ory-client 1.22.86 → 1.22.88

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4480634fcad1b4db5a6cf8dbe1c6afc61cb2a4ca532a35b2a8568abd39acc787
-  data.tar.gz: 5bd5b4e7adee5d8be6080a4b0c6a0f9fef61ff03a8b412b328acba6b8385e942
+  metadata.gz: 750f52ded9c1ec9ee203d91c302868b06c547bb4b0f976421164a9d72c7f6097
+  data.tar.gz: 94f8bf6ac5e1c0514c51b7b216c9d9a207abce9a04a2bcf055473bc7e2a9ad00
 SHA512:
-  metadata.gz: c2d5888ae6cb8202ad37e47bf3e07ea9de8c50b1b7283b5f0bdb8cb09243bccd194c1e709f5214ca698c7b14a7f74b93d2543f7e8acccdf00d3f582f1813bcc2
-  data.tar.gz: dee72f64db79733e71970cdc151399594e0ef82776257638a6c2c24ac69788c9acd4608179f248124db9761e29d7d2c0eb0d0776cb12ac2ab966d199a8a4557b
+  metadata.gz: c3780db961ac3b273de1b15d565f8f4fbd165418aa9535975c3855029b95bb5ddb97bbbf8e59b43ff9cf424b236afffed4964053284580343ca2382477b2f03c
+  data.tar.gz: 262d3a6b590b46d78936ca73f122092fc7497e0561e4fe2d96d6c85601fcd22e414843235d12a73b1ffe34c05fdc96036f803fd1e31550a6cf4409cb745bdb27

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    ory-client (1.22.86)
+    ory-client (1.22.88)
       typhoeus (~> 1.0, >= 1.0.1)
 
 GEM
@@ -12,16 +12,16 @@ GEM
       reline (>= 0.6.0)
     coderay (1.1.3)
     diff-lcs (1.6.2)
-    ethon (0.18.0)
+    ethon (0.19.1)
       ffi (>= 1.15.0)
       logger
     ffi (1.17.4-x86_64-linux-gnu)
-    io-console (0.9.4)
+    io-console (0.9.5)
     jaro_winkler (1.5.6)
     logger (1.7.0)
     method_source (1.1.0)
     parallel (1.28.0)
-    parser (3.3.12.0)
+    parser (3.3.13.0)
       ast (~> 2.4.1)
       racc
     pry (0.16.1)
@@ -61,8 +61,8 @@ GEM
       unicode-display_width (>= 1.4.0, < 1.6)
     ruby-progressbar (1.13.0)
     stringio (3.2.0)
-    typhoeus (1.6.0)
-      ethon (>= 0.18.0)
+    typhoeus (1.7.1)
+      ethon (>= 0.19.1, < 0.20.0)
     unicode-display_width (1.5.0)
 
 PLATFORMS

data/README.md

@@ -26,8 +26,8 @@ This document describes the APIs available in the Ory Network. The APIs are avai
 
 This SDK is automatically generated by the [OpenAPI Generator](https://openapi-generator.tech) project:
 
-- API version: v1.22.86
-- Package version: v1.22.86
+- API version: v1.22.88
+- Package version: v1.22.88
 - Generator version: 7.17.0
 - Build package: org.openapitools.codegen.languages.RubyClientCodegen
 
@@ -44,16 +44,16 @@ gem build ory-client.gemspec
 Then either install the gem locally:
 
 ```shell
-gem install ./ory-client-v1.22.86.gem
+gem install ./ory-client-v1.22.88.gem
 ```
 
-(for development, run `gem install --dev ./ory-client-v1.22.86.gem` to install the development dependencies)
+(for development, run `gem install --dev ./ory-client-v1.22.88.gem` to install the development dependencies)
 
 or publish the gem to a gem hosting service, e.g. [RubyGems](https://rubygems.org/).
 
 Finally add this to the Gemfile:
 
-    gem 'ory-client', '~> v1.22.86'
+    gem 'ory-client', '~> v1.22.88'
 
 ### Install from Git
 

data/docs/AcceptOAuth2ConsentRequest.md

@@ -5,7 +5,7 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
 | **context** | **Object** |  | [optional] |
-| **grant_access_token_audience** | **Array<String>** | GrantedAudience sets the audience the user authorized the client to use. Should be a subset of `requested_access_token_audience`. | [optional] |
+| **grant_access_token_audience** | **Array<String>** | GrantedAudience sets the access token audiences approved by the user, including exact URIs from requested_resources. When resources are requested, grant at least one of them to accept consent. | [optional] |
 | **grant_scope** | **Array<String>** | GrantScope sets the scope the user authorized the client to use. Should be a subset of `requested_scope`. | [optional] |
 | **remember** | **Boolean** | Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same client asks the same user for the same, or a subset of, scope. | [optional] |
 | **remember_for** | **Integer** | RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the authorization will be remembered indefinitely. | [optional] |

data/docs/AdminUpdateImportedApiKeyRequest.md

@@ -9,7 +9,7 @@
 | **expire_time** | **Time** |  | [optional] |
 | **ip_restriction** | [**IPRestriction**](IPRestriction.md) |  | [optional] |
 | **last_used_time** | **Time** |  | [optional] |
-| **metadata** | **Object** | metadata is a free-form JSON object for caller-defined attributes (e.g., source, environment, tags). Values may be strings, numbers, booleans, arrays, objects, or null. Total serialized size is capped at 4KB. AIP-148 metadata field. | [optional] |
+| **metadata** | **Object** | metadata is a free-form JSON object for caller-defined attributes (e.g., source, environment, tags). Values may be strings, numbers, booleans, arrays, objects, or null. Total serialized size is capped at 64 KiB. AIP-148 metadata field. | [optional] |
 | **name** | **String** |  | [optional] |
 | **rate_limit_policy** | [**RateLimitPolicy**](RateLimitPolicy.md) |  | [optional] |
 | **revocation_description** | **String** | revocation_description provides free-form context for a revocation. Only set when revocation_reason is PRIVILEGE_WITHDRAWN. JSON API change: field was formerly revocation_reason_text. Field number 13 is unchanged so the change is wire-compatible for binary proto encoding. | [optional] |

data/docs/AdminUpdateIssuedApiKeyRequest.md

@@ -9,7 +9,7 @@
 | **expire_time** | **Time** |  | [optional] |
 | **ip_restriction** | [**IPRestriction**](IPRestriction.md) |  | [optional] |
 | **last_used_time** | **Time** |  | [optional] |
-| **metadata** | **Object** | metadata is a free-form JSON object for caller-defined attributes (e.g., source, environment, tags). Values may be strings, numbers, booleans, arrays, objects, or null. Total serialized size is capped at 4KB. AIP-148 metadata field. | [optional] |
+| **metadata** | **Object** | metadata is a free-form JSON object for caller-defined attributes (e.g., source, environment, tags). Values may be strings, numbers, booleans, arrays, objects, or null. Total serialized size is capped at 64 KiB. AIP-148 metadata field. | [optional] |
 | **name** | **String** |  | [optional] |
 | **rate_limit_policy** | [**RateLimitPolicy**](RateLimitPolicy.md) |  | [optional] |
 | **revocation_description** | **String** | revocation_description provides free-form context for a revocation. Only set when revocation_reason is PRIVILEGE_WITHDRAWN. JSON API change: field was formerly revocation_reason_text. Field number 13 is unchanged so the change is wire-compatible for binary proto encoding. | [optional] |

data/docs/CreateEventStreamBody.md

@@ -4,6 +4,10 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
+| **event_types** | **Array<String>** | The events to deliver, as exact event names or patterns such as Session* or *Failed, in which * matches any characters, using the names listed in the event streams documentation. Omit it or send an empty list to deliver every event. | [optional] |
+| **https_auth_header_name** | **String** | The header that carries the API key. Required if https_auth_type is api_key. It must not be a header Ory sets itself, or a connection-specific header such as Connection, Keep-Alive, Upgrade, or TE, which HTTP/2 does not allow. | [optional] |
+| **https_auth_secret** | **String** | The API key or bearer token. Required if https_auth_type is api_key or bearer. At most 4096 bytes. | [optional] |
+| **https_auth_type** | **String** | How deliveries to the HTTPS endpoint authenticate. Defaults to none. `api_key` sends https_auth_secret in the header named by https_auth_header_name. `bearer` sends it as `Authorization: Bearer`. | [optional] |
 | **https_endpoint** | **String** | The HTTPS endpoint URL to send events to. Required if type is https. | [optional] |
 | **role_arn** | **String** | The AWS IAM role ARN to assume when publishing to the SNS topic. Required if type is sns. | [optional] |
 | **status** | **String** | The status of the event stream. Defaults to active. A paused stream is created but does not forward any events until it is set to active. | [optional] |
@@ -16,6 +20,10 @@
 require 'ory-client'
 
 instance = OryClient::CreateEventStreamBody.new(
+  event_types: null,
+  https_auth_header_name: null,
+  https_auth_secret: null,
+  https_auth_type: null,
   https_endpoint: null,
   role_arn: null,
   status: null,

data/docs/CreateProjectNormalizedPayload.md

@@ -43,6 +43,7 @@
 | **hydra_oauth2_refresh_token_hook** | **String** | Sets the Refresh Token Hook Endpoint. If set this endpoint will be called during the OAuth2 Token Refresh grant update the OAuth2 Access Token claims.  This governs the \"oauth2.refresh_token_hook\" setting. | [optional] |
 | **hydra_oauth2_token_hook** | **String** | Sets the token hook endpoint for all grant types. If set it will be called while providing token to customize claims.  This governs the \"oauth2.token_hook.url\" setting. | [optional] |
 | **hydra_oauth2_token_prefix** | **String** | Sets a per-project Access Token, Refresh Token, and Authorization Code prefix. The literal \"%s\" is replaced at issuance time with the token kind: \"at\" (access token), \"rt\" (refresh token), or \"ac\" (authorization code). For example, \"acme_%s_\" yields \"acme_at_…\", \"acme_rt_…\", and \"acme_ac_…\".  Must be a fmt.Sprintf template with exactly one \"%s\" substitution. The rendered prefix may contain only ASCII letters, digits, and underscores — no other \"%\" directives (\"%d\", \"%%\", positional or width-flagged verbs), no hyphens, dots, slashes, whitespace, quotes, or non-ASCII characters. Leave empty to keep the default \"ory_%s_\" prefix.  This is an Enterprise feature.  This governs the \"oauth2.token_prefix\" setting. | [optional] |
+| **hydra_oidc_dynamic_client_registration_default_audience** | **Array<String>** | The audience allow list assigned during OpenID Connect Dynamic Client Registration when audience is omitted or null. An explicit audience, including an empty list, takes precedence. Defaults apply only during registration.  This governs the \"oidc.dynamic_client_registration.default_audience\" setting. | [optional] |
 | **hydra_oidc_dynamic_client_registration_default_scope** | **Array<String>** | The OpenID Connect Dynamic Client Registration specification has no concept of whitelisting OAuth 2.0 Scope. If you want to expose Dynamic Client Registration, you should set the default scope enabled for newly registered clients. Keep in mind that users can overwrite this default by setting the \"scope\" key in the registration payload, effectively disabling the concept of whitelisted scopes.  This governs the \"oidc.dynamic_client_registration.default_scope\" setting. | [optional] |
 | **hydra_oidc_dynamic_client_registration_enabled** | **Boolean** | Configures OpenID Connect Dynamic Client Registration.  This governs the \"oidc.dynamic_client_registration.enabled\" setting. | [optional] |
 | **hydra_oidc_subject_identifiers_pairwise_salt** | **String** | Configures OpenID Connect Discovery and overwrites the pairwise algorithm  This governs the \"oidc.subject_identifiers.pairwise_salt\" setting. | [optional] |
@@ -175,6 +176,15 @@
 | **kratos_selfservice_flows_login_after_password_default_browser_return_url** | **String** | Configures the Ory Kratos Login After Password Default Return URL  This governs the \"selfservice.flows.login.after.password.default_browser_return_url\" setting. | [optional] |
 | **kratos_selfservice_flows_login_after_totp_default_browser_return_url** | **String** | Configures the Ory Kratos Login After TOTP Default Return URL  This governs the \"selfservice.flows.login.after.totp.default_browser_return_url\" setting. | [optional] |
 | **kratos_selfservice_flows_login_after_webauthn_default_browser_return_url** | **String** | Configures the Ory Kratos Login After WebAuthn Default Return URL  This governs the \"selfservice.flows.login.after.webauthn.default_browser_return_url\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_enabled** | **Boolean** | Configures whether failed sign-ins are throttled with exponential backoff  Turning it off keeps the thresholds, so it can be turned back on without entering them again. Requires an Enterprise plan.  This governs the \"selfservice.flows.login.brute_force_protection.enabled\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_identifier_exponential_backoff_initial** | **String** | Configures the first delay for an identifier once its threshold is exceeded, for example \"1s\"  The delay doubles with every further failure.  This governs the \"selfservice.flows.login.brute_force_protection.identifier.exponential_backoff.initial\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_identifier_exponential_backoff_max** | **String** | Configures the longest delay for an identifier, for example \"15m\", at most \"8760h\"  This governs the \"selfservice.flows.login.brute_force_protection.identifier.exponential_backoff.max\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_identifier_max_failures** | **Integer** | Configures how many failed sign-ins per identifier the window tolerates before delays start  This governs the \"selfservice.flows.login.brute_force_protection.identifier.max_failures\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_identifier_window** | **String** | Configures how long the failure count of an identifier lives after its first failure, for example \"5m\"  This governs the \"selfservice.flows.login.brute_force_protection.identifier.window\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_ip_exponential_backoff_initial** | **String** | Configures the first delay for a client IP once its threshold is exceeded, for example \"1s\"  The delay doubles with every further failure.  This governs the \"selfservice.flows.login.brute_force_protection.ip.exponential_backoff.initial\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_ip_exponential_backoff_max** | **String** | Configures the longest delay for a client IP, for example \"15m\", at most \"8760h\"  This governs the \"selfservice.flows.login.brute_force_protection.ip.exponential_backoff.max\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_ip_max_failures** | **Integer** | Configures how many failed sign-ins per client IP the window tolerates before delays start  This governs the \"selfservice.flows.login.brute_force_protection.ip.max_failures\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_ip_window** | **String** | Configures how long the failure count of a client IP lives after its first failure, for example \"1m\"  This governs the \"selfservice.flows.login.brute_force_protection.ip.window\" setting. | [optional] |
 | **kratos_selfservice_flows_login_lifespan** | **String** | Configures the Ory Kratos Login Lifespan  This governs the \"selfservice.flows.login.lifespan\" setting. | [optional] |
 | **kratos_selfservice_flows_login_style** | **String** | Configures the Ory Kratos Login Flow Style  This governs the \"selfservice.flows.login.style\" setting. Possible values are \"unified\" and \"identifier_first\". | [optional] |
 | **kratos_selfservice_flows_login_ui_url** | **String** | Configures the Ory Kratos Login UI URL  This governs the \"selfservice.flows.login.ui_url\" setting. | [optional] |
@@ -357,6 +367,7 @@ instance = OryClient::CreateProjectNormalizedPayload.new(
   hydra_oauth2_refresh_token_hook: null,
   hydra_oauth2_token_hook: null,
   hydra_oauth2_token_prefix: null,
+  hydra_oidc_dynamic_client_registration_default_audience: null,
   hydra_oidc_dynamic_client_registration_default_scope: null,
   hydra_oidc_dynamic_client_registration_enabled: null,
   hydra_oidc_subject_identifiers_pairwise_salt: null,
@@ -489,6 +500,15 @@ instance = OryClient::CreateProjectNormalizedPayload.new(
   kratos_selfservice_flows_login_after_password_default_browser_return_url: null,
   kratos_selfservice_flows_login_after_totp_default_browser_return_url: null,
   kratos_selfservice_flows_login_after_webauthn_default_browser_return_url: null,
+  kratos_selfservice_flows_login_brute_force_protection_enabled: null,
+  kratos_selfservice_flows_login_brute_force_protection_identifier_exponential_backoff_initial: null,
+  kratos_selfservice_flows_login_brute_force_protection_identifier_exponential_backoff_max: null,
+  kratos_selfservice_flows_login_brute_force_protection_identifier_max_failures: null,
+  kratos_selfservice_flows_login_brute_force_protection_identifier_window: null,
+  kratos_selfservice_flows_login_brute_force_protection_ip_exponential_backoff_initial: null,
+  kratos_selfservice_flows_login_brute_force_protection_ip_exponential_backoff_max: null,
+  kratos_selfservice_flows_login_brute_force_protection_ip_max_failures: null,
+  kratos_selfservice_flows_login_brute_force_protection_ip_window: null,
   kratos_selfservice_flows_login_lifespan: null,
   kratos_selfservice_flows_login_style: null,
   kratos_selfservice_flows_login_ui_url: null,

data/docs/DeriveTokenRequest.md

@@ -5,8 +5,9 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
 | **algorithm** | [**TokenAlgorithm**](TokenAlgorithm.md) |  | [optional][default to 'TOKEN_ALGORITHM_UNSPECIFIED'] |
-| **credential** | **String** |  | [optional] |
-| **custom_claims** | **Object** | custom_claims is a JSON object whose entries are merged into the JWT payload (or macaroon caveats) at signing time. Reserved JWT claims (iss, sub, aud, exp, nbf, iat, jti) are rejected. Total serialized size is capped at 4KB. | [optional] |
+| **audiences** | **Array<String>** | audiences binds the derived token to the named recipients (the \"aud\" claim). A verifier that expects an audience accepts the token only when at least one value matches exactly. Omit to leave the token unbound, which every audience-expecting verification then rejects. | [optional] |
+| **credential** | **String** | credential is the API key secret (issued or imported) to derive a token from. At most 8,192 bytes of UTF-8. | [optional] |
+| **custom_claims** | **Object** | custom_claims is a JSON object whose entries are merged into the JWT payload (or macaroon caveats) at signing time. Entries named after a reserved claim (the standard JWT claims and the claims Talos sets, listed in the derived tokens guide) are removed before signing. The complete signed token, including its signature and any macaroon prefix, must not exceed 8,192 bytes; larger tokens are rejected, never truncated. | [optional] |
 | **scopes** | **Array<String>** |  | [optional] |
 | **ttl** | **String** | ttl sets the expiry as a duration from now. Encoded as a google.protobuf.Duration (string ending in \"s\", e.g. \"3600s\"). Accepted bounds: 1s to 315360000s (~10 years). If unset or zero, the project default TTL applies. For convenience, the server also accepts Go-style duration strings (\"24h\", \"30m\", \"1h30m\") and an extended unit set (\"1d\", \"1w\", \"1mo\", \"1y\"; approximations: 1mo = 30d, 1y = 365d). Clients should prefer the standard Duration encoding for portability. | [optional] |
 
@@ -17,6 +18,7 @@ require 'ory-client'
 
 instance = OryClient::DeriveTokenRequest.new(
   algorithm: null,
+  audiences: null,
   credential: null,
   custom_claims: null,
   scopes: null,

data/docs/EventStream.md

@@ -5,8 +5,12 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
 | **created_at** | **Time** |  | [optional] |
+| **event_types** | **Array<String>** | The events the stream delivers, sorted. An entry is an exact event name or a pattern such as Session* or *Failed, in which * matches any characters. An empty list delivers every event. | [optional] |
 | **http_protocol_major_version** | **Integer** | The major version of the HTTP protocol the endpoint negotiated during the most recent successful connectivity test: 1 for HTTP/1.x, 2 for HTTP/2. Null when the endpoint has not been verified, for example on a paused stream or a non-HTTPS stream. | [optional][readonly] |
-| **https_endpoint** | **String** | The HTTPS endpoint, if type is HTTPS.  Returned with its userinfo and query values masked. Omit it on write to keep the stored endpoint; sending the masked form back overwrites it. | [optional] |
+| **https_auth_header_name** | **String** | The header that carries the API key, if https_auth_type is api_key. | [optional] |
+| **https_auth_secret** | **String** | The API key or bearer token, if https_auth_type is api_key or bearer.  Returned masked. Omit it on write to keep the stored secret. | [optional] |
+| **https_auth_type** | **String** | How deliveries to the HTTPS endpoint authenticate, if type is HTTPS. `api_key` sends the secret in the header named by https_auth_header_name. `bearer` sends it as `Authorization: Bearer`. Credentials in the endpoint URL are sent as Basic auth either way. | [optional] |
+| **https_endpoint** | **String** | The HTTPS endpoint, if type is HTTPS.  Returned with its userinfo and query values masked. Omit it on write to keep the stored endpoint. | [optional] |
 | **id** | **String** |  | [optional] |
 | **role_arn** | **String** | The AWS IAM role ARN assumed when publishing to the SNS topic, if type is SNS. | [optional] |
 | **status** | **String** | The status of the event stream. A paused event stream does not forward any events until it is set back to active. | [optional] |
@@ -21,7 +25,11 @@ require 'ory-client'
 
 instance = OryClient::EventStream.new(
   created_at: null,
+  event_types: null,
   http_protocol_major_version: null,
+  https_auth_header_name: null,
+  https_auth_secret: null,
+  https_auth_type: null,
   https_endpoint: null,
   id: null,
   role_arn: null,

data/docs/ImportApiKeyRequest.md

@@ -6,10 +6,10 @@
 | ---- | ---- | ----------- | ----- |
 | **actor_id** | **String** | actor_id is the identifier of the entity that owns this imported key. Required so every imported key is traceable to an actor for revocation and audit queries. | [optional] |
 | **ip_restriction** | [**IPRestriction**](IPRestriction.md) |  | [optional] |
-| **metadata** | **Object** | metadata is a free-form JSON object for caller-defined attributes (e.g., source, environment, tags). Values may be strings, numbers, booleans, arrays, objects, or null. Total serialized size is capped at 4KB. AIP-148 metadata field. | [optional] |
+| **metadata** | **Object** | metadata is a free-form JSON object for caller-defined attributes (e.g., source, environment, tags). Values may be strings, numbers, booleans, arrays, objects, or null. Total serialized size is capped at 64 KiB. AIP-148 metadata field. | [optional] |
 | **name** | **String** |  | [optional] |
 | **rate_limit_policy** | [**RateLimitPolicy**](RateLimitPolicy.md) |  | [optional] |
-| **raw_key** | **String** |  | [optional] |
+| **raw_key** | **String** | raw_key is the key string to import (REQUIRED). At most 8,192 bytes of UTF-8; multibyte characters count once per byte. | [optional] |
 | **request_id** | **String** |  | [optional] |
 | **scopes** | **Array<String>** |  | [optional] |
 | **ttl** | **String** | ttl sets the expiry as a duration from now. Encoded as a google.protobuf.Duration (string ending in \"s\", e.g. \"3600s\"). Accepted bounds: 1s to 315360000s (~10 years). If unset or zero, the project default TTL applies. For convenience, the server also accepts Go-style duration strings (\"24h\", \"30m\", \"1h30m\") and an extended unit set (\"1d\", \"1w\", \"1mo\", \"1y\"; approximations: 1mo = 30d, 1y = 365d). Clients should prefer the standard Duration encoding for portability. | [optional] |

data/docs/ImportedApiKey.md

@@ -10,7 +10,7 @@
 | **ip_restriction** | [**IPRestriction**](IPRestriction.md) |  | [optional] |
 | **key_id** | **String** |  | [optional] |
 | **last_used_time** | **Time** |  | [optional] |
-| **metadata** | **Object** | metadata is a free-form JSON object for caller-defined attributes (e.g., source, environment, tags). Values may be strings, numbers, booleans, arrays, objects, or null. Total serialized size is capped at 4KB. AIP-148 metadata field. | [optional] |
+| **metadata** | **Object** | metadata is a free-form JSON object for caller-defined attributes (e.g., source, environment, tags). Values may be strings, numbers, booleans, arrays, objects, or null. Total serialized size is capped at 64 KiB. AIP-148 metadata field. | [optional] |
 | **name** | **String** |  | [optional] |
 | **rate_limit_policy** | [**RateLimitPolicy**](RateLimitPolicy.md) |  | [optional] |
 | **revocation_description** | **String** | revocation_description provides free-form context for a revocation. Only set when revocation_reason is PRIVILEGE_WITHDRAWN. JSON API change: field was formerly revocation_reason_text. Field number 13 is unchanged so the change is wire-compatible for binary proto encoding. | [optional] |

data/docs/IssueApiKeyRequest.md

@@ -6,7 +6,7 @@
 | ---- | ---- | ----------- | ----- |
 | **actor_id** | **String** |  | [optional] |
 | **ip_restriction** | [**IPRestriction**](IPRestriction.md) |  | [optional] |
-| **metadata** | **Object** | metadata is a free-form JSON object for caller-defined attributes (e.g., source, environment, tags). Values may be strings, numbers, booleans, arrays, objects, or null. Total serialized size is capped at 4KB. AIP-148 metadata field. | [optional] |
+| **metadata** | **Object** | metadata is a free-form JSON object for caller-defined attributes (e.g., source, environment, tags). Values may be strings, numbers, booleans, arrays, objects, or null. Total serialized size is capped at 64 KiB. AIP-148 metadata field. | [optional] |
 | **name** | **String** |  | [optional] |
 | **rate_limit_policy** | [**RateLimitPolicy**](RateLimitPolicy.md) |  | [optional] |
 | **request_id** | **String** |  | [optional] |

data/docs/IssuedApiKey.md

@@ -10,7 +10,7 @@
 | **ip_restriction** | [**IPRestriction**](IPRestriction.md) |  | [optional] |
 | **key_id** | **String** |  | [optional] |
 | **last_used_time** | **Time** |  | [optional] |
-| **metadata** | **Object** | metadata is a free-form JSON object for caller-defined attributes (e.g., source, environment, tags). Values may be strings, numbers, booleans, arrays, objects, or null. Total serialized size is capped at 4KB. AIP-148 metadata field. | [optional] |
+| **metadata** | **Object** | metadata is a free-form JSON object for caller-defined attributes (e.g., source, environment, tags). Values may be strings, numbers, booleans, arrays, objects, or null. Total serialized size is capped at 64 KiB. AIP-148 metadata field. | [optional] |
 | **name** | **String** |  | [optional] |
 | **rate_limit_policy** | [**RateLimitPolicy**](RateLimitPolicy.md) |  | [optional] |
 | **revocation_description** | **String** | revocation_description provides free-form context for a revocation. Only set when revocation_reason is PRIVILEGE_WITHDRAWN. JSON API change: field was formerly revocation_reason_text. Field number 13 is unchanged so the change is wire-compatible for binary proto encoding. | [optional] |

data/docs/LoginFlowTestDebugPayload.md

@@ -10,6 +10,7 @@
 | **jsonnet_mapper_url** | **String** | URL of the Jsonnet mapper that was executed on the claims. | [optional] |
 | **jsonnet_output** | **Hash<String, Object>** | Output JSON returned by the Jsonnet mapper. | [optional] |
 | **jsonnet_stderr** | **String** | Anything the Jsonnet mapper wrote to standard error. | [optional] |
+| **missing_required_traits** | **Array<String>** | JSON pointers to required identity traits the Jsonnet mapper did not set. The test still succeeds, because on first sign-in the user is asked to provide these fields before the identity is created. | [optional] |
 | **schema_validation_errors** | [**Array<LoginFlowTestSchemaValidationError>**](LoginFlowTestSchemaValidationError.md) | Identity-schema validation errors produced from the mapped traits. | [optional] |
 | **userinfo** | **Hash<String, Object>** | Claims returned from the provider's userinfo endpoint, if any. | [optional] |
 
@@ -25,6 +26,7 @@ instance = OryClient::LoginFlowTestDebugPayload.new(
   jsonnet_mapper_url: null,
   jsonnet_output: null,
   jsonnet_stderr: null,
+  missing_required_traits: null,
   schema_validation_errors: null,
   userinfo: null
 )

data/docs/NormalizedProjectRevision.md

@@ -41,6 +41,7 @@
 | **hydra_oauth2_refresh_token_hook** | **String** | Sets the Refresh Token Hook Endpoint. If set this endpoint will be called during the OAuth2 Token Refresh grant update the OAuth2 Access Token claims.  This governs the \"oauth2.refresh_token_hook\" setting. | [optional] |
 | **hydra_oauth2_token_hook** | **String** | Sets the token hook endpoint for all grant types. If set it will be called while providing token to customize claims.  This governs the \"oauth2.token_hook.url\" setting. | [optional] |
 | **hydra_oauth2_token_prefix** | **String** | Sets a per-project Access Token, Refresh Token, and Authorization Code prefix. The literal \"%s\" is replaced at issuance time with the token kind: \"at\" (access token), \"rt\" (refresh token), or \"ac\" (authorization code). For example, \"acme_%s_\" yields \"acme_at_…\", \"acme_rt_…\", and \"acme_ac_…\".  Must be a fmt.Sprintf template with exactly one \"%s\" substitution. The rendered prefix may contain only ASCII letters, digits, and underscores — no other \"%\" directives (\"%d\", \"%%\", positional or width-flagged verbs), no hyphens, dots, slashes, whitespace, quotes, or non-ASCII characters. Leave empty to keep the default \"ory_%s_\" prefix.  This is an Enterprise feature.  This governs the \"oauth2.token_prefix\" setting. | [optional] |
+| **hydra_oidc_dynamic_client_registration_default_audience** | **Array<String>** | The audience allow list assigned during OpenID Connect Dynamic Client Registration when audience is omitted or null. An explicit audience, including an empty list, takes precedence. Defaults apply only during registration.  This governs the \"oidc.dynamic_client_registration.default_audience\" setting. | [optional] |
 | **hydra_oidc_dynamic_client_registration_default_scope** | **Array<String>** | The OpenID Connect Dynamic Client Registration specification has no concept of whitelisting OAuth 2.0 Scope. If you want to expose Dynamic Client Registration, you should set the default scope enabled for newly registered clients. Keep in mind that users can overwrite this default by setting the \"scope\" key in the registration payload, effectively disabling the concept of whitelisted scopes.  This governs the \"oidc.dynamic_client_registration.default_scope\" setting. | [optional] |
 | **hydra_oidc_dynamic_client_registration_enabled** | **Boolean** | Configures OpenID Connect Dynamic Client Registration.  This governs the \"oidc.dynamic_client_registration.enabled\" setting. | [optional] |
 | **hydra_oidc_subject_identifiers_pairwise_salt** | **String** | Configures OpenID Connect Discovery and overwrites the pairwise algorithm  This governs the \"oidc.subject_identifiers.pairwise_salt\" setting. | [optional] |
@@ -173,6 +174,15 @@
 | **kratos_selfservice_flows_login_after_password_default_browser_return_url** | **String** | Configures the Ory Kratos Login After Password Default Return URL  This governs the \"selfservice.flows.login.after.password.default_browser_return_url\" setting. | [optional] |
 | **kratos_selfservice_flows_login_after_totp_default_browser_return_url** | **String** | Configures the Ory Kratos Login After TOTP Default Return URL  This governs the \"selfservice.flows.login.after.totp.default_browser_return_url\" setting. | [optional] |
 | **kratos_selfservice_flows_login_after_webauthn_default_browser_return_url** | **String** | Configures the Ory Kratos Login After WebAuthn Default Return URL  This governs the \"selfservice.flows.login.after.webauthn.default_browser_return_url\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_enabled** | **Boolean** | Configures whether failed sign-ins are throttled with exponential backoff  Turning it off keeps the thresholds, so it can be turned back on without entering them again. Requires an Enterprise plan.  This governs the \"selfservice.flows.login.brute_force_protection.enabled\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_identifier_exponential_backoff_initial** | **String** | Configures the first delay for an identifier once its threshold is exceeded, for example \"1s\"  The delay doubles with every further failure.  This governs the \"selfservice.flows.login.brute_force_protection.identifier.exponential_backoff.initial\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_identifier_exponential_backoff_max** | **String** | Configures the longest delay for an identifier, for example \"15m\", at most \"8760h\"  This governs the \"selfservice.flows.login.brute_force_protection.identifier.exponential_backoff.max\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_identifier_max_failures** | **Integer** | Configures how many failed sign-ins per identifier the window tolerates before delays start  This governs the \"selfservice.flows.login.brute_force_protection.identifier.max_failures\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_identifier_window** | **String** | Configures how long the failure count of an identifier lives after its first failure, for example \"5m\"  This governs the \"selfservice.flows.login.brute_force_protection.identifier.window\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_ip_exponential_backoff_initial** | **String** | Configures the first delay for a client IP once its threshold is exceeded, for example \"1s\"  The delay doubles with every further failure.  This governs the \"selfservice.flows.login.brute_force_protection.ip.exponential_backoff.initial\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_ip_exponential_backoff_max** | **String** | Configures the longest delay for a client IP, for example \"15m\", at most \"8760h\"  This governs the \"selfservice.flows.login.brute_force_protection.ip.exponential_backoff.max\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_ip_max_failures** | **Integer** | Configures how many failed sign-ins per client IP the window tolerates before delays start  This governs the \"selfservice.flows.login.brute_force_protection.ip.max_failures\" setting. | [optional] |
+| **kratos_selfservice_flows_login_brute_force_protection_ip_window** | **String** | Configures how long the failure count of a client IP lives after its first failure, for example \"1m\"  This governs the \"selfservice.flows.login.brute_force_protection.ip.window\" setting. | [optional] |
 | **kratos_selfservice_flows_login_lifespan** | **String** | Configures the Ory Kratos Login Lifespan  This governs the \"selfservice.flows.login.lifespan\" setting. | [optional] |
 | **kratos_selfservice_flows_login_style** | **String** | Configures the Ory Kratos Login Flow Style  This governs the \"selfservice.flows.login.style\" setting. Possible values are \"unified\" and \"identifier_first\". | [optional] |
 | **kratos_selfservice_flows_login_ui_url** | **String** | Configures the Ory Kratos Login UI URL  This governs the \"selfservice.flows.login.ui_url\" setting. | [optional] |
@@ -352,6 +362,7 @@ instance = OryClient::NormalizedProjectRevision.new(
   hydra_oauth2_refresh_token_hook: null,
   hydra_oauth2_token_hook: null,
   hydra_oauth2_token_prefix: null,
+  hydra_oidc_dynamic_client_registration_default_audience: null,
   hydra_oidc_dynamic_client_registration_default_scope: null,
   hydra_oidc_dynamic_client_registration_enabled: null,
   hydra_oidc_subject_identifiers_pairwise_salt: null,
@@ -484,6 +495,15 @@ instance = OryClient::NormalizedProjectRevision.new(
   kratos_selfservice_flows_login_after_password_default_browser_return_url: null,
   kratos_selfservice_flows_login_after_totp_default_browser_return_url: null,
   kratos_selfservice_flows_login_after_webauthn_default_browser_return_url: null,
+  kratos_selfservice_flows_login_brute_force_protection_enabled: null,
+  kratos_selfservice_flows_login_brute_force_protection_identifier_exponential_backoff_initial: null,
+  kratos_selfservice_flows_login_brute_force_protection_identifier_exponential_backoff_max: null,
+  kratos_selfservice_flows_login_brute_force_protection_identifier_max_failures: null,
+  kratos_selfservice_flows_login_brute_force_protection_identifier_window: null,
+  kratos_selfservice_flows_login_brute_force_protection_ip_exponential_backoff_initial: null,
+  kratos_selfservice_flows_login_brute_force_protection_ip_exponential_backoff_max: null,
+  kratos_selfservice_flows_login_brute_force_protection_ip_max_failures: null,
+  kratos_selfservice_flows_login_brute_force_protection_ip_window: null,
   kratos_selfservice_flows_login_lifespan: null,
   kratos_selfservice_flows_login_style: null,
   kratos_selfservice_flows_login_ui_url: null,

data/docs/OAuth2Api.md

@@ -1318,7 +1318,7 @@ end
 
 ## o_auth2_authorize
 
-> <ErrorOAuth2> o_auth2_authorize
+> <ErrorOAuth2> o_auth2_authorize(opts)
 
 OAuth 2.0 Authorize Endpoint
 
@@ -1331,10 +1331,13 @@ require 'time'
 require 'ory-client'
 
 api_instance = OryClient::OAuth2Api.new
+opts = {
+  resource: ['inner_example'] # Array<String> | Resource is a repeated RFC 8707 resource indicator. When resource indicators are enabled, each value must be an absolute URI without a fragment that is listed in the client's audience, and is exposed separately to consent. Other values return invalid_target. Resource indicators are enabled when feature_flags.resource_indicators_enabled is true. Otherwise, resource is an extension parameter.
+}
 
 begin
   # OAuth 2.0 Authorize Endpoint
-  result = api_instance.o_auth2_authorize
+  result = api_instance.o_auth2_authorize(opts)
   p result
 rescue OryClient::ApiError => e
   puts "Error when calling OAuth2Api->o_auth2_authorize: #{e}"
@@ -1345,12 +1348,12 @@ end
 
 This returns an Array which contains the response data, status code and headers.
 
-> <Array(<ErrorOAuth2>, Integer, Hash)> o_auth2_authorize_with_http_info
+> <Array(<ErrorOAuth2>, Integer, Hash)> o_auth2_authorize_with_http_info(opts)
 
 ```ruby
 begin
   # OAuth 2.0 Authorize Endpoint
-  data, status_code, headers = api_instance.o_auth2_authorize_with_http_info
+  data, status_code, headers = api_instance.o_auth2_authorize_with_http_info(opts)
   p status_code # => 2xx
   p headers # => { ... }
   p data # => <ErrorOAuth2>
@@ -1361,7 +1364,9 @@ end
 
 ### Parameters
 
-This endpoint does not need any parameter.
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **resource** | [**Array&lt;String&gt;**](String.md) | Resource is a repeated RFC 8707 resource indicator. When resource indicators are enabled, each value must be an absolute URI without a fragment that is listed in the client&#39;s audience, and is exposed separately to consent. Other values return invalid_target. Resource indicators are enabled when feature_flags.resource_indicators_enabled is true. Otherwise, resource is an extension parameter. | [optional] |
 
 ### Return type
 
@@ -1467,7 +1472,8 @@ opts = {
   client_id: 'client_id_example', # String | 
   code: 'code_example', # String | 
   redirect_uri: 'redirect_uri_example', # String | 
-  refresh_token: 'refresh_token_example' # String | 
+  refresh_token: 'refresh_token_example', # String | 
+  resource: ['inner_example'] # Array<String> | Resource is a repeated RFC 8707 resource indicator. When resource indicators are enabled, each value must be an absolute URI without a fragment. The access token audience is narrowed to the exact authorized resource values. Invalid or unauthorized values return invalid_target. The `@ory/client` TypeScript SDK sends only the last value of this array, so use another HTTP client to request several resources at the token endpoint.
 }
 
 begin
@@ -1506,6 +1512,7 @@ end
 | **code** | **String** |  | [optional] |
 | **redirect_uri** | **String** |  | [optional] |
 | **refresh_token** | **String** |  | [optional] |
+| **resource** | [**Array&lt;String&gt;**](String.md) | Resource is a repeated RFC 8707 resource indicator. When resource indicators are enabled, each value must be an absolute URI without a fragment. The access token audience is narrowed to the exact authorized resource values. Invalid or unauthorized values return invalid_target. The &#x60;@ory/client&#x60; TypeScript SDK sends only the last value of this array, so use another HTTP client to request several resources at the token endpoint. | [optional] |
 
 ### Return type
 

data/docs/OAuth2ConsentRequest.md

@@ -15,6 +15,7 @@
 | **oidc_context** | [**OAuth2ConsentRequestOpenIDConnectContext**](OAuth2ConsentRequestOpenIDConnectContext.md) |  | [optional] |
 | **request_url** | **String** | RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but might come in handy if you want to deal with additional request parameters. | [optional] |
 | **requested_access_token_audience** | **Array<String>** | RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client. | [optional] |
+| **requested_resources** | **Array<String>** | RequestedResources contains the RFC 8707 resource indicators requested by the OAuth 2.0 Client. Approve a resource by including its exact URI in grant_access_token_audience. | [optional] |
 | **requested_scope** | **Array<String>** | RequestedScope contains the OAuth 2.0 Scope requested by the OAuth 2.0 Client. | [optional] |
 | **skip** | **Boolean** | Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you must not ask the user to grant the requested scopes. You must however either allow or deny the consent request using the usual API call. | [optional] |
 | **subject** | **String** | Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client. | [optional] |
@@ -36,6 +37,7 @@ instance = OryClient::OAuth2ConsentRequest.new(
   oidc_context: null,
   request_url: null,
   requested_access_token_audience: null,
+  requested_resources: null,
   requested_scope: null,
   skip: null,
   subject: null

data/docs/OAuth2ConsentSession.md

@@ -7,7 +7,7 @@
 | **consent_request** | [**OAuth2ConsentRequest**](OAuth2ConsentRequest.md) |  | [optional] |
 | **consent_request_id** | **String** | ConsentRequestID is the identifier of the consent request that initiated this consent session. | [optional] |
 | **context** | **Object** |  | [optional] |
-| **grant_access_token_audience** | **Array<String>** | Audience Granted  GrantedAudience sets the audience the user authorized the client to use. Should be a subset of `requested_access_token_audience`. | [optional] |
+| **grant_access_token_audience** | **Array<String>** | Audience Granted  GrantedAudience contains the access token audiences approved by the user, including resource URIs. | [optional] |
 | **grant_scope** | **Array<String>** | Scope Granted  GrantScope sets the scope the user authorized the client to use. Should be a subset of `requested_scope`. | [optional] |
 | **handled_at** | **Time** |  | [optional] |
 | **remember** | **Boolean** | Remember Consent  Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same client asks the same user for the same, or a subset of, scope. | [optional] |

data/docs/OAuth2LoginRequest.md

@@ -9,6 +9,7 @@
 | **oidc_context** | [**OAuth2ConsentRequestOpenIDConnectContext**](OAuth2ConsentRequestOpenIDConnectContext.md) |  | [optional] |
 | **request_url** | **String** | RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but might come in handy if you want to deal with additional request parameters. |  |
 | **requested_access_token_audience** | **Array<String>** | RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client. | [optional] |
+| **requested_resources** | **Array<String>** | RequestedResources contains RFC 8707 resource indicators. | [optional] |
 | **requested_scope** | **Array<String>** | RequestedScope contains the OAuth 2.0 Scope requested by the OAuth 2.0 Client. | [optional] |
 | **session_id** | **String** | SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false) this will be a new random value. This value is used as the \"sid\" parameter in the ID Token and in OIDC Front-/Back- channel logout. It's value can generally be used to associate consecutive login requests by a certain user. | [optional] |
 | **skip** | **Boolean** | Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you can skip asking the user to grant the requested scopes, and simply forward the user to the redirect URL.  This feature allows you to update / set session information. |  |
@@ -25,6 +26,7 @@ instance = OryClient::OAuth2LoginRequest.new(
   oidc_context: null,
   request_url: null,
   requested_access_token_audience: null,
+  requested_resources: null,
   requested_scope: null,
   session_id: null,
   skip: null,

data/docs/OnboardingPortalOrganization.md

@@ -7,6 +7,7 @@
 | **apple_mapper_url** | **String** | AppleMapper specifies the JSONNet code snippet which uses Apple's profile information to hydrate the identity's data. | [optional] |
 | **auth0_mapper_url** | **String** | Auth0Mapper specifies the JSONNet code snippet which uses Auth0's profile information to hydrate the identity's data. | [optional] |
 | **base_url** | **String** |  |  |
+| **domains** | **Array<String>** | The organization's domains that sign-ins are routed by. When domain verification is enforced, only trusted domains are listed. |  |
 | **facebook_mapper_url** | **String** | FacebookMapper specifies the JSONNet code snippet which uses Facebook's profile information to hydrate the identity's data. | [optional] |
 | **generic_oidc_mapper_url** | **String** | GenericOIDCMapper specifies the JSONNet code snippet which uses the OIDC Provider's profile information to hydrate the identity's data. | [optional] |
 | **github_mapper_url** | **String** | GithubMapper specifies the JSONNet code snippet which uses GitHub's profile information to hydrate the identity's data. | [optional] |
@@ -41,6 +42,7 @@ instance = OryClient::OnboardingPortalOrganization.new(
   apple_mapper_url: null,
   auth0_mapper_url: null,
   base_url: null,
+  domains: null,
   facebook_mapper_url: null,
   generic_oidc_mapper_url: null,
   github_mapper_url: null,

data/docs/QuotaUsage.md

@@ -6,7 +6,7 @@
 | ---- | ---- | ----------- | ----- |
 | **additional_price** | **String** | The additional price per unit in cents. |  |
 | **can_use_more** | **Boolean** |  |  |
-| **feature** | **String** | production_projects ProductionProjects ai_assistant AIAssistant staging_projects StagingProjects development_projects DevelopmentProjects daily_active_users DailyActiveUsers custom_domains CustomDomains event_streams EventStreams event_stream_events EventStreamEvents sla SLA collaborator_seats CollaboratorSeats edge_cache EdgeCache branding_themes BrandingThemes zendesk_support ZendeskSupport zendesk_support_on_call ZendeskSupportOnCall project_metrics ProjectMetrics project_metrics_time_window ProjectMetricsTimeWindow project_metrics_events_history ProjectMetricsEventsHistory organizations Organizations rop_grant ResourceOwnerPasswordGrant concierge_onboarding ConciergeOnboarding credit Credit data_location_global DataLocationGlobal data_location_us DataLocationUS data_location_asiane DataLocationAsiaNorthEast m2m_token_issuance M2MTokenIssuance permission_checks PermissionChecks captcha Captcha captcha_byo CaptchaBYO hide_ory_branding HideOryBranding identity_search_api IdentitySearchAPI saml_sp SAMLSP saml_idp SAMLIDP native_saml_engine NativeSAMLEngine auto_link_policy AutoLinkPolicy scim_clients SCIMClients default_smtp_email_customization DefaultSMTPEmailCustomization onboarding_portal OnboardingPortal console_organization_sso ConsoleOrganizationSSO talos_api_keys TalosAPIKeys talos_rate_limit TalosRateLimit talos_cache TalosCache graceful_refresh_token_count GracefulRefreshTokenCount hydra_token_prefix HydraTokenPrefix hydra_device_authorization HydraDeviceAuthorization kratos_oidc_front_channel_logout KratosOIDCFrontChannelLogout deviceauthn Deviceauthn keto_allow_opl_permit_relation_collision KetoAllowOPLPermitRelationCollision exempts a subscription from rejecting OPL  that declares the same name as both a relation and a permit. keto_allow_opl_traverse_subject_set KetoAllowOPLTraverseSubjectSet exempts a subscription from rejecting OPL  that traverses a relation declared as a subject set. Override-only, for  legacy configurations; see the OPL reference for the supported shape. allow_insecure_origins AllowInsecureOrigins grandfathers a project past strict wildcard  enforcement (CORS origins + return URLs). Override-only; never sold. update_self_service_registration_rate_limit_tier RateLimitTierUpdateSelfServiceRegistration  Self-service rate limits update_self_service_recovery_rate_limit_tier RateLimitTierUpdateSelfServiceRecovery update_self_service_settings_rate_limit_tier RateLimitTierUpdateSelfServiceSettings update_self_service_verification_rate_limit_tier RateLimitTierUpdateSelfServiceVerification identities_create_rate_limit_tier RateLimitTierIdentitiesCreate identities_import_rate_limit_tier RateLimitTierIdentitiesImport fed_cm_parameters_rate_limit_tier RateLimitTierFedCMParameters data_location_regional DataLocationRegional  Required Features rate_limit_tier RateLimitTier session_rate_limit_tier RateLimitTierSessions identities_list_rate_limit_tier RateLimitTierIdentitiesList permission_checks_rate_limit_tier RateLimitTierPermissionChecks oauth2_introspect_rate_limit_tier RateLimitTierOAuth2Introspect create_recovery_admin_rate_limit_tier RateLimitTierCreateAdminRecovery scim_rate_limit_tier RateLimitTierSCIM hydra_admin_high_rate_limit_tier RateLimitTierHydraAdminHigh  Bucket-specific rate limit tiers hydra_admin_medium_rate_limit_tier RateLimitTierHydraAdminMedium hydra_admin_low_rate_limit_tier RateLimitTierHydraAdminLow hydra_public_high_rate_limit_tier RateLimitTierHydraPublicHigh hydra_public_medium_rate_limit_tier RateLimitTierHydraPublicMedium hydra_public_low_rate_limit_tier RateLimitTierHydraPublicLow keto_admin_low_rate_limit_tier RateLimitTierKetoAdminLow keto_admin_medium_rate_limit_tier RateLimitTierKetoAdminMedium keto_public_high_rate_limit_tier RateLimitTierKetoPublicHigh kratos_admin_high_rate_limit_tier RateLimitTierKratosAdminHigh kratos_admin_medium_rate_limit_tier RateLimitTierKratosAdminMedium kratos_admin_low_rate_limit_tier RateLimitTierKratosAdminLow kratos_public_high_rate_limit_tier RateLimitTierKratosPublicHigh kratos_public_medium_rate_limit_tier RateLimitTierKratosPublicMedium kratos_public_low_rate_limit_tier RateLimitTierKratosPublicLow polis_public_high_rate_limit_tier RateLimitTierPolisPublicHigh polis_public_medium_rate_limit_tier RateLimitTierPolisPublicMedium talos_admin_high_rate_limit_tier RateLimitTierTalosAdminHigh talos_admin_medium_rate_limit_tier RateLimitTierTalosAdminMedium talos_admin_low_rate_limit_tier RateLimitTierTalosAdminLow talos_public_high_rate_limit_tier RateLimitTierTalosPublicHigh talos_public_low_rate_limit_tier RateLimitTierTalosPublicLow unassigned_rate_limit_tier RateLimitTierUnassigned |  |
+| **feature** | **String** | production_projects ProductionProjects ai_assistant AIAssistant staging_projects StagingProjects development_projects DevelopmentProjects daily_active_users DailyActiveUsers custom_domains CustomDomains event_streams EventStreams event_stream_events EventStreamEvents sla SLA collaborator_seats CollaboratorSeats edge_cache EdgeCache branding_themes BrandingThemes zendesk_support ZendeskSupport zendesk_support_on_call ZendeskSupportOnCall project_metrics ProjectMetrics project_metrics_time_window ProjectMetricsTimeWindow project_metrics_events_history ProjectMetricsEventsHistory organizations Organizations rop_grant ResourceOwnerPasswordGrant concierge_onboarding ConciergeOnboarding credit Credit data_location_global DataLocationGlobal data_location_us DataLocationUS data_location_asiane DataLocationAsiaNorthEast m2m_token_issuance M2MTokenIssuance permission_checks PermissionChecks captcha Captcha captcha_byo CaptchaBYO hide_ory_branding HideOryBranding identity_search_api IdentitySearchAPI saml_sp SAMLSP saml_idp SAMLIDP native_saml_engine NativeSAMLEngine auto_link_policy AutoLinkPolicy scim_clients SCIMClients default_smtp_email_customization DefaultSMTPEmailCustomization onboarding_portal OnboardingPortal console_organization_sso ConsoleOrganizationSSO talos_api_keys TalosAPIKeys talos_rate_limit TalosRateLimit talos_cache TalosCache graceful_refresh_token_count GracefulRefreshTokenCount hydra_token_prefix HydraTokenPrefix hydra_device_authorization HydraDeviceAuthorization kratos_oidc_front_channel_logout KratosOIDCFrontChannelLogout kratos_brute_force_protection KratosBruteForceProtection deviceauthn Deviceauthn keto_allow_opl_permit_relation_collision KetoAllowOPLPermitRelationCollision exempts a subscription from rejecting OPL  that declares the same name as both a relation and a permit. keto_allow_opl_traverse_subject_set KetoAllowOPLTraverseSubjectSet exempts a subscription from rejecting OPL  that traverses a relation declared as a subject set. Override-only, for  legacy configurations; see the OPL reference for the supported shape. allow_insecure_origins AllowInsecureOrigins grandfathers a project past strict wildcard  enforcement (CORS origins + return URLs). Override-only; never sold. update_self_service_registration_rate_limit_tier RateLimitTierUpdateSelfServiceRegistration  Self-service rate limits update_self_service_recovery_rate_limit_tier RateLimitTierUpdateSelfServiceRecovery update_self_service_settings_rate_limit_tier RateLimitTierUpdateSelfServiceSettings update_self_service_verification_rate_limit_tier RateLimitTierUpdateSelfServiceVerification identities_create_rate_limit_tier RateLimitTierIdentitiesCreate identities_import_rate_limit_tier RateLimitTierIdentitiesImport fed_cm_parameters_rate_limit_tier RateLimitTierFedCMParameters data_location_regional DataLocationRegional  Required Features rate_limit_tier RateLimitTier session_rate_limit_tier RateLimitTierSessions identities_list_rate_limit_tier RateLimitTierIdentitiesList permission_checks_rate_limit_tier RateLimitTierPermissionChecks oauth2_introspect_rate_limit_tier RateLimitTierOAuth2Introspect create_recovery_admin_rate_limit_tier RateLimitTierCreateAdminRecovery scim_rate_limit_tier RateLimitTierSCIM hydra_admin_high_rate_limit_tier RateLimitTierHydraAdminHigh  Bucket-specific rate limit tiers hydra_admin_medium_rate_limit_tier RateLimitTierHydraAdminMedium hydra_admin_low_rate_limit_tier RateLimitTierHydraAdminLow hydra_public_high_rate_limit_tier RateLimitTierHydraPublicHigh hydra_public_medium_rate_limit_tier RateLimitTierHydraPublicMedium hydra_public_low_rate_limit_tier RateLimitTierHydraPublicLow keto_admin_low_rate_limit_tier RateLimitTierKetoAdminLow keto_admin_medium_rate_limit_tier RateLimitTierKetoAdminMedium keto_public_high_rate_limit_tier RateLimitTierKetoPublicHigh kratos_admin_high_rate_limit_tier RateLimitTierKratosAdminHigh kratos_admin_medium_rate_limit_tier RateLimitTierKratosAdminMedium kratos_admin_low_rate_limit_tier RateLimitTierKratosAdminLow kratos_public_high_rate_limit_tier RateLimitTierKratosPublicHigh kratos_public_medium_rate_limit_tier RateLimitTierKratosPublicMedium kratos_public_low_rate_limit_tier RateLimitTierKratosPublicLow polis_public_high_rate_limit_tier RateLimitTierPolisPublicHigh polis_public_medium_rate_limit_tier RateLimitTierPolisPublicMedium talos_admin_high_rate_limit_tier RateLimitTierTalosAdminHigh talos_admin_medium_rate_limit_tier RateLimitTierTalosAdminMedium talos_admin_low_rate_limit_tier RateLimitTierTalosAdminLow talos_public_high_rate_limit_tier RateLimitTierTalosPublicHigh talos_public_low_rate_limit_tier RateLimitTierTalosPublicLow unassigned_rate_limit_tier RateLimitTierUnassigned |  |
 | **feature_available** | **Boolean** |  |  |
 | **included** | **Integer** |  |  |
 | **is_unlimited** | **Boolean** |  |  |

data/docs/SelfRevokeApiKeyRequest.md

@@ -4,7 +4,7 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **credential** | **String** |  | [optional] |
+| **credential** | **String** | credential is the full API key secret or imported key (REQUIRED). At most 8,192 bytes of UTF-8. | [optional] |
 | **reason** | [**RevocationReason**](RevocationReason.md) |  | [optional][default to 'REVOCATION_REASON_UNSPECIFIED'] |
 
 ## Example

data/docs/SetEventStreamBody.md

@@ -4,7 +4,11 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **https_endpoint** | **String** | The HTTPS endpoint URL to send events to. When omitted, the current value is kept. | [optional] |
+| **event_types** | **Array<String>** | The events to deliver, as exact event names or patterns such as Session* or *Failed, in which * matches any characters, using the names listed in the event streams documentation. When omitted, the current list is kept. An empty list delivers every event. | [optional] |
+| **https_auth_header_name** | **String** | The header that carries the API key. When omitted, the current value is kept. | [optional] |
+| **https_auth_secret** | **String** | The API key or bearer token. When omitted, the current secret is kept as long as the scheme and the endpoint stay the same. The masked value from an API response is rejected. | [optional] |
+| **https_auth_type** | **String** | How deliveries to the HTTPS endpoint authenticate. When omitted, the current scheme and its secret are kept. `none` removes the header name and secret. Changing the scheme requires a new secret. | [optional] |
+| **https_endpoint** | **String** | The HTTPS endpoint URL to send events to. When omitted, the current value is kept. Changing it requires https_auth_secret in the same update when deliveries authenticate with an API key or bearer token. | [optional] |
 | **role_arn** | **String** | The AWS IAM role ARN to assume when publishing to the SNS topic. When omitted, the current value is kept. | [optional] |
 | **status** | **String** | The desired status of the event stream. When omitted, the current status is kept. | [optional] |
 | **topic_arn** | **String** | The AWS SNS topic ARN. When omitted, the current value is kept. | [optional] |
@@ -16,6 +20,10 @@
 require 'ory-client'
 
 instance = OryClient::SetEventStreamBody.new(
+  event_types: null,
+  https_auth_header_name: null,
+  https_auth_secret: null,
+  https_auth_type: null,
   https_endpoint: null,
   role_arn: null,
   status: null,

data/docs/Token.md

@@ -4,6 +4,7 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
+| **audiences** | **Array<String>** | audiences lists the recipients the token names (the \"aud\" claim). Empty when the token names none, in which case verification accepts it only for callers that state no audience expectation. | [optional] |
 | **claims** | **Object** | claims is the decoded token payload. For JWT, this contains the standard claims (iss, sub, aud, exp, iat, jti) plus custom claims. For macaroons, this lists the caveats. The shape is backend-dependent and should be treated as opaque diagnostic data. | [optional] |
 | **expire_time** | **Time** |  | [optional] |
 | **scopes** | **Array<String>** |  | [optional] |
@@ -15,6 +16,7 @@
 require 'ory-client'
 
 instance = OryClient::Token.new(
+  audiences: null,
   claims: null,
   expire_time: null,
   scopes: null,

data/docs/UpdateLoginFlowWithLookupSecretMethod.md

@@ -7,6 +7,7 @@
 | **csrf_token** | **String** | Sending the anti-csrf token is only required for browser login flows. | [optional] |
 | **lookup_secret** | **String** | The lookup secret. |  |
 | **method** | **String** | Method should be set to \"lookup_secret\" when logging in using the lookup_secret strategy. |  |
+| **transient_payload** | **Object** | Transient data to pass along to any webhooks | [optional] |
 
 ## Example
 
@@ -16,7 +17,8 @@ require 'ory-client'
 instance = OryClient::UpdateLoginFlowWithLookupSecretMethod.new(
   csrf_token: null,
   lookup_secret: null,
-  method: null
+  method: null,
+  transient_payload: null
 )
 ```