ory-client 1.22.66 → 1.22.79

data/docs/GenericError.md

@@ -21,12 +21,12 @@ require 'ory-client'
 
 instance = OryClient::GenericError.new(
   code: 404,
-  debug: SQL field "foo" is not a bool.,
+  debug: SQL field "foo" is not a bool,
   details: null,
   error: null,
   id: null,
   message: The resource could not be found,
-  reason: User with ID 1234 does not exist.,
+  reason: User with ID 1234 does not exist,
   request: d7ef54b1-ec15-46e6-bccb-524b82c035e6,
   status: Not Found
 )

data/docs/IdentityApi.md

@@ -33,7 +33,7 @@ All URIs are relative to *https://playground.projects.oryapis.com*
 
 Create multiple identities
 
-Creates multiple [identities](https://www.ory.com/docs/kratos/concepts/identity-user-model).  You can also use this endpoint to [import credentials](https://www.ory.com/docs/kratos/manage-identities/import-user-accounts-identities), including passwords, social sign-in settings, and multi-factor authentication methods.  If the patch includes hashed passwords you can import up to 1,000 identities per request.  If the patch includes at least one plaintext password you can import up to 200 identities per request.  Avoid importing large batches with plaintext passwords. They can cause timeouts as the passwords need to be hashed before they are stored.  If at least one identity is imported successfully, the response status is 200 OK. If all imports fail, the response is one of the following 4xx errors: 400 Bad Request: The request payload is invalid or improperly formatted. 409 Conflict: Duplicate identities or conflicting data were detected.  If you get a 504 Gateway Timeout: Reduce the batch size Avoid duplicate identities Pre-hash passwords with BCrypt  If the issue persists, contact support.
+Creates multiple [identities](https://www.ory.com/docs/kratos/concepts/identity-user-model).  You can also use this endpoint to [import credentials](https://www.ory.com/docs/kratos/manage-identities/import-user-accounts-identities), including passwords, social sign-in settings, and multi-factor authentication methods.  If the patch includes hashed passwords you can import up to 1,000 identities per request.  If the patch includes at least one plaintext password you can import up to 200 identities per request.  Avoid importing large batches with plaintext passwords. They can cause timeouts as the passwords need to be hashed before they are stored.  If at least one identity is imported successfully, the response status is 200 OK. If all imports fail, the response is one of the following 4xx errors: - 400 Bad Request: The request payload is invalid or improperly formatted. - 409 Conflict: Duplicate identities or conflicting data were detected.  This applies while `with_partial_inserts` is true, which is the default. Set it to false to import the batch as a single unit instead: one conflict then fails the whole request with 409 Conflict and no identity is created, in exchange for a considerably faster import.  If you get a 504 Gateway Timeout: - Reduce the batch size - Avoid duplicate identities - Pre-hash passwords with BCrypt  If the issue persists, contact support.
 
 ### Examples
 
@@ -471,7 +471,7 @@ end
 
 api_instance = OryClient::IdentityApi.new
 id = 'id_example' # String | ID is the identity's ID.
-type = 'password' # String | Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML deviceauthn CredentialsTypeDeviceAuthn identifier_first CredentialsTypeIdentifierFirst link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
+type = 'password' # String | Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML deviceauthn CredentialsTypeDeviceAuthn identifier_first CredentialsTypeIdentifierFirst link_recovery CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
 opts = {
   identifier: 'identifier_example' # String | Identifier is the identifier of the credential to delete. It is required for the `oidc`, `saml`, and `deviceauthn` credential types: for `oidc` and `saml` it selects the provider link to remove, for `deviceauthn` it is the `client_key_id` of the device key to revoke. Find the identifier by calling the `GET /admin/identities/{id}?include_credential={type}` endpoint.
 }
@@ -507,7 +507,7 @@ end
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
 | **id** | **String** | ID is the identity's ID. |  |
-| **type** | **String** | Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML deviceauthn CredentialsTypeDeviceAuthn identifier_first CredentialsTypeIdentifierFirst link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode |  |
+| **type** | **String** | Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML deviceauthn CredentialsTypeDeviceAuthn identifier_first CredentialsTypeIdentifierFirst link_recovery CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode |  |
 | **identifier** | **String** | Identifier is the identifier of the credential to delete. It is required for the `oidc`, `saml`, and `deviceauthn` credential types: for `oidc` and `saml` it selects the provider link to remove, for `deviceauthn` it is the `client_key_id` of the device key to revoke. Find the identifier by calling the `GET /admin/identities/{id}?include_credential={type}` endpoint. | [optional] |
 
 ### Return type
@@ -945,7 +945,7 @@ No authorization required
 
 Get Session
 
-This endpoint is useful for:  Getting a session object with all specified expandables that exist in an administrative context.
+This endpoint is useful for:  - Getting a session object with all specified expandables that exist in an administrative context.
 
 ### Examples
 
@@ -1037,8 +1037,8 @@ opts = {
   page: 789, # Integer | Deprecated Pagination Page  DEPRECATED: Please use `page_token` instead. This parameter will be removed in the future.  This value is currently an integer, but it is not sequential. The value is not the page number, but a reference. The next page can be any number and some numbers might return an empty list.  For example, page 2 might not follow after page 1. And even if page 3 and 5 exist, but page 4 might not exist. The first page can be retrieved by omitting this parameter. Following page pointers will be returned in the `Link` header.
   page_size: 789, # Integer | Page Size  This is the number of items per page to return. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination).
   page_token: 'page_token_example', # String | Next Page Token  The next page token. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination).
-  consistency: 'consistency_example', # String | Read Consistency Level (preview)  The read consistency level determines the consistency guarantee for reads:  strong (slow): The read is guaranteed to return the most recent data committed at the start of the read. eventual (very fast): The result will return data that is about 4.8 seconds old.  The default consistency guarantee can be changed in the Ory Network Console or using the Ory CLI with `ory patch project --replace '/previews/default_read_consistency_level=\"strong\"'`.  Setting the default consistency level to `eventual` may cause regressions in the future as we add consistency controls to more APIs. Currently, the following APIs will be affected by this setting:  `GET /admin/identities`  This feature is in preview and only available in Ory Network.  ConsistencyLevelUnset  ConsistencyLevelUnset is the unset / default consistency level. strong ConsistencyLevelStrong  ConsistencyLevelStrong is the strong consistency level. eventual ConsistencyLevelEventual  ConsistencyLevelEventual is the eventual consistency level using follower read timestamps.
-  ids: ['inner_example'], # Array<String> | Retrieve multiple identities by their IDs.  This parameter has the following limitations:  Duplicate or non-existent IDs are ignored. The order of returned IDs may be different from the request. This filter does not support pagination. You must implement your own pagination as the maximum number of items returned by this endpoint may not exceed a certain threshold (currently 500).
+  consistency: 'consistency_example', # String | Read Consistency Level (preview)  The read consistency level determines the consistency guarantee for reads:  - strong (slow): The read is guaranteed to return the most recent data committed at the start of the read. - eventual (very fast): The result will return data that is about 4.8 seconds old.  The default consistency guarantee can be changed in the Ory Network Console or using the Ory CLI with `ory patch project --replace '/previews/default_read_consistency_level=\"strong\"'`.  Setting the default consistency level to `eventual` may cause regressions in the future as we add consistency controls to more APIs. Currently, the following APIs will be affected by this setting:  - `GET /admin/identities`  This feature is in preview and only available in Ory Network.  ConsistencyLevelUnset is the unset / default consistency level. strong ConsistencyLevelStrong is the strong consistency level. eventual ConsistencyLevelEventual is the eventual consistency level using follower read timestamps.
+  ids: ['inner_example'], # Array<String> | Retrieve multiple identities by their IDs.  This parameter has the following limitations:  - Duplicate or non-existent IDs are ignored. - The order of returned IDs may be different from the request. - This filter does not support pagination. You must implement your own pagination as the maximum number of items returned by this endpoint may not exceed a certain threshold (currently 500).
   credentials_identifier: 'credentials_identifier_example', # String | CredentialsIdentifier is the identifier (username, email) of the credentials to look up using exact match. Only one of CredentialsIdentifier and CredentialsIdentifierSimilar can be used.
   preview_credentials_identifier_similar: 'preview_credentials_identifier_similar_example', # String | This is an EXPERIMENTAL parameter that WILL CHANGE. Do NOT rely on consistent, deterministic behavior. THIS PARAMETER WILL BE REMOVED IN AN UPCOMING RELEASE WITHOUT ANY MIGRATION PATH.  CredentialsIdentifierSimilar is the (partial) identifier (username, email) of the credentials to look up using similarity search. Only one of CredentialsIdentifier and CredentialsIdentifierSimilar can be used.
   include_credential: ['inner_example'], # Array<String> | Include Credentials in Response  Include any credential, for example `password` or `oidc`, in the response. When set to `oidc`, This will return the initial OAuth 2.0 Access Token, OAuth 2.0 Refresh Token, and the OpenID Connect ID Token if available.
@@ -1080,8 +1080,8 @@ end
 | **page** | **Integer** | Deprecated Pagination Page  DEPRECATED: Please use &#x60;page_token&#x60; instead. This parameter will be removed in the future.  This value is currently an integer, but it is not sequential. The value is not the page number, but a reference. The next page can be any number and some numbers might return an empty list.  For example, page 2 might not follow after page 1. And even if page 3 and 5 exist, but page 4 might not exist. The first page can be retrieved by omitting this parameter. Following page pointers will be returned in the &#x60;Link&#x60; header. | [optional] |
 | **page_size** | **Integer** | Page Size  This is the number of items per page to return. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). | [optional][default to 250] |
 | **page_token** | **String** | Next Page Token  The next page token. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). | [optional] |
-| **consistency** | **String** | Read Consistency Level (preview)  The read consistency level determines the consistency guarantee for reads:  strong (slow): The read is guaranteed to return the most recent data committed at the start of the read. eventual (very fast): The result will return data that is about 4.8 seconds old.  The default consistency guarantee can be changed in the Ory Network Console or using the Ory CLI with &#x60;ory patch project --replace &#39;/previews/default_read_consistency_level&#x3D;\&quot;strong\&quot;&#39;&#x60;.  Setting the default consistency level to &#x60;eventual&#x60; may cause regressions in the future as we add consistency controls to more APIs. Currently, the following APIs will be affected by this setting:  &#x60;GET /admin/identities&#x60;  This feature is in preview and only available in Ory Network.  ConsistencyLevelUnset  ConsistencyLevelUnset is the unset / default consistency level. strong ConsistencyLevelStrong  ConsistencyLevelStrong is the strong consistency level. eventual ConsistencyLevelEventual  ConsistencyLevelEventual is the eventual consistency level using follower read timestamps. | [optional] |
-| **ids** | [**Array&lt;String&gt;**](String.md) | Retrieve multiple identities by their IDs.  This parameter has the following limitations:  Duplicate or non-existent IDs are ignored. The order of returned IDs may be different from the request. This filter does not support pagination. You must implement your own pagination as the maximum number of items returned by this endpoint may not exceed a certain threshold (currently 500). | [optional] |
+| **consistency** | **String** | Read Consistency Level (preview)  The read consistency level determines the consistency guarantee for reads:  - strong (slow): The read is guaranteed to return the most recent data committed at the start of the read. - eventual (very fast): The result will return data that is about 4.8 seconds old.  The default consistency guarantee can be changed in the Ory Network Console or using the Ory CLI with &#x60;ory patch project --replace &#39;/previews/default_read_consistency_level&#x3D;\&quot;strong\&quot;&#39;&#x60;.  Setting the default consistency level to &#x60;eventual&#x60; may cause regressions in the future as we add consistency controls to more APIs. Currently, the following APIs will be affected by this setting:  - &#x60;GET /admin/identities&#x60;  This feature is in preview and only available in Ory Network.  ConsistencyLevelUnset is the unset / default consistency level. strong ConsistencyLevelStrong is the strong consistency level. eventual ConsistencyLevelEventual is the eventual consistency level using follower read timestamps. | [optional] |
+| **ids** | [**Array&lt;String&gt;**](String.md) | Retrieve multiple identities by their IDs.  This parameter has the following limitations:  - Duplicate or non-existent IDs are ignored. - The order of returned IDs may be different from the request. - This filter does not support pagination. You must implement your own pagination as the maximum number of items returned by this endpoint may not exceed a certain threshold (currently 500). | [optional] |
 | **credentials_identifier** | **String** | CredentialsIdentifier is the identifier (username, email) of the credentials to look up using exact match. Only one of CredentialsIdentifier and CredentialsIdentifierSimilar can be used. | [optional] |
 | **preview_credentials_identifier_similar** | **String** | This is an EXPERIMENTAL parameter that WILL CHANGE. Do NOT rely on consistent, deterministic behavior. THIS PARAMETER WILL BE REMOVED IN AN UPCOMING RELEASE WITHOUT ANY MIGRATION PATH.  CredentialsIdentifierSimilar is the (partial) identifier (username, email) of the credentials to look up using similarity search. Only one of CredentialsIdentifier and CredentialsIdentifierSimilar can be used. | [optional] |
 | **include_credential** | [**Array&lt;String&gt;**](String.md) | Include Credentials in Response  Include any credential, for example &#x60;password&#x60; or &#x60;oidc&#x60;, in the response. When set to &#x60;oidc&#x60;, This will return the initial OAuth 2.0 Access Token, OAuth 2.0 Refresh Token, and the OpenID Connect ID Token if available. | [optional] |
@@ -1337,7 +1337,7 @@ end
 
 Manage sessions in bulk
 
-Disable or delete sessions for a list of identities or a list of sessions in a single call. The `action` field selects the operation:  `disable` — deactivate matching sessions (sets `active = false`, preserves audit data). `delete` — permanently delete matching sessions.  Exactly one of `identities` or `sessions` must be provided. To scope the operation to every session in the network, pass `identities: [\"*\"]`; the wildcard is not accepted in the `sessions` field. Up to 500 explicit IDs are accepted per call.  All requests return `200 OK` with `{processed, more}`. `processed` reports how many rows the call affected; for `disable` it counts only sessions that were active before the call. `more` is `true` only when a wildcard request reached the per-call batch limit and additional rows may remain; callers drain the network by re-issuing the same request while `more` is `true`. Explicit-IDs requests always return `more: false`.
+Disable or delete sessions for a list of identities or a list of sessions in a single call. The `action` field selects the operation:  - `disable` — deactivate matching sessions (sets `active = false`, preserves audit data). - `delete` — permanently delete matching sessions.  Exactly one of `identities` or `sessions` must be provided. To scope the operation to every session in the network, pass `identities: [\"*\"]`; the wildcard is not accepted in the `sessions` field. Up to 500 explicit IDs are accepted per call.  All requests return `200 OK` with `{processed, more}`. `processed` reports how many rows the call affected; for `disable` it counts only sessions that were active before the call. `more` is `true` only when a wildcard request reached the per-call batch limit and additional rows may remain; callers drain the network by re-issuing the same request while `more` is `true`. Explicit-IDs requests always return `more: false`.
 
 ### Examples
 
@@ -1479,7 +1479,7 @@ end
 
 Update an Identity
 
-This endpoint updates an [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model). The full identity payload (except credentials) is expected.  It is possible to update the identity's credentials as well. Using this operation, credentials will not be overwritten but instead added to the list. For example, if a user has a social sign in connection set up, updating the credentials will keep the social sign in connection and add the new credentials to the list. This prevents accidentally overwriting credentials and locking out users. A complete view of all credential types is here:  `password`: The existing password credential will be completely replaced with the new configuration. You can provide either a hashed password, a plaintext password (which will be hashed), or enable the password migration hook. `oidc`, `saml`: The existing OIDC and SAML credentials will be kept and the new credentials will be added to the list. `totp`: The existing TOTP credentials will be replaced with the new configuration. `lookup_secret`: The existing Lookup Secret codes will be kept and the new codes will be added to the list. `webauthn`, `passkey`: The existing credentials are preserved, new credentials are added, and credentials with matching IDs are updated with new values. If a new `user_handle` is provided, it's added to the identity's identifiers list while preserving previous user handles. `code`: To import code credentials, configure your identity schema to use one of the identity traits as an identifier source (`{\"ory.sh/kratos\":{\"code\":{\"identifier\":true\", \"via\":\"email\"}}}`).
+This endpoint updates an [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model). The full identity payload (except credentials) is expected.  It is possible to update the identity's credentials as well. Using this operation, credentials will not be overwritten but instead added to the list. For example, if a user has a social sign in connection set up, updating the credentials will keep the social sign in connection and add the new credentials to the list. This prevents accidentally overwriting credentials and locking out users. A complete view of all credential types is here:  - `password`: The existing password credential will be completely replaced with the new configuration. You can provide either a hashed password, a plaintext password (which will be hashed), or enable the password migration hook. - `oidc`, `saml`: The existing OIDC and SAML credentials will be kept and the new credentials will be added to the list. - `totp`: The existing TOTP credentials will be replaced with the new configuration. - `lookup_secret`: The existing Lookup Secret codes will be kept and the new codes will be added to the list. - `webauthn`, `passkey`: The existing credentials are preserved, new credentials are added, and credentials with matching IDs are updated with new values. If a new `user_handle` is provided, it's added to the identity's identifiers list while preserving previous user handles. - `code`: To import code credentials, configure your identity schema to use one of the identity traits as an identifier source (`{\"ory.sh/kratos\":{\"code\":{\"identifier\":true\", \"via\":\"email\"}}}`).
 
 ### Examples
 

data/docs/IdentityCredentials.md

@@ -7,7 +7,7 @@
 | **config** | **Object** |  | [optional] |
 | **created_at** | **Time** | CreatedAt is a helper struct field for gobuffalo.pop. | [optional] |
 | **identifiers** | **Array<String>** | Identifiers represent a list of unique identifiers this credential type matches. | [optional] |
-| **type** | **String** | Type discriminates between different types of credentials. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML deviceauthn CredentialsTypeDeviceAuthn identifier_first CredentialsTypeIdentifierFirst link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode | [optional] |
+| **type** | **String** | Type discriminates between different types of credentials. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML deviceauthn CredentialsTypeDeviceAuthn identifier_first CredentialsTypeIdentifierFirst link_recovery CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode | [optional] |
 | **updated_at** | **Time** | UpdatedAt is a helper struct field for gobuffalo.pop. | [optional] |
 | **version** | **Integer** | Version refers to the version of the credential. Useful when changing the config schema. | [optional] |
 

data/docs/JwkApi.md

@@ -19,7 +19,7 @@ All URIs are relative to *https://playground.projects.oryapis.com*
 
 Create JSON Web Key
 
-This endpoint is capable of generating JSON Web Key Sets for you. There are different strategies available, such as symmetric cryptographic keys (HS256, HS512) and asymmetric cryptographic keys (RS256, ECDSA). If the specified JSON Web Key Set does not exist, it will be created.  If the set already exists, the newly generated key is added to it and all existing keys are kept. This allows you to rotate keys: tokens signed with an older key in the set remain verifiable. Exception: when Ory Hydra is configured to use a Hardware Security Module (HSM), generating a key replaces the set, which then contains only the new key. To replace a set and all of its keys instead, use the `setJsonWebKeySet` operation (`PUT /admin/keys/{set}`).  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
+This endpoint is capable of generating JSON Web Key Sets for you. There are different strategies available, such as symmetric cryptographic keys (HS256, HS512) and asymmetric cryptographic keys (RS256, ECDSA). If the specified JSON Web Key Set does not exist, it will be created.  If the set already exists, the newly generated key is added to it and all existing keys are kept. This allows you to rotate keys: tokens signed with an older key in the set remain verifiable. Exception: when Ory Hydra is configured to use a Hardware Security Module (HSM), generating a key replaces the set, which then contains only the new key. To replace a set and all of its keys instead, use the `setJsonWebKeySet` operation (`PUT /admin/keys/{set}`).  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.  While `jwks.admin_api.expose_private_keys` is disabled, responses contain public key material only, and a key with no public representation is omitted. The generated key is stored in full either way.
 
 ### Examples
 
@@ -228,7 +228,7 @@ nil (empty response body)
 
 Get JSON Web Key
 
-This endpoint returns a singular JSON Web Key contained in a set. It is identified by the set and the specific key ID (kid).
+This endpoint returns a singular JSON Web Key contained in a set. It is identified by the set and the specific key ID (kid).  While `jwks.admin_api.expose_private_keys` is disabled, responses contain public key material only, and a key with no public representation is omitted.
 
 ### Examples
 
@@ -299,7 +299,7 @@ end
 
 Retrieve a JSON Web Key Set
 
-This endpoint can be used to retrieve JWK Sets stored in ORY Hydra.  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
+This endpoint can be used to retrieve JWK Sets stored in ORY Hydra.  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.  While `jwks.admin_api.expose_private_keys` is disabled, responses contain public key material only, and a key with no public representation is omitted.
 
 ### Examples
 
@@ -368,7 +368,7 @@ end
 
 Set JSON Web Key
 
-Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.  Warning: the key is created or updated under the `kid` given in the request body. The `{kid}` path parameter exists for historical reasons only: it is ignored and not validated against the body.  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
+Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.  Warning: the key is created or updated under the `kid` given in the request body. The `{kid}` path parameter exists for historical reasons only: it is ignored and not validated against the body.  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.  The response echoes the key as it was stored, including any private key material the request carried. `jwks.admin_api.expose_private_keys` governs what a read discloses and does not apply here, because this response returns only what the request already contained.  While that setting is disabled, writing a public key over the last private key of a set is rejected with `400`, because reading the set returns public keys only and writing that response back would discard the key it signs with.
 
 ### Examples
 
@@ -443,7 +443,7 @@ end
 
 Update a JSON Web Key Set
 
-Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.  This operation replaces the entire JSON Web Key Set: keys that exist in the set but are not part of the request body are deleted. To add a newly generated key to the set while keeping the existing keys, use the `createJsonWebKeySet` operation (`POST /admin/keys/{set}`).  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.
+Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.  This operation replaces the entire JSON Web Key Set: keys that exist in the set but are not part of the request body are deleted. To add a newly generated key to the set while keeping the existing keys, use the `createJsonWebKeySet` operation (`POST /admin/keys/{set}`).  A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.  The response echoes the key set as it was stored, including any private key material the request carried. `jwks.admin_api.expose_private_keys` governs what a read discloses and does not apply here, because this response returns only what the request already contained.  While that setting is disabled, a request that would leave the key set without a private key is rejected with `400`. Reading a key set returns public keys only, so writing that response back would discard the private keys the set signs with. Retiring one key to its public half stays possible as long as the set keeps another private key, and a key set is removed with the `deleteJsonWebKeySet` operation.
 
 ### Examples
 

data/docs/KeysetPaginationResponseHeaders.md

@@ -4,7 +4,7 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **link** | **String** | The Link HTTP Header  The `Link` header contains a comma-delimited list of links to the following pages:  first: The first page of results. next: The next page of results.  Pages are omitted if they do not exist. For example, if there is no next page, the `next` link is omitted. Examples:  </admin/sessions?page_size=250&page_token={last_item_uuid}; rel=\"first\",/admin/sessions?page_size=250&page_token=>; rel=\"next\" | [optional] |
+| **link** | **String** | The Link HTTP Header  The `Link` header contains a comma-delimited list of links to the following pages:  - first: The first page of results. - next: The next page of results.  Pages are omitted if they do not exist. For example, if there is no next page, the `next` link is omitted. Examples:  </admin/sessions?page_size=250&page_token={last_item_uuid}; rel=\"first\",/admin/sessions?page_size=250&page_token=>; rel=\"next\" | [optional] |
 
 ## Example
 

data/docs/ListWorkspaceContacts.md

@@ -0,0 +1,22 @@
+# OryClient::ListWorkspaceContacts
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **contacts** | [**Array<WorkspaceContact>**](WorkspaceContact.md) |  |  |
+| **has_next_page** | **Boolean** |  |  |
+| **next_page_token** | **String** |  |  |
+
+## Example
+
+```ruby
+require 'ory-client'
+
+instance = OryClient::ListWorkspaceContacts.new(
+  contacts: null,
+  has_next_page: null,
+  next_page_token: null
+)
+```
+

data/docs/LoginFlow.md

@@ -4,7 +4,7 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **active** | **String** | The active login method  If set contains the login method used. If the flow is new, it is unset. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML deviceauthn CredentialsTypeDeviceAuthn identifier_first CredentialsTypeIdentifierFirst link_recovery CredentialsTypeRecoveryLink  CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode | [optional] |
+| **active** | **String** | The active login method  If set contains the login method used. If the flow is new, it is unset. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML deviceauthn CredentialsTypeDeviceAuthn identifier_first CredentialsTypeIdentifierFirst link_recovery CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow).  It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode | [optional] |
 | **created_at** | **Time** | CreatedAt is a helper struct field for gobuffalo.pop. | [optional] |
 | **expires_at** | **Time** | ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated. |  |
 | **id** | **String** | ID represents the flow's unique ID. When performing the login flow, this represents the id in the login UI's query parameter: http://<selfservice.flows.login.ui_url>/?flow=<flow_id> |  |
@@ -18,7 +18,7 @@
 | **requested_aal** | [**AuthenticatorAssuranceLevel**](AuthenticatorAssuranceLevel.md) |  | [optional] |
 | **return_to** | **String** | ReturnTo contains the requested return_to URL. | [optional] |
 | **session_token_exchange_code** | **String** | SessionTokenExchangeCode holds the secret code that the client can use to retrieve a session token after the login flow has been completed. This is only set if the client has requested a session token exchange code, and if the flow is of type \"api\", and only on creating the login flow. | [optional] |
-| **state** | **Object** | State represents the state of this request:  choose_method: ask the user to choose a method to sign in with sent_email: the email has been sent to the user passed_challenge: the request was successful and the login challenge was passed. |  |
+| **state** | [**LoginFlowState**](LoginFlowState.md) |  |  |
 | **test_context** | [**LoginFlowTestContext**](LoginFlowTestContext.md) |  | [optional] |
 | **transient_payload** | **Object** | TransientPayload is used to pass data from the login to hooks and email templates | [optional] |
 | **type** | **String** | The flow type can either be `api` or `browser`. |  |

data/docs/ManageSessionsBody.md

@@ -4,7 +4,7 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **action** | **String** | Action to perform on the matching sessions. disable ManageSessionsActionDisable delete ManageSessionsActionDelete |  |
+| **action** | **String** | Action to perform on the matching sessions. |  |
 | **identities** | **Array<String>** | Identity IDs whose sessions should be disabled or deleted, or `[\"*\"]` to operate on every session in the network. Mutually exclusive with `sessions`. | [optional] |
 | **sessions** | **Array<String>** | Session IDs to disable or delete. Mutually exclusive with `identities`. The wildcard `[\"*\"]` is not accepted in this field — pass `identities: [\"*\"]` to scope the operation to every session in the network. | [optional] |
 

data/docs/Message.md

@@ -13,7 +13,7 @@
 | **send_count** | **Integer** |  |  |
 | **status** | [**CourierMessageStatus**](CourierMessageStatus.md) |  |  |
 | **subject** | **String** |  |  |
-| **template_type** | **String** |  recovery_invalid TypeRecoveryInvalid recovery_valid TypeRecoveryValid recovery_code_invalid TypeRecoveryCodeInvalid recovery_code_valid TypeRecoveryCodeValid verification_invalid TypeVerificationInvalid verification_valid TypeVerificationValid verification_code_invalid TypeVerificationCodeInvalid verification_code_valid TypeVerificationCodeValid stub TypeTestStub login_code_valid TypeLoginCodeValid registration_code_valid TypeRegistrationCodeValid verifiable_address_changed TypeVerifiableAddressChanged authenticator_key_added TypeAuthenticatorKeyAdded |  |
+| **template_type** | **String** | recovery_invalid TypeRecoveryInvalid recovery_valid TypeRecoveryValid recovery_code_invalid TypeRecoveryCodeInvalid recovery_code_valid TypeRecoveryCodeValid verification_invalid TypeVerificationInvalid verification_valid TypeVerificationValid verification_code_invalid TypeVerificationCodeInvalid verification_code_valid TypeVerificationCodeValid stub TypeTestStub login_code_valid TypeLoginCodeValid registration_code_valid TypeRegistrationCodeValid verifiable_address_changed TypeVerifiableAddressChanged authenticator_key_added TypeAuthenticatorKeyAdded |  |
 | **type** | [**CourierMessageType**](CourierMessageType.md) |  |  |
 | **updated_at** | **Time** | UpdatedAt is a helper struct field for gobuffalo.pop. |  |
 

data/docs/NormalizedProjectRevision.md

@@ -12,7 +12,7 @@
 | **account_experience_favicon_light** | **String** | Holds the URL to the account experience's favicon. This governs the \"favicon_light\" setting. | [optional] |
 | **account_experience_hide_ory_branding** | **Boolean** | Whether to hide the Ory branding badge on the account experience. This governs the \"hide_ory_branding\" setting. | [optional] |
 | **account_experience_hide_registration_link** | **Boolean** | Whether to hide the registration link on the account experience login card. This governs the \"hide_registration_link\" setting. | [optional] |
-| **account_experience_locale_behavior** | **String** | Holds the URL to the account experience's language behavior.  Can be one of: `respect_accept_language`: Respect the `Accept-Language` header. `force_default`: Force the default language. This governs the \"locale_behavior\" setting. | [optional] |
+| **account_experience_locale_behavior** | **String** | Holds the URL to the account experience's language behavior.  Can be one of: - `respect_accept_language`: Respect the `Accept-Language` header. - `force_default`: Force the default language. This governs the \"locale_behavior\" setting. | [optional] |
 | **account_experience_logo_dark** | **String** | Holds the URL to the account experience's dark theme logo (currently unused). This governs the \"logo_dark\" setting. | [optional] |
 | **account_experience_logo_light** | **String** | Holds the URL to the account experience's logo. This governs the \"logo_light\" setting. | [optional] |
 | **account_experience_privacy_policy_url** | **String** | Holds the URL to the account experience's Privacy Policy page. This governs the \"privacy_policy_url\" setting. | [optional] |
@@ -22,6 +22,7 @@
 | **created_at** | **Time** | The Project's Revision Creation Date | [optional][readonly] |
 | **disable_account_experience_welcome_screen** | **Boolean** | Whether to disable the account experience welcome screen, which is hosted under `/ui/welcome`. This governs the \"disable_welcome_screen\" setting. | [optional] |
 | **enable_ax_v2** | **Boolean** | Whether the new account experience is enabled and reachable. This governs the \"enable_ax_v2\" setting. | [optional] |
+| **feature_flags** | **Hash<String, Boolean>** | The project's feature flags. Keys are catalog flag keys such as `kratos.choose_recovery_address`. Responses contain every flag with its effective value; requests may set any subset. | [optional] |
 | **hydra_oauth2_allowed_top_level_claims** | **Array<String>** | A list of custom claims which are allowed to be added top level to the Access Token. They cannot override reserved claims.  This governs the \"oauth2.allowed_top_level_claims\" setting. | [optional] |
 | **hydra_oauth2_client_credentials_default_grant_allowed_scope** | **Boolean** | Automatically grant authorized OAuth2 Scope in OAuth2 Client Credentials Flow.  Each OAuth2 Client is allowed to request a predefined OAuth2 Scope (for example `read write`). If this option is enabled, the full scope is automatically granted when performing the OAuth2 Client Credentials flow.  If disabled, the OAuth2 Client has to request the scope in the OAuth2 request by providing the `scope` query parameter.  Setting this option to true is common if you need compatibility with MITREid.  This governs the \"oauth2.client_credentials.default_grant_allowed_scope\" setting. | [optional] |
 | **hydra_oauth2_device_authorization_token_polling_interval** | **String** | Configures how often a non-interactive device should poll the OAuth 2.0 Device Authorization Grant token endpoint. Purely informational — the value is reported to the device in the \"interval\" response field of the device authorization response. Hydra defaults to 5s when this is left empty.  This is an Enterprise feature.  This governs the \"oauth2.device_authorization.token_polling_interval\" setting. | [optional] |
@@ -50,7 +51,7 @@
 | **hydra_serve_cookies_same_site_legacy_workaround** | **Boolean** | Configures the Ory Hydra Cookie Same Site Legacy Workaround  This governs the \"serve.cookies.same_site_legacy_workaround\" setting. | [optional] |
 | **hydra_serve_cookies_same_site_mode** | **String** | Configures the Ory Hydra Cookie Same Site Mode  This governs the \"serve.cookies.same_site_mode\" setting. | [optional] |
 | **hydra_strategies_access_token** | **String** | Defines access token type  This governs the \"strategies.access_token\" setting. opaque Oauth2AccessTokenStrategyOpaque jwt Oauth2AccessTokenStrategyJwt | [optional][default to 'opaque'] |
-| **hydra_strategies_jwt_scope_claim** | **String** | Define the claim to use as the scope in the access token.  This governs the \"strategies.jwt.scope_claim\" setting.  list: The scope claim is an array of strings named `scope`: `{ \"scope\": [\"read\", \"write\"] }` string: The scope claim is a space delimited list of strings named `scp`: `{ \"scp\": \"read write\" }` both: The scope claim is both a space delimited list and an array of strings named `scope` and `scp`: `{ \"scope\": [\"read\", \"write\"], \"scp\": \"read write\" }` list OAuth2JWTScopeClaimList string OAuth2JWTScopeClaimString both OAuth2JWTScopeClaimBoth | [optional][default to 'list'] |
+| **hydra_strategies_jwt_scope_claim** | **String** | Define the claim to use as the scope in the access token.  This governs the \"strategies.jwt.scope_claim\" setting.  - list: The scope claim is an array of strings named `scope`: `{ \"scope\": [\"read\", \"write\"] }` - string: The scope claim is a space delimited list of strings named `scp`: `{ \"scp\": \"read write\" }` - both: The scope claim is both a space delimited list and an array of strings named `scope` and `scp`: `{ \"scope\": [\"read\", \"write\"], \"scp\": \"read write\" }` list OAuth2JWTScopeClaimList string OAuth2JWTScopeClaimString both OAuth2JWTScopeClaimBoth | [optional][default to 'list'] |
 | **hydra_strategies_scope** | **String** | Defines how scopes are matched. For more details have a look at https://github.com/ory/fosite#scopes  This governs the \"strategies.scope\" setting. exact Oauth2ScopeStrategyExact wildcard Oauth2ScopeStrategyWildcard | [optional][default to 'wildcard'] |
 | **hydra_ttl_access_token** | **String** | This governs the \"ttl.access_token\" setting. | [optional][default to '30m'] |
 | **hydra_ttl_auth_code** | **String** | Configures how long refresh tokens are valid.  Set to -1 for refresh tokens to never expire. This is not recommended!  This governs the \"ttl.auth_code\" setting. | [optional][default to '720h'] |
@@ -77,18 +78,20 @@
 | **hydra_webfinger_oidc_discovery_token_url** | **String** | Configures OpenID Connect Discovery and overwrites the OAuth2 Token URL.  This governs the \"webfinger.oidc_discovery.token_url\" setting. | [optional] |
 | **hydra_webfinger_oidc_discovery_userinfo_url** | **String** | Configures OpenID Connect Discovery and overwrites userinfo endpoint to be advertised at the OpenID Connect Discovery endpoint /.well-known/openid-configuration. Defaults to Ory Hydra's userinfo endpoint at /userinfo. Set this value if you want to handle this endpoint yourself.  This governs the \"webfinger.oidc_discovery.userinfo_url\" setting. | [optional] |
 | **id** | **String** | The revision ID. | [optional][readonly] |
+| **keto_feature_flags_strict_mode** | **Boolean** | Configures Keto's strict mode.  This governs the \"feature_flags.strict_mode\" setting. | [optional] |
 | **keto_namespace_configuration** | **String** | The Revisions' Keto Namespace Configuration  The string is a URL pointing to an OPL file with the configuration.  This governs the \"namespaces.location\" setting. | [optional] |
 | **keto_namespaces** | [**Array<KetoNamespace>**](KetoNamespace.md) |  | [optional] |
 | **keto_secrets_pagination** | **Array<String>** | Configures Keto's pagination secrets.  This governs the \"secrets.pagination\" setting. | [optional] |
+| **keto_strict_mode_readonly** | **Boolean** | When true, strict mode is locked: changes to it are rejected from any client (API, Console, config import), and the Console hides the toggle. NULL and false mean strict mode can be changed (existing projects during migration). New projects are created with this set to true, permanently enabling strict mode. This flag is backoffice metadata and is not part of the rendered Keto configuration. | [optional] |
 | **kratos_cookies_same_site** | **String** | Configures the Ory Kratos Cookie SameSite Attribute  This governs the \"cookies.same_site\" setting. | [optional] |
 | **kratos_courier_channels** | [**Array<NormalizedProjectRevisionCourierChannel>**](NormalizedProjectRevisionCourierChannel.md) |  | [optional] |
-| **kratos_courier_delivery_strategy** | **String** | The delivery strategy to use when sending emails  This governs the \"courier.delivery_strategy\" setting.  `smtp`: Use SMTP server `http`: Use the built in HTTP client to send the email to some remote service | [optional][default to 'smtp'] |
-| **kratos_courier_http_request_config_auth_api_key_in** | **String** | The location of the API key to use in the HTTP email sending service's authentication  `header`: Send the key value pair as a header `cookie`: Send the key value pair as a cookie This governs the \"courier.http.request_config.auth.config.in\" setting. | [optional] |
+| **kratos_courier_delivery_strategy** | **String** | The delivery strategy to use when sending emails  This governs the \"courier.delivery_strategy\" setting.  - `smtp`: Use SMTP server - `http`: Use the built in HTTP client to send the email to some remote service | [optional][default to 'smtp'] |
+| **kratos_courier_http_request_config_auth_api_key_in** | **String** | The location of the API key to use in the HTTP email sending service's authentication  - `header`: Send the key value pair as a header - `cookie`: Send the key value pair as a cookie This governs the \"courier.http.request_config.auth.config.in\" setting. | [optional] |
 | **kratos_courier_http_request_config_auth_api_key_name** | **String** | The name of the API key to use in the HTTP email sending service's authentication  This governs the \"courier.http.request_config.auth.config.name\" setting. | [optional] |
 | **kratos_courier_http_request_config_auth_api_key_value** | **String** | The value of the API key to use in the HTTP email sending service's authentication  This governs the \"courier.http.request_config.auth.config.value\" setting. | [optional] |
 | **kratos_courier_http_request_config_auth_basic_auth_password** | **String** | The password to use for basic auth in the HTTP email sending service's authentication  This governs the \"courier.http.request_config.auth.config.password\" setting. | [optional] |
 | **kratos_courier_http_request_config_auth_basic_auth_user** | **String** | The user to use for basic auth in the HTTP email sending service's authentication  This governs the \"courier.http.request_config.auth.config.user\" setting. | [optional] |
-| **kratos_courier_http_request_config_auth_type** | **String** | The authentication type to use while contacting the remote HTTP email sending service  This governs the \"courier.http.request_config.auth.type\" setting.  `basic_auth`: Use Basic Authentication `api_key`: Use API Key Authentication in a header or cookie | [optional][default to 'empty (no authentication)'] |
+| **kratos_courier_http_request_config_auth_type** | **String** | The authentication type to use while contacting the remote HTTP email sending service  This governs the \"courier.http.request_config.auth.type\" setting.  - `basic_auth`: Use Basic Authentication - `api_key`: Use API Key Authentication in a header or cookie | [optional][default to 'empty (no authentication)'] |
 | **kratos_courier_http_request_config_body** | **String** | The Jsonnet template to generate the body to send to the remote HTTP email sending service  Should be valid Jsonnet and base64 encoded  This governs the \"courier.http.request_config.body\" setting. | [optional] |
 | **kratos_courier_http_request_config_headers** | **Object** | Any additional headers to send to the remote HTTP email sending service  This governs the \"courier.http.request_config.headers\" setting. | [optional] |
 | **kratos_courier_http_request_config_method** | **String** | The http METHOD to use when calling the remote HTTP email sending service  This governs the \"courier.http.request_config.method\" setting. | [optional][default to 'POST'] |
@@ -138,6 +141,7 @@
 | **kratos_feature_flags_cacheable_sessions** | **Boolean** | Configures the Ory Kratos Session caching feature flag  This governs the \"feature_flags.cacheable_sessions\" setting. | [optional] |
 | **kratos_feature_flags_cacheable_sessions_max_age** | **String** | Configures the Ory Kratos Session caching max-age feature flag  This governs the \"feature_flags.cacheable_sessions_max_age\" setting. | [optional] |
 | **kratos_feature_flags_choose_recovery_address** | **Boolean** | This governs the \"feature_flags.choose_recovery_address\" setting. | [optional] |
+| **kratos_feature_flags_enforce_identity_schema_guards** | **Boolean** | Configures whether Ory Kratos enforces the identity schema guards  If enabled, an identity schema that does not pass the identity schema guards is rejected. If disabled, the result is logged and the schema is used.  This governs the \"feature_flags.enforce_identity_schema_guards\" setting. | [optional] |
 | **kratos_feature_flags_faster_session_extend** | **Boolean** | Configures the Ory Kratos Faster Session Extend setting  If enabled allows faster session extension by skipping the session lookup and returning 201 instead of 200. Disabling this feature will be deprecated in the future.  This governs the \"feature_flags.faster_session_extend\" setting. | [optional] |
 | **kratos_feature_flags_legacy_continue_with_verification_ui** | **Boolean** | Always include show_verification_ui in continue_with  If true, restores the legacy behavior of always including `show_verification_ui` in the registration flow's `continue_with` when verification is enabled. If set to false, `show_verification_ui` is only set in `continue_with` if the `show_verification_ui` hook is used. This flag will be removed in the future.  This governs the \"feature_flags.legacy_continue_with_verification_ui\" setting. | [optional] |
 | **kratos_feature_flags_legacy_oidc_registration_node_group** | **Boolean** | Controls whether the UI nodes in an OIDC registration flow have group \"oidc\" in case required fields are not returned by the OIDC provider.  If set to true, the UI nodes will have group \"oidc\" and the flow will be considered successful if the user completes the flow. This is the legacy behavior.  This governs the \"feature_flags.legacy_oidc_registration_node_group\" setting. | [optional] |
@@ -145,11 +149,12 @@
 | **kratos_feature_flags_password_profile_registration_node_group** | **Boolean** | Configures the group for the password method in the registration flow.  If true, it sets the password method group value to \"password\" if it is the only method available. This is the legacy behavior. If false is, it sets the password method group value to \"default\".  This governs the \"feature_flags.password_profile_registration_node_group\" setting. | [optional] |
 | **kratos_feature_flags_refresh_login_choose_address** | **Boolean** | Render an address picker on the code refresh login screen  If true, a code-strategy refresh (privileged re-authentication) login renders a \"Send code to <address>\" button per available code address instead of re-asking for the identifier. The identity is already fixed by the active session, so re-entering the identifier is unnecessary. It is safe to toggle this back and forth.  This governs the \"feature_flags.refresh_login_choose_address\" setting. | [optional] |
 | **kratos_feature_flags_use_continue_with_transitions** | **Boolean** | Configures the Ory Kratos Session use_continue_with_transitions flag  This governs the \"feature_flags.use_continue_with_transitions\" setting. | [optional] |
+| **kratos_feature_flags_webhook_response_directives** | **Boolean** | Honor flow directives in web hook responses  If true, a login `after` web hook whose `response.parse` is enabled may return `{\"required_aal\":\"aal2\"}` to require step-up for that login. Identities without a second factor are routed to enrollment. Off by default, because a web hook that already returns a `required_aal` field has it ignored today and enabling that silently would change how existing logins end.  This governs the \"feature_flags.webhook_response_directives\" setting. | [optional] |
 | **kratos_identity_schemas** | [**Array<NormalizedProjectRevisionIdentitySchema>**](NormalizedProjectRevisionIdentitySchema.md) |  | [optional] |
 | **kratos_oauth2_provider_headers** | **Object** | Configures the OAuth2 Provider Integration HTTP Headers  This governs the \"oauth2_provider.headers\" setting. | [optional] |
 | **kratos_oauth2_provider_override_return_to** | **Boolean** | Kratos OAuth2 Provider Override Return To  Enabling this allows Kratos to set the return_to parameter automatically to the OAuth2 request URL on the login flow, allowing complex flows such as recovery to continue to the initial OAuth2 flow.  This governs the \"oauth2_provider.override_return_to\" setting. | [optional] |
 | **kratos_oauth2_provider_url** | **String** | The Revisions' OAuth2 Provider Integration URL  This governs the \"oauth2_provider.url\" setting. | [optional] |
-| **kratos_preview_default_read_consistency_level** | **String** | Configures the default read consistency level for identity APIs  The read consistency level determines the consistency guarantee for reads:  strong (slow): The read is guaranteed to return the most recent data committed at the start of the read. eventual (very fast): The result will return data that is about 4.8 seconds old.  Setting the default consistency level to `eventual` may cause regressions in the future as we add consistency controls to more APIs. Currently, the following APIs will be affected by this setting:  `GET /admin/identities`  Defaults to \"strong\" for new and existing projects. This feature is in preview. Use with caution. This governs the \"preview.default_read_consistency_level\" setting. | [optional] |
+| **kratos_preview_default_read_consistency_level** | **String** | Configures the default read consistency level for identity APIs  The read consistency level determines the consistency guarantee for reads:  - strong (slow): The read is guaranteed to return the most recent data committed at the start of the read. - eventual (very fast): The result will return data that is about 4.8 seconds old.  Setting the default consistency level to `eventual` may cause regressions in the future as we add consistency controls to more APIs. Currently, the following APIs will be affected by this setting:  - `GET /admin/identities`  Defaults to \"strong\" for new and existing projects. This feature is in preview. Use with caution. This governs the \"preview.default_read_consistency_level\" setting. | [optional] |
 | **kratos_secrets_cipher** | **Array<String>** | Configures the Ory Kratos Cipher Secret  This governs the \"secrets.cipher\" setting. | [optional] |
 | **kratos_secrets_cookie** | **Array<String>** | Configures the Ory Kratos Cookie Secret  This governs the \"secrets.cookie\" setting. | [optional] |
 | **kratos_secrets_default** | **Array<String>** | Configures the Ory Kratos Default Secret  This governs the \"secrets.default\" setting. | [optional] |
@@ -220,6 +225,7 @@
 | **kratos_selfservice_methods_code_mfa_enabled** | **Boolean** | Configures whether the code method can be used to fulfil MFA flows  This governs the \"selfservice.methods.code.mfa_enabled\" setting. | [optional] |
 | **kratos_selfservice_methods_code_passwordless_enabled** | **Boolean** | Configures whether Ory Kratos Passwordless should use the Code Method  This governs the \"selfservice.methods.code.passwordless_enabled\" setting. | [optional] |
 | **kratos_selfservice_methods_code_passwordless_login_fallback_enabled** | **Boolean** | This setting allows the code method to always login a user with code if they have registered with another authentication method such as password or social sign in.  This governs the \"selfservice.methods.code.passwordless_login_fallback_enabled\" setting. | [optional] |
+| **kratos_selfservice_methods_deviceauthn_config_android_allow_expired_factory_certificates** | **Boolean** | Configures whether Ory Kratos Device authentication accepts expired certificates in Android factory attestation chains  When enabled, Android enrollment accepts expired CA certificates in factory-provisioned attestation chains that lead to a pinned Google root key. Devices launched before 2021 ship factory keyboxes whose certificates have expired but that Google documents as still trustworthy unless revoked. Revocation, signature, and leaf-validity checks still apply, and keys enrolled this way are first-class hardware-attested keys. Defaults to false.  This governs the \"selfservice.methods.deviceauthn.config.android_allow_expired_factory_certificates\" setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_android_app_ids** | **Array<String>** | Configures the allow-list of Android app signing-certificate digests that a device key may be bound to.  This governs the \"selfservice.methods.deviceauthn.config.android_app_ids\" setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_first_factor** | **Boolean** | Configures whether device authentication may be used as the sole first factor.  When enabled, a confirmed device key with PIN or platform user verification can complete an AAL2 login in a single submission, without a password or code. Defaults to false, which keeps device keys usable only as a second factor (step-up).  This governs the \"selfservice.methods.deviceauthn.config.first_factor\" setting. | [optional] |
 | **kratos_selfservice_methods_deviceauthn_config_insecure_allow_relaxed_attestation** | **Boolean** | Configures whether Ory Kratos Device authentication accepts relaxed attestations for testing  Only allowed on development projects and forced off otherwise. Keys enrolled under relaxation are short-lived and refused once this is turned off.  This governs the \"selfservice.methods.deviceauthn.config.insecure_allow_relaxed_attestation\" setting. | [optional] |
@@ -317,6 +323,7 @@ instance = OryClient::NormalizedProjectRevision.new(
   created_at: null,
   disable_account_experience_welcome_screen: null,
   enable_ax_v2: null,
+  feature_flags: null,
   hydra_oauth2_allowed_top_level_claims: null,
   hydra_oauth2_client_credentials_default_grant_allowed_scope: null,
   hydra_oauth2_device_authorization_token_polling_interval: 15s,
@@ -372,9 +379,11 @@ instance = OryClient::NormalizedProjectRevision.new(
   hydra_webfinger_oidc_discovery_token_url: null,
   hydra_webfinger_oidc_discovery_userinfo_url: null,
   id: null,
+  keto_feature_flags_strict_mode: null,
   keto_namespace_configuration: null,
   keto_namespaces: null,
   keto_secrets_pagination: null,
+  keto_strict_mode_readonly: null,
   kratos_cookies_same_site: null,
   kratos_courier_channels: null,
   kratos_courier_delivery_strategy: null,
@@ -433,6 +442,7 @@ instance = OryClient::NormalizedProjectRevision.new(
   kratos_feature_flags_cacheable_sessions: null,
   kratos_feature_flags_cacheable_sessions_max_age: null,
   kratos_feature_flags_choose_recovery_address: null,
+  kratos_feature_flags_enforce_identity_schema_guards: null,
   kratos_feature_flags_faster_session_extend: null,
   kratos_feature_flags_legacy_continue_with_verification_ui: null,
   kratos_feature_flags_legacy_oidc_registration_node_group: null,
@@ -440,6 +450,7 @@ instance = OryClient::NormalizedProjectRevision.new(
   kratos_feature_flags_password_profile_registration_node_group: null,
   kratos_feature_flags_refresh_login_choose_address: null,
   kratos_feature_flags_use_continue_with_transitions: null,
+  kratos_feature_flags_webhook_response_directives: null,
   kratos_identity_schemas: null,
   kratos_oauth2_provider_headers: null,
   kratos_oauth2_provider_override_return_to: null,
@@ -515,6 +526,7 @@ instance = OryClient::NormalizedProjectRevision.new(
   kratos_selfservice_methods_code_mfa_enabled: null,
   kratos_selfservice_methods_code_passwordless_enabled: null,
   kratos_selfservice_methods_code_passwordless_login_fallback_enabled: null,
+  kratos_selfservice_methods_deviceauthn_config_android_allow_expired_factory_certificates: null,
   kratos_selfservice_methods_deviceauthn_config_android_app_ids: null,
   kratos_selfservice_methods_deviceauthn_config_first_factor: null,
   kratos_selfservice_methods_deviceauthn_config_insecure_allow_relaxed_attestation: null,

data/docs/NormalizedProjectRevisionCourierChannel.md

@@ -6,7 +6,7 @@
 | ---- | ---- | ----------- | ----- |
 | **channel_id** | **String** | The Channel's public ID |  |
 | **created_at** | **Time** | The creation date | [optional][readonly] |
-| **request_config_auth_config_api_key_in** | **String** | API key location  Can either be \"header\" or \"query\" | [optional] |
+| **request_config_auth_config_api_key_in** | **String** | API key location  Can either be \"header\" or \"query\"  Only used if the auth type is api_key | [optional] |
 | **request_config_auth_config_api_key_name** | **String** | API key name  Only used if the auth type is api_key | [optional] |
 | **request_config_auth_config_api_key_value** | **String** | API key value  Only used if the auth type is api_key | [optional] |
 | **request_config_auth_config_basic_auth_password** | **String** | Basic Auth Password  Only used if the auth type is basic_auth | [optional] |

data/docs/NormalizedProjectRevisionIdentitySchema.md

@@ -27,7 +27,7 @@ instance = OryClient::NormalizedProjectRevisionIdentitySchema.new(
   identity_schema: null,
   identity_schema_id: null,
   import_id: null,
-  import_url: base64://ey...,
+  import_url: base64://ey..,
   is_default: null,
   preset: null,
   project_revision_id: null,

data/docs/NormalizedProjectRevisionSAMLProvider.md

@@ -7,6 +7,7 @@
 | **audience_override_base_url** | **String** |  | [optional] |
 | **created_at** | **Time** | The Project's Revision Creation Date | [optional][readonly] |
 | **id** | **String** |  | [optional] |
+| **idp_initiated_login_enabled** | **Boolean** | IdPInitiatedLoginEnabled enables IdP-initiated login for this provider.  When enabled, users can start a login from their identity provider's app launcher. The Polis connection's default redirect URL then points at the Kratos IdP-initiated login entry point instead of the SAML callback. | [optional] |
 | **label** | **String** | Label represents an optional label which can be used in the UI generation. | [optional] |
 | **mapper_url** | **String** | Mapper specifies the JSONNet code snippet which uses the OpenID Connect Provider's data (e.g. GitHub or Google profile information) to hydrate the identity's data. | [optional] |
 | **organization_id** | **String** |  | [optional] |
@@ -16,7 +17,7 @@
 | **proxy_saml_audience_override** | **String** |  | [optional] |
 | **raw_idp_metadata_xml** | **String** | RawIDPMetadataXML is the raw XML metadata of the IDP. | [optional] |
 | **state** | **String** | State indicates the state of the provider  Only providers with state `enabled` will be used for authentication enabled ThirdPartyProviderStateEnabled disabled ThirdPartyProviderStateDisabled | [optional] |
-| **update_identity_on_login** | **String** | UpdateIdentityOnLogin controls whether the identity is updated from SAML claims on each login.  Possible values are \"never\" (default) and \"automatic\". never UpdateIdentityOnLoginNever  UpdateIdentityOnLoginNever disables identity updates on login (default). automatic UpdateIdentityOnLoginAutomatic  UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically. | [optional] |
+| **update_identity_on_login** | **String** | UpdateIdentityOnLogin controls whether the identity is updated from SAML claims on each login.  Possible values are \"never\" (default) and \"automatic\". never UpdateIdentityOnLoginNever disables identity updates on login (default). automatic UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically. | [optional] |
 | **updated_at** | **Time** | Last Time Project's Revision was Updated | [optional][readonly] |
 | **valid_to** | **Array<String>** | Valid to dates of all signing certs associated with the SAML connection | [optional][readonly] |
 
@@ -29,6 +30,7 @@ instance = OryClient::NormalizedProjectRevisionSAMLProvider.new(
   audience_override_base_url: null,
   created_at: null,
   id: null,
+  idp_initiated_login_enabled: null,
   label: null,
   mapper_url: null,
   organization_id: null,

data/docs/NormalizedProjectRevisionThirdPartyProvider.md

@@ -6,7 +6,7 @@
 | ---- | ---- | ----------- | ----- |
 | **aal2_acr_values** | **Array<String>** | AAL2ACRValues lists upstream OIDC `acr` claim values that should elevate the resulting Kratos session to AAL2. Empty means the upstream `acr` claim is ignored when deciding session AAL. | [optional] |
 | **aal2_amr_values** | **Array<String>** | AAL2AMRValues lists upstream OIDC `amr` claim values that should elevate the resulting Kratos session to AAL2 when any of them appears in the upstream `amr` array. Empty means the upstream `amr` claim is ignored when deciding session AAL. | [optional] |
-| **account_linking_mode** | **String** | AccountLinkingMode controls how account conflicts are resolved for this provider.  Possible values are `confirm_with_existing_credential` (default) and `automatic`. `automatic` silently links accounts when the provider verifies email ownership. Only supported for `apple` and `google` providers. automatic AccountLinkingModeAutomatic  AccountLinkingModeAutomatic silently links accounts if the provider verifies email ownership. confirm_with_existing_credential AccountLinkingModeConfirmWithExistingCredential  AccountLinkingModeConfirmWithExistingCredential requires the user to confirm the account linking by providing an existing credential. | [optional] |
+| **account_linking_mode** | **String** | AccountLinkingMode controls how account conflicts are resolved for this provider.  Possible values are `confirm_with_existing_credential` (default) and `automatic`. `automatic` silently links accounts when the provider verifies email ownership. Only supported for `apple` and `google` providers. automatic AccountLinkingModeAutomatic silently links accounts if the provider verifies email ownership. confirm_with_existing_credential AccountLinkingModeConfirmWithExistingCredential requires the user to confirm the account linking by providing an existing credential. | [optional] |
 | **additional_id_token_audiences** | **Array<String>** | AdditionalIDTokenAudiences is a list of additional audiences allowed in the ID Token.  This is only relevant in OIDC flows that submit an IDToken instead of using the callback from the OIDC provider. | [optional] |
 | **apple_private_key** | **String** |  | [optional] |
 | **apple_private_key_id** | **String** | Apple Private Key Identifier  Sign In with Apple Private Key Identifier needed for generating a JWT token for client secret | [optional] |
@@ -18,6 +18,7 @@
 | **client_secret** | **String** |  | [optional] |
 | **created_at** | **Time** | The Project's Revision Creation Date | [optional][readonly] |
 | **fedcm_config_url** | **String** |  | [optional] |
+| **front_channel_logout** | **Boolean** | FrontChannelLogout enables OpenID Connect Front-Channel Logout for this provider: a login issues a companion cookie that lets the provider end the resulting Ory session from its own sign-out page.  Requires the provider to return the `sid` claim in the ID token. | [optional] |
 | **id** | **String** |  | [optional] |
 | **issuer_url** | **String** | IssuerURL is the OpenID Connect Server URL. You can leave this empty if `provider` is not set to `generic`. If set, neither `auth_url` nor `token_url` are required. | [optional] |
 | **label** | **String** | Label represents an optional label which can be used in the UI generation. | [optional] |
@@ -26,7 +27,7 @@
 | **organization_id** | **String** |  | [optional] |
 | **pkce** | **String** |  | [optional] |
 | **project_revision_id** | **String** | The Revision's ID this provider belongs to | [optional] |
-| **provider** | **String** | Provider is either \"generic\" for a generic OAuth 2.0 / OpenID Connect Provider or one of: generic google github gitlab microsoft discord slack facebook vk yandex apple | [optional] |
+| **provider** | **String** | Provider is either \"generic\" for a generic OAuth 2.0 / OpenID Connect Provider or one of: - generic - google - github - gitlab - microsoft - discord - slack - facebook - vk - yandex - apple | [optional] |
 | **provider_id** | **String** | ID is the provider's ID | [optional] |
 | **proxy_oidc_redirect_url** | **String** | Proxy OIDC Redirect URL if overriding with a customer-controlled URL | [optional][readonly] |
 | **requested_claims** | **Object** |  | [optional] |
@@ -34,7 +35,7 @@
 | **state** | **String** | State indicates the state of the provider  Only providers with state `enabled` will be used for authentication enabled ThirdPartyProviderStateEnabled disabled ThirdPartyProviderStateDisabled | [optional] |
 | **subject_source** | **String** |  | [optional] |
 | **token_url** | **String** | TokenURL is the token url, typically something like: https://example.org/oauth2/token  Should only be used when the OAuth2 / OpenID Connect server is not supporting OpenID Connect Discovery and when `provider` is set to `generic`. | [optional] |
-| **update_identity_on_login** | **String** | UpdateIdentityOnLogin controls whether the identity is updated from OIDC claims on each login.  Possible values are \"never\" (default) and \"automatic\". never UpdateIdentityOnLoginNever  UpdateIdentityOnLoginNever disables identity updates on login (default). automatic UpdateIdentityOnLoginAutomatic  UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically. | [optional] |
+| **update_identity_on_login** | **String** | UpdateIdentityOnLogin controls whether the identity is updated from OIDC claims on each login.  Possible values are \"never\" (default) and \"automatic\". never UpdateIdentityOnLoginNever disables identity updates on login (default). automatic UpdateIdentityOnLoginAutomatic re-runs the Jsonnet claims mapper on every login and updates the identity's traits and metadata automatically. | [optional] |
 | **updated_at** | **Time** | Last Time Project's Revision was Updated | [optional][readonly] |
 
 ## Example
@@ -57,6 +58,7 @@ instance = OryClient::NormalizedProjectRevisionThirdPartyProvider.new(
   client_secret: null,
   created_at: null,
   fedcm_config_url: null,
+  front_channel_logout: null,
   id: null,
   issuer_url: https://accounts.google.com,
   label: null,

data/docs/NormalizedProjectRevisionTokenizerTemplate.md

@@ -7,7 +7,7 @@
 | **claims_mapper_url** | **String** | Claims mapper URL | [optional] |
 | **created_at** | **Time** | The Project's Revision Creation Date | [optional][readonly] |
 | **id** | **String** | The revision ID. | [optional][readonly] |
-| **jwks_url** | **String** | JSON Web Key URL | [optional] |
+| **jwks_url** | **String** | JSON Web Key URL  The key set signs the tokens this template issues. It is write only and the value will not be returned in response to a read request. An update that leaves this field empty keeps the stored key set; supply a new one to rotate. | [optional] |
 | **key** | **String** | The unique key of the template | [optional] |
 | **project_revision_id** | **String** | The Revision's ID this schema belongs to | [optional] |
 | **subject_source** | **String** | Subject source for the tokenizer  Can be either id or external_id or empty | [optional][default to 'id'] |

data/docs/OAuth2Api.md

@@ -2095,11 +2095,11 @@ nil (empty response body)
 
 ## rotate_o_auth2_client_secret
 
-> <OAuth2Client> rotate_o_auth2_client_secret(id)
+> <OAuth2Client> rotate_o_auth2_client_secret(id, opts)
 
 Rotate OAuth 2.0 Client Secret
 
-Rotates an OAuth 2.0 client's secrets. The old secret will remain valid for authentication, allowing for zero-downtime secret rotations. A new secret will be generated and returned in the response.  Up to five rotated secrets are retained. Use the `deleteRotatedOAuth2ClientSecrets` endpoint to remove old rotated secrets when they are no longer needed.
+Rotates an OAuth 2.0 client's secrets. The old secret will remain valid for authentication, allowing for zero-downtime secret rotations. A new secret will be generated and returned in the response.  Up to five rotated secrets are retained. Use the `deleteRotatedOAuth2ClientSecrets` endpoint to remove old rotated secrets when they are no longer needed.  Supply `client_secret` in the request body to rotate to a specific value instead of a generated one. The request body is optional.
 
 ### Examples
 
@@ -2114,10 +2114,13 @@ end
 
 api_instance = OryClient::OAuth2Api.new
 id = 'id_example' # String | OAuth 2.0 Client ID
+opts = {
+  rotate_o_auth2_client_secret_body: OryClient::RotateOAuth2ClientSecretBody.new # RotateOAuth2ClientSecretBody | 
+}
 
 begin
   # Rotate OAuth 2.0 Client Secret
-  result = api_instance.rotate_o_auth2_client_secret(id)
+  result = api_instance.rotate_o_auth2_client_secret(id, opts)
   p result
 rescue OryClient::ApiError => e
   puts "Error when calling OAuth2Api->rotate_o_auth2_client_secret: #{e}"
@@ -2128,12 +2131,12 @@ end
 
 This returns an Array which contains the response data, status code and headers.
 
-> <Array(<OAuth2Client>, Integer, Hash)> rotate_o_auth2_client_secret_with_http_info(id)
+> <Array(<OAuth2Client>, Integer, Hash)> rotate_o_auth2_client_secret_with_http_info(id, opts)
 
 ```ruby
 begin
   # Rotate OAuth 2.0 Client Secret
-  data, status_code, headers = api_instance.rotate_o_auth2_client_secret_with_http_info(id)
+  data, status_code, headers = api_instance.rotate_o_auth2_client_secret_with_http_info(id, opts)
   p status_code # => 2xx
   p headers # => { ... }
   p data # => <OAuth2Client>
@@ -2147,6 +2150,7 @@ end
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
 | **id** | **String** | OAuth 2.0 Client ID |  |
+| **rotate_o_auth2_client_secret_body** | [**RotateOAuth2ClientSecretBody**](RotateOAuth2ClientSecretBody.md) |  | [optional] |
 
 ### Return type
 
@@ -2158,7 +2162,7 @@ end
 
 ### HTTP request headers
 
-- **Content-Type**: Not defined
+- **Content-Type**: application/json
 - **Accept**: application/json