@alicloud/agentcore20260804 2.6.0 → 3.0.0

package/src/models/UpdateIdentityProviderRequest.ts

@@ -5,7 +5,7 @@ import * as $dara from '@darabonba/typescript';
 export class UpdateIdentityProviderRequestBodyMetadata extends $dara.Model {
   /**
    * @remarks
-   * The App ID of the Feishu application. This parameter is required when the binding type is Feishu.
+   * The App ID of the Lark application. If this parameter is omitted during an update, the existing value is retained. If explicitly submitted, it must be a non-empty value. The merged configuration for Lark must include this field.
    * 
    * @example
    * cli_exampleappid01
@@ -13,7 +13,7 @@ export class UpdateIdentityProviderRequestBodyMetadata extends $dara.Model {
   appId?: string;
   /**
    * @remarks
-   * The AppKey of the DingTalk application. This parameter is required when the binding type is DingTalk.
+   * The AppKey of the DingTalk application. If this parameter is omitted during an update, the existing value is retained. If explicitly submitted, it must be a non-empty value. The merged configuration for DingTalk must include this field.
    * 
    * @example
    * dingexampleappkey01
@@ -21,7 +21,7 @@ export class UpdateIdentityProviderRequestBodyMetadata extends $dara.Model {
   appKey?: string;
   /**
    * @remarks
-   * Required. The secret of the external identity provider application. This parameter is used only for writing and is not returned by query APIs.
+   * The AppSecret of the DingTalk or Lark application. If this parameter is omitted during an update, the existing secret is retained and does not need to be retransmitted each time. If explicitly submitted, it must be a non-empty value, and the merged configuration must include this field. This is sensitive input and is not echoed in queries. The example is a fictitious value.
    * 
    * @example
    * example-app-secret
@@ -29,7 +29,7 @@ export class UpdateIdentityProviderRequestBodyMetadata extends $dara.Model {
   appSecret?: string;
   /**
    * @remarks
-   * The CorpId of the DingTalk enterprise. This parameter is required when the binding type is DingTalk.
+   * The CorpId of the organization to which the DingTalk application belongs. If this parameter is omitted during an update, the existing value is retained. If explicitly submitted, it must be a non-empty value and must match the organization to which the application belongs. The merged configuration for DingTalk must include this field.
    * 
    * @example
    * dingexamplecorpid01
@@ -37,7 +37,7 @@ export class UpdateIdentityProviderRequestBodyMetadata extends $dara.Model {
   corpId?: string;
   /**
    * @remarks
-   * The data encryption key for event subscription. The value must be the same as the one configured in the external identity provider application. This parameter is used only for writing and is not returned by query APIs.
+   * The encryption key for vendor event callbacks, which must be consistent with the vendor application configuration. If this parameter is omitted during an update, the existing value is retained. When incremental synchronization is enabled, the merged configuration must include this field. This is sensitive input and is not echoed in queries.
    * 
    * @example
    * example-encrypt-key
@@ -45,7 +45,7 @@ export class UpdateIdentityProviderRequestBodyMetadata extends $dara.Model {
   encryptKey?: string;
   /**
    * @remarks
-   * The verification token for event subscription. The value must be the same as the one configured in the external identity provider application. This parameter is used only for writing and is not returned by query APIs.
+   * The verification token for vendor event callbacks, which must be consistent with the vendor application configuration. If this parameter is omitted during an update, the existing value is retained. When incremental synchronization is enabled, the merged configuration must include this field. This is sensitive input and is not echoed in queries.
    * 
    * @example
    * example-verification-token
@@ -85,7 +85,7 @@ export class UpdateIdentityProviderRequestBodyMetadata extends $dara.Model {
 export class UpdateIdentityProviderRequestBodySaml extends $dara.Model {
   /**
    * @remarks
-   * HTTP-Redirect or HTTP-POST. This parameter is required for manual entry. Queries return the short name.
+   * The binding type for manual SAML configuration. HTTP-Redirect and HTTP-POST are supported. This parameter must be submitted together with entityId, loginUrl, and x509Certificates, and cannot be mixed with metadataXml.
    * 
    * @example
    * HTTP-Redirect
@@ -93,7 +93,7 @@ export class UpdateIdentityProviderRequestBodySaml extends $dara.Model {
   bindingType?: string;
   /**
    * @remarks
-   * Required for manual entry. It must be non-empty and up to 2,048 characters in length. Existing configurations do not support replacement. It is different from the local entity ID returned by SP queries.
+   * The entity ID of the enterprise IdP. This parameter is required for manual configuration. It must be non-empty and up to 2,048 characters, and cannot be changed after saving. It must be submitted together with loginUrl, bindingType, and x509Certificates, and cannot be mixed with metadataXml.
    * 
    * @example
    * https://idp.example.com/entity
@@ -101,23 +101,7 @@ export class UpdateIdentityProviderRequestBodySaml extends $dara.Model {
   entityId?: string;
   /**
    * @remarks
-   * Can be set independently. If omitted during an update, the existing value is retained. If omitted for the first time, the default value is false. A valid SAML configuration is required.
-   * 
-   * @example
-   * false
-   */
-  jitProvisionEnabled?: boolean;
-  /**
-   * @remarks
-   * Can be set independently. If omitted during an update, the existing value is retained. If omitted for the first time, the default value is false. A valid SAML configuration is required.
-   * 
-   * @example
-   * false
-   */
-  jitUpdateEnabled?: boolean;
-  /**
-   * @remarks
-   * Required for manual entry. It must be an absolute HTTPS URL without user credentials or fragments.
+   * The SSO logon URL of the enterprise IdP. This parameter is required for manual configuration. It must be an absolute HTTPS URL without user credentials and fragments. It must be submitted together with entityId, bindingType, and x509Certificates, and cannot be mixed with metadataXml.
    * 
    * @example
    * https://idp.example.com/sso
@@ -125,7 +109,7 @@ export class UpdateIdentityProviderRequestBodySaml extends $dara.Model {
   loginUrl?: string;
   /**
    * @remarks
-   * The input is the XML text of a single IdP EntityDescriptor, with a maximum size of 1 MiB. It cannot be a URL or a file path. It is mutually exclusive with the four manual entry fields.
+   * The original SAML metadata XML text of the enterprise IdP, not a URL or file path. The maximum size is 1 MiB. It must contain a single EntityDescriptor. DTDs and external entities are prohibited. It cannot be mixed with the four manual configuration fields. After saving, queries return the standardized configuration and do not echo the original XML text.
    * 
    * @example
    * <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://idp.example.com/entity"><IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><KeyDescriptor use="signing"><KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"><X509Data><X509Certificate>MIICwDCCAaigAwIBAgIULlsHLfcADyBax5ZtFlj+YGzZVo0wDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUuY29tMB4XDTI2MDEwMTAwMDAwMFoXDTM2MDEwMTAwMDAwMFowGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAto0DN0W1CrPRzK9QZ9A1aApb4Lg8oGlp2c0PbN3LokXe/HzwxCMXx65IDnrenttxzTwp9BgUnUN/3LRzWaOL2UQ/vNYNW9LFLkI1T64UPyI7eyi28YlALhb41xkYhEp7rz+MjqifBzVZeTDUxBYtbK2hAhbYEL1+udwsXEx0KB7xuQ/rbI2OKeqAEAD1tfYg7T/SM2wrXNYhx+o1HtchM4/0I8Okkk27JQ4y3ofzC5sTySmFF1Y7XcpSd+5WSyazedhkAieo8AB01DkJV6nnKfH8sH0EBsnH3FP8FhqCLrIeEkjX9B9OcIRLGjiZqx4u/ryW1QhMldnv+pFfNjWy/wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQC1hSQG8AwtGOoX2gKBK4Hi5XBrBreij8WlLTUWld0FINQ0Rg84f/27CjDthywj6wgxCesCuOVFhpxQa1UacsP/Gcai1aKABtLWImcaWECRYK5gDkwhTMFKM9mXA26hH1l4v/UR2iTpEK9H78egC4W7bs2LDTpPryuaNKTqP2O0tMbNkAHB8yecz5LxHXnxadL9Egow25g2RClvpifWqDnuS9TSbKkIWLcPLjocJj2K9ILpBwhXiXi/BiSgyYTLiYvVvih9vX4s+hKGZNJc0j92YLiOHDF0XH1oxgdVjfTmRiedeb2VZJZElptD92z0AqFR7z2d5B+OqpPA2gjuMLV5</X509Certificate></X509Data></KeyInfo></KeyDescriptor><SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.example.com/sso"/></IDPSSODescriptor></EntityDescriptor>
@@ -133,7 +117,7 @@ export class UpdateIdentityProviderRequestBodySaml extends $dara.Model {
   metadataXml?: string;
   /**
    * @remarks
-   * Required for manual entry. It must be a non-empty array using PEM X.509 certificate text. The current validity period is validated, and up to 10 certificates are supported.
+   * The list of X.509 signing certificates for the enterprise IdP. For manual configuration, a non-empty list must be provided, with a maximum of 10 certificates. The certificates must be valid. This parameter must be submitted together with entityId, loginUrl, and bindingType, and cannot be mixed with metadataXml.
    * 
    * @example
    * ["-----BEGIN CERTIFICATE-----\\\\nMIICwDCCAaigAwIBAgIULlsHLfcADyBax5ZtFlj+YGzZVo0wDQYJKoZIhvcNAQEL\\\\nBQAwGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUuY29tMB4XDTI2MDEwMTAwMDAwMFoX\\\\nDTM2MDEwMTAwMDAwMFowGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUuY29tMIIBIjAN\\\\nBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAto0DN0W1CrPRzK9QZ9A1aApb4Lg8\\\\noGlp2c0PbN3LokXe/HzwxCMXx65IDnrenttxzTwp9BgUnUN/3LRzWaOL2UQ/vNYN\\\\nW9LFLkI1T64UPyI7eyi28YlALhb41xkYhEp7rz+MjqifBzVZeTDUxBYtbK2hAhbY\\\\nEL1+udwsXEx0KB7xuQ/rbI2OKeqAEAD1tfYg7T/SM2wrXNYhx+o1HtchM4/0I8Ok\\\\nkk27JQ4y3ofzC5sTySmFF1Y7XcpSd+5WSyazedhkAieo8AB01DkJV6nnKfH8sH0E\\\\nBsnH3FP8FhqCLrIeEkjX9B9OcIRLGjiZqx4u/ryW1QhMldnv+pFfNjWy/wIDAQAB\\\\nMA0GCSqGSIb3DQEBCwUAA4IBAQC1hSQG8AwtGOoX2gKBK4Hi5XBrBreij8WlLTUW\\\\nld0FINQ0Rg84f/27CjDthywj6wgxCesCuOVFhpxQa1UacsP/Gcai1aKABtLWImca\\\\nWECRYK5gDkwhTMFKM9mXA26hH1l4v/UR2iTpEK9H78egC4W7bs2LDTpPryuaNKTq\\\\nP2O0tMbNkAHB8yecz5LxHXnxadL9Egow25g2RClvpifWqDnuS9TSbKkIWLcPLjoc\\\\nJj2K9ILpBwhXiXi/BiSgyYTLiYvVvih9vX4s+hKGZNJc0j92YLiOHDF0XH1oxgdV\\\\njfTmRiedeb2VZJZElptD92z0AqFR7z2d5B+OqpPA2gjuMLV5\\\\n-----END CERTIFICATE-----"]
@@ -143,8 +127,6 @@ export class UpdateIdentityProviderRequestBodySaml extends $dara.Model {
     return {
       bindingType: 'bindingType',
       entityId: 'entityId',
-      jitProvisionEnabled: 'jitProvisionEnabled',
-      jitUpdateEnabled: 'jitUpdateEnabled',
       loginUrl: 'loginUrl',
       metadataXml: 'metadataXml',
       x509Certificates: 'x509Certificates',
@@ -155,8 +137,6 @@ export class UpdateIdentityProviderRequestBodySaml extends $dara.Model {
     return {
       bindingType: 'string',
       entityId: 'string',
-      jitProvisionEnabled: 'boolean',
-      jitUpdateEnabled: 'boolean',
       loginUrl: 'string',
       metadataXml: 'string',
       x509Certificates: { 'type': 'array', 'itemType': 'string' },
@@ -178,7 +158,7 @@ export class UpdateIdentityProviderRequestBodySaml extends $dara.Model {
 export class UpdateIdentityProviderRequestBodySyncScope extends $dara.Model {
   /**
    * @remarks
-   * When the mode is SelectedDepartments, it must contain at least one non-empty department ID, which should be obtained from ListIdentityProviderDepartments. When the mode is AllAuthorized, pass an empty array or omit this parameter.
+   * The list of department IDs in the synchronization scope, obtained from ListIdentityProviderDepartments. In SelectedDepartments mode, at least one non-empty department ID must be provided. In AllAuthorized mode, this parameter should be omitted or an empty array should be passed.
    * 
    * @example
    * ["10001"]
@@ -186,10 +166,7 @@ export class UpdateIdentityProviderRequestBodySyncScope extends $dara.Model {
   departmentIds?: string[];
   /**
    * @remarks
-   * Valid values:
-   * - AllAuthorized: The full authorization scope, subject to the application address book authorization limits.
-   * - SelectedDepartments: The selected departments and all their sub-departments.
-   * When explicitly submitting syncScope, you must provide a valid mode, which is validated by the backend.
+   * The synchronization scope mode. AllAuthorized: all members within the authorization scope of the application address book. SelectedDepartments: the selected departments and all their sub-departments. A valid mode must be provided when syncScope is explicitly submitted.
    * 
    * @example
    * SelectedDepartments
@@ -224,12 +201,12 @@ export class UpdateIdentityProviderRequestBodySyncScope extends $dara.Model {
 export class UpdateIdentityProviderRequestBody extends $dara.Model {
   /**
    * @remarks
-   * Specifies whether to allow workspace users to log on through the external identity provider.
+   * Specifies whether to allow logon by using this identity provider. If this parameter is omitted or set to null during an update, the original value is retained. For CustomSSO, a valid SAML configuration must exist before logon is enabled. Disabling logon does not delete the saved SAML or SCIM configurations.
    */
   loginEnabled?: boolean;
   /**
    * @remarks
-   * The new application configuration of the external identity provider. If not specified, the existing configuration remains unchanged.
+   * Applies only to DingTalk and Lark. The application configuration is merged by field. Omitted fields and existing keys retain their original values. Explicitly submitted fields must not be null, empty strings, or blank strings. The merged configuration must meet the complete configuration requirements of the vendor. CustomSSO does not accept this field.
    * 
    * @example
    * {"appSecret":"example-app-secret"}
@@ -237,7 +214,7 @@ export class UpdateIdentityProviderRequestBody extends $dara.Model {
   metadata?: UpdateIdentityProviderRequestBodyMetadata;
   /**
    * @remarks
-   * Currently, only SAML is supported. This parameter may not be returned if no valid configuration is saved. OIDC placeholder initialization is not supported.
+   * The logon protocol, which applies only to CustomSSO. Currently, only SAML is supported. DingTalk and Lark do not accept this field. If submitted with a non-empty saml configuration, this field can be omitted and the server processes it as SAML.
    * 
    * @example
    * SAML
@@ -245,17 +222,17 @@ export class UpdateIdentityProviderRequestBody extends $dara.Model {
   protocol?: string;
   /**
    * @remarks
-   * The input supports either XML or complete manual entry. Queries return standardized configurations and do not echo the original XML. This parameter can be omitted if it is not configured.
+   * Applies only to CustomSSO. You can either provide metadataXml or provide the four complete manual configuration fields. The two methods cannot be mixed. If a valid configuration already exists, you can also modify only the JIT switches. Saving the configuration does not automatically enable logon.
    */
   saml?: UpdateIdentityProviderRequestBodySaml;
   /**
    * @remarks
-   * Specifies whether to enable organization member synchronization. After it is enabled, the external identity provider synchronizes organization members as workspace users.
+   * Applies only to DingTalk and Lark. Controls the incremental synchronization of subsequent address book change events. If this parameter is omitted or set to null during an update, the original value is retained. It does not control the initial synchronization or manual synchronization. When enabled, the merged metadata must include encryptKey and verificationToken. For CustomSSO, use UpdateIdentityProviderSCIM to manage the synchronization switch.
    */
   syncEnabled?: boolean;
   /**
    * @remarks
-   * Follows the synchronization scope definition by department. If omitted during creation, the default value is AllAuthorized. The first vendor synchronization is determined by syncOnBind. If omitted or set to null during an update, the original value is retained. Updating and saving the scope does not automatically perform full synchronization.
+   * The address book synchronization scope, which applies only to DingTalk and Lark. If this parameter is omitted or set to null, the current scope is retained. Saving the scope does not automatically trigger a full synchronization. CustomSSO does not accept this field.
    */
   syncScope?: UpdateIdentityProviderRequestBodySyncScope;
   static names(): { [key: string]: string } {
@@ -301,7 +278,7 @@ export class UpdateIdentityProviderRequestBody extends $dara.Model {
 export class UpdateIdentityProviderRequest extends $dara.Model {
   /**
    * @remarks
-   * The request content for updating the external identity provider.
+   * The configuration fields to be modified. For DingTalk and Lark, you must submit at least one of loginEnabled, syncEnabled, metadata, and syncScope. For CustomSSO, use protocol, saml, and loginEnabled. You cannot submit vendor metadata, syncEnabled, or syncScope.
    */
   body?: UpdateIdentityProviderRequestBody;
   static names(): { [key: string]: string } {

package/src/models/UpdateIdentityProviderResponseBody.ts

@@ -5,7 +5,7 @@ import * as $dara from '@darabonba/typescript';
 export class UpdateIdentityProviderResponseBodyDataConfiguration extends $dara.Model {
   /**
    * @remarks
-   * HTTP-Redirect or HTTP-POST. This parameter is required for manual entry. Queries return the short name.
+   * The actual SAML binding type saved in the upstream, which is HTTP-Redirect or HTTP-POST.
    * 
    * @example
    * HTTP-Redirect
@@ -13,7 +13,7 @@ export class UpdateIdentityProviderResponseBodyDataConfiguration extends $dara.M
   bindingType?: string;
   /**
    * @remarks
-   * Required for manual entry. It must be non-empty and up to 2,048 characters in length. Existing configurations do not support replacement. It is different from the local entity ID returned by SP queries.
+   * The actual enterprise IdP entity ID saved in the upstream.
    * 
    * @example
    * https://idp.example.com/entity
@@ -21,23 +21,7 @@ export class UpdateIdentityProviderResponseBodyDataConfiguration extends $dara.M
   entityId?: string;
   /**
    * @remarks
-   * The actual switch value. Valid values: Enabled and Disabled.
-   * 
-   * @example
-   * Disabled
-   */
-  jitProvisionStatus?: string;
-  /**
-   * @remarks
-   * The actual switch value. Valid values: Enabled and Disabled.
-   * 
-   * @example
-   * Disabled
-   */
-  jitUpdateStatus?: string;
-  /**
-   * @remarks
-   * Required for manual entry. It must be an absolute HTTPS URL without user credentials or fragments.
+   * The actual enterprise IdP SSO logon URL saved in the upstream.
    * 
    * @example
    * https://idp.example.com/sso
@@ -45,7 +29,7 @@ export class UpdateIdentityProviderResponseBodyDataConfiguration extends $dara.M
   loginUrl?: string;
   /**
    * @remarks
-   * The actual switch value. Valid values: Enabled and Disabled. This value is not equivalent to the expected loginEnabled value saved in AC.
+   * The actual SSO logon status in the upstream. Enabled indicates that it is turned on, and Disabled indicates that it is turned off. This should be evaluated separately from the expected value of loginEnabled.
    * 
    * @example
    * Enabled
@@ -55,8 +39,6 @@ export class UpdateIdentityProviderResponseBodyDataConfiguration extends $dara.M
     return {
       bindingType: 'bindingType',
       entityId: 'entityId',
-      jitProvisionStatus: 'jitProvisionStatus',
-      jitUpdateStatus: 'jitUpdateStatus',
       loginUrl: 'loginUrl',
       ssoStatus: 'ssoStatus',
     };
@@ -66,8 +48,6 @@ export class UpdateIdentityProviderResponseBodyDataConfiguration extends $dara.M
     return {
       bindingType: 'string',
       entityId: 'string',
-      jitProvisionStatus: 'string',
-      jitUpdateStatus: 'string',
       loginUrl: 'string',
       ssoStatus: 'string',
     };
@@ -85,7 +65,7 @@ export class UpdateIdentityProviderResponseBodyDataConfiguration extends $dara.M
 export class UpdateIdentityProviderResponseBodyDataSaml extends $dara.Model {
   /**
    * @remarks
-   * HTTP-Redirect or HTTP-POST. This parameter is required for manual entry. Queries return the short name.
+   * The saved SAML binding type, which is HTTP-Redirect or HTTP-POST.
    * 
    * @example
    * HTTP-Redirect
@@ -93,7 +73,7 @@ export class UpdateIdentityProviderResponseBodyDataSaml extends $dara.Model {
   bindingType?: string;
   /**
    * @remarks
-   * Required for manual entry. It must be non-empty and up to 2,048 characters in length. Existing configurations do not support replacement. It is different from the local entity ID returned by SP queries.
+   * The saved enterprise IdP entity ID, which is different from the entity ID of the service provider (SP).
    * 
    * @example
    * https://idp.example.com/entity
@@ -101,23 +81,7 @@ export class UpdateIdentityProviderResponseBodyDataSaml extends $dara.Model {
   entityId?: string;
   /**
    * @remarks
-   * Can be set independently. If omitted during an update, the existing value is retained. If omitted for the first time, the default value is false. A valid SAML configuration is required.
-   * 
-   * @example
-   * false
-   */
-  jitProvisionEnabled?: boolean;
-  /**
-   * @remarks
-   * Can be set independently. If omitted during an update, the existing value is retained. If omitted for the first time, the default value is false. A valid SAML configuration is required.
-   * 
-   * @example
-   * false
-   */
-  jitUpdateEnabled?: boolean;
-  /**
-   * @remarks
-   * Required for manual entry. It must be an absolute HTTPS URL without user credentials or fragments.
+   * The saved enterprise IdP SSO logon URL.
    * 
    * @example
    * https://idp.example.com/sso
@@ -125,7 +89,7 @@ export class UpdateIdentityProviderResponseBodyDataSaml extends $dara.Model {
   loginUrl?: string;
   /**
    * @remarks
-   * Required for manual entry. It must be a non-empty array using PEM X.509 certificate text. The current validity period is validated, and up to 10 certificates are supported.
+   * The list of saved enterprise IdP X.509 signing certificates.
    * 
    * @example
    * ["-----BEGIN CERTIFICATE-----\\\\nMIICwDCCAaigAwIBAgIULlsHLfcADyBax5ZtFlj+YGzZVo0wDQYJKoZIhvcNAQEL\\\\nBQAwGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUuY29tMB4XDTI2MDEwMTAwMDAwMFoX\\\\nDTM2MDEwMTAwMDAwMFowGjEYMBYGA1UEAwwPaWRwLmV4YW1wbGUuY29tMIIBIjAN\\\\nBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAto0DN0W1CrPRzK9QZ9A1aApb4Lg8\\\\noGlp2c0PbN3LokXe/HzwxCMXx65IDnrenttxzTwp9BgUnUN/3LRzWaOL2UQ/vNYN\\\\nW9LFLkI1T64UPyI7eyi28YlALhb41xkYhEp7rz+MjqifBzVZeTDUxBYtbK2hAhbY\\\\nEL1+udwsXEx0KB7xuQ/rbI2OKeqAEAD1tfYg7T/SM2wrXNYhx+o1HtchM4/0I8Ok\\\\nkk27JQ4y3ofzC5sTySmFF1Y7XcpSd+5WSyazedhkAieo8AB01DkJV6nnKfH8sH0E\\\\nBsnH3FP8FhqCLrIeEkjX9B9OcIRLGjiZqx4u/ryW1QhMldnv+pFfNjWy/wIDAQAB\\\\nMA0GCSqGSIb3DQEBCwUAA4IBAQC1hSQG8AwtGOoX2gKBK4Hi5XBrBreij8WlLTUW\\\\nld0FINQ0Rg84f/27CjDthywj6wgxCesCuOVFhpxQa1UacsP/Gcai1aKABtLWImca\\\\nWECRYK5gDkwhTMFKM9mXA26hH1l4v/UR2iTpEK9H78egC4W7bs2LDTpPryuaNKTq\\\\nP2O0tMbNkAHB8yecz5LxHXnxadL9Egow25g2RClvpifWqDnuS9TSbKkIWLcPLjoc\\\\nJj2K9ILpBwhXiXi/BiSgyYTLiYvVvih9vX4s+hKGZNJc0j92YLiOHDF0XH1oxgdV\\\\njfTmRiedeb2VZJZElptD92z0AqFR7z2d5B+OqpPA2gjuMLV5\\\\n-----END CERTIFICATE-----"]
@@ -135,8 +99,6 @@ export class UpdateIdentityProviderResponseBodyDataSaml extends $dara.Model {
     return {
       bindingType: 'bindingType',
       entityId: 'entityId',
-      jitProvisionEnabled: 'jitProvisionEnabled',
-      jitUpdateEnabled: 'jitUpdateEnabled',
       loginUrl: 'loginUrl',
       x509Certificates: 'x509Certificates',
     };
@@ -146,8 +108,6 @@ export class UpdateIdentityProviderResponseBodyDataSaml extends $dara.Model {
     return {
       bindingType: 'string',
       entityId: 'string',
-      jitProvisionEnabled: 'boolean',
-      jitUpdateEnabled: 'boolean',
       loginUrl: 'string',
       x509Certificates: { 'type': 'array', 'itemType': 'string' },
     };
@@ -168,7 +128,7 @@ export class UpdateIdentityProviderResponseBodyDataSaml extends $dara.Model {
 export class UpdateIdentityProviderResponseBodyDataSyncScope extends $dara.Model {
   /**
    * @remarks
-   * When the mode is SelectedDepartments, it must contain at least one non-empty department ID, which should be obtained from ListIdentityProviderDepartments. When the mode is AllAuthorized, pass an empty array or omit this parameter.
+   * The list of department IDs in the synchronization scope, obtained from ListIdentityProviderDepartments. In SelectedDepartments mode, at least one non-empty department ID must be provided. In AllAuthorized mode, this parameter should be omitted or an empty array should be passed.
    * 
    * @example
    * ["10001"]
@@ -176,10 +136,7 @@ export class UpdateIdentityProviderResponseBodyDataSyncScope extends $dara.Model
   departmentIds?: string[];
   /**
    * @remarks
-   * Valid values:
-   * - AllAuthorized: The full authorization scope, subject to the application address book authorization limits.
-   * - SelectedDepartments: The selected departments and all their sub-departments.
-   * When explicitly submitting syncScope, you must provide a valid mode, which is validated by the backend.
+   * The synchronization scope mode. AllAuthorized: all members within the authorization scope of the application address book. SelectedDepartments: the selected departments and all their sub-departments. A valid mode must be provided when syncScope is explicitly submitted.
    * 
    * @example
    * SelectedDepartments
@@ -214,12 +171,12 @@ export class UpdateIdentityProviderResponseBodyDataSyncScope extends $dara.Model
 export class UpdateIdentityProviderResponseBodyData extends $dara.Model {
   /**
    * @remarks
-   * The actual SAML configuration is read back on demand only by GetIdentityProvider. SCIM queries and preparations return the actual received status and URL.
+   * The actual SAML configuration read back from the upstream. This update operation does not perform the read-back and usually does not return this field. Use GetIdentityProvider to obtain it.
    */
   configuration?: UpdateIdentityProviderResponseBodyDataConfiguration;
   /**
    * @remarks
-   * The type of the external identity provider. Valid values: DingTalk and Feishu.
+   * The type of the identity provider. DingTalk: DingTalk. Feishu: Lark. CustomSSO: custom enterprise identity provider connected through SAML. The value must be the same as the type of the identity provider bound to the current workspace.
    * 
    * @example
    * DingTalk
@@ -227,12 +184,12 @@ export class UpdateIdentityProviderResponseBodyData extends $dara.Model {
   identityProviderType?: string;
   /**
    * @remarks
-   * Specifies whether to allow workspace users to log on through the external identity provider.
+   * The currently saved expected value of the logon switch, which alone does not prove that the upstream logon configuration has taken effect.
    */
   loginEnabled?: boolean;
   /**
    * @remarks
-   * Currently, only SAML is supported. This parameter may not be returned if no valid configuration is saved. OIDC placeholder initialization is not supported.
+   * The currently saved logon protocol for CustomSSO, which is SAML when configured. This field is not returned for DingTalk or Lark.
    * 
    * @example
    * SAML
@@ -240,12 +197,22 @@ export class UpdateIdentityProviderResponseBodyData extends $dara.Model {
   protocol?: string;
   /**
    * @remarks
-   * The input supports either XML or complete manual entry. Queries return standardized configurations and do not echo the original XML. This parameter can be omitted if it is not configured.
+   * The saved standardized SAML configuration for CustomSSO. The original metadata XML is not echoed. This field is not returned if no valid configuration is saved or if the identity provider is DingTalk or Lark. This value is the locally saved configuration and is not equivalent to the actual upstream configuration.
    */
   saml?: UpdateIdentityProviderResponseBodyDataSaml;
   /**
    * @remarks
-   * The binding status. Valid values: CONFIGURED (the configuration is accepted and waiting for the user pool to be activated), SYNCING (synchronizing organization members), SYNCED (organization member synchronization is completed), READY (the binding is in effect), SYNC_FAILED (organization member synchronization failed), UPDATING (updating the configuration), UPDATE_FAILED (configuration update failed), DISCONNECTING (disconnecting), and DISCONNECT_FAILED (disconnection failed).
+   * The status of the identity provider resource and logon configuration. Valid values:
+   * - CONFIGURED: The configuration is accepted.
+   * - UPDATING: The configuration is being updated.
+   * - SYNCING: Synchronization is in progress.
+   * - SYNCED: The synchronization phase is completed.
+   * - READY: The resource is ready.
+   * - SYNC_FAILED: Synchronization failed.
+   * - UPDATE_FAILED: The update failed.
+   * - DISCONNECTING: Unbinding is in progress.
+   * - DISCONNECT_FAILED: Unbinding failed.
+   * READY alone does not indicate that users have been imported. Query the SCIM operation results for CustomSSO separately.
    * 
    * @example
    * READY
@@ -253,17 +220,17 @@ export class UpdateIdentityProviderResponseBodyData extends $dara.Model {
   status?: string;
   /**
    * @remarks
-   * Specifies whether to enable organization member synchronization. After it is enabled, the external identity provider synchronizes organization members as workspace users.
+   * The currently saved expected value of the synchronization switch. For DingTalk and Lark, it is used for subsequent address book change events. The SCIM switch for CustomSSO is managed through UpdateIdentityProviderSCIM, and the operation results are queried through GetIdentityProviderSCIM.
    */
   syncEnabled?: boolean;
   /**
    * @remarks
-   * Follows the synchronization scope definition by department. If omitted during creation, the default value is AllAuthorized. The first vendor synchronization is determined by syncOnBind. If omitted or set to null during an update, the original value is retained. Updating and saving the scope does not automatically perform full synchronization.
+   * The saved synchronization scope for DingTalk and Lark. The default value for valid historical configurations is AllAuthorized, and this field may not be returned for corrupted historical configurations. This field is not returned for CustomSSO.
    */
   syncScope?: UpdateIdentityProviderResponseBodyDataSyncScope;
   /**
    * @remarks
-   * The workspace ID.
+   * The ID of the workspace to which the identity provider belongs.
    * 
    * @example
    * ws-123456
@@ -318,7 +285,7 @@ export class UpdateIdentityProviderResponseBodyData extends $dara.Model {
 export class UpdateIdentityProviderResponseBody extends $dara.Model {
   /**
    * @remarks
-   * The business status code.
+   * The business status code of the API request. SUCCESS indicates that the request is successful, but does not mean that the asynchronous configuration or synchronization task is completed.
    * 
    * @example
    * SUCCESS
@@ -326,12 +293,12 @@ export class UpdateIdentityProviderResponseBody extends $dara.Model {
   code?: string;
   /**
    * @remarks
-   * The updated external identity provider binding information.
+   * The currently saved identity provider binding information, including the expected configuration and resource status. The actual update may still be executing in the background.
    */
   data?: UpdateIdentityProviderResponseBodyData;
   /**
    * @remarks
-   * The HTTP status code.
+   * The HTTP status code of the API request, which does not represent the execution result of the background task.
    * 
    * @example
    * 200
@@ -339,7 +306,7 @@ export class UpdateIdentityProviderResponseBody extends $dara.Model {
   httpStatusCode?: number;
   /**
    * @remarks
-   * The response message. An error description is returned when the request fails.
+   * The response message of the API request. An error description is returned if the request fails.
    * 
    * @example
    * success
@@ -347,7 +314,7 @@ export class UpdateIdentityProviderResponseBody extends $dara.Model {
   message?: string;
   /**
    * @remarks
-   * The request ID.
+   * The unique identifier of the request. Provide this value when you troubleshoot issues.
    * 
    * @example
    * request-123456
@@ -355,7 +322,7 @@ export class UpdateIdentityProviderResponseBody extends $dara.Model {
   requestId?: string;
   /**
    * @remarks
-   * Indicates whether the request is successful.
+   * Indicates whether the API request is successful. To check whether the background configuration has taken effect, query the identity provider status separately.
    */
   success?: boolean;
   static names(): { [key: string]: string } {

package/src/models/UpdateIdentityProviderScimrequest.ts

@@ -0,0 +1,65 @@
+// This file is auto-generated, don't edit it
+import * as $dara from '@darabonba/typescript';
+
+
+export class UpdateIdentityProviderSCIMRequestBody extends $dara.Model {
+  /**
+   * @remarks
+   * Do not set this parameter to true during CustomSSO initialization. You can only update it later by calling UpdateIdentityProviderSCIM. Determine the result based on operationStatus.
+   * 
+   * This parameter is required.
+   */
+  syncEnabled?: boolean;
+  static names(): { [key: string]: string } {
+    return {
+      syncEnabled: 'syncEnabled',
+    };
+  }
+
+  static types(): { [key: string]: any } {
+    return {
+      syncEnabled: 'boolean',
+    };
+  }
+
+  validate() {
+    super.validate();
+  }
+
+  constructor(map?: { [key: string]: any }) {
+    super(map);
+  }
+}
+
+export class UpdateIdentityProviderSCIMRequest extends $dara.Model {
+  /**
+   * @remarks
+   * Submits business parameters as described in this API. The body parameters of the public API are mapped to the backend wrapper by the gateway. Do not mix them with the backend direct connection body wrapper.
+   * 
+   * This parameter is required.
+   */
+  body?: UpdateIdentityProviderSCIMRequestBody;
+  static names(): { [key: string]: string } {
+    return {
+      body: 'body',
+    };
+  }
+
+  static types(): { [key: string]: any } {
+    return {
+      body: UpdateIdentityProviderSCIMRequestBody,
+    };
+  }
+
+  validate() {
+    if(this.body && typeof (this.body as any).validate === 'function') {
+      (this.body as any).validate();
+    }
+    super.validate();
+  }
+
+  constructor(map?: { [key: string]: any }) {
+    super(map);
+  }
+}
+

package/src/models/UpdateIdentityProviderScimresponse.ts

@@ -0,0 +1,40 @@
+// This file is auto-generated, don't edit it
+import * as $dara from '@darabonba/typescript';
+import { UpdateIdentityProviderSCIMResponseBody } from "./UpdateIdentityProviderScimresponseBody";
+
+
+export class UpdateIdentityProviderSCIMResponse extends $dara.Model {
+  headers?: { [key: string]: string };
+  statusCode?: number;
+  body?: UpdateIdentityProviderSCIMResponseBody;
+  static names(): { [key: string]: string } {
+    return {
+      headers: 'headers',
+      statusCode: 'statusCode',
+      body: 'body',
+    };
+  }
+
+  static types(): { [key: string]: any } {
+    return {
+      headers: { 'type': 'map', 'keyType': 'string', 'valueType': 'string' },
+      statusCode: 'number',
+      body: UpdateIdentityProviderSCIMResponseBody,
+    };
+  }
+
+  validate() {
+    if(this.headers) {
+      $dara.Model.validateMap(this.headers);
+    }
+    if(this.body && typeof (this.body as any).validate === 'function') {
+      (this.body as any).validate();
+    }
+    super.validate();
+  }
+
+  constructor(map?: { [key: string]: any }) {
+    super(map);
+  }
+}
+