zyphr 0.1.53 → 0.1.55

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c48e48e0a4e1c2a2ea9d58e507adcee64e9cbac7a31c336da15d0ca3b0df3d51
-  data.tar.gz: c8accc89829202be56cdcae385e1ffd1df20da4bd89bbb2c46d70944eebe9ad8
+  metadata.gz: 78bb305af68d19bf367f4a1dfd0947fe5a83e2b339f3477abb2d123608ccf627
+  data.tar.gz: 3ca4b809dfae512150cf30224c490a55499f51c91071af4f4fdbb324e11657e1
 SHA512:
-  metadata.gz: f3281a542c1412e8722f4a45a9363b956b8aa78133d77d0bd8dc56a9a40e827e88f8f05f8b80d75436786eb50e0772714dcc20c7fa0db00ff61bd86d2162eda3
-  data.tar.gz: bb9cd301b7568d3b9ff54f04555f1f1006c8a29a847c0c2f79986e45ac1368aa4d74daae347df7c3ba73f51fed00ac27e83f6d889faf29c2fbb8fe5125878b0a
+  metadata.gz: 497270029ef52c3c6a9b183c22a623b86292d4da19ecb85325173ebaa54f5b655795ca0c119011269e0048bbd7784ceedb7cd711740133ee37db1feec0451f8e
+  data.tar.gz: 7941e5eaaabb87dda7c572ac928b451484d7756a269fc48795decec7f8888a92f518a9c10222adb559b5da05ff91c23cc5866772c69de44b3341576919fd55bb

data/README.md

@@ -102,31 +102,15 @@ Please follow the [installation](#installation) procedure and then run the follo
 # Load the gem
 require 'zyphr'
 
-# Setup authorization
-Zyphr.configure do |config|
-  # Configure API key authorization: ApplicationSecret
-  config.api_key['X-Application-Secret'] = 'YOUR API KEY'
-  # Uncomment the following line to set a prefix for the API key, e.g. 'Bearer' (defaults to nil)
-  # config.api_key_prefix['X-Application-Secret'] = 'Bearer'
-  # Configure faraday connection
-  config.configure_faraday_connection { |connection| 'YOUR CONNECTION CONFIG PROC' }
-
-  # Configure API key authorization: ApplicationPublicKey
-  config.api_key['X-Application-Key'] = 'YOUR API KEY'
-  # Uncomment the following line to set a prefix for the API key, e.g. 'Bearer' (defaults to nil)
-  # config.api_key_prefix['X-Application-Key'] = 'Bearer'
-  # Configure faraday connection
-  config.configure_faraday_connection { |connection| 'YOUR CONNECTION CONFIG PROC' }
-end
-
 api_instance = Zyphr::AuthApplicationApi.new
+id = '38400000-8cf0-11bd-b23e-10b96e4ef00d' # String | Application ID
+user_id = '38400000-8cf0-11bd-b23e-10b96e4ef00d' # String | End user ID
 
 begin
-  #Get the authenticating application
-  result = api_instance.get_self_application
-  p result
+  #Export all data held about an end user
+  api_instance.export_end_user_data(id, user_id)
 rescue Zyphr::ApiError => e
-  puts "Exception when calling AuthApplicationApi->get_self_application: #{e}"
+  puts "Exception when calling AuthApplicationApi->export_end_user_data: #{e}"
 end
 
 ```
@@ -137,6 +121,7 @@ All URIs are relative to *https://api.zyphr.dev/v1*
 
 Class | Method | HTTP request | Description
 ------------ | ------------- | ------------- | -------------
+*Zyphr::AuthApplicationApi* | [**export_end_user_data**](docs/AuthApplicationApi.md#export_end_user_data) | **GET** /v1/applications/{id}/users/{userId}/export | Export all data held about an end user
 *Zyphr::AuthApplicationApi* | [**get_self_application**](docs/AuthApplicationApi.md#get_self_application) | **GET** /auth/application | Get the authenticating application
 *Zyphr::AuthApplicationApi* | [**set_self_application_test_recipients**](docs/AuthApplicationApi.md#set_self_application_test_recipients) | **PATCH** /auth/application | Set the authenticating application's auth-email test allowlist
 *Zyphr::AuthEmailOTPApi* | [**check_email_otp_availability**](docs/AuthEmailOTPApi.md#check_email_otp_availability) | **GET** /auth/email-otp/available | Check email OTP availability
@@ -283,6 +268,7 @@ Class | Method | HTTP request | Description
 *Zyphr::SMSApi* | [**delete_sms_config**](docs/SMSApi.md#delete_sms_config) | **DELETE** /sms/config | Delete SMS configuration
 *Zyphr::SMSApi* | [**get_sms**](docs/SMSApi.md#get_sms) | **GET** /sms/{id} | Get SMS message details
 *Zyphr::SMSApi* | [**get_sms_config**](docs/SMSApi.md#get_sms_config) | **GET** /sms/config | Get SMS configuration
+*Zyphr::SMSApi* | [**get_sms_inbound_webhook**](docs/SMSApi.md#get_sms_inbound_webhook) | **GET** /sms/inbound-webhook | Get the inbound SMS webhook URL
 *Zyphr::SMSApi* | [**list_sms**](docs/SMSApi.md#list_sms) | **GET** /sms | List SMS messages
 *Zyphr::SMSApi* | [**send_batch_sms**](docs/SMSApi.md#send_batch_sms) | **POST** /sms/batch | Send batch SMS messages
 *Zyphr::SMSApi* | [**send_sms**](docs/SMSApi.md#send_sms) | **POST** /sms | Send an SMS message
@@ -369,7 +355,6 @@ Class | Method | HTTP request | Description
 *Zyphr::WebhooksApi* | [**get_webhook_ips**](docs/WebhooksApi.md#get_webhook_ips) | **GET** /v1/webhooks/ips | Get static webhook IPs
 *Zyphr::WebhooksApi* | [**get_webhook_job**](docs/WebhooksApi.md#get_webhook_job) | **GET** /v1/webhooks/jobs/{jobId} | Get replay/retry job status
 *Zyphr::WebhooksApi* | [**get_webhook_metrics**](docs/WebhooksApi.md#get_webhook_metrics) | **GET** /v1/webhooks/{id}/metrics | Get webhook health metrics
-*Zyphr::WebhooksApi* | [**get_webhook_regions**](docs/WebhooksApi.md#get_webhook_regions) | **GET** /v1/webhooks/regions | Get available webhook regions
 *Zyphr::WebhooksApi* | [**get_webhook_usage**](docs/WebhooksApi.md#get_webhook_usage) | **GET** /v1/webhooks/usage | Get webhook usage metrics
 *Zyphr::WebhooksApi* | [**list_webhook_deliveries**](docs/WebhooksApi.md#list_webhook_deliveries) | **GET** /v1/webhooks/{id}/deliveries | List webhook deliveries
 *Zyphr::WebhooksApi* | [**list_webhook_event_types**](docs/WebhooksApi.md#list_webhook_event_types) | **GET** /v1/webhooks/events | List webhook event types
@@ -674,6 +659,7 @@ Class | Method | HTTP request | Description
  - [Zyphr::ReorderWorkflowStepsRequest](docs/ReorderWorkflowStepsRequest.md)
  - [Zyphr::ReplayWebhookEventsRequest](docs/ReplayWebhookEventsRequest.md)
  - [Zyphr::RequestMeta](docs/RequestMeta.md)
+ - [Zyphr::ResendEmailVerificationRequest](docs/ResendEmailVerificationRequest.md)
  - [Zyphr::ResetPasswordRequest](docs/ResetPasswordRequest.md)
  - [Zyphr::ResetPasswordResponse](docs/ResetPasswordResponse.md)
  - [Zyphr::ResubscribeRequest](docs/ResubscribeRequest.md)
@@ -878,9 +864,6 @@ Class | Method | HTTP request | Description
  - [Zyphr::WebhookJobResponse](docs/WebhookJobResponse.md)
  - [Zyphr::WebhookListResponse](docs/WebhookListResponse.md)
  - [Zyphr::WebhookMetricsResponse](docs/WebhookMetricsResponse.md)
- - [Zyphr::WebhookRegion](docs/WebhookRegion.md)
- - [Zyphr::WebhookRegionsResponse](docs/WebhookRegionsResponse.md)
- - [Zyphr::WebhookRegionsResponseData](docs/WebhookRegionsResponseData.md)
  - [Zyphr::WebhookReplayResponse](docs/WebhookReplayResponse.md)
  - [Zyphr::WebhookResponse](docs/WebhookResponse.md)
  - [Zyphr::WebhookSecretRotateResponse](docs/WebhookSecretRotateResponse.md)

data/docs/AuthApplicationApi.md

@@ -4,10 +4,76 @@ All URIs are relative to *https://api.zyphr.dev/v1*
 
 | Method | HTTP request | Description |
 | ------ | ------------ | ----------- |
+| [**export_end_user_data**](AuthApplicationApi.md#export_end_user_data) | **GET** /v1/applications/{id}/users/{userId}/export | Export all data held about an end user |
 | [**get_self_application**](AuthApplicationApi.md#get_self_application) | **GET** /auth/application | Get the authenticating application |
 | [**set_self_application_test_recipients**](AuthApplicationApi.md#set_self_application_test_recipients) | **PATCH** /auth/application | Set the authenticating application's auth-email test allowlist |
 
 
+## export_end_user_data
+
+> export_end_user_data(id, user_id)
+
+Export all data held about an end user
+
+Returns a machine-readable JSON bundle of everything stored about one end user, for answering a GDPR Art. 15 (access) or Art. 20 (portability) request.  Zyphr is a **processor**: we do not answer data subjects directly. This endpoint gives you, the controller, the data needed to respond to your own end user.  **Credentials are deliberately excluded** and are listed in `export_metadata.excluded`: password hashes, session refresh-token hashes, MFA secrets, OAuth access/refresh tokens and WebAuthn public keys. These are authentication artifacts rather than personal data about the subject, and including them would turn this endpoint into a credential-exfiltration path.  Message history is capped at the 1,000 most recent messages; `export_metadata.message_history_truncated` reports whether the cap was hit. 
+
+### Examples
+
+```ruby
+require 'time'
+require 'zyphr'
+
+api_instance = Zyphr::AuthApplicationApi.new
+id = '38400000-8cf0-11bd-b23e-10b96e4ef00d' # String | Application ID
+user_id = '38400000-8cf0-11bd-b23e-10b96e4ef00d' # String | End user ID
+
+begin
+  # Export all data held about an end user
+  api_instance.export_end_user_data(id, user_id)
+rescue Zyphr::ApiError => e
+  puts "Error when calling AuthApplicationApi->export_end_user_data: #{e}"
+end
+```
+
+#### Using the export_end_user_data_with_http_info variant
+
+This returns an Array which contains the response data (`nil` in this case), status code and headers.
+
+> <Array(nil, Integer, Hash)> export_end_user_data_with_http_info(id, user_id)
+
+```ruby
+begin
+  # Export all data held about an end user
+  data, status_code, headers = api_instance.export_end_user_data_with_http_info(id, user_id)
+  p status_code # => 2xx
+  p headers # => { ... }
+  p data # => nil
+rescue Zyphr::ApiError => e
+  puts "Error when calling AuthApplicationApi->export_end_user_data_with_http_info: #{e}"
+end
+```
+
+### Parameters
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **id** | **String** | Application ID |  |
+| **user_id** | **String** | End user ID |  |
+
+### Return type
+
+nil (empty response body)
+
+### Authorization
+
+No authorization required
+
+### HTTP request headers
+
+- **Content-Type**: Not defined
+- **Accept**: Not defined
+
+
 ## get_self_application
 
 > <ApplicationSelfResponse> get_self_application

data/docs/AuthEmailVerificationApi.md

@@ -15,7 +15,7 @@ All URIs are relative to *https://api.zyphr.dev/v1*
 
 Confirm email verification
 
-Verify the user's email using the token from the verification email.
+Verify the user's email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user's verified state back and report that — correct whether or not the link already consumed the token.
 
 ### Examples
 
@@ -116,7 +116,7 @@ end
 
 api_instance = Zyphr::AuthEmailVerificationApi.new
 opts = {
-  send_email_verification_request: Zyphr::SendEmailVerificationRequest.new # SendEmailVerificationRequest | 
+  resend_email_verification_request: Zyphr::ResendEmailVerificationRequest.new # ResendEmailVerificationRequest | 
 }
 
 begin
@@ -150,7 +150,7 @@ end
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **send_email_verification_request** | [**SendEmailVerificationRequest**](SendEmailVerificationRequest.md) |  | [optional] |
+| **resend_email_verification_request** | [**ResendEmailVerificationRequest**](ResendEmailVerificationRequest.md) |  | [optional] |
 
 ### Return type
 
@@ -172,7 +172,7 @@ end
 
 Send email verification
 
-Send an email verification link to the authenticated user.
+Send an email verification link to the authenticated user. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user's `Authorization: Bearer` token. If the recipient is blocked by the application's `auth_email_mode=allowlist` gate, the request is still **accepted with 200** (mirroring `POST /auth/forgot-password`): no email is sent, and the suppression is recorded as a `messages` row (`status=suppressed`, `status_reason=recipient_not_allowlisted`) and an `email.suppressed` webhook. It is NOT a 500.
 
 ### Examples
 

data/docs/ConfirmEmailVerificationResponseData.md

@@ -6,6 +6,7 @@
 | ---- | ---- | ----------- | ----- |
 | **success** | **Boolean** |  | [optional] |
 | **email** | **String** |  | [optional] |
+| **already_verified** | **Boolean** | True when the address was already verified (the emailed link consumed the token on click). Still a 200 — an idempotent success, not an error (sc-7721). | [optional] |
 
 ## Example
 
@@ -14,7 +15,8 @@ require 'zyphr'
 
 instance = Zyphr::ConfirmEmailVerificationResponseData.new(
   success: null,
-  email: null
+  email: null,
+  already_verified: null
 )
 ```
 

data/docs/EmailsApi.md

@@ -381,7 +381,7 @@ end
 
 Send an email
 
-Queue an email for delivery. The email is processed asynchronously and you'll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`. 
+Queue an email for delivery. The email is processed asynchronously and you'll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`.  **CAN-SPAM compliance — actions required from you:**  - **Set `classification`** to `transactional` or `marketing`. Unclassified is   treated as marketing, the stricter reading. Transactional mail (password   resets, receipts) is exempt from the opt-out and postal-address requirements. - **Set your postal address** in project settings. Commercial email must carry a   valid physical postal address — the most commonly missed CAN-SPAM element.   Marketing sends without one are flagged. - **Include an unsubscribe mechanism** on commercial email. Zyphr enforces   suppression automatically once someone opts out, but the link itself is yours   to include.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
 
 ### Examples
 

data/docs/ResendEmailVerificationRequest.md

@@ -0,0 +1,18 @@
+# Zyphr::ResendEmailVerificationRequest
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **redirect_url** | **String** | URL to redirect to after verification | [optional] |
+
+## Example
+
+```ruby
+require 'zyphr'
+
+instance = Zyphr::ResendEmailVerificationRequest.new(
+  redirect_url: null
+)
+```
+

data/docs/SMSApi.md

@@ -7,6 +7,7 @@ All URIs are relative to *https://api.zyphr.dev/v1*
 | [**delete_sms_config**](SMSApi.md#delete_sms_config) | **DELETE** /sms/config | Delete SMS configuration |
 | [**get_sms**](SMSApi.md#get_sms) | **GET** /sms/{id} | Get SMS message details |
 | [**get_sms_config**](SMSApi.md#get_sms_config) | **GET** /sms/config | Get SMS configuration |
+| [**get_sms_inbound_webhook**](SMSApi.md#get_sms_inbound_webhook) | **GET** /sms/inbound-webhook | Get the inbound SMS webhook URL |
 | [**list_sms**](SMSApi.md#list_sms) | **GET** /sms | List SMS messages |
 | [**send_batch_sms**](SMSApi.md#send_batch_sms) | **POST** /sms/batch | Send batch SMS messages |
 | [**send_sms**](SMSApi.md#send_sms) | **POST** /sms | Send an SMS message |
@@ -222,6 +223,73 @@ This endpoint does not need any parameter.
 - **Accept**: application/json
 
 
+## get_sms_inbound_webhook
+
+> get_sms_inbound_webhook
+
+Get the inbound SMS webhook URL
+
+Returns the URL to configure in your SMS provider so STOP/opt-out replies reach Zyphr. The token is generated on first request and is stable thereafter.  **This is required for TCPA compliance.** Until your provider is pointed at this URL, opt-out replies stop at the provider and never reach us — from Zyphr's side the recipient never opted out, and sends continue.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
+
+### Examples
+
+```ruby
+require 'time'
+require 'zyphr'
+# setup authorization
+Zyphr.configure do |config|
+  # Configure API key authorization: ApiKeyAuth
+  config.api_key['X-API-Key'] = 'YOUR API KEY'
+  # Uncomment the following line to set a prefix for the API key, e.g. 'Bearer' (defaults to nil)
+  # config.api_key_prefix['X-API-Key'] = 'Bearer'
+end
+
+api_instance = Zyphr::SMSApi.new
+
+begin
+  # Get the inbound SMS webhook URL
+  api_instance.get_sms_inbound_webhook
+rescue Zyphr::ApiError => e
+  puts "Error when calling SMSApi->get_sms_inbound_webhook: #{e}"
+end
+```
+
+#### Using the get_sms_inbound_webhook_with_http_info variant
+
+This returns an Array which contains the response data (`nil` in this case), status code and headers.
+
+> <Array(nil, Integer, Hash)> get_sms_inbound_webhook_with_http_info
+
+```ruby
+begin
+  # Get the inbound SMS webhook URL
+  data, status_code, headers = api_instance.get_sms_inbound_webhook_with_http_info
+  p status_code # => 2xx
+  p headers # => { ... }
+  p data # => nil
+rescue Zyphr::ApiError => e
+  puts "Error when calling SMSApi->get_sms_inbound_webhook_with_http_info: #{e}"
+end
+```
+
+### Parameters
+
+This endpoint does not need any parameter.
+
+### Return type
+
+nil (empty response body)
+
+### Authorization
+
+[ApiKeyAuth](../README.md#ApiKeyAuth)
+
+### HTTP request headers
+
+- **Content-Type**: Not defined
+- **Accept**: Not defined
+
+
 ## list_sms
 
 > <SmsListResponse> list_sms(opts)
@@ -378,7 +446,7 @@ end
 
 Send an SMS message
 
-Send a single SMS text message. Supports subscriber preference checks and scheduling.
+Send a single SMS text message. Supports subscriber preference checks and scheduling.  **TCPA compliance — actions required from you:**  - **Configure the inbound webhook.** Zyphr only processes STOP/opt-out replies   if your SMS provider is pointed at our inbound endpoint. Until you do this,   opt-outs never reach us and we will keep delivering. See   [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). - **Pass `recipient_timezone`** (IANA, e.g. `America/New_York`) so quiet hours   (8am-9pm recipient-local) can be enforced. Without it we send and record that   quiet hours could not be evaluated. We deliberately do not infer a timezone   from the area code — people keep numbers when they move. - **Record consent** for marketing sends. Marketing requires prior express   *written* consent; `express` consent covers transactional only. With no record   on file we deliver and flag it, which is a gap in your evidence, not permission. - **Set `classification`.** Unclassified messages are treated as marketing, the   stricter reading. 
 
 ### Examples
 

data/docs/SendEmailVerificationRequest.md

@@ -4,7 +4,7 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **redirect_url** | **String** | URL to redirect to after verification | [optional] |
+| **redirect_url** | **String** | URL to redirect to after verification (snake_case `redirect_url` — a camelCase `redirectUrl` is ignored and the hosted verification page is used instead). Must match one of the application's configured redirect URIs. | [optional] |
 
 ## Example
 

data/docs/WebhookDelivery.md

@@ -18,7 +18,6 @@
 | **first_attempted_at** | **Time** |  | [optional] |
 | **last_attempted_at** | **Time** |  | [optional] |
 | **completed_at** | **Time** |  | [optional] |
-| **delivery_region** | **String** |  | [optional] |
 | **created_at** | **Time** |  | [optional] |
 
 ## Example
@@ -41,7 +40,6 @@ instance = Zyphr::WebhookDelivery.new(
   first_attempted_at: null,
   last_attempted_at: null,
   completed_at: null,
-  delivery_region: null,
   created_at: null
 )
 ```

data/docs/WebhookDeliveryDetail.md

@@ -18,7 +18,6 @@
 | **first_attempted_at** | **Time** |  | [optional] |
 | **last_attempted_at** | **Time** |  | [optional] |
 | **completed_at** | **Time** |  | [optional] |
-| **delivery_region** | **String** |  | [optional] |
 | **created_at** | **Time** |  | [optional] |
 | **payload** | **Object** |  | [optional] |
 | **last_response_body** | **String** |  | [optional] |
@@ -45,7 +44,6 @@ instance = Zyphr::WebhookDeliveryDetail.new(
   first_attempted_at: null,
   last_attempted_at: null,
   completed_at: null,
-  delivery_region: null,
   created_at: null,
   payload: null,
   last_response_body: null,

data/docs/WebhooksApi.md

@@ -15,7 +15,6 @@ All URIs are relative to *https://api.zyphr.dev/v1*
 | [**get_webhook_ips**](WebhooksApi.md#get_webhook_ips) | **GET** /v1/webhooks/ips | Get static webhook IPs |
 | [**get_webhook_job**](WebhooksApi.md#get_webhook_job) | **GET** /v1/webhooks/jobs/{jobId} | Get replay/retry job status |
 | [**get_webhook_metrics**](WebhooksApi.md#get_webhook_metrics) | **GET** /v1/webhooks/{id}/metrics | Get webhook health metrics |
-| [**get_webhook_regions**](WebhooksApi.md#get_webhook_regions) | **GET** /v1/webhooks/regions | Get available webhook regions |
 | [**get_webhook_usage**](WebhooksApi.md#get_webhook_usage) | **GET** /v1/webhooks/usage | Get webhook usage metrics |
 | [**list_webhook_deliveries**](WebhooksApi.md#list_webhook_deliveries) | **GET** /v1/webhooks/{id}/deliveries | List webhook deliveries |
 | [**list_webhook_event_types**](WebhooksApi.md#list_webhook_event_types) | **GET** /v1/webhooks/events | List webhook event types |
@@ -810,74 +809,6 @@ end
 - **Accept**: application/json
 
 
-## get_webhook_regions
-
-> <WebhookRegionsResponse> get_webhook_regions
-
-Get available webhook regions
-
-Get available webhook delivery regions. Requires multi_region plan feature (Enterprise only).
-
-### Examples
-
-```ruby
-require 'time'
-require 'zyphr'
-# setup authorization
-Zyphr.configure do |config|
-  # Configure API key authorization: ApiKeyAuth
-  config.api_key['X-API-Key'] = 'YOUR API KEY'
-  # Uncomment the following line to set a prefix for the API key, e.g. 'Bearer' (defaults to nil)
-  # config.api_key_prefix['X-API-Key'] = 'Bearer'
-end
-
-api_instance = Zyphr::WebhooksApi.new
-
-begin
-  # Get available webhook regions
-  result = api_instance.get_webhook_regions
-  p result
-rescue Zyphr::ApiError => e
-  puts "Error when calling WebhooksApi->get_webhook_regions: #{e}"
-end
-```
-
-#### Using the get_webhook_regions_with_http_info variant
-
-This returns an Array which contains the response data, status code and headers.
-
-> <Array(<WebhookRegionsResponse>, Integer, Hash)> get_webhook_regions_with_http_info
-
-```ruby
-begin
-  # Get available webhook regions
-  data, status_code, headers = api_instance.get_webhook_regions_with_http_info
-  p status_code # => 2xx
-  p headers # => { ... }
-  p data # => <WebhookRegionsResponse>
-rescue Zyphr::ApiError => e
-  puts "Error when calling WebhooksApi->get_webhook_regions_with_http_info: #{e}"
-end
-```
-
-### Parameters
-
-This endpoint does not need any parameter.
-
-### Return type
-
-[**WebhookRegionsResponse**](WebhookRegionsResponse.md)
-
-### Authorization
-
-[ApiKeyAuth](../README.md#ApiKeyAuth)
-
-### HTTP request headers
-
-- **Content-Type**: Not defined
-- **Accept**: application/json
-
-
 ## get_webhook_usage
 
 > <WebhookUsageResponse> get_webhook_usage

data/lib/zyphr/api/auth_application_api.rb

@@ -19,6 +19,73 @@ module Zyphr
     def initialize(api_client = ApiClient.default)
       @api_client = api_client
     end
+    # Export all data held about an end user
+    # Returns a machine-readable JSON bundle of everything stored about one end user, for answering a GDPR Art. 15 (access) or Art. 20 (portability) request.  Zyphr is a **processor**: we do not answer data subjects directly. This endpoint gives you, the controller, the data needed to respond to your own end user.  **Credentials are deliberately excluded** and are listed in `export_metadata.excluded`: password hashes, session refresh-token hashes, MFA secrets, OAuth access/refresh tokens and WebAuthn public keys. These are authentication artifacts rather than personal data about the subject, and including them would turn this endpoint into a credential-exfiltration path.  Message history is capped at the 1,000 most recent messages; `export_metadata.message_history_truncated` reports whether the cap was hit. 
+    # @param id [String] Application ID
+    # @param user_id [String] End user ID
+    # @param [Hash] opts the optional parameters
+    # @return [nil]
+    def export_end_user_data(id, user_id, opts = {})
+      export_end_user_data_with_http_info(id, user_id, opts)
+      nil
+    end
+
+    # Export all data held about an end user
+    # Returns a machine-readable JSON bundle of everything stored about one end user, for answering a GDPR Art. 15 (access) or Art. 20 (portability) request.  Zyphr is a **processor**: we do not answer data subjects directly. This endpoint gives you, the controller, the data needed to respond to your own end user.  **Credentials are deliberately excluded** and are listed in `export_metadata.excluded`: password hashes, session refresh-token hashes, MFA secrets, OAuth access/refresh tokens and WebAuthn public keys. These are authentication artifacts rather than personal data about the subject, and including them would turn this endpoint into a credential-exfiltration path.  Message history is capped at the 1,000 most recent messages; `export_metadata.message_history_truncated` reports whether the cap was hit. 
+    # @param id [String] Application ID
+    # @param user_id [String] End user ID
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(nil, Integer, Hash)>] nil, response status code and response headers
+    def export_end_user_data_with_http_info(id, user_id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: AuthApplicationApi.export_end_user_data ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling AuthApplicationApi.export_end_user_data"
+      end
+      # verify the required parameter 'user_id' is set
+      if @api_client.config.client_side_validation && user_id.nil?
+        fail ArgumentError, "Missing the required parameter 'user_id' when calling AuthApplicationApi.export_end_user_data"
+      end
+      # resource path
+      local_var_path = '/v1/applications/{id}/users/{userId}/export'.sub('{' + 'id' + '}', CGI.escape(id.to_s)).sub('{' + 'userId' + '}', CGI.escape(user_id.to_s))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type]
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || []
+
+      new_options = opts.merge(
+        :operation => :"AuthApplicationApi.export_end_user_data",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: AuthApplicationApi#export_end_user_data\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Get the authenticating application
     # Return non-sensitive metadata about the application whose credentials authenticated this request. Lets an integrator read their own application_id (the sole tenant discriminator embedded in every end-user token) directly from the API, rather than only from the dashboard UI or by decoding a token. Returns only id, name, the calling environment's mode, and the JWT signing algorithm — never secrets, signing keys, or account-internal fields. 
     # @param [Hash] opts the optional parameters

data/lib/zyphr/api/auth_email_verification_api.rb

@@ -20,7 +20,7 @@ module Zyphr
       @api_client = api_client
     end
     # Confirm email verification
-    # Verify the user's email using the token from the verification email.
+    # Verify the user's email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user's verified state back and report that — correct whether or not the link already consumed the token.
     # @param confirm_email_verification_request [ConfirmEmailVerificationRequest] 
     # @param [Hash] opts the optional parameters
     # @return [ConfirmEmailVerificationResponse]
@@ -30,7 +30,7 @@ module Zyphr
     end
 
     # Confirm email verification
-    # Verify the user's email using the token from the verification email.
+    # Verify the user's email using a token you collected yourself. IMPORTANT: the emailed verification LINK verifies the address server-side **on click** and then redirects to `redirect_url`. So if you take the token off that redirect and post it here, it is already redeemed — and this endpoint treats that as an idempotent **success** (`200` with `already_verified: true`), not an error. Only a genuinely invalid / expired / unknown token returns `400`. `send` / `confirm` / `resend` are NOT a mandatory matched set — `confirm` is for flows where you collect the token directly rather than landing the hosted redirect. Recommended pattern for the redirect landing: call `confirm`, ignore its result, then read the user's verified state back and report that — correct whether or not the link already consumed the token.
     # @param confirm_email_verification_request [ConfirmEmailVerificationRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(ConfirmEmailVerificationResponse, Integer, Hash)>] ConfirmEmailVerificationResponse data, response status code and response headers
@@ -90,7 +90,7 @@ module Zyphr
     # Resend email verification
     # Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
     # @param [Hash] opts the optional parameters
-    # @option opts [SendEmailVerificationRequest] :send_email_verification_request 
+    # @option opts [ResendEmailVerificationRequest] :resend_email_verification_request 
     # @return [SuccessResult]
     def resend_email_verification(opts = {})
       data, _status_code, _headers = resend_email_verification_with_http_info(opts)
@@ -100,7 +100,7 @@ module Zyphr
     # Resend email verification
     # Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
     # @param [Hash] opts the optional parameters
-    # @option opts [SendEmailVerificationRequest] :send_email_verification_request 
+    # @option opts [ResendEmailVerificationRequest] :resend_email_verification_request 
     # @return [Array<(SuccessResult, Integer, Hash)>] SuccessResult data, response status code and response headers
     def resend_email_verification_with_http_info(opts = {})
       if @api_client.config.debugging
@@ -126,7 +126,7 @@ module Zyphr
       form_params = opts[:form_params] || {}
 
       # http body (model)
-      post_body = opts[:debug_body] || @api_client.object_to_http_body(opts[:'send_email_verification_request'])
+      post_body = opts[:debug_body] || @api_client.object_to_http_body(opts[:'resend_email_verification_request'])
 
       # return_type
       return_type = opts[:debug_return_type] || 'SuccessResult'
@@ -152,7 +152,7 @@ module Zyphr
     end
 
     # Send email verification
-    # Send an email verification link to the authenticated user.
+    # Send an email verification link to the authenticated user. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user's `Authorization: Bearer` token. If the recipient is blocked by the application's `auth_email_mode=allowlist` gate, the request is still **accepted with 200** (mirroring `POST /auth/forgot-password`): no email is sent, and the suppression is recorded as a `messages` row (`status=suppressed`, `status_reason=recipient_not_allowlisted`) and an `email.suppressed` webhook. It is NOT a 500.
     # @param [Hash] opts the optional parameters
     # @option opts [SendEmailVerificationRequest] :send_email_verification_request 
     # @return [SuccessResult]
@@ -162,7 +162,7 @@ module Zyphr
     end
 
     # Send email verification
-    # Send an email verification link to the authenticated user.
+    # Send an email verification link to the authenticated user. Requires all three credentials simultaneously: the application key (&#x60;X-Application-Key&#x60;), the application secret (&#x60;X-Application-Secret&#x60;), and the end user&#39;s &#x60;Authorization: Bearer&#x60; token. If the recipient is blocked by the application&#39;s &#x60;auth_email_mode&#x3D;allowlist&#x60; gate, the request is still **accepted with 200** (mirroring &#x60;POST /auth/forgot-password&#x60;): no email is sent, and the suppression is recorded as a &#x60;messages&#x60; row (&#x60;status&#x3D;suppressed&#x60;, &#x60;status_reason&#x3D;recipient_not_allowlisted&#x60;) and an &#x60;email.suppressed&#x60; webhook. It is NOT a 500.
     # @param [Hash] opts the optional parameters
     # @option opts [SendEmailVerificationRequest] :send_email_verification_request 
     # @return [Array<(SuccessResult, Integer, Hash)>] SuccessResult data, response status code and response headers

data/lib/zyphr/api/emails_api.rb

@@ -362,7 +362,7 @@ module Zyphr
     end
 
     # Send an email
-    # Queue an email for delivery. The email is processed asynchronously and you'll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`. 
+    # Queue an email for delivery. The email is processed asynchronously and you'll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`.  **CAN-SPAM compliance — actions required from you:**  - **Set `classification`** to `transactional` or `marketing`. Unclassified is   treated as marketing, the stricter reading. Transactional mail (password   resets, receipts) is exempt from the opt-out and postal-address requirements. - **Set your postal address** in project settings. Commercial email must carry a   valid physical postal address — the most commonly missed CAN-SPAM element.   Marketing sends without one are flagged. - **Include an unsubscribe mechanism** on commercial email. Zyphr enforces   suppression automatically once someone opts out, but the link itself is yours   to include.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
     # @param send_email_request [SendEmailRequest] 
     # @param [Hash] opts the optional parameters
     # @return [SendEmailResponse]
@@ -372,7 +372,7 @@ module Zyphr
     end
 
     # Send an email
-    # Queue an email for delivery. The email is processed asynchronously and you'll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`. 
+    # Queue an email for delivery. The email is processed asynchronously and you'll receive a message ID to track its status.  You can provide content directly via `html`/`text` fields, or use a template by specifying `template_id` and `template_data`.  **CAN-SPAM compliance — actions required from you:**  - **Set `classification`** to `transactional` or `marketing`. Unclassified is   treated as marketing, the stricter reading. Transactional mail (password   resets, receipts) is exempt from the opt-out and postal-address requirements. - **Set your postal address** in project settings. Commercial email must carry a   valid physical postal address — the most commonly missed CAN-SPAM element.   Marketing sends without one are flagged. - **Include an unsubscribe mechanism** on commercial email. Zyphr enforces   suppression automatically once someone opts out, but the link itself is yours   to include.  See [Compliance Requirements](https://zyphr.dev/guides/compliance-requirements). 
     # @param send_email_request [SendEmailRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(SendEmailResponse, Integer, Hash)>] SendEmailResponse data, response status code and response headers