zyphr 0.1.67 → 0.1.69

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fdc21ac68755d4d99a8bbb674bd1c8800983400238aadb050a1e01879c4268df
-  data.tar.gz: ff4ce43f126392339b452107bf3bdda1843df6f4140b45b8b74af7d6055b145a
+  metadata.gz: c5c83bb9035502544f5fee965c60cfb70abb16feab1cb9de561ef8a656546a4f
+  data.tar.gz: 9312fa1c709851fe5fb90f6dc9dc847b383eda89017f0012f6ec21703aa7463a
 SHA512:
-  metadata.gz: f9925dd6534471523e92d43430e300979fa3f7983328f6bf6c03bbf518de284ec323db3152fd518e6420f7f50c125f0524d81bdecd24cb0d30cecdd86c63e509
-  data.tar.gz: 14bc44775a7b816c94a537f2fba2db2367b4bf5169d23c9113dbd428d30e3f17f0526fdff886e65cfcfb0a8d6e64d084526fea3bc0eec6dba4c3b15384f8e3ce
+  metadata.gz: 6fa72f833f9bf74434640604c86e638d2989f1b4ac93dfc1fd71a732f0db9c5021b1d26f86c4cf4434177e0a57b0b08bdc4978e1b470e8a5acab9829b9f5391d
+  data.tar.gz: 8cc0d6d4d9185e81caf7df21c25d2ffa90c24fec85c4d084bbf8441562fd0b7ff2c2c5b4f639b1585ca14971fae7b16131707612d6748b327645a374aca02f74

data/README.md

@@ -505,6 +505,8 @@ Class | Method | HTTP request | Description
  - [Zyphr::ExecutionRetryResponse](docs/ExecutionRetryResponse.md)
  - [Zyphr::ExecutionRetryResponseData](docs/ExecutionRetryResponseData.md)
  - [Zyphr::ForgotPasswordRequest](docs/ForgotPasswordRequest.md)
+ - [Zyphr::ForgotPasswordResult](docs/ForgotPasswordResult.md)
+ - [Zyphr::ForgotPasswordResultData](docs/ForgotPasswordResultData.md)
  - [Zyphr::GenerateSubscriberToken200Response](docs/GenerateSubscriberToken200Response.md)
  - [Zyphr::GenerateSubscriberToken200ResponseData](docs/GenerateSubscriberToken200ResponseData.md)
  - [Zyphr::GenerateSubscriberTokenRequest](docs/GenerateSubscriberTokenRequest.md)
@@ -558,6 +560,8 @@ Class | Method | HTTP request | Description
  - [Zyphr::ListWorkflows200ResponseMeta](docs/ListWorkflows200ResponseMeta.md)
  - [Zyphr::LoginRequest](docs/LoginRequest.md)
  - [Zyphr::MagicLinkSendRequest](docs/MagicLinkSendRequest.md)
+ - [Zyphr::MagicLinkSendResult](docs/MagicLinkSendResult.md)
+ - [Zyphr::MagicLinkSendResultData](docs/MagicLinkSendResultData.md)
  - [Zyphr::MagicLinkVerifyRequest](docs/MagicLinkVerifyRequest.md)
  - [Zyphr::MagicLinkVerifyResponse](docs/MagicLinkVerifyResponse.md)
  - [Zyphr::MagicLinkVerifyResponseData](docs/MagicLinkVerifyResponseData.md)
@@ -666,6 +670,7 @@ Class | Method | HTTP request | Description
  - [Zyphr::ResetPasswordResponse](docs/ResetPasswordResponse.md)
  - [Zyphr::ResubscribeRequest](docs/ResubscribeRequest.md)
  - [Zyphr::ResubscribeResponse](docs/ResubscribeResponse.md)
+ - [Zyphr::ReturnedAuthLink](docs/ReturnedAuthLink.md)
  - [Zyphr::RevokeAllSessionsResponse](docs/RevokeAllSessionsResponse.md)
  - [Zyphr::RevokeAllSessionsResponseData](docs/RevokeAllSessionsResponseData.md)
  - [Zyphr::RevokeSessionRequest](docs/RevokeSessionRequest.md)

data/docs/AuthEmailVerificationApi.md

@@ -91,7 +91,7 @@ end
 
 Resend email verification
 
-Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
+Resend the verification email to the authenticated user. Rate limited to once per 60 seconds. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user's `Authorization: Bearer` token. Failures behave as on `POST /auth/verify-email/send`, including the 200 accepted-and-suppressed response for a recipient outside the application allowlist.
 
 ### Examples
 

data/docs/AuthMagicLinksApi.md

@@ -10,11 +10,11 @@ All URIs are relative to *https://api.zyphr.dev/v1*
 
 ## send_magic_link
 
-> <SuccessResult> send_magic_link(magic_link_send_request)
+> <MagicLinkSendResult> send_magic_link(magic_link_send_request)
 
 Send a magic link
 
-Send a magic link email for passwordless authentication.
+Send a magic link email for passwordless authentication.  **Sending the email yourself:** pass `return_link: true` (with `redirect_url`) and Zyphr mints the link but sends nothing, returning it in `data.link`. Requires your application secret, so call it server-side only. 
 
 ### Examples
 
@@ -50,7 +50,7 @@ end
 
 This returns an Array which contains the response data, status code and headers.
 
-> <Array(<SuccessResult>, Integer, Hash)> send_magic_link_with_http_info(magic_link_send_request)
+> <Array(<MagicLinkSendResult>, Integer, Hash)> send_magic_link_with_http_info(magic_link_send_request)
 
 ```ruby
 begin
@@ -58,7 +58,7 @@ begin
   data, status_code, headers = api_instance.send_magic_link_with_http_info(magic_link_send_request)
   p status_code # => 2xx
   p headers # => { ... }
-  p data # => <SuccessResult>
+  p data # => <MagicLinkSendResult>
 rescue Zyphr::ApiError => e
   puts "Error when calling AuthMagicLinksApi->send_magic_link_with_http_info: #{e}"
 end
@@ -72,7 +72,7 @@ end
 
 ### Return type
 
-[**SuccessResult**](SuccessResult.md)
+[**MagicLinkSendResult**](MagicLinkSendResult.md)
 
 ### Authorization
 

data/docs/AuthPasswordResetApi.md

@@ -11,11 +11,11 @@ All URIs are relative to *https://api.zyphr.dev/v1*
 
 ## forgot_password
 
-> <SuccessResult> forgot_password(forgot_password_request)
+> <ForgotPasswordResult> forgot_password(forgot_password_request)
 
 Request a password reset
 
-Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
+Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.  **Sending the email yourself:** pass `return_link: true` (with `redirect_url`) and Zyphr mints the token but sends nothing, returning the link in `data.link`. When no link is minted, `data.link` is null and `data.link_suppressed_reason` says why. Unlike the default response, this reveals whether the address is registered — acceptable only because the endpoint requires your application secret, so it must only be called server-side. 
 
 ### Examples
 
@@ -51,7 +51,7 @@ end
 
 This returns an Array which contains the response data, status code and headers.
 
-> <Array(<SuccessResult>, Integer, Hash)> forgot_password_with_http_info(forgot_password_request)
+> <Array(<ForgotPasswordResult>, Integer, Hash)> forgot_password_with_http_info(forgot_password_request)
 
 ```ruby
 begin
@@ -59,7 +59,7 @@ begin
   data, status_code, headers = api_instance.forgot_password_with_http_info(forgot_password_request)
   p status_code # => 2xx
   p headers # => { ... }
-  p data # => <SuccessResult>
+  p data # => <ForgotPasswordResult>
 rescue Zyphr::ApiError => e
   puts "Error when calling AuthPasswordResetApi->forgot_password_with_http_info: #{e}"
 end
@@ -73,7 +73,7 @@ end
 
 ### Return type
 
-[**SuccessResult**](SuccessResult.md)
+[**ForgotPasswordResult**](ForgotPasswordResult.md)
 
 ### Authorization
 

data/docs/AuthUserDirectoryApi.md

@@ -400,7 +400,7 @@ end
 
 Pre-provision (invite) an end user (server-side admin)
 
-Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset's. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application's redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset's. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application's redirect_uris allowlist (custom schemes such as yourapp://path are permitted).  **Sending the email yourself:** pass `return_link: true` with a `send_link` and Zyphr mints that link but sends nothing, returning it in `data.link` (`link_sent` stays false). The same `link_suppressed_reason` values apply when no link can be minted. 
 
 ### Examples
 

data/docs/ForgotPasswordRequest.md

@@ -6,6 +6,7 @@
 | ---- | ---- | ----------- | ----- |
 | **email** | **String** |  |  |
 | **redirect_url** | **String** |  | [optional] |
+| **return_link** | **Boolean** | When true, Zyphr mints the token but sends no email, and returns the link in `data.link` so you can render and send the email yourself (for example through `POST /v1/emails`). Requires `redirect_url`.  | [optional][default to false] |
 
 ## Example
 
@@ -14,7 +15,8 @@ require 'zyphr'
 
 instance = Zyphr::ForgotPasswordRequest.new(
   email: null,
-  redirect_url: null
+  redirect_url: null,
+  return_link: null
 )
 ```
 

data/docs/ForgotPasswordResult.md

@@ -0,0 +1,20 @@
+# Zyphr::ForgotPasswordResult
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **data** | [**ForgotPasswordResultData**](ForgotPasswordResultData.md) |  | [optional] |
+| **meta** | [**GetDomain200ResponseMeta**](GetDomain200ResponseMeta.md) |  | [optional] |
+
+## Example
+
+```ruby
+require 'zyphr'
+
+instance = Zyphr::ForgotPasswordResult.new(
+  data: null,
+  meta: null
+)
+```
+

data/docs/ForgotPasswordResultData.md

@@ -0,0 +1,22 @@
+# Zyphr::ForgotPasswordResultData
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **success** | **Boolean** |  | [optional] |
+| **link** | [**ReturnedAuthLink**](ReturnedAuthLink.md) | Present only when `return_link` was true; null when no link was minted. | [optional] |
+| **link_suppressed_reason** | **String** | Present only when `return_link` was true and `link` is null. | [optional] |
+
+## Example
+
+```ruby
+require 'zyphr'
+
+instance = Zyphr::ForgotPasswordResultData.new(
+  success: null,
+  link: null,
+  link_suppressed_reason: null
+)
+```
+

data/docs/InviteEndUser200ResponseData.md

@@ -7,6 +7,7 @@
 | **user_id** | **String** |  | [optional] |
 | **created** | **Boolean** | True when a new user was provisioned; false when an existing user was reused (idempotent on email). | [optional] |
 | **link_sent** | **Boolean** | True when the requested invitation, magic-link or password-reset email was successfully dispatched. | [optional] |
+| **link** | [**ReturnedAuthLink**](ReturnedAuthLink.md) |  | [optional] |
 | **link_suppressed_reason** | **String** | Present only when `send_link` was requested and `link_sent` is false — explains why, so a caller can distinguish \"suppressed by design\" from \"delivery failed\".  Known values:  - `identity_has_other_auth_methods` — the identity has no password but does have a   linked OAuth provider and/or a passkey, so it is not locked out and no   set-password link is sent. The attempt is recorded as a suppressed message,   visible via `GET /emails`.   (For `send_link: \"invitation\"` the reason is returned here only; no   suppressed message is recorded.) - `user_has_password` — `send_link: \"invitation\"` only: the identity already has   a password, so there is nothing to accept. Use `password_reset` to send a reset. - `user_not_found_in_environment` — the identity could not be resolved in the   calling environment (a race; it was created or resolved immediately prior). - `recipient_not_allowlisted` — the application's `test_recipients` allowlist   blocked the recipient. - `send_failed` — dispatch was attempted and failed with no more specific code.  Not a closed set: a mail-provider error code may be surfaced verbatim, so treat an unrecognised value as a generic failure rather than an error.  | [optional] |
 
 ## Example
@@ -18,6 +19,7 @@ instance = Zyphr::InviteEndUser200ResponseData.new(
   user_id: null,
   created: null,
   link_sent: null,
+  link: null,
   link_suppressed_reason: identity_has_other_auth_methods
 )
 ```

data/docs/InviteEndUserRequest.md

@@ -9,6 +9,7 @@
 | **metadata** | **Object** |  | [optional] |
 | **send_link** | **String** |  | [optional][default to 'none'] |
 | **redirect_url** | **String** |  | [optional] |
+| **return_link** | **Boolean** | Return the link in `data.link` instead of emailing it. Requires `send_link` other than \"none\". | [optional][default to false] |
 
 ## Example
 
@@ -20,7 +21,8 @@ instance = Zyphr::InviteEndUserRequest.new(
   name: null,
   metadata: null,
   send_link: null,
-  redirect_url: null
+  redirect_url: null,
+  return_link: null
 )
 ```
 

data/docs/MagicLinkSendRequest.md

@@ -6,6 +6,7 @@
 | ---- | ---- | ----------- | ----- |
 | **email** | **String** |  |  |
 | **redirect_url** | **String** |  | [optional] |
+| **return_link** | **Boolean** | When true, Zyphr mints the token but sends no email, and returns the link in `data.link` so you can render and send the email yourself (for example through `POST /v1/emails`). Requires `redirect_url`.  | [optional][default to false] |
 
 ## Example
 
@@ -14,7 +15,8 @@ require 'zyphr'
 
 instance = Zyphr::MagicLinkSendRequest.new(
   email: null,
-  redirect_url: null
+  redirect_url: null,
+  return_link: null
 )
 ```
 

data/docs/MagicLinkSendResult.md

@@ -0,0 +1,20 @@
+# Zyphr::MagicLinkSendResult
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **data** | [**MagicLinkSendResultData**](MagicLinkSendResultData.md) |  | [optional] |
+| **meta** | [**GetDomain200ResponseMeta**](GetDomain200ResponseMeta.md) |  | [optional] |
+
+## Example
+
+```ruby
+require 'zyphr'
+
+instance = Zyphr::MagicLinkSendResult.new(
+  data: null,
+  meta: null
+)
+```
+

data/docs/MagicLinkSendResultData.md

@@ -0,0 +1,20 @@
+# Zyphr::MagicLinkSendResultData
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **success** | **Boolean** |  | [optional] |
+| **link** | [**ReturnedAuthLink**](ReturnedAuthLink.md) |  | [optional] |
+
+## Example
+
+```ruby
+require 'zyphr'
+
+instance = Zyphr::MagicLinkSendResultData.new(
+  success: null,
+  link: null
+)
+```
+

data/docs/ResendEmailVerificationRequest.md

@@ -4,7 +4,7 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **redirect_url** | **String** | URL to redirect to after verification | [optional] |
+| **redirect_url** | **String** | URL to redirect to after verification. Same rules as `POST /auth/verify-email/send`. | [optional] |
 
 ## Example
 

data/docs/ReturnedAuthLink.md

@@ -0,0 +1,22 @@
+# Zyphr::ReturnedAuthLink
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **url** | **String** | Your `redirect_url` with `?token=` appended — the same URL Zyphr's email would carry. |  |
+| **token** | **String** | The raw token, redeemed at the matching endpoint (`/auth/magic-link/verify` or `/auth/reset-password`). |  |
+| **expires_at** | **Time** |  |  |
+
+## Example
+
+```ruby
+require 'zyphr'
+
+instance = Zyphr::ReturnedAuthLink.new(
+  url: null,
+  token: null,
+  expires_at: null
+)
+```
+

data/docs/SendEmailVerificationRequest.md

@@ -4,7 +4,7 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **redirect_url** | **String** | URL to redirect to after verification (snake_case `redirect_url` — a camelCase `redirectUrl` is ignored and the hosted verification page is used instead). Must match one of the application's configured redirect URIs. | [optional] |
+| **redirect_url** | **String** | URL to redirect to after verification. Must be snake_case `redirect_url`: a camelCase `redirectUrl` is rejected with 400, since Zyphr hosts no fallback page. Must match one of the application's configured redirect URIs. | [optional] |
 
 ## Example
 

data/lib/zyphr/api/auth_email_verification_api.rb

@@ -88,7 +88,7 @@ module Zyphr
     end
 
     # Resend email verification
-    # Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
+    # Resend the verification email to the authenticated user. Rate limited to once per 60 seconds. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user's `Authorization: Bearer` token. Failures behave as on `POST /auth/verify-email/send`, including the 200 accepted-and-suppressed response for a recipient outside the application allowlist.
     # @param [Hash] opts the optional parameters
     # @option opts [ResendEmailVerificationRequest] :resend_email_verification_request 
     # @return [SuccessResult]
@@ -98,7 +98,7 @@ module Zyphr
     end
 
     # Resend email verification
-    # Resend the verification email to the authenticated user. Rate limited to once per 60 seconds.
+    # Resend the verification email to the authenticated user. Rate limited to once per 60 seconds. Requires all three credentials simultaneously: the application key (`X-Application-Key`), the application secret (`X-Application-Secret`), and the end user's `Authorization: Bearer` token. Failures behave as on `POST /auth/verify-email/send`, including the 200 accepted-and-suppressed response for a recipient outside the application allowlist.
     # @param [Hash] opts the optional parameters
     # @option opts [ResendEmailVerificationRequest] :resend_email_verification_request 
     # @return [Array<(SuccessResult, Integer, Hash)>] SuccessResult data, response status code and response headers

data/lib/zyphr/api/auth_magic_links_api.rb

@@ -20,20 +20,20 @@ module Zyphr
       @api_client = api_client
     end
     # Send a magic link
-    # Send a magic link email for passwordless authentication.
+    # Send a magic link email for passwordless authentication.  **Sending the email yourself:** pass `return_link: true` (with `redirect_url`) and Zyphr mints the link but sends nothing, returning it in `data.link`. Requires your application secret, so call it server-side only. 
     # @param magic_link_send_request [MagicLinkSendRequest] 
     # @param [Hash] opts the optional parameters
-    # @return [SuccessResult]
+    # @return [MagicLinkSendResult]
     def send_magic_link(magic_link_send_request, opts = {})
       data, _status_code, _headers = send_magic_link_with_http_info(magic_link_send_request, opts)
       data
     end
 
     # Send a magic link
-    # Send a magic link email for passwordless authentication.
+    # Send a magic link email for passwordless authentication.  **Sending the email yourself:** pass `return_link: true` (with `redirect_url`) and Zyphr mints the link but sends nothing, returning it in `data.link`. Requires your application secret, so call it server-side only. 
     # @param magic_link_send_request [MagicLinkSendRequest] 
     # @param [Hash] opts the optional parameters
-    # @return [Array<(SuccessResult, Integer, Hash)>] SuccessResult data, response status code and response headers
+    # @return [Array<(MagicLinkSendResult, Integer, Hash)>] MagicLinkSendResult data, response status code and response headers
     def send_magic_link_with_http_info(magic_link_send_request, opts = {})
       if @api_client.config.debugging
         @api_client.config.logger.debug 'Calling API: AuthMagicLinksApi.send_magic_link ...'
@@ -65,7 +65,7 @@ module Zyphr
       post_body = opts[:debug_body] || @api_client.object_to_http_body(magic_link_send_request)
 
       # return_type
-      return_type = opts[:debug_return_type] || 'SuccessResult'
+      return_type = opts[:debug_return_type] || 'MagicLinkSendResult'
 
       # auth_names
       auth_names = opts[:debug_auth_names] || ['ApplicationSecret', 'ApplicationPublicKey']

data/lib/zyphr/api/auth_password_reset_api.rb

@@ -20,20 +20,20 @@ module Zyphr
       @api_client = api_client
     end
     # Request a password reset
-    # Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
+    # Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.  **Sending the email yourself:** pass `return_link: true` (with `redirect_url`) and Zyphr mints the token but sends nothing, returning the link in `data.link`. When no link is minted, `data.link` is null and `data.link_suppressed_reason` says why. Unlike the default response, this reveals whether the address is registered — acceptable only because the endpoint requires your application secret, so it must only be called server-side. 
     # @param forgot_password_request [ForgotPasswordRequest] 
     # @param [Hash] opts the optional parameters
-    # @return [SuccessResult]
+    # @return [ForgotPasswordResult]
     def forgot_password(forgot_password_request, opts = {})
       data, _status_code, _headers = forgot_password_with_http_info(forgot_password_request, opts)
       data
     end
 
     # Request a password reset
-    # Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`. 
+    # Request a password reset email. Creates a reset token and sends an email to the user. Always returns success to prevent email enumeration — the response is identical whether or not the address is registered.  An identity with **no password set** still receives a link, which sets a first password. This covers users migrated from a provider that cannot export password hashes.  The one case where no email is sent (beyond an unknown address) is an identity that has no password but *does* have another way in — a linked OAuth provider and/or a passkey. Those users are not locked out, so no set-password link is sent; the attempt is recorded as a suppressed message visible via `GET /emails`.  **Sending the email yourself:** pass `return_link: true` (with `redirect_url`) and Zyphr mints the token but sends nothing, returning the link in `data.link`. When no link is minted, `data.link` is null and `data.link_suppressed_reason` says why. Unlike the default response, this reveals whether the address is registered — acceptable only because the endpoint requires your application secret, so it must only be called server-side. 
     # @param forgot_password_request [ForgotPasswordRequest] 
     # @param [Hash] opts the optional parameters
-    # @return [Array<(SuccessResult, Integer, Hash)>] SuccessResult data, response status code and response headers
+    # @return [Array<(ForgotPasswordResult, Integer, Hash)>] ForgotPasswordResult data, response status code and response headers
     def forgot_password_with_http_info(forgot_password_request, opts = {})
       if @api_client.config.debugging
         @api_client.config.logger.debug 'Calling API: AuthPasswordResetApi.forgot_password ...'
@@ -65,7 +65,7 @@ module Zyphr
       post_body = opts[:debug_body] || @api_client.object_to_http_body(forgot_password_request)
 
       # return_type
-      return_type = opts[:debug_return_type] || 'SuccessResult'
+      return_type = opts[:debug_return_type] || 'ForgotPasswordResult'
 
       # auth_names
       auth_names = opts[:debug_auth_names] || ['ApplicationSecret', 'ApplicationPublicKey']

data/lib/zyphr/api/auth_user_directory_api.rb

@@ -334,7 +334,7 @@ module Zyphr
     end
 
     # Pre-provision (invite) an end user (server-side admin)
-    # Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset's. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application's redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+    # Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset's. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application's redirect_uris allowlist (custom schemes such as yourapp://path are permitted).  **Sending the email yourself:** pass `return_link: true` with a `send_link` and Zyphr mints that link but sends nothing, returning it in `data.link` (`link_sent` stays false). The same `link_suppressed_reason` values apply when no link can be minted. 
     # @param invite_end_user_request [InviteEndUserRequest] 
     # @param [Hash] opts the optional parameters
     # @return [InviteEndUser200Response]
@@ -344,7 +344,7 @@ module Zyphr
     end
 
     # Pre-provision (invite) an end user (server-side admin)
-    # Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset's. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application's redirect_uris allowlist (custom schemes such as yourapp://path are permitted). 
+    # Secret-key-scoped pre-provisioning for an end user. Creates a passwordless user in the authenticating application (idempotent on email — an existing, non-deleted user is reused, not duplicated) and, when `send_link` is set, sends a first-login link so the user can set up their account without self-registration.  - `send_link: \"invitation\"` sends the `invitation` auth email: a   set-password link (valid 7 days) redeemed at   `POST /auth/reset-password`, so the invitee ends up with a password.   It has its own per-application template, separate from password   reset's. Not sent to an identity that can already sign in. - `send_link: \"password_reset\"` sends a set-password email using the   password-reset template. - `send_link: \"magic\"` sends a magic-link sign-in email. The user   still has no credential afterwards. - `send_link: \"none\"` (default) creates the user with no email.  A `redirect_url` is required whenever `send_link` is not \"none\"; it must match the application's redirect_uris allowlist (custom schemes such as yourapp://path are permitted).  **Sending the email yourself:** pass `return_link: true` with a `send_link` and Zyphr mints that link but sends nothing, returning it in `data.link` (`link_sent` stays false). The same `link_suppressed_reason` values apply when no link can be minted. 
     # @param invite_end_user_request [InviteEndUserRequest] 
     # @param [Hash] opts the optional parameters
     # @return [Array<(InviteEndUser200Response, Integer, Hash)>] InviteEndUser200Response data, response status code and response headers

data/lib/zyphr/models/forgot_password_request.rb

@@ -19,11 +19,15 @@ module Zyphr
 
     attr_accessor :redirect_url
 
+    # When true, Zyphr mints the token but sends no email, and returns the link in `data.link` so you can render and send the email yourself (for example through `POST /v1/emails`). Requires `redirect_url`. 
+    attr_accessor :return_link
+
     # Attribute mapping from ruby-style variable name to JSON key.
     def self.attribute_map
       {
         :'email' => :'email',
-        :'redirect_url' => :'redirect_url'
+        :'redirect_url' => :'redirect_url',
+        :'return_link' => :'return_link'
       }
     end
 
@@ -41,7 +45,8 @@ module Zyphr
     def self.openapi_types
       {
         :'email' => :'String',
-        :'redirect_url' => :'String'
+        :'redirect_url' => :'String',
+        :'return_link' => :'Boolean'
       }
     end
 
@@ -76,6 +81,12 @@ module Zyphr
       if attributes.key?(:'redirect_url')
         self.redirect_url = attributes[:'redirect_url']
       end
+
+      if attributes.key?(:'return_link')
+        self.return_link = attributes[:'return_link']
+      else
+        self.return_link = false
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -114,7 +125,8 @@ module Zyphr
       return true if self.equal?(o)
       self.class == o.class &&
           email == o.email &&
-          redirect_url == o.redirect_url
+          redirect_url == o.redirect_url &&
+          return_link == o.return_link
     end
 
     # @see the `==` method
@@ -126,7 +138,7 @@ module Zyphr
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [email, redirect_url].hash
+      [email, redirect_url, return_link].hash
     end
 
     # Builds the object from hash