
+id = 'id_example' # String | OAuth 2.0 Client ID
+
+begin
+  # Rotate OAuth 2.0 Client Secret
+  result = api_instance.rotate_o_auth2_client_secret(id)
+  p result
+rescue OryClient::ApiError => e
+  puts "Error when calling OAuth2Api->rotate_o_auth2_client_secret: #{e}"
+end
+```
+
+#### Using the rotate_o_auth2_client_secret_with_http_info variant
+
+This returns an Array which contains the response data, status code and headers.
+
+> <Array(<OAuth2Client>, Integer, Hash)> rotate_o_auth2_client_secret_with_http_info(id)
+
+```ruby
+begin
+  # Rotate OAuth 2.0 Client Secret
+  data, status_code, headers = api_instance.rotate_o_auth2_client_secret_with_http_info(id)
+  p status_code # => 2xx
+  p headers # => { ... }
+  p data # => <OAuth2Client>
+rescue OryClient::ApiError => e
+  puts "Error when calling OAuth2Api->rotate_o_auth2_client_secret_with_http_info: #{e}"
+end
+```
+
+### Parameters
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **id** | **String** | OAuth 2.0 Client ID |  |
+
+### Return type
+
+[**OAuth2Client**](OAuth2Client.md)
+
+### Authorization
+
+[oryAccessToken](../README.md#oryAccessToken)
+
+### HTTP request headers
+
+- **Content-Type**: Not defined
+- **Accept**: application/json
+
+
 ## set_o_auth2_client
 
 > <OAuth2Client> set_o_auth2_client(id, o_auth2_client)
 
 Set OAuth 2.0 Client
 
-Replaces an existing OAuth 2.0 Client with the payload you send. If you pass `client_secret` the secret is used, otherwise the existing secret is used.  If set, the secret is echoed in the response. It is not possible to retrieve it later on.  OAuth 2.0 Clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.
+Replaces an existing OAuth 2.0 Client with the payload you send. If you pass `client_secret` the secret is used, otherwise the existing secret is used. Rotated secrets will be cleared if you pass a new `client_secret`.  If set, the secret is echoed in the response. It is not possible to retrieve it later on.  To perform a seamless client secret rotation, use the `rotateOAuth2ClientSecret` endpoint instead.  OAuth 2.0 Clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities.
 
 ### Examples
 

data/docs/OAuth2Client.md

@@ -44,7 +44,7 @@
 | **registration_client_uri** | **String** | OpenID Connect Dynamic Client Registration URL  RegistrationClientURI is the URL used to update, get, or delete the OAuth2 Client. | [optional] |
 | **request_object_signing_alg** | **String** | OpenID Connect Request Object Signing Algorithm  JWS [JWS] alg algorithm [JWA] that MUST be used for signing Request Objects sent to the OP. All Request Objects from this Client MUST be rejected, if not signed with this algorithm. | [optional] |
 | **request_uris** | **Array<String>** | OpenID Connect Request URIs  Array of request_uri values that are pre-registered by the RP for use at the OP. Servers MAY cache the contents of the files referenced by these URIs and not retrieve them at the time they are used in a request. OPs can require that request_uri values used be pre-registered with the require_request_uri_registration discovery parameter. | [optional] |
-| **response_types** | **Array<String>** | OAuth 2.0 Client Response Types  An array of the OAuth 2.0 response type strings that the client can use at the authorization endpoint. Can be one of:  Needed for OpenID Connect Implicit Grant: Returns ID Token to redirect URI: `id_token` Returns Access token redirect URI: `token` Needed for Authorization Code Grant: `code` | [optional] |
+| **response_types** | **Array<String>** | OAuth 2.0 Client Response Types  An array of the OAuth 2.0 response type strings that the client can use at the authorization endpoint. Possible values are:  `code` for Authorization Code Grant. `token` or `id_token` or `token id_token` for OpenID Connect Implicit Grant (not recommended). `code token` or `code id_token` or `code token id_token` for OpenID Connect Hybrid Flow (not recommended). | [optional] |
 | **scope** | **String** | OAuth 2.0 Client Scope  Scope is a string containing a space-separated list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client can use when requesting access tokens. | [optional] |
 | **sector_identifier_uri** | **String** | OpenID Connect Sector Identifier URI  URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a file with a single JSON array of redirect_uri values. | [optional] |
 | **skip_consent** | **Boolean** | SkipConsent skips the consent screen for this client. This field can only be set from the admin API. | [optional] |

data/docs/OrganizationByHostname.md

@@ -0,0 +1,20 @@
+# OryClient::OrganizationByHostname
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **domains** | **Array<String>** | Domains are the organization's SSO domains. |  |
+| **id** | **String** | ID is the organization's unique identifier. |  |
+
+## Example
+
+```ruby
+require 'ory-client'
+
+instance = OryClient::OrganizationByHostname.new(
+  domains: null,
+  id: null
+)
+```
+