ory-client 1.22.66 → 1.22.78

data/docs/KeysetPaginationResponseHeaders.md

@@ -4,7 +4,7 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **link** | **String** | The Link HTTP Header  The `Link` header contains a comma-delimited list of links to the following pages:  first: The first page of results. next: The next page of results.  Pages are omitted if they do not exist. For example, if there is no next page, the `next` link is omitted. Examples:  </admin/sessions?page_size=250&page_token={last_item_uuid}; rel=\"first\",/admin/sessions?page_size=250&page_token=>; rel=\"next\" | [optional] |
+| **link** | **String** | The Link HTTP Header  The `Link` header contains a comma-delimited list of links to the following pages:  - first: The first page of results. - next: The next page of results.  Pages are omitted if they do not exist. For example, if there is no next page, the `next` link is omitted. Examples:  </admin/sessions?page_size=250&page_token={last_item_uuid}; rel=\"first\",/admin/sessions?page_size=250&page_token=>; rel=\"next\" | [optional] |
 
 ## Example
 

data/docs/ListWorkspaceContacts.md

@@ -0,0 +1,22 @@
+# OryClient::ListWorkspaceContacts
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **contacts** | [**Array<WorkspaceContact>**](WorkspaceContact.md) |  |  |
+| **has_next_page** | **Boolean** |  |  |
+| **next_page_token** | **String** |  |  |
+
+## Example
+
+```ruby
+require 'ory-client'
+
+instance = OryClient::ListWorkspaceContacts.new(
+  contacts: null,
+  has_next_page: null,
+  next_page_token: null
+)
+```
+

data/docs/LoginFlow.md

@@ -4,7 +4,7 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **active** | **String** | The active login method  If set contains the login method used. If the flow is new, it is unset. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML deviceauthn CredentialsTypeDeviceAuthn identifier_first CredentialsTypeIdentifierFirst link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode | [optional] |
+| **active** | **String** | The active login method  If set contains the login method used. If the flow is new, it is unset. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML deviceauthn CredentialsTypeDeviceAuthn identifier_first CredentialsTypeIdentifierFirst link_recovery CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode | [optional] |
 | **created_at** | **Time** | CreatedAt is a helper struct field for gobuffalo.pop. | [optional] |
 | **expires_at** | **Time** | ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated. |  |
 | **id** | **String** | ID represents the flow's unique ID. When performing the login flow, this represents the id in the login UI's query parameter: http://<selfservice.flows.login.ui_url>/?flow=<flow_id> |  |
@@ -18,7 +18,7 @@
 | **requested_aal** | [**AuthenticatorAssuranceLevel**](AuthenticatorAssuranceLevel.md) |  | [optional] |
 | **return_to** | **String** | ReturnTo contains the requested return_to URL. | [optional] |
 | **session_token_exchange_code** | **String** | SessionTokenExchangeCode holds the secret code that the client can use to retrieve a session token after the login flow has been completed. This is only set if the client has requested a session token exchange code, and if the flow is of type \"api\", and only on creating the login flow. | [optional] |
-| **state** | **Object** | State represents the state of this request:  choose_method: ask the user to choose a method to sign in with sent_email: the email has been sent to the user passed_challenge: the request was successful and the login challenge was passed. |  |
+| **state** | [**LoginFlowState**](LoginFlowState.md) |  |  |
 | **test_context** | [**LoginFlowTestContext**](LoginFlowTestContext.md) |  | [optional] |
 | **transient_payload** | **Object** | TransientPayload is used to pass data from the login to hooks and email templates | [optional] |
 | **type** | **String** | The flow type can either be `api` or `browser`. |  |

data/docs/ManageSessionsBody.md

@@ -4,7 +4,7 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **action** | **String** | Action to perform on the matching sessions. disable ManageSessionsActionDisable delete ManageSessionsActionDelete |  |
+| **action** | **String** | Action to perform on the matching sessions. |  |
 | **identities** | **Array<String>** | Identity IDs whose sessions should be disabled or deleted, or `[\"*\"]` to operate on every session in the network. Mutually exclusive with `sessions`. | [optional] |
 | **sessions** | **Array<String>** | Session IDs to disable or delete. Mutually exclusive with `identities`. The wildcard `[\"*\"]` is not accepted in this field — pass `identities: [\"*\"]` to scope the operation to every session in the network. | [optional] |
 

data/docs/Message.md

@@ -13,7 +13,7 @@
 | **send_count** | **Integer** |  |  |
 | **status** | [**CourierMessageStatus**](CourierMessageStatus.md) |  |  |
 | **subject** | **String** |  |  |
-| **template_type** | **String** |  recovery_invalid TypeRecoveryInvalid recovery_valid TypeRecoveryValid recovery_code_invalid TypeRecoveryCodeInvalid recovery_code_valid TypeRecoveryCodeValid verification_invalid TypeVerificationInvalid verification_valid TypeVerificationValid verification_code_invalid TypeVerificationCodeInvalid verification_code_valid TypeVerificationCodeValid stub TypeTestStub login_code_valid TypeLoginCodeValid registration_code_valid TypeRegistrationCodeValid verifiable_address_changed TypeVerifiableAddressChanged authenticator_key_added TypeAuthenticatorKeyAdded |  |
+| **template_type** | **String** | recovery_invalid TypeRecoveryInvalid recovery_valid TypeRecoveryValid recovery_code_invalid TypeRecoveryCodeInvalid recovery_code_valid TypeRecoveryCodeValid verification_invalid TypeVerificationInvalid verification_valid TypeVerificationValid verification_code_invalid TypeVerificationCodeInvalid verification_code_valid TypeVerificationCodeValid stub TypeTestStub login_code_valid TypeLoginCodeValid registration_code_valid TypeRegistrationCodeValid verifiable_address_changed TypeVerifiableAddressChanged authenticator_key_added TypeAuthenticatorKeyAdded |  |
 | **type** | [**CourierMessageType**](CourierMessageType.md) |  |  |
 | **updated_at** | **Time** | UpdatedAt is a helper struct field for gobuffalo.pop. |  |
 

data/docs/NormalizedProjectRevision.md

@@ -12,7 +12,7 @@
 | **account_experience_favicon_light** | **String** | Holds the URL to the account experience's favicon. This governs the \"favicon_light\" setting. | [optional] |
 | **account_experience_hide_ory_branding** | **Boolean** | Whether to hide the Ory branding badge on the account experience. This governs the \"hide_ory_branding\" setting. | [optional] |
 | **account_experience_hide_registration_link** | **Boolean** | Whether to hide the registration link on the account experience login card. This governs the \"hide_registration_link\" setting. | [optional] |
-| **account_experience_locale_behavior** | **String** | Holds the URL to the account experience's language behavior.  Can be one of: `respect_accept_language`: Respect the `Accept-Language` header. `force_default`: Force the default language. This governs the \"locale_behavior\" setting. | [optional] |
+| **account_experience_locale_behavior** | **String** | Holds the URL to the account experience's language behavior.  Can be one of: - `respect_accept_language`: Respect the `Accept-Language` header. - `force_default`: Force the default language. This governs the \"locale_behavior\" setting. | [optional] |
 | **account_experience_logo_dark** | **String** | Holds the URL to the account experience's dark theme logo (currently unused). This governs the \"logo_dark\" setting. | [optional] |
 | **account_experience_logo_light** | **String** | Holds the URL to the account experience's logo. This governs the \"logo_light\" setting. | [optional] |
 | **account_experience_privacy_policy_url** | **String** | Holds the URL to the account experience's Privacy Policy page. This governs the \"privacy_policy_url\" setting. | [optional] |
@@ -22,6 +22,7 @@
 | **created_at** | **Time** | The Project's Revision Creation Date | [optional][readonly] |
 | **disable_account_experience_welcome_screen** | **Boolean** | Whether to disable the account experience welcome screen, which is hosted under `/ui/welcome`. This governs the \"disable_welcome_screen\" setting. | [optional] |
 | **enable_ax_v2** | **Boolean** | Whether the new account experience is enabled and reachable. This governs the \"enable_ax_v2\" setting. | [optional] |
+| **feature_flags** | **Hash<String, Boolean>** | The project's feature flags. Keys are catalog flag keys such as `kratos.choose_recovery_address`. Responses contain every flag with its effective value; requests may set any subset. | [optional] |
 | **hydra_oauth2_allowed_top_level_claims** | **Array<String>** | A list of custom claims which are allowed to be added top level to the Access Token. They cannot override reserved claims.  This governs the \"oauth2.allowed_top_level_claims\" setting. | [optional] |
 | **hydra_oauth2_client_credentials_default_grant_allowed_scope** | **Boolean** | Automatically grant authorized OAuth2 Scope in OAuth2 Client Credentials Flow.  Each OAuth2 Client is allowed to request a predefined OAuth2 Scope (for example `read write`). If this option is enabled, the full scope is automatically granted when performing the OAuth2 Client Credentials flow.  If disabled, the OAuth2 Client has to request the scope in the OAuth2 request by providing the `scope` query parameter.  Setting this option to true is common if you need compatibility with MITREid.  This governs the \"oauth2.client_credentials.default_grant_allowed_scope\" setting. | [optional] |
 | **hydra_oauth2_device_authorization_token_polling_interval** | **String** | Configures how often a non-interactive device should poll the OAuth 2.0 Device Authorization Grant token endpoint. Purely informational — the value is reported to the device in the \"interval\" response field of the device authorization response. Hydra defaults to 5s when this is left empty.  This is an Enterprise feature.  This governs the \"oauth2.device_authorization.token_polling_interval\" setting. | [optional] |
@@ -50,7 +51,7 @@
 | **hydra_serve_cookies_same_site_legacy_workaround** | **Boolean** | Configures the Ory Hydra Cookie Same Site Legacy Workaround  This governs the \"serve.cookies.same_site_legacy_workaround\" setting. | [optional] |
 | **hydra_serve_cookies_same_site_mode** | **String** | Configures the Ory Hydra Cookie Same Site Mode  This governs the \"serve.cookies.same_site_mode\" setting. | [optional] |
 | **hydra_strategies_access_token** | **String** | Defines access token type  This governs the \"strategies.access_token\" setting. opaque Oauth2AccessTokenStrategyOpaque jwt Oauth2AccessTokenStrategyJwt | [optional][default to 'opaque'] |
-| **hydra_strategies_jwt_scope_claim** | **String** | Define the claim to use as the scope in the access token.  This governs the \"strategies.jwt.scope_claim\" setting.  list: The scope claim is an array of strings named `scope`: `{ \"scope\": [\"read\", \"write\"] }` string: The scope claim is a space delimited list of strings named `scp`: `{ \"scp\": \"read write\" }` both: The scope claim is both a space delimited list and an array of strings named `scope` and `scp`: `{ \"scope\": [\"read\", \"write\"], \"scp\": \"read write\" }` list OAuth2JWTScopeClaimList string OAuth2JWTScopeClaimString both OAuth2JWTScopeClaimBoth | [optional][default to 'list'] |
+| **hydra_strategies_jwt_scope_claim** | **String** | Define the claim to use as the scope in the access token.  This governs the \"strategies.jwt.scope_claim\" setting.  - list: The scope claim is an array of strings named `scope`: `{ \"scope\": [\"read\", \"write\"] }` - string: The scope claim is a space delimited list of strings named `scp`: `{ \"scp\": \"read write\" }` - both: The scope claim is both a space delimited list and an array of strings named `scope` and `scp`: `{ \"scope\": [\"read\", \"write\"], \"scp\": \"read write\" }` list OAuth2JWTScopeClaimList string OAuth2JWTScopeClaimString both OAuth2JWTScopeClaimBoth | [optional][default to 'list'] |
 | **hydra_strategies_scope** | **String** | Defines how scopes are matched. For more details have a look at https://github.com/ory/fosite#scopes  This governs the \"strategies.scope\" setting. exact Oauth2ScopeStrategyExact wildcard Oauth2ScopeStrategyWildcard | [optional][default to 'wildcard'] |
 | **hydra_ttl_access_token** | **String** | This governs the \"ttl.access_token\" setting. | [optional][default to '30m'] |
 | **hydra_ttl_auth_code** | **String** | Configures how long refresh tokens are valid.  Set to -1 for refresh tokens to never expire. This is not recommended!  This governs the \"ttl.auth_code\" setting. | [optional][default to '720h'] |
@@ -77,18 +78,20 @@
 | **hydra_webfinger_oidc_discovery_token_url** | **String** | Configures OpenID Connect Discovery and overwrites the OAuth2 Token URL.  This governs the \"webfinger.oidc_discovery.token_url\" setting. | [optional] |
 | **hydra_webfinger_oidc_discovery_userinfo_url** | **String** | Configures OpenID Connect Discovery and overwrites userinfo endpoint to be advertised at the OpenID Connect Discovery endpoint /.well-known/openid-configuration. Defaults to Ory Hydra's userinfo endpoint at /userinfo. Set this value if you want to handle this endpoint yourself.  This governs the \"webfinger.oidc_discovery.userinfo_url\" setting. | [optional] |
 | **id** | **String** | The revision ID. | [optional][readonly] |
+| **keto_feature_flags_strict_mode** | **Boolean** | Configures Keto's strict mode.  This governs the \"feature_flags.strict_mode\" setting. | [optional] |
 | **keto_namespace_configuration** | **String** | The Revisions' Keto Namespace Configuration  The string is a URL pointing to an OPL file with the configuration.  This governs the \"namespaces.location\" setting. | [optional] |
 | **keto_namespaces** | [**Array<KetoNamespace>**](KetoNamespace.md) |  | [optional] |
 | **keto_secrets_pagination** | **Array<String>** | Configures Keto's pagination secrets.  This governs the \"secrets.pagination\" setting. | [optional] |
+| **keto_strict_mode_readonly** | **Boolean** | When true, strict mode is locked: changes to it are rejected from any client (API, Console, config import), and the Console hides the toggle. NULL and false mean strict mode can be changed (existing projects during migration). New projects are created with this set to true, permanently enabling strict mode. This flag is backoffice metadata and is not part of the rendered Keto configuration. | [optional] |
 | **kratos_cookies_same_site** | **String** | Configures the Ory Kratos Cookie SameSite Attribute  This governs the \"cookies.same_site\" setting. | [optional] |
 | **kratos_courier_channels** | [**Array<NormalizedProjectRevisionCourierChannel>**](NormalizedProjectRevisionCourierChannel.md) |  | [optional] |
-| **kratos_courier_delivery_strategy** | **String** | The delivery strategy to use when sending emails  This governs the \"courier.delivery_strategy\" setting.  `smtp`: Use SMTP server `http`: Use the built in HTTP client to send the email to some remote service | [optional][default to 'smtp'] |
-| **kratos_courier_http_request_config_auth_api_key_in** | **String** | The location of the API key to use in the HTTP email sending service's authentication  `header`: Send the key value pair as a header `cookie`: Send the key value pair as a cookie This governs the \"courier.http.request_config.auth.config.in\" setting. | [optional] |
+| **kratos_courier_delivery_strategy** | **String** | The delivery strategy to use when sending emails  This governs the \"courier.delivery_strategy\" setting.  - `smtp`: Use SMTP server - `http`: Use the built in HTTP client to send the email to some remote service | [optional][default to 'smtp'] |
+| **kratos_courier_http_request_config_auth_api_key_in** | **String** | The location of the API key to use in the HTTP email sending service's authentication  - `header`: Send the key value pair as a header - `cookie`: Send the key value pair as a cookie This governs the \"courier.http.request_config.auth.config.in\" setting. | [optional] |
 | **kratos_courier_http_request_config_auth_api_key_name** | **String** | The name of the API key to use in the HTTP email sending service's authentication  This governs the \"courier.http.request_config.auth.config.name\" setting. | [optional] |
 | **kratos_courier_http_request_config_auth_api_key_value** | **String** | The value of the API key to use in the HTTP email sending service's authentication  This governs the \"courier.http.request_config.auth.config.value\" setting. | [optional] |
 | **kratos_courier_http_request_config_auth_basic_auth_password** | **String** | The password to use for basic auth in the HTTP email sending service's authentication  This governs the \"courier.http.request_config.auth.config.password\" setting. | [optional] |
 | **kratos_courier_http_request_config_auth_basic_auth_user** | **String** | The user to use for basic auth in the HTTP email sending service's authentication  This governs the \"courier.http.request_config.auth.config.user\" setting. | [optional] |
-| **kratos_courier_http_request_config_auth_type** | **String** | The authentication type to use while contacting the remote HTTP email sending service  This governs the \"courier.http.request_config.auth.type\" setting.  `basic_auth`: Use Basic Authentication `api_key`: Use API Key Authentication in a header or cookie | [optional][default to 'empty (no authentication)'] |
+| **kratos_courier_http_request_config_auth_type** | **String** | The authentication type to use while contacting the remote HTTP email sending service  This governs the \"courier.http.request_config.auth.type\" setting.  - `basic_auth`: Use Basic Authentication - `api_key`: Use API Key Authentication in a header or cookie | [optional][default to 'empty (no authentication)'] |
 | **kratos_courier_http_request_config_body** | **String** | The Jsonnet template to generate the body to send to the remote HTTP email sending service  Should be valid Jsonnet and base64 encoded  This governs the \"courier.http.request_config.body\" setting. | [optional] |
 | **kratos_courier_http_request_config_headers** | **Object** | Any additional headers to send to the remote HTTP email sending service  This governs the \"courier.http.request_config.headers\" setting. | [optional] |
 | **kratos_courier_http_request_config_method** | **String** | The http METHOD to use when calling the remote HTTP email sending service  This governs the \"courier.http.request_config.method\" setting. | [optional][default to 'POST'] |
@@ -138,6 +141,7 @@
 | **kratos_feature_flags_cacheable_sessions** | **Boolean** | Configures the Ory Kratos Session caching feature flag  This governs the \"feature_flags.cacheable_sessions\" setting. | [optional] |
 | **kratos_feature_flags_cacheable_sessions_max_age** | **String** | Configures the Ory Kratos Session caching max-age feature flag  This governs the \"feature_flags.cacheable_sessions_max_age\" setting. | [optional] |
 | **kratos_feature_flags_choose_recovery_address** | **Boolean** | This governs the \"feature_flags.choose_recovery_address\" setting. | [optional] |
+| **kratos_feature_flags_enforce_identity_schema_guards** | **Boolean** | Configures whether Ory Kratos enforces the identity schema guards  If enabled, an identity schema that does not pass the identity schema guards is rejected. If disabled, the result is logged and the schema is used.  This governs the \"feature_flags.enforce_identity_schema_guards\" setting. | [optional] |
 | **kratos_feature_flags_faster_session_extend** | **Boolean** | Configures the Ory Kratos Faster Session Extend setting  If enabled allows faster session extension by skipping the session lookup and returning 201 instead of 200. Disabling this feature will be deprecated in the future.  This governs the \"feature_flags.faster_session_extend\" setting. | [optional] |
 | **kratos_feature_flags_legacy_continue_with_verification_ui** | **Boolean** | Always include show_verification_ui in continue_with  If true, restores the legacy behavior of always including `show_verification_ui` in the registration flow's `continue_with` when verification is enabled. If set to false, `show_verification_ui` is only set in `continue_with` if the `show_verification_ui` hook is used. This flag will be removed in the future.  This governs the \"feature_flags.legacy_continue_with_verification_ui\" setting. | [optional] |
 | **kratos_feature_flags_legacy_oidc_registration_node_group** | **Boolean** | Controls whether the UI nodes in an OIDC registration flow have group \"oidc\" in case required fields are not returned by the OIDC provider.  If set to true, the UI nodes will have group \"oidc\" and the flow will be considered successful if the user completes the flow. This is the legacy behavior.  This governs the \"feature_flags.legacy_oidc_registration_node_group\" setting. | [optional] |
@@ -145,11 +149,12 @@
 | **kratos_feature_flags_password_profile_registration_node_group** | **Boolean** | Configures the group for the password method in the registration flow.  If true, it sets the password method group value to \"password\" if it is the only method available. This is the legacy behavior. If false is, it sets the password method group value to \"default\".  This governs the \"feature_flags.password_profile_registration_node_group\" setting. | [optional] |
 | **kratos_feature_flags_refresh_login_choose_address** | **Boolean** | Render an address picker on the code refresh login screen  If true, a code-strategy refresh (privileged re-authentication) login renders a \"Send code to <address>\" button per available code address instead of re-asking for the identifier. The identity is already fixed by the active session, so re-entering the identifier is unnecessary. It is safe to toggle this back and forth.  This governs the \"feature_flags.refresh_login_choose_address\" setting. | [optional] |
 | **kratos_feature_flags_use_continue_with_transitions** | **Boolean** | Configures the Ory Kratos Session use_continue_with_transitions flag  This governs the \"feature_flags.use_continue_with_transitions\" setting. | [optional] |
+| **kratos_feature_flags_webhook_response_directives** | **Boolean** | Honor flow directives in web hook responses  If true, a login `after` web hook whose `response.parse` is enabled may return `{\"required_aal\":\"aal2\"}` to require step-up for that login. Identities without a second factor are routed to enrollment. Off by default, because a web hook that already returns a `required_aal` field has it ignored today and enabling that silently would change how existing logins end.  This governs the \"feature_flags.webhook_response_directives\" setting. | [optional] |
 | **kratos_identity_schemas** | [**Array<NormalizedProjectRevisionIdentitySchema>**](NormalizedProjectRevisionIdentitySchema.md) |  | [optional] |
 | **kratos_oauth2_provider_headers** | **Object** | Configures the OAuth2 Provider Integration HTTP Headers  This governs the \"oauth2_provider.headers\" setting. | [optional] |
 | **kratos_oauth2_provider_override_return_to** | **Boolean** | Kratos OAuth2 Provider Override Return To  Enabling this allows Kratos to set the return_to parameter automatically to the OAuth2 request URL on the login flow, allowing complex flows such as recovery to continue to the initial OAuth2 flow.  This governs the \"oauth2_provider.override_return_to\" setting. | [optional] |
 | **kratos_oauth2_provider_url** | **String** | The Revisions' OAuth2 Provider Integration URL  This governs the \"oauth2_provider.url\" setting. | [optional] |
-| **kratos_preview_default_read_consistency_level** | **String** | Configures the default read consistency level for identity APIs  The read consistency level determines the consistency guarantee for reads:  strong (slow): The read is guaranteed to return the most recent data committed at the start of the read. eventual (very fast): The result will return data that is about 4.8 seconds old.  Setting the default consistency level to `eventual` may cause regressions in the future as we add consistency controls to more APIs. Currently, the following APIs will be affected by this setting:  `GET /admin/identities`  Defaults to \"strong\" for new and existing projects. This feature is in preview. Use with caution. This governs the \"preview.default_read_consistency_level\" setting. | [optional] |
+| **kratos_preview_default_read_consistency_level** | **String** | Configures the default read consistency level for identity APIs  The read consistency level determines the consistency guarantee for reads:  - strong (slow): The read is guaranteed to return the most recent data committed at the start of the read. - eventual (very fast): The result will return data that is about 4.8 seconds old.  Setting the default consistency level to `eventual` may cause regressions in the future as we add consistency controls to more APIs. Currently, the following APIs will be affected by this setting:  - `GET /admin/identities`  Defaults to \"strong\" for new and existing projects. This feature is in preview. Use with caution. This governs the \"preview.default_read_consistency_level\" setting. | [optional] |
 | **kratos_secrets_cipher** | **Array<String>** | Configures the Ory Kratos Cipher Secret  This governs the \"secrets.cipher\" setting. | [optional] |
 | **kratos_secrets_cookie** | **Array<String>** | Configures the Ory Kratos Cookie Secret  This governs the \"secrets.cookie\" setting. | [optional] |
 | **kratos_secrets_default** | **Array<String>** | Configures the Ory Kratos Default Secret  This governs the \"secrets.default\" setting. | [optional] |
@@ -220,6 +225,7 @@
 | **kratos_selfservice_methods_code_mfa_enabled** | **Boolean** | Configures whether the code method can be used to fulfil MFA flows  This governs the \"selfservice.methods.code.mfa_enabled\" setting. | [optional] |
 | **kratos_selfservice_methods_code_passwordless_enabled** | **Boolean** | Configures whether Ory Kratos Passwordless should use the Code Method  This governs the \"selfservice.methods.code.passwordless_enabled\" setting. | [optional] |
 | **kratos_selfservice_methods_code_passwordless_login_fallback_enabled** | **Boolean** | This setting allows the code method to always login a user with code if they have registered with another authentication method such as password or social sign in.  This governs the \"selfservice.methods.code.passwordless_login_fallback_enabled\" setting. | [optional] |
+| **kratos_selfservice_methods_deviceauthn_config_android_allow_expired_factory_certificates** | **Boolean** | Configures whether Ory Kratos Device authentication accepts expired certificates in Android factory attestation chains  When enabled, Android enrollment accepts expired CA certificates in factory-provisioned attestation chains that lead to a pinned Google root key. Devices launched before 2021 ship factory keyboxes whose certificates have expired but that Google documents as still trustworthy unless revoked. Revocation, signature, and leaf-validity checks still apply, and keys enrolled this way are first-class hardware-attested keys. Defaults to false.  This governs the \"selfservice.methods.deviceauthn.config.android_allow_expired_factory_certificates\" setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_android_app_ids** | **Array<String>** | Configures the allow-list of Android app signing-certificate digests that a device key may be bound to.  This governs the \"selfservice.methods.deviceauthn.config.android_app_ids\" setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_first_factor** | **Boolean** | Configures whether device authentication may be used as the sole first factor.  When enabled, a confirmed device key with PIN or platform user verification can complete an AAL2 login in a single submission, without a password or code. Defaults to false, which keeps device keys usable only as a second factor (step-up).  This governs the \"selfservice.methods.deviceauthn.config.first_factor\" setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_insecure_allow_relaxed_attestation** | **Boolean** | Configures whether Ory Kratos Device authentication accepts relaxed attestations for testing  Only allowed on development projects and forced off otherwise. Keys enrolled under relaxation are short-lived and refused once this is turned off.  This governs the \"selfservice.methods.deviceauthn.config.insecure_allow_relaxed_attestation\" setting. | [optional] |
@@ -317,6 +323,7 @@ instance = OryClient::NormalizedProjectRevision.new(
   created_at: null,
   disable_account_experience_welcome_screen: null,
   enable_ax_v2: null,
+  feature_flags: null,
   hydra_oauth2_allowed_top_level_claims: null,
   hydra_oauth2_client_credentials_default_grant_allowed_scope: null,
   hydra_oauth2_device_authorization_token_polling_interval: 15s,
@@ -372,9 +379,11 @@ instance = OryClient::NormalizedProjectRevision.new(
   hydra_webfinger_oidc_discovery_token_url: null,
   hydra_webfinger_oidc_discovery_userinfo_url: null,
   id: null,
+  keto_feature_flags_strict_mode: null,
   keto_namespace_configuration: null,
   keto_namespaces: null,
   keto_secrets_pagination: null,
+  keto_strict_mode_readonly: null,
   kratos_cookies_same_site: null,
   kratos_courier_channels: null,
   kratos_courier_delivery_strategy: null,
@@ -433,6 +442,7 @@ instance = OryClient::NormalizedProjectRevision.new(
   kratos_feature_flags_cacheable_sessions: null,
   kratos_feature_flags_cacheable_sessions_max_age: null,
   kratos_feature_flags_choose_recovery_address: null,
+  kratos_feature_flags_enforce_identity_schema_guards: null,
   kratos_feature_flags_faster_session_extend: null,
   kratos_feature_flags_legacy_continue_with_verification_ui: null,
   kratos_feature_flags_legacy_oidc_registration_node_group: null,
@@ -440,6 +450,7 @@ instance = OryClient::NormalizedProjectRevision.new(
   kratos_feature_flags_password_profile_registration_node_group: null,
   kratos_feature_flags_refresh_login_choose_address: null,
   kratos_feature_flags_use_continue_with_transitions: null,
+  kratos_feature_flags_webhook_response_directives: null,
   kratos_identity_schemas: null,
   kratos_oauth2_provider_headers: null,
   kratos_oauth2_provider_override_return_to: null,
@@ -515,6 +526,7 @@ instance = OryClient::NormalizedProjectRevision.new(
   kratos_selfservice_methods_code_mfa_enabled: null,
   kratos_selfservice_methods_code_passwordless_enabled: null,
   kratos_selfservice_methods_code_passwordless_login_fallback_enabled: null,
+  kratos_selfservice_methods_deviceauthn_config_android_allow_expired_factory_certificates: null,
   kratos_selfservice_methods_deviceauthn_config_android_app_ids: null,
   kratos_selfservice_methods_deviceauthn_config_first_factor: null,
   kratos_selfservice_methods_deviceauthn_config_insecure_allow_relaxed_attestation: null,

data/docs/NormalizedProjectRevisionCourierChannel.md

@@ -6,7 +6,7 @@
 | ---- | ---- | ----------- | ----- |
 | **channel_id** | **String** | The Channel's public ID |  |
 | **created_at** | **Time** | The creation date | [optional][readonly] |
-| **request_config_auth_config_api_key_in** | **String** | API key location  Can either be \"header\" or \"query\" | [optional] |
+| **request_config_auth_config_api_key_in** | **String** | API key location  Can either be \"header\" or \"query\"  Only used if the auth type is api_key | [optional] |
 | **request_config_auth_config_api_key_name** | **String** | API key name  Only used if the auth type is api_key | [optional] |
 | **request_config_auth_config_api_key_value** | **String** | API key value  Only used if the auth type is api_key | [optional] |
 | **request_config_auth_config_basic_auth_password** | **String** | Basic Auth Password  Only used if the auth type is basic_auth | [optional] |

data/docs/NormalizedProjectRevisionIdentitySchema.md

@@ -27,7 +27,7 @@ instance = OryClient::NormalizedProjectRevisionIdentitySchema.new(
   identity_schema: null,
   identity_schema_id: null,
   import_id: null,
-  import_url: base64://ey...,
+  import_url: base64://ey..,
   is_default: null,
   preset: null,
   project_revision_id: null,

data/docs/NormalizedProjectRevisionSAMLProvider.md

@@ -7,6 +7,7 @@
 | **audience_override_base_url** | **String** |  | [optional] |
 | **created_at** | **Time** | The Project's Revision Creation Date | [optional][readonly] |
 | **id** | **String** |  | [optional] |
+| **idp_initiated_login_enabled** | **Boolean** | IdPInitiatedLoginEnabled enables IdP-initiated login for this provider.  When enabled, users can start a login from their identity provider's app launcher. The Polis connection's default redirect URL then points at the Kratos IdP-initiated login entry point instead of the SAML callback. | [optional] |
 | **label** | **String** | Label represents an optional label which can be used in the UI generation. | [optional] |
 | **mapper_url** | **String** | Mapper specifies the JSONNet code snippet which uses the OpenID Connect Provider's data (e.g. GitHub or Google profile information) to hydrate the identity's data. | [optional] |
 | **organization_id** | **String** |  | [optional] |
@@ -16,7 +17,7 @@
 | **proxy_saml_audience_override** | **String** |  | [optional] |
 | **raw_idp_metadata_xml** | **String** | RawIDPMetadataXML is the raw XML metadata of the IDP. | [optional] |
 | **state** | **String** | State indicates the state of the provider  Only providers with state `enabled` will be used for authentication enabled ThirdPartyProviderStateEnabled disabled ThirdPartyProviderStateDisabled | [optional] |
-| **update_identity_on_login** | **String** | UpdateIdentityOnLogin controls whether the identity is updated from SAML claims on each login.  Possible values are \"never\" (default) and \"automatic\". never UpdateIdentityOnLoginNever  UpdateIdentityOnLoginNever disables identity updates on login (default). automatic UpdateIdentityOnLoginAutomatic  UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically. | [optional] |
+| **update_identity_on_login** | **String** | UpdateIdentityOnLogin controls whether the identity is updated from SAML claims on each login.  Possible values are \"never\" (default) and \"automatic\". never UpdateIdentityOnLoginNever disables identity updates on login (default). automatic UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically. | [optional] |
 | **updated_at** | **Time** | Last Time Project's Revision was Updated | [optional][readonly] |
 | **valid_to** | **Array<String>** | Valid to dates of all signing certs associated with the SAML connection | [optional][readonly] |
 
@@ -29,6 +30,7 @@ instance = OryClient::NormalizedProjectRevisionSAMLProvider.new(
   audience_override_base_url: null,
   created_at: null,
   id: null,
+  idp_initiated_login_enabled: null,
   label: null,
   mapper_url: null,
   organization_id: null,

data/docs/NormalizedProjectRevisionThirdPartyProvider.md

@@ -6,7 +6,7 @@
 | ---- | ---- | ----------- | ----- |
 | **aal2_acr_values** | **Array<String>** | AAL2ACRValues lists upstream OIDC `acr` claim values that should elevate the resulting Kratos session to AAL2. Empty means the upstream `acr` claim is ignored when deciding session AAL. | [optional] |
 | **aal2_amr_values** | **Array<String>** | AAL2AMRValues lists upstream OIDC `amr` claim values that should elevate the resulting Kratos session to AAL2 when any of them appears in the upstream `amr` array. Empty means the upstream `amr` claim is ignored when deciding session AAL. | [optional] |
-| **account_linking_mode** | **String** | AccountLinkingMode controls how account conflicts are resolved for this provider.  Possible values are `confirm_with_existing_credential` (default) and `automatic`. `automatic` silently links accounts when the provider verifies email ownership. Only supported for `apple` and `google` providers. automatic AccountLinkingModeAutomatic  AccountLinkingModeAutomatic silently links accounts if the provider verifies email ownership. confirm_with_existing_credential AccountLinkingModeConfirmWithExistingCredential  AccountLinkingModeConfirmWithExistingCredential requires the user to confirm the account linking by providing an existing credential. | [optional] |
+| **account_linking_mode** | **String** | AccountLinkingMode controls how account conflicts are resolved for this provider.  Possible values are `confirm_with_existing_credential` (default) and `automatic`. `automatic` silently links accounts when the provider verifies email ownership. Only supported for `apple` and `google` providers. automatic AccountLinkingModeAutomatic silently links accounts if the provider verifies email ownership. confirm_with_existing_credential AccountLinkingModeConfirmWithExistingCredential requires the user to confirm the account linking by providing an existing credential. | [optional] |
 | **additional_id_token_audiences** | **Array<String>** | AdditionalIDTokenAudiences is a list of additional audiences allowed in the ID Token.  This is only relevant in OIDC flows that submit an IDToken instead of using the callback from the OIDC provider. | [optional] |
 | **apple_private_key** | **String** |  | [optional] |
 | **apple_private_key_id** | **String** | Apple Private Key Identifier  Sign In with Apple Private Key Identifier needed for generating a JWT token for client secret | [optional] |
@@ -26,7 +26,7 @@
 | **organization_id** | **String** |  | [optional] |
 | **pkce** | **String** |  | [optional] |
 | **project_revision_id** | **String** | The Revision's ID this provider belongs to | [optional] |
-| **provider** | **String** | Provider is either \"generic\" for a generic OAuth 2.0 / OpenID Connect Provider or one of: generic google github gitlab microsoft discord slack facebook vk yandex apple | [optional] |
+| **provider** | **String** | Provider is either \"generic\" for a generic OAuth 2.0 / OpenID Connect Provider or one of: - generic - google - github - gitlab - microsoft - discord - slack - facebook - vk - yandex - apple | [optional] |
 | **provider_id** | **String** | ID is the provider's ID | [optional] |
 | **proxy_oidc_redirect_url** | **String** | Proxy OIDC Redirect URL if overriding with a customer-controlled URL | [optional][readonly] |
 | **requested_claims** | **Object** |  | [optional] |
@@ -34,7 +34,7 @@
 | **state** | **String** | State indicates the state of the provider  Only providers with state `enabled` will be used for authentication enabled ThirdPartyProviderStateEnabled disabled ThirdPartyProviderStateDisabled | [optional] |
 | **subject_source** | **String** |  | [optional] |
 | **token_url** | **String** | TokenURL is the token url, typically something like: https://example.org/oauth2/token  Should only be used when the OAuth2 / OpenID Connect server is not supporting OpenID Connect Discovery and when `provider` is set to `generic`. | [optional] |
-| **update_identity_on_login** | **String** | UpdateIdentityOnLogin controls whether the identity is updated from OIDC claims on each login.  Possible values are \"never\" (default) and \"automatic\". never UpdateIdentityOnLoginNever  UpdateIdentityOnLoginNever disables identity updates on login (default). automatic UpdateIdentityOnLoginAutomatic  UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically. | [optional] |
+| **update_identity_on_login** | **String** | UpdateIdentityOnLogin controls whether the identity is updated from OIDC claims on each login.  Possible values are \"never\" (default) and \"automatic\". never UpdateIdentityOnLoginNever disables identity updates on login (default). automatic UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically. | [optional] |
 | **updated_at** | **Time** | Last Time Project's Revision was Updated | [optional][readonly] |
 
 ## Example

data/docs/NormalizedProjectRevisionTokenizerTemplate.md

@@ -7,7 +7,7 @@
 | **claims_mapper_url** | **String** | Claims mapper URL | [optional] |
 | **created_at** | **Time** | The Project's Revision Creation Date | [optional][readonly] |
 | **id** | **String** | The revision ID. | [optional][readonly] |
-| **jwks_url** | **String** | JSON Web Key URL | [optional] |
+| **jwks_url** | **String** | JSON Web Key URL  The key set signs the tokens this template issues. It is write only and the value will not be returned in response to a read request. An update that leaves this field empty keeps the stored key set; supply a new one to rotate. | [optional] |
 | **key** | **String** | The unique key of the template | [optional] |
 | **project_revision_id** | **String** | The Revision's ID this schema belongs to | [optional] |
 | **subject_source** | **String** | Subject source for the tokenizer  Can be either id or external_id or empty | [optional][default to 'id'] |

data/docs/OAuth2Api.md

@@ -2095,11 +2095,11 @@ nil (empty response body)
 
 ## rotate_o_auth2_client_secret
 
-> <OAuth2Client> rotate_o_auth2_client_secret(id)
+> <OAuth2Client> rotate_o_auth2_client_secret(id, opts)
 
 Rotate OAuth 2.0 Client Secret
 
-Rotates an OAuth 2.0 client's secrets. The old secret will remain valid for authentication, allowing for zero-downtime secret rotations. A new secret will be generated and returned in the response.  Up to five rotated secrets are retained. Use the `deleteRotatedOAuth2ClientSecrets` endpoint to remove old rotated secrets when they are no longer needed.
+Rotates an OAuth 2.0 client's secrets. The old secret will remain valid for authentication, allowing for zero-downtime secret rotations. A new secret will be generated and returned in the response.  Up to five rotated secrets are retained. Use the `deleteRotatedOAuth2ClientSecrets` endpoint to remove old rotated secrets when they are no longer needed.  Supply `client_secret` in the request body to rotate to a specific value instead of a generated one. The request body is optional.
 
 ### Examples
 
@@ -2114,10 +2114,13 @@ end
 
 api_instance = OryClient::OAuth2Api.new
 id = 'id_example' # String | OAuth 2.0 Client ID
+opts = {
+  rotate_o_auth2_client_secret_body: OryClient::RotateOAuth2ClientSecretBody.new # RotateOAuth2ClientSecretBody | 
+}
 
 begin
   # Rotate OAuth 2.0 Client Secret
-  result = api_instance.rotate_o_auth2_client_secret(id)
+  result = api_instance.rotate_o_auth2_client_secret(id, opts)
   p result
 rescue OryClient::ApiError => e
   puts "Error when calling OAuth2Api->rotate_o_auth2_client_secret: #{e}"
@@ -2128,12 +2131,12 @@ end
 
 This returns an Array which contains the response data, status code and headers.
 
-> <Array(<OAuth2Client>, Integer, Hash)> rotate_o_auth2_client_secret_with_http_info(id)
+> <Array(<OAuth2Client>, Integer, Hash)> rotate_o_auth2_client_secret_with_http_info(id, opts)
 
 ```ruby
 begin
   # Rotate OAuth 2.0 Client Secret
-  data, status_code, headers = api_instance.rotate_o_auth2_client_secret_with_http_info(id)
+  data, status_code, headers = api_instance.rotate_o_auth2_client_secret_with_http_info(id, opts)
   p status_code # => 2xx
   p headers # => { ... }
   p data # => <OAuth2Client>
@@ -2147,6 +2150,7 @@ end
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
 | **id** | **String** | OAuth 2.0 Client ID |  |
+| **rotate_o_auth2_client_secret_body** | [**RotateOAuth2ClientSecretBody**](RotateOAuth2ClientSecretBody.md) |  | [optional] |
 
 ### Return type
 
@@ -2158,7 +2162,7 @@ end
 
 ### HTTP request headers
 
-- **Content-Type**: Not defined
+- **Content-Type**: application/json
 - **Accept**: application/json
 
 

data/docs/OAuth2Client.md

@@ -25,7 +25,7 @@
 | **device_authorization_grant_refresh_token_lifespan** | **String** |  | [optional] |
 | **frontchannel_logout_session_required** | **Boolean** | OpenID Connect Front-Channel Logout Session Required  Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session with the OP when the frontchannel_logout_uri is used. If omitted, the default value is false. | [optional] |
 | **frontchannel_logout_uri** | **String** | OpenID Connect Front-Channel Logout URI  RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter MAY be included by the OP to enable the RP to validate the request and to determine which of the potentially multiple sessions is to be logged out; if either is included, both MUST be. | [optional] |
-| **grant_types** | **Array<String>** | OAuth 2.0 Client Grant Types  An array of OAuth 2.0 grant types the client is allowed to use. Can be one of:  Client Credentials Grant: `client_credentials` Authorization Code Grant: `authorization_code` OpenID Connect Implicit Grant (deprecated!): `implicit` Refresh Token Grant: `refresh_token` OAuth 2.0 Token Exchange: `urn:ietf:params:oauth:grant-type:jwt-bearer` OAuth 2.0 Device Code Grant: `urn:ietf:params:oauth:grant-type:device_code` | [optional] |
+| **grant_types** | **Array<String>** | OAuth 2.0 Client Grant Types  An array of OAuth 2.0 grant types the client is allowed to use. Can be one of:  - Client Credentials Grant: `client_credentials` - Authorization Code Grant: `authorization_code` - OpenID Connect Implicit Grant (deprecated!): `implicit` - Refresh Token Grant: `refresh_token` - OAuth 2.0 Token Exchange: `urn:ietf:params:oauth:grant-type:jwt-bearer` - OAuth 2.0 Device Code Grant: `urn:ietf:params:oauth:grant-type:device_code` | [optional] |
 | **implicit_grant_access_token_lifespan** | **String** |  | [optional] |
 | **implicit_grant_id_token_lifespan** | **String** |  | [optional] |
 | **jwks** | [**JsonWebKeySet**](JsonWebKeySet.md) |  | [optional] |
@@ -44,13 +44,13 @@
 | **registration_client_uri** | **String** | OpenID Connect Dynamic Client Registration URL  RegistrationClientURI is the URL used to update, get, or delete the OAuth2 Client. | [optional] |
 | **request_object_signing_alg** | **String** | OpenID Connect Request Object Signing Algorithm  JWS [JWS] alg algorithm [JWA] that MUST be used for signing Request Objects sent to the OP. All Request Objects from this Client MUST be rejected, if not signed with this algorithm. | [optional] |
 | **request_uris** | **Array<String>** | OpenID Connect Request URIs  Array of request_uri values that are pre-registered by the RP for use at the OP. Servers MAY cache the contents of the files referenced by these URIs and not retrieve them at the time they are used in a request. OPs can require that request_uri values used be pre-registered with the require_request_uri_registration discovery parameter. | [optional] |
-| **response_types** | **Array<String>** | OAuth 2.0 Client Response Types  An array of the OAuth 2.0 response type strings that the client can use at the authorization endpoint. Possible values are:  `code` for Authorization Code Grant. `token` or `id_token` or `token id_token` for OpenID Connect Implicit Grant (not recommended). `code token` or `code id_token` or `code token id_token` for OpenID Connect Hybrid Flow (not recommended). | [optional] |
+| **response_types** | **Array<String>** | OAuth 2.0 Client Response Types  An array of the OAuth 2.0 response type strings that the client can use at the authorization endpoint. Possible values are:  - `code` for Authorization Code Grant. - `token` or `id_token` or `token id_token` for OpenID Connect Implicit Grant (not recommended). - `code token` or `code id_token` or `code token id_token` for OpenID Connect Hybrid Flow (not recommended). | [optional] |
 | **scope** | **String** | OAuth 2.0 Client Scope  Scope is a string containing a space-separated list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client can use when requesting access tokens. | [optional] |
 | **sector_identifier_uri** | **String** | OpenID Connect Sector Identifier URI  URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a file with a single JSON array of redirect_uri values. | [optional] |
 | **skip_consent** | **Boolean** | SkipConsent skips the consent screen for this client. This field can only be set from the admin API. | [optional] |
 | **skip_logout_consent** | **Boolean** | SkipLogoutConsent skips the logout consent screen for this client. This field can only be set from the admin API. | [optional] |
 | **subject_type** | **String** | OpenID Connect Subject Type  The `subject_types_supported` Discovery parameter contains a list of the supported subject_type values for this server. Valid types include `pairwise` and `public`. | [optional] |
-| **token_endpoint_auth_method** | **String** | OAuth 2.0 Token Endpoint Authentication Method  Requested Client Authentication method for the Token Endpoint. The options are:  `client_secret_basic`: (default) Send `client_id` and `client_secret` as `application/x-www-form-urlencoded` encoded in the HTTP Authorization header. `client_secret_post`: Send `client_id` and `client_secret` as `application/x-www-form-urlencoded` in the HTTP body. `private_key_jwt`: Use JSON Web Tokens to authenticate the client. `none`: Used for public clients (native apps, mobile apps) which can not have secrets. | [optional][default to 'client_secret_basic'] |
+| **token_endpoint_auth_method** | **String** | OAuth 2.0 Token Endpoint Authentication Method  Requested Client Authentication method for the Token Endpoint. The options are:  - `client_secret_basic`: (default) Send `client_id` and `client_secret` as `application/x-www-form-urlencoded` encoded in the HTTP Authorization header. - `client_secret_post`: Send `client_id` and `client_secret` as `application/x-www-form-urlencoded` in the HTTP body. - `private_key_jwt`: Use JSON Web Tokens to authenticate the client. - `none`: Used for public clients (native apps, mobile apps) which can not have secrets. | [optional][default to 'client_secret_basic'] |
 | **token_endpoint_auth_signing_alg** | **String** | OAuth 2.0 Token Endpoint Signing Algorithm  Requested Client Authentication signing algorithm for the Token Endpoint. | [optional] |
 | **tos_uri** | **String** | OAuth 2.0 Client Terms of Service URI  A URL string pointing to a human-readable terms of service document for the client that describes a contractual relationship between the end-user and the client that the end-user accepts when authorizing the client. | [optional] |
 | **updated_at** | **Time** | OAuth 2.0 Client Last Update Date  UpdatedAt returns the timestamp of the last update. | [optional] |

data/docs/OAuth2ConsentRequestOpenIDConnectContext.md

@@ -5,7 +5,7 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
 | **acr_values** | **Array<String>** | ACRValues is the Authentication AuthorizationContext Class Reference requested in the OAuth 2.0 Authorization request. It is a parameter defined by OpenID Connect and expresses which level of authentication (e.g. 2FA) is required.  OpenID Connect defines it as follows: > Requested Authentication AuthorizationContext Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference. The Authentication AuthorizationContext Class satisfied by the authentication performed is returned as the acr Claim Value, as specified in Section 2. The acr Claim is requested as a Voluntary Claim by this parameter. | [optional] |
-| **display** | **String** | Display is a string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User. The defined values are: page: The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view. If the display parameter is not specified, this is the default display mode. popup: The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over. touch: The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface. wap: The Authorization Server SHOULD display the authentication and consent UI consistent with a \"feature phone\" type display.  The Authorization Server MAY also attempt to detect the capabilities of the User Agent and present an appropriate display. | [optional] |
+| **display** | **String** | Display is a string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User. The defined values are: - page: The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view. If the display parameter is not specified, this is the default display mode. - popup: The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over. - touch: The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface. - wap: The Authorization Server SHOULD display the authentication and consent UI consistent with a \"feature phone\" type display.  The Authorization Server MAY also attempt to detect the capabilities of the User Agent and present an appropriate display. | [optional] |
 | **id_token_hint_claims** | **Hash<String, Object>** | IDTokenHintClaims are the claims of the ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. | [optional] |
 | **login_hint** | **String** | LoginHint hints about the login identifier the End-User might use to log in (if necessary). This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier) and then wants to pass that value as a hint to the discovered authorization service. This value MAY also be a phone number in the format specified for the phone_number Claim. The use of this parameter is optional. | [optional] |
 | **ui_locales** | **Array<String>** | UILocales is the End-User'id preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance, the value \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation). An error SHOULD NOT result if some or all of the requested locales are not supported by the OpenID Provider. | [optional] |

data/docs/OidcApi.md

@@ -414,7 +414,7 @@ This endpoint does not need any parameter.
 
 OpenID Connect Front- and Back-channel Enabled Logout
 
-This endpoint initiates and completes user logout at the Ory OAuth2 & OpenID provider and initiates OpenID Connect Front- / Back-channel logout:  https://openid.net/specs/openid-connect-frontchannel-1_0.html https://openid.net/specs/openid-connect-backchannel-1_0.html  Back-channel logout is performed asynchronously and does not affect logout flow.
+This endpoint initiates and completes user logout at the Ory OAuth2 & OpenID provider and initiates OpenID Connect Front- / Back-channel logout:  - https://openid.net/specs/openid-connect-frontchannel-1_0.html - https://openid.net/specs/openid-connect-backchannel-1_0.html  Back-channel logout is performed asynchronously and does not affect logout flow.
 
 ### Examples
 

data/docs/OidcConfiguration.md

@@ -69,7 +69,7 @@ instance = OryClient::OidcConfiguration.new(
   response_types_supported: null,
   revocation_endpoint: null,
   scopes_supported: null,
-  subject_types_supported: null,
+  subject_types_supported: ["public","pairwise"],
   token_endpoint: https://playground.ory.sh/ory-hydra/public/oauth2/token,
   token_endpoint_auth_methods_supported: null,
   userinfo_endpoint: null,

data/docs/OplParseError.md

@@ -0,0 +1,22 @@
+# OryClient::OplParseError
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **_end** | [**OplSourcePosition**](OplSourcePosition.md) |  | [optional] |
+| **message** | **String** |  | [optional] |
+| **start** | [**OplSourcePosition**](OplSourcePosition.md) |  | [optional] |
+
+## Example
+
+```ruby
+require 'ory-client'
+
+instance = OryClient::OplParseError.new(
+  _end: null,
+  message: null,
+  start: null
+)
+```
+

data/docs/OplSourcePosition.md

@@ -0,0 +1,20 @@
+# OryClient::OplSourcePosition
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **column** | **Integer** |  | [optional] |
+| **line** | **Integer** |  | [optional] |
+
+## Example
+
+```ruby
+require 'ory-client'
+
+instance = OryClient::OplSourcePosition.new(
+  column: null,
+  line: null
+)
+```
+

data/docs/OplValidateResult.md

@@ -0,0 +1,18 @@
+# OryClient::OplValidateResult
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **errors** | [**Array<OplParseError>**](OplParseError.md) |  | [optional] |
+
+## Example
+
+```ruby
+require 'ory-client'
+
+instance = OryClient::OplValidateResult.new(
+  errors: null
+)
+```
+

data/docs/PatchIdentitiesBody.md

@@ -5,6 +5,7 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
 | **identities** | [**Array<IdentityPatch>**](IdentityPatch.md) | Identities holds the list of patches to apply  required | [optional] |
+| **with_partial_inserts** | **Boolean** | WithPartialInserts controls how the batch handles an identity that conflicts with one that already exists.  When true (the default), every identity is applied on its own: the ones that do not conflict are created, and the response reports the conflicting ones individually.  When false, the batch is written in one transaction and is all-or-nothing. A single conflict fails the whole request with 409 Conflict and no identity is created, but the import is considerably faster. | [optional] |
 
 ## Example
 
@@ -12,7 +13,8 @@
 require 'ory-client'
 
 instance = OryClient::PatchIdentitiesBody.new(
-  identities: null
+  identities: null,
+  with_partial_inserts: null
 )
 ```
 

data/docs/PatchWorkspaceContactBody.md

@@ -0,0 +1,26 @@
+# OryClient::PatchWorkspaceContactBody
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **business** | **Boolean** |  | [optional] |
+| **privacy** | **Boolean** |  | [optional] |
+| **recipient** | [**WorkspaceContactRecipientInput**](WorkspaceContactRecipientInput.md) |  | [optional] |
+| **security** | **Boolean** |  | [optional] |
+| **technical** | **Boolean** |  | [optional] |
+
+## Example
+
+```ruby
+require 'ory-client'
+
+instance = OryClient::PatchWorkspaceContactBody.new(
+  business: null,
+  privacy: null,
+  recipient: null,
+  security: null,
+  technical: null
+)
+```
+