@alicloud/agentcore20260804 2.5.0 → 3.0.0

package/src/models/UpdateIdentityProviderRequest.ts

@@ -5,7 +5,7 @@ import * as $dara from '@darabonba/typescript';
 export class UpdateIdentityProviderRequestBodyMetadata extends $dara.Model {
   /**
    * @remarks
-   * The App ID of the Lark application. This parameter is required when the binding type is Feishu.
+   * The App ID of the Lark application. If this parameter is omitted during an update, the existing value is retained. If explicitly submitted, it must be a non-empty value. The merged configuration for Lark must include this field.
    * 
    * @example
    * cli_exampleappid01
@@ -13,7 +13,7 @@ export class UpdateIdentityProviderRequestBodyMetadata extends $dara.Model {
   appId?: string;
   /**
    * @remarks
-   * The AppKey of the DingTalk application. This parameter is required when the binding type is DingTalk.
+   * The AppKey of the DingTalk application. If this parameter is omitted during an update, the existing value is retained. If explicitly submitted, it must be a non-empty value. The merged configuration for DingTalk must include this field.
    * 
    * @example
    * dingexampleappkey01
@@ -21,7 +21,7 @@ export class UpdateIdentityProviderRequestBodyMetadata extends $dara.Model {
   appKey?: string;
   /**
    * @remarks
-   * Required. The secret of the external identity provider application. This parameter is write-only and is not returned by query operations.
+   * The AppSecret of the DingTalk or Lark application. If this parameter is omitted during an update, the existing secret is retained and does not need to be retransmitted each time. If explicitly submitted, it must be a non-empty value, and the merged configuration must include this field. This is sensitive input and is not echoed in queries. The example is a fictitious value.
    * 
    * @example
    * example-app-secret
@@ -29,7 +29,7 @@ export class UpdateIdentityProviderRequestBodyMetadata extends $dara.Model {
   appSecret?: string;
   /**
    * @remarks
-   * The CorpId of the DingTalk organization. This parameter is required when the binding type is DingTalk.
+   * The CorpId of the organization to which the DingTalk application belongs. If this parameter is omitted during an update, the existing value is retained. If explicitly submitted, it must be a non-empty value and must match the organization to which the application belongs. The merged configuration for DingTalk must include this field.
    * 
    * @example
    * dingexamplecorpid01
@@ -37,7 +37,7 @@ export class UpdateIdentityProviderRequestBodyMetadata extends $dara.Model {
   corpId?: string;
   /**
    * @remarks
-   * The data encryption key for event subscriptions. The value must match the one configured in the external identity provider application. This parameter is write-only and is not returned by query operations.
+   * The encryption key for vendor event callbacks, which must be consistent with the vendor application configuration. If this parameter is omitted during an update, the existing value is retained. When incremental synchronization is enabled, the merged configuration must include this field. This is sensitive input and is not echoed in queries.
    * 
    * @example
    * example-encrypt-key
@@ -45,7 +45,7 @@ export class UpdateIdentityProviderRequestBodyMetadata extends $dara.Model {
   encryptKey?: string;
   /**
    * @remarks
-   * The verification token for event subscriptions. The value must match the one configured in the external identity provider application. This parameter is write-only and is not returned by query operations.
+   * The verification token for vendor event callbacks, which must be consistent with the vendor application configuration. If this parameter is omitted during an update, the existing value is retained. When incremental synchronization is enabled, the merged configuration must include this field. This is sensitive input and is not echoed in queries.
    * 
    * @example
    * example-verification-token
@@ -82,27 +82,167 @@ export class UpdateIdentityProviderRequestBodyMetadata extends $dara.Model {
   }
 }
 
+export class UpdateIdentityProviderRequestBodySaml extends $dara.Model {
+  /**
+   * @remarks
+   * The binding type for manual SAML configuration. HTTP-Redirect and HTTP-POST are supported. This parameter must be submitted together with entityId, loginUrl, and x509Certificates, and cannot be mixed with metadataXml.
+   * 
+   * @example
+   * HTTP-Redirect
+   */
+  bindingType?: string;
+  /**
+   * @remarks
+   * The entity ID of the enterprise IdP. This parameter is required for manual configuration. It must be non-empty and up to 2,048 characters, and cannot be changed after saving. It must be submitted together with loginUrl, bindingType, and x509Certificates, and cannot be mixed with metadataXml.
+   * 
+   * @example
+   * https://idp.example.com/entity
+   */
+  entityId?: string;
+  /**
+   * @remarks
+   * The SSO logon URL of the enterprise IdP. This parameter is required for manual configuration. It must be an absolute HTTPS URL without user credentials and fragments. It must be submitted together with entityId, bindingType, and x509Certificates, and cannot be mixed with metadataXml.
+   * 
+   * @example
+   * https://idp.example.com/sso
+   */
+  loginUrl?: string;
+  /**
+   * @remarks
+   * The original SAML metadata XML text of the enterprise IdP, not a URL or file path. The maximum size is 1 MiB. It must contain a single EntityDescriptor. DTDs and external entities are prohibited. It cannot be mixed with the four manual configuration fields. After saving, queries return the standardized configuration and do not echo the original XML text.
+   * 
+   * @example
+   * <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://idp.example.com/entity"><IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><KeyDescriptor use="signing"><KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"><X509Data><X509Certificate>MIICwDCCAaigAwIBAgIULlsHLfcADyBax5ZtFlj+YGzZVo0wDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUuY29tMB4XDTI2MDEwMTAwMDAwMFoXDTM2MDEwMTAwMDAwMFowGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAto0DN0W1CrPRzK9QZ9A1aApb4Lg8oGlp2c0PbN3LokXe/HzwxCMXx65IDnrenttxzTwp9BgUnUN/3LRzWaOL2UQ/vNYNW9LFLkI1T64UPyI7eyi28YlALhb41xkYhEp7rz+MjqifBzVZeTDUxBYtbK2hAhbYEL1+udwsXEx0KB7xuQ/rbI2OKeqAEAD1tfYg7T/SM2wrXNYhx+o1HtchM4/0I8Okkk27JQ4y3ofzC5sTySmFF1Y7XcpSd+5WSyazedhkAieo8AB01DkJV6nnKfH8sH0EBsnH3FP8FhqCLrIeEkjX9B9OcIRLGjiZqx4u/ryW1QhMldnv+pFfNjWy/wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQC1hSQG8AwtGOoX2gKBK4Hi5XBrBreij8WlLTUWld0FINQ0Rg84f/27CjDthywj6wgxCesCuOVFhpxQa1UacsP/Gcai1aKABtLWImcaWECRYK5gDkwhTMFKM9mXA26hH1l4v/UR2iTpEK9H78egC4W7bs2LDTpPryuaNKTqP2O0tMbNkAHB8yecz5LxHXnxadL9Egow25g2RClvpifWqDnuS9TSbKkIWLcPLjocJj2K9ILpBwhXiXi/BiSgyYTLiYvVvih9vX4s+hKGZNJc0j92YLiOHDF0XH1oxgdVjfTmRiedeb2VZJZElptD92z0AqFR7z2d5B+OqpPA2gjuMLV5</X509Certificate></X509Data></KeyInfo></KeyDescriptor><SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.example.com/sso"/></IDPSSODescriptor></EntityDescriptor>
+   */
+  metadataXml?: string;
+  /**
+   * @remarks
+   * The list of X.509 signing certificates for the enterprise IdP. For manual configuration, a non-empty list must be provided, with a maximum of 10 certificates. The certificates must be valid. This parameter must be submitted together with entityId, loginUrl, and bindingType, and cannot be mixed with metadataXml.
+   * 
+   * @example
+   * ["-----BEGIN CERTIFICATE-----\\\\nMIICwDCCAaigAwIBAgIULlsHLfcADyBax5ZtFlj+YGzZVo0wDQYJKoZIhvcNAQEL\\\\nBQAwGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUuY29tMB4XDTI2MDEwMTAwMDAwMFoX\\\\nDTM2MDEwMTAwMDAwMFowGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUuY29tMIIBIjAN\\\\nBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAto0DN0W1CrPRzK9QZ9A1aApb4Lg8\\\\noGlp2c0PbN3LokXe/HzwxCMXx65IDnrenttxzTwp9BgUnUN/3LRzWaOL2UQ/vNYN\\\\nW9LFLkI1T64UPyI7eyi28YlALhb41xkYhEp7rz+MjqifBzVZeTDUxBYtbK2hAhbY\\\\nEL1+udwsXEx0KB7xuQ/rbI2OKeqAEAD1tfYg7T/SM2wrXNYhx+o1HtchM4/0I8Ok\\\\nkk27JQ4y3ofzC5sTySmFF1Y7XcpSd+5WSyazedhkAieo8AB01DkJV6nnKfH8sH0E\\\\nBsnH3FP8FhqCLrIeEkjX9B9OcIRLGjiZqx4u/ryW1QhMldnv+pFfNjWy/wIDAQAB\\\\nMA0GCSqGSIb3DQEBCwUAA4IBAQC1hSQG8AwtGOoX2gKBK4Hi5XBrBreij8WlLTUW\\\\nld0FINQ0Rg84f/27CjDthywj6wgxCesCuOVFhpxQa1UacsP/Gcai1aKABtLWImca\\\\nWECRYK5gDkwhTMFKM9mXA26hH1l4v/UR2iTpEK9H78egC4W7bs2LDTpPryuaNKTq\\\\nP2O0tMbNkAHB8yecz5LxHXnxadL9Egow25g2RClvpifWqDnuS9TSbKkIWLcPLjoc\\\\nJj2K9ILpBwhXiXi/BiSgyYTLiYvVvih9vX4s+hKGZNJc0j92YLiOHDF0XH1oxgdV\\\\njfTmRiedeb2VZJZElptD92z0AqFR7z2d5B+OqpPA2gjuMLV5\\\\n-----END CERTIFICATE-----"]
+   */
+  x509Certificates?: string[];
+  static names(): { [key: string]: string } {
+    return {
+      bindingType: 'bindingType',
+      entityId: 'entityId',
+      loginUrl: 'loginUrl',
+      metadataXml: 'metadataXml',
+      x509Certificates: 'x509Certificates',
+    };
+  }
+
+  static types(): { [key: string]: any } {
+    return {
+      bindingType: 'string',
+      entityId: 'string',
+      loginUrl: 'string',
+      metadataXml: 'string',
+      x509Certificates: { 'type': 'array', 'itemType': 'string' },
+    };
+  }
+
+  validate() {
+    if(Array.isArray(this.x509Certificates)) {
+      $dara.Model.validateArray(this.x509Certificates);
+    }
+    super.validate();
+  }
+
+  constructor(map?: { [key: string]: any }) {
+    super(map);
+  }
+}
+
+export class UpdateIdentityProviderRequestBodySyncScope extends $dara.Model {
+  /**
+   * @remarks
+   * The list of department IDs in the synchronization scope, obtained from ListIdentityProviderDepartments. In SelectedDepartments mode, at least one non-empty department ID must be provided. In AllAuthorized mode, this parameter should be omitted or an empty array should be passed.
+   * 
+   * @example
+   * ["10001"]
+   */
+  departmentIds?: string[];
+  /**
+   * @remarks
+   * The synchronization scope mode. AllAuthorized: all members within the authorization scope of the application address book. SelectedDepartments: the selected departments and all their sub-departments. A valid mode must be provided when syncScope is explicitly submitted.
+   * 
+   * @example
+   * SelectedDepartments
+   */
+  mode?: string;
+  static names(): { [key: string]: string } {
+    return {
+      departmentIds: 'departmentIds',
+      mode: 'mode',
+    };
+  }
+
+  static types(): { [key: string]: any } {
+    return {
+      departmentIds: { 'type': 'array', 'itemType': 'string' },
+      mode: 'string',
+    };
+  }
+
+  validate() {
+    if(Array.isArray(this.departmentIds)) {
+      $dara.Model.validateArray(this.departmentIds);
+    }
+    super.validate();
+  }
+
+  constructor(map?: { [key: string]: any }) {
+    super(map);
+  }
+}
+
 export class UpdateIdentityProviderRequestBody extends $dara.Model {
   /**
    * @remarks
-   * Specifies whether workspace users are allowed to log on through this external identity provider.
+   * Specifies whether to allow logon by using this identity provider. If this parameter is omitted or set to null during an update, the original value is retained. For CustomSSO, a valid SAML configuration must exist before logon is enabled. Disabling logon does not delete the saved SAML or SCIM configurations.
    */
   loginEnabled?: boolean;
   /**
    * @remarks
-   * The new application configuration of the external identity provider. If not specified, the existing configuration remains unchanged.
+   * Applies only to DingTalk and Lark. The application configuration is merged by field. Omitted fields and existing keys retain their original values. Explicitly submitted fields must not be null, empty strings, or blank strings. The merged configuration must meet the complete configuration requirements of the vendor. CustomSSO does not accept this field.
+   * 
+   * @example
+   * {"appSecret":"example-app-secret"}
    */
   metadata?: UpdateIdentityProviderRequestBodyMetadata;
   /**
    * @remarks
-   * Specifies whether to enable organization member synchronization. When enabled, the external identity provider synchronizes organization members as workspace users.
+   * The logon protocol, which applies only to CustomSSO. Currently, only SAML is supported. DingTalk and Lark do not accept this field. If submitted with a non-empty saml configuration, this field can be omitted and the server processes it as SAML.
+   * 
+   * @example
+   * SAML
+   */
+  protocol?: string;
+  /**
+   * @remarks
+   * Applies only to CustomSSO. You can either provide metadataXml or provide the four complete manual configuration fields. The two methods cannot be mixed. If a valid configuration already exists, you can also modify only the JIT switches. Saving the configuration does not automatically enable logon.
+   */
+  saml?: UpdateIdentityProviderRequestBodySaml;
+  /**
+   * @remarks
+   * Applies only to DingTalk and Lark. Controls the incremental synchronization of subsequent address book change events. If this parameter is omitted or set to null during an update, the original value is retained. It does not control the initial synchronization or manual synchronization. When enabled, the merged metadata must include encryptKey and verificationToken. For CustomSSO, use UpdateIdentityProviderSCIM to manage the synchronization switch.
    */
   syncEnabled?: boolean;
+  /**
+   * @remarks
+   * The address book synchronization scope, which applies only to DingTalk and Lark. If this parameter is omitted or set to null, the current scope is retained. Saving the scope does not automatically trigger a full synchronization. CustomSSO does not accept this field.
+   */
+  syncScope?: UpdateIdentityProviderRequestBodySyncScope;
   static names(): { [key: string]: string } {
     return {
       loginEnabled: 'loginEnabled',
       metadata: 'metadata',
+      protocol: 'protocol',
+      saml: 'saml',
       syncEnabled: 'syncEnabled',
+      syncScope: 'syncScope',
     };
   }
 
@@ -110,7 +250,10 @@ export class UpdateIdentityProviderRequestBody extends $dara.Model {
     return {
       loginEnabled: 'boolean',
       metadata: UpdateIdentityProviderRequestBodyMetadata,
+      protocol: 'string',
+      saml: UpdateIdentityProviderRequestBodySaml,
       syncEnabled: 'boolean',
+      syncScope: UpdateIdentityProviderRequestBodySyncScope,
     };
   }
 
@@ -118,6 +261,12 @@ export class UpdateIdentityProviderRequestBody extends $dara.Model {
     if(this.metadata && typeof (this.metadata as any).validate === 'function') {
       (this.metadata as any).validate();
     }
+    if(this.saml && typeof (this.saml as any).validate === 'function') {
+      (this.saml as any).validate();
+    }
+    if(this.syncScope && typeof (this.syncScope as any).validate === 'function') {
+      (this.syncScope as any).validate();
+    }
     super.validate();
   }
 
@@ -129,7 +278,7 @@ export class UpdateIdentityProviderRequestBody extends $dara.Model {
 export class UpdateIdentityProviderRequest extends $dara.Model {
   /**
    * @remarks
-   * The request body for updating the external identity provider.
+   * The configuration fields to be modified. For DingTalk and Lark, you must submit at least one of loginEnabled, syncEnabled, metadata, and syncScope. For CustomSSO, use protocol, saml, and loginEnabled. You cannot submit vendor metadata, syncEnabled, or syncScope.
    */
   body?: UpdateIdentityProviderRequestBody;
   static names(): { [key: string]: string } {

package/src/models/UpdateIdentityProviderResponseBody.ts

@@ -2,10 +2,181 @@
 import * as $dara from '@darabonba/typescript';
 
 
+export class UpdateIdentityProviderResponseBodyDataConfiguration extends $dara.Model {
+  /**
+   * @remarks
+   * The actual SAML binding type saved in the upstream, which is HTTP-Redirect or HTTP-POST.
+   * 
+   * @example
+   * HTTP-Redirect
+   */
+  bindingType?: string;
+  /**
+   * @remarks
+   * The actual enterprise IdP entity ID saved in the upstream.
+   * 
+   * @example
+   * https://idp.example.com/entity
+   */
+  entityId?: string;
+  /**
+   * @remarks
+   * The actual enterprise IdP SSO logon URL saved in the upstream.
+   * 
+   * @example
+   * https://idp.example.com/sso
+   */
+  loginUrl?: string;
+  /**
+   * @remarks
+   * The actual SSO logon status in the upstream. Enabled indicates that it is turned on, and Disabled indicates that it is turned off. This should be evaluated separately from the expected value of loginEnabled.
+   * 
+   * @example
+   * Enabled
+   */
+  ssoStatus?: string;
+  static names(): { [key: string]: string } {
+    return {
+      bindingType: 'bindingType',
+      entityId: 'entityId',
+      loginUrl: 'loginUrl',
+      ssoStatus: 'ssoStatus',
+    };
+  }
+
+  static types(): { [key: string]: any } {
+    return {
+      bindingType: 'string',
+      entityId: 'string',
+      loginUrl: 'string',
+      ssoStatus: 'string',
+    };
+  }
+
+  validate() {
+    super.validate();
+  }
+
+  constructor(map?: { [key: string]: any }) {
+    super(map);
+  }
+}
+
+export class UpdateIdentityProviderResponseBodyDataSaml extends $dara.Model {
+  /**
+   * @remarks
+   * The saved SAML binding type, which is HTTP-Redirect or HTTP-POST.
+   * 
+   * @example
+   * HTTP-Redirect
+   */
+  bindingType?: string;
+  /**
+   * @remarks
+   * The saved enterprise IdP entity ID, which is different from the entity ID of the service provider (SP).
+   * 
+   * @example
+   * https://idp.example.com/entity
+   */
+  entityId?: string;
+  /**
+   * @remarks
+   * The saved enterprise IdP SSO logon URL.
+   * 
+   * @example
+   * https://idp.example.com/sso
+   */
+  loginUrl?: string;
+  /**
+   * @remarks
+   * The list of saved enterprise IdP X.509 signing certificates.
+   * 
+   * @example
+   * ["-----BEGIN CERTIFICATE-----\\\\nMIICwDCCAaigAwIBAgIULlsHLfcADyBax5ZtFlj+YGzZVo0wDQYJKoZIhvcNAQEL\\\\nBQAwGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUuY29tMB4XDTI2MDEwMTAwMDAwMFoX\\\\nDTM2MDEwMTAwMDAwMFowGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUuY29tMIIBIjAN\\\\nBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAto0DN0W1CrPRzK9QZ9A1aApb4Lg8\\\\noGlp2c0PbN3LokXe/HzwxCMXx65IDnrenttxzTwp9BgUnUN/3LRzWaOL2UQ/vNYN\\\\nW9LFLkI1T64UPyI7eyi28YlALhb41xkYhEp7rz+MjqifBzVZeTDUxBYtbK2hAhbY\\\\nEL1+udwsXEx0KB7xuQ/rbI2OKeqAEAD1tfYg7T/SM2wrXNYhx+o1HtchM4/0I8Ok\\\\nkk27JQ4y3ofzC5sTySmFF1Y7XcpSd+5WSyazedhkAieo8AB01DkJV6nnKfH8sH0E\\\\nBsnH3FP8FhqCLrIeEkjX9B9OcIRLGjiZqx4u/ryW1QhMldnv+pFfNjWy/wIDAQAB\\\\nMA0GCSqGSIb3DQEBCwUAA4IBAQC1hSQG8AwtGOoX2gKBK4Hi5XBrBreij8WlLTUW\\\\nld0FINQ0Rg84f/27CjDthywj6wgxCesCuOVFhpxQa1UacsP/Gcai1aKABtLWImca\\\\nWECRYK5gDkwhTMFKM9mXA26hH1l4v/UR2iTpEK9H78egC4W7bs2LDTpPryuaNKTq\\\\nP2O0tMbNkAHB8yecz5LxHXnxadL9Egow25g2RClvpifWqDnuS9TSbKkIWLcPLjoc\\\\nJj2K9ILpBwhXiXi/BiSgyYTLiYvVvih9vX4s+hKGZNJc0j92YLiOHDF0XH1oxgdV\\\\njfTmRiedeb2VZJZElptD92z0AqFR7z2d5B+OqpPA2gjuMLV5\\\\n-----END CERTIFICATE-----"]
+   */
+  x509Certificates?: string[];
+  static names(): { [key: string]: string } {
+    return {
+      bindingType: 'bindingType',
+      entityId: 'entityId',
+      loginUrl: 'loginUrl',
+      x509Certificates: 'x509Certificates',
+    };
+  }
+
+  static types(): { [key: string]: any } {
+    return {
+      bindingType: 'string',
+      entityId: 'string',
+      loginUrl: 'string',
+      x509Certificates: { 'type': 'array', 'itemType': 'string' },
+    };
+  }
+
+  validate() {
+    if(Array.isArray(this.x509Certificates)) {
+      $dara.Model.validateArray(this.x509Certificates);
+    }
+    super.validate();
+  }
+
+  constructor(map?: { [key: string]: any }) {
+    super(map);
+  }
+}
+
+export class UpdateIdentityProviderResponseBodyDataSyncScope extends $dara.Model {
+  /**
+   * @remarks
+   * The list of department IDs in the synchronization scope, obtained from ListIdentityProviderDepartments. In SelectedDepartments mode, at least one non-empty department ID must be provided. In AllAuthorized mode, this parameter should be omitted or an empty array should be passed.
+   * 
+   * @example
+   * ["10001"]
+   */
+  departmentIds?: string[];
+  /**
+   * @remarks
+   * The synchronization scope mode. AllAuthorized: all members within the authorization scope of the application address book. SelectedDepartments: the selected departments and all their sub-departments. A valid mode must be provided when syncScope is explicitly submitted.
+   * 
+   * @example
+   * SelectedDepartments
+   */
+  mode?: string;
+  static names(): { [key: string]: string } {
+    return {
+      departmentIds: 'departmentIds',
+      mode: 'mode',
+    };
+  }
+
+  static types(): { [key: string]: any } {
+    return {
+      departmentIds: { 'type': 'array', 'itemType': 'string' },
+      mode: 'string',
+    };
+  }
+
+  validate() {
+    if(Array.isArray(this.departmentIds)) {
+      $dara.Model.validateArray(this.departmentIds);
+    }
+    super.validate();
+  }
+
+  constructor(map?: { [key: string]: any }) {
+    super(map);
+  }
+}
+
 export class UpdateIdentityProviderResponseBodyData extends $dara.Model {
   /**
    * @remarks
-   * The type of the external identity provider. Valid values: DingTalk, Feishu.
+   * The actual SAML configuration read back from the upstream. This update operation does not perform the read-back and usually does not return this field. Use GetIdentityProvider to obtain it.
+   */
+  configuration?: UpdateIdentityProviderResponseBodyDataConfiguration;
+  /**
+   * @remarks
+   * The type of the identity provider. DingTalk: DingTalk. Feishu: Lark. CustomSSO: custom enterprise identity provider connected through SAML. The value must be the same as the type of the identity provider bound to the current workspace.
    * 
    * @example
    * DingTalk
@@ -13,21 +184,35 @@ export class UpdateIdentityProviderResponseBodyData extends $dara.Model {
   identityProviderType?: string;
   /**
    * @remarks
-   * Specifies whether workspace users are allowed to log on through this external identity provider.
+   * The currently saved expected value of the logon switch, which alone does not prove that the upstream logon configuration has taken effect.
    */
   loginEnabled?: boolean;
   /**
    * @remarks
-   * The binding status. Valid values:
-   * - CONFIGURED: The configuration has been accepted and is waiting for user pool provisioning.
-   * - SYNCING: Organization members are being synchronized.
-   * - SYNCED: Organization member synchronization is complete.
-   * - READY: The binding is active.
-   * - SYNC_FAILED: Organization member synchronization failed.
+   * The currently saved logon protocol for CustomSSO, which is SAML when configured. This field is not returned for DingTalk or Lark.
+   * 
+   * @example
+   * SAML
+   */
+  protocol?: string;
+  /**
+   * @remarks
+   * The saved standardized SAML configuration for CustomSSO. The original metadata XML is not echoed. This field is not returned if no valid configuration is saved or if the identity provider is DingTalk or Lark. This value is the locally saved configuration and is not equivalent to the actual upstream configuration.
+   */
+  saml?: UpdateIdentityProviderResponseBodyDataSaml;
+  /**
+   * @remarks
+   * The status of the identity provider resource and logon configuration. Valid values:
+   * - CONFIGURED: The configuration is accepted.
    * - UPDATING: The configuration is being updated.
-   * - UPDATE_FAILED: The configuration update failed.
-   * - DISCONNECTING: The binding is being removed.
-   * - DISCONNECT_FAILED: The unbinding failed.
+   * - SYNCING: Synchronization is in progress.
+   * - SYNCED: The synchronization phase is completed.
+   * - READY: The resource is ready.
+   * - SYNC_FAILED: Synchronization failed.
+   * - UPDATE_FAILED: The update failed.
+   * - DISCONNECTING: Unbinding is in progress.
+   * - DISCONNECT_FAILED: Unbinding failed.
+   * READY alone does not indicate that users have been imported. Query the SCIM operation results for CustomSSO separately.
    * 
    * @example
    * READY
@@ -35,12 +220,17 @@ export class UpdateIdentityProviderResponseBodyData extends $dara.Model {
   status?: string;
   /**
    * @remarks
-   * Specifies whether to enable organization member synchronization. When enabled, the external identity provider synchronizes organization members as workspace users.
+   * The currently saved expected value of the synchronization switch. For DingTalk and Lark, it is used for subsequent address book change events. The SCIM switch for CustomSSO is managed through UpdateIdentityProviderSCIM, and the operation results are queried through GetIdentityProviderSCIM.
    */
   syncEnabled?: boolean;
   /**
    * @remarks
-   * The workspace ID.
+   * The saved synchronization scope for DingTalk and Lark. The default value for valid historical configurations is AllAuthorized, and this field may not be returned for corrupted historical configurations. This field is not returned for CustomSSO.
+   */
+  syncScope?: UpdateIdentityProviderResponseBodyDataSyncScope;
+  /**
+   * @remarks
+   * The ID of the workspace to which the identity provider belongs.
    * 
    * @example
    * ws-123456
@@ -48,25 +238,42 @@ export class UpdateIdentityProviderResponseBodyData extends $dara.Model {
   workspaceId?: string;
   static names(): { [key: string]: string } {
     return {
+      configuration: 'configuration',
       identityProviderType: 'identityProviderType',
       loginEnabled: 'loginEnabled',
+      protocol: 'protocol',
+      saml: 'saml',
       status: 'status',
       syncEnabled: 'syncEnabled',
+      syncScope: 'syncScope',
       workspaceId: 'workspaceId',
     };
   }
 
   static types(): { [key: string]: any } {
     return {
+      configuration: UpdateIdentityProviderResponseBodyDataConfiguration,
       identityProviderType: 'string',
       loginEnabled: 'boolean',
+      protocol: 'string',
+      saml: UpdateIdentityProviderResponseBodyDataSaml,
       status: 'string',
       syncEnabled: 'boolean',
+      syncScope: UpdateIdentityProviderResponseBodyDataSyncScope,
       workspaceId: 'string',
     };
   }
 
   validate() {
+    if(this.configuration && typeof (this.configuration as any).validate === 'function') {
+      (this.configuration as any).validate();
+    }
+    if(this.saml && typeof (this.saml as any).validate === 'function') {
+      (this.saml as any).validate();
+    }
+    if(this.syncScope && typeof (this.syncScope as any).validate === 'function') {
+      (this.syncScope as any).validate();
+    }
     super.validate();
   }
 
@@ -78,7 +285,7 @@ export class UpdateIdentityProviderResponseBodyData extends $dara.Model {
 export class UpdateIdentityProviderResponseBody extends $dara.Model {
   /**
    * @remarks
-   * The business status code.
+   * The business status code of the API request. SUCCESS indicates that the request is successful, but does not mean that the asynchronous configuration or synchronization task is completed.
    * 
    * @example
    * SUCCESS
@@ -86,12 +293,12 @@ export class UpdateIdentityProviderResponseBody extends $dara.Model {
   code?: string;
   /**
    * @remarks
-   * The binding information of the external identity provider after the update.
+   * The currently saved identity provider binding information, including the expected configuration and resource status. The actual update may still be executing in the background.
    */
   data?: UpdateIdentityProviderResponseBodyData;
   /**
    * @remarks
-   * The HTTP status code.
+   * The HTTP status code of the API request, which does not represent the execution result of the background task.
    * 
    * @example
    * 200
@@ -99,7 +306,7 @@ export class UpdateIdentityProviderResponseBody extends $dara.Model {
   httpStatusCode?: number;
   /**
    * @remarks
-   * The response message. An error description is returned if the request failed.
+   * The response message of the API request. An error description is returned if the request fails.
    * 
    * @example
    * success
@@ -107,7 +314,7 @@ export class UpdateIdentityProviderResponseBody extends $dara.Model {
   message?: string;
   /**
    * @remarks
-   * The request ID.
+   * The unique identifier of the request. Provide this value when you troubleshoot issues.
    * 
    * @example
    * request-123456
@@ -115,7 +322,7 @@ export class UpdateIdentityProviderResponseBody extends $dara.Model {
   requestId?: string;
   /**
    * @remarks
-   * Indicates whether the request was successful.
+   * Indicates whether the API request is successful. To check whether the background configuration has taken effect, query the identity provider status separately.
    */
   success?: boolean;
   static names(): { [key: string]: string } {

package/src/models/UpdateIdentityProviderScimrequest.ts

@@ -0,0 +1,65 @@
+// This file is auto-generated, don't edit it
+import * as $dara from '@darabonba/typescript';
+
+
+export class UpdateIdentityProviderSCIMRequestBody extends $dara.Model {
+  /**
+   * @remarks
+   * Do not set this parameter to true during CustomSSO initialization. You can only update it later by calling UpdateIdentityProviderSCIM. Determine the result based on operationStatus.
+   * 
+   * This parameter is required.
+   */
+  syncEnabled?: boolean;
+  static names(): { [key: string]: string } {
+    return {
+      syncEnabled: 'syncEnabled',
+    };
+  }
+
+  static types(): { [key: string]: any } {
+    return {
+      syncEnabled: 'boolean',
+    };
+  }
+
+  validate() {
+    super.validate();
+  }
+
+  constructor(map?: { [key: string]: any }) {
+    super(map);
+  }
+}
+
+export class UpdateIdentityProviderSCIMRequest extends $dara.Model {
+  /**
+   * @remarks
+   * Submits business parameters as described in this API. The body parameters of the public API are mapped to the backend wrapper by the gateway. Do not mix them with the backend direct connection body wrapper.
+   * 
+   * This parameter is required.
+   */
+  body?: UpdateIdentityProviderSCIMRequestBody;
+  static names(): { [key: string]: string } {
+    return {
+      body: 'body',
+    };
+  }
+
+  static types(): { [key: string]: any } {
+    return {
+      body: UpdateIdentityProviderSCIMRequestBody,
+    };
+  }
+
+  validate() {
+    if(this.body && typeof (this.body as any).validate === 'function') {
+      (this.body as any).validate();
+    }
+    super.validate();
+  }
+
+  constructor(map?: { [key: string]: any }) {
+    super(map);
+  }
+}
+