@alicloud/agentcore20260804 2.6.0 → 3.0.1

package/dist/client.d.ts

@@ -283,15 +283,15 @@ export default class Client extends OpenApi {
      */
     createExternalAgentBootstrapToken(workspaceId: string, agentId: string, request: $_model.CreateExternalAgentBootstrapTokenRequest): Promise<$_model.CreateExternalAgentBootstrapTokenResponse>;
     /**
-     * Binds an external identity provider to a specified workspace for single sign-on and organization member synchronization of workspace users. You can bind up to one external identity provider to each workspace. The binding is an asynchronous operation. After the API returns, you can call GetIdentityProvider to query the status and track the progress.
+     * Binds an external identity provider to a specified workspace for single sign-on and organization member synchronization of workspace users. A maximum of one external identity provider can be bound to each workspace. The binding is an asynchronous operation. After the API returns, you can query the status by calling GetIdentityProvider to track the progress.
      *
      * @remarks
      * ## Features and prerequisites
-     * A workspace can be bound to only one external identity provider. The identityProviderType parameter supports DingTalk, Feishu, and CustomSSO. CustomSSO only initializes the shared user pool. Do not pass non-empty metadata, and do not pass true for loginEnabled or syncEnabled. By default, both switches are turned off. Protocols and SAML configurations are saved by calling UpdateIdentityProvider. SCIM is configured through a separate API. You do not need to save SAML first. After the request is accepted and CONFIGURED is returned, call GetIdentityProvider and wait for the user pool initialization to complete. READY only indicates that the resource is ready, not that SAML is configured. If the same CustomSSO binding is in the CONFIGURED or READY state, the existing binding can be returned. You cannot treat all states as repeatable creations.
-     * For DingTalk, the metadata parameter requires appKey, appSecret, and corpId. For Feishu, appId and appSecret are required. The vendor logon switch is enabled by default, and the synchronization switch is disabled by default. When synchronization is enabled, encryptKey and verificationToken are also required. The vendor syncOnBind and syncScope parameters retain the existing department-based synchronization definitions. Do not use these vendor pull parameters to replace SCIM configurations during CustomSSO initialization.
+     * A workspace can be bound to only one external identity provider. The identityProviderType parameter supports DingTalk, Feishu, and CustomSSO. CustomSSO only initializes the shared user pool. Do not pass non-empty metadata, and do not pass true for loginEnabled or syncEnabled. By default, both switches are turned off. Protocols and SAML configurations are saved by calling UpdateIdentityProvider. SCIM is configured through a separate API. Saving SAML first is not required. After the request is accepted and CONFIGURED is returned, call GetIdentityProvider and wait for the user pool initialization to complete. READY only indicates that the resource is ready, not that SAML is configured. If the same CustomSSO binding is in the CONFIGURED or READY state, the existing binding may be returned. Not all states can be treated as repeatedly creatable.
+     * For DingTalk, appKey, appSecret, and corpId are required in metadata. For Feishu, appId and appSecret are required. The vendor login switch is enabled by default. The synchronization switch is disabled by default. When synchronization is enabled, encryptKey and verificationToken are also required. The vendor syncOnBind and syncScope parameters retain the existing department-based synchronization definitions. Do not use these vendor pull parameters to replace SCIM configurations during CustomSSO initialization.
      * ## Requests and examples
      * POST /workspaces/{workspaceId}/identity-providers
-     * Call conventions: Call the API based on the region of the target workspace. Use an AccessKey pair or STS token that has permissions on the identity provider resources of the corresponding workspace. The ws-example, URLs, certificates, and tokens in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example only shows the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity provider resources of the workspace. The ws-example, URL, certificate, and token in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
      * ```text
      * POST /workspaces/ws-example/identity-providers
      * {"identityProviderType": "CustomSSO"}
@@ -309,7 +309,7 @@ export default class Client extends OpenApi {
      * }
      * ```
      * ## Errors and handling
-     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call to the upstream service may return 503 IdentityProviderProvisioningUnavailable if it fails. Keep the request ID for troubleshooting and do not interpret a read failure as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call failure to an upstream service may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret a read failure as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
      * 409 IdentityProviderAlreadyBound: An external binding already exists. Query and reuse the correct binding first. Do not automatically unbind the entire binding. Asynchronous initialization failure does not equal HTTP request failure. You must continue to query the status.
      *
      * @param tmpReq - CreateIdentityProviderRequest
@@ -321,15 +321,15 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.CreateIdentityProviderResponse>;
     /**
-     * Binds an external identity provider to a specified workspace for single sign-on and organization member synchronization of workspace users. You can bind up to one external identity provider to each workspace. The binding is an asynchronous operation. After the API returns, you can call GetIdentityProvider to query the status and track the progress.
+     * Binds an external identity provider to a specified workspace for single sign-on and organization member synchronization of workspace users. A maximum of one external identity provider can be bound to each workspace. The binding is an asynchronous operation. After the API returns, you can query the status by calling GetIdentityProvider to track the progress.
      *
      * @remarks
      * ## Features and prerequisites
-     * A workspace can be bound to only one external identity provider. The identityProviderType parameter supports DingTalk, Feishu, and CustomSSO. CustomSSO only initializes the shared user pool. Do not pass non-empty metadata, and do not pass true for loginEnabled or syncEnabled. By default, both switches are turned off. Protocols and SAML configurations are saved by calling UpdateIdentityProvider. SCIM is configured through a separate API. You do not need to save SAML first. After the request is accepted and CONFIGURED is returned, call GetIdentityProvider and wait for the user pool initialization to complete. READY only indicates that the resource is ready, not that SAML is configured. If the same CustomSSO binding is in the CONFIGURED or READY state, the existing binding can be returned. You cannot treat all states as repeatable creations.
-     * For DingTalk, the metadata parameter requires appKey, appSecret, and corpId. For Feishu, appId and appSecret are required. The vendor logon switch is enabled by default, and the synchronization switch is disabled by default. When synchronization is enabled, encryptKey and verificationToken are also required. The vendor syncOnBind and syncScope parameters retain the existing department-based synchronization definitions. Do not use these vendor pull parameters to replace SCIM configurations during CustomSSO initialization.
+     * A workspace can be bound to only one external identity provider. The identityProviderType parameter supports DingTalk, Feishu, and CustomSSO. CustomSSO only initializes the shared user pool. Do not pass non-empty metadata, and do not pass true for loginEnabled or syncEnabled. By default, both switches are turned off. Protocols and SAML configurations are saved by calling UpdateIdentityProvider. SCIM is configured through a separate API. Saving SAML first is not required. After the request is accepted and CONFIGURED is returned, call GetIdentityProvider and wait for the user pool initialization to complete. READY only indicates that the resource is ready, not that SAML is configured. If the same CustomSSO binding is in the CONFIGURED or READY state, the existing binding may be returned. Not all states can be treated as repeatedly creatable.
+     * For DingTalk, appKey, appSecret, and corpId are required in metadata. For Feishu, appId and appSecret are required. The vendor login switch is enabled by default. The synchronization switch is disabled by default. When synchronization is enabled, encryptKey and verificationToken are also required. The vendor syncOnBind and syncScope parameters retain the existing department-based synchronization definitions. Do not use these vendor pull parameters to replace SCIM configurations during CustomSSO initialization.
      * ## Requests and examples
      * POST /workspaces/{workspaceId}/identity-providers
-     * Call conventions: Call the API based on the region of the target workspace. Use an AccessKey pair or STS token that has permissions on the identity provider resources of the corresponding workspace. The ws-example, URLs, certificates, and tokens in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example only shows the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity provider resources of the workspace. The ws-example, URL, certificate, and token in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
      * ```text
      * POST /workspaces/ws-example/identity-providers
      * {"identityProviderType": "CustomSSO"}
@@ -347,13 +347,99 @@ export default class Client extends OpenApi {
      * }
      * ```
      * ## Errors and handling
-     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call to the upstream service may return 503 IdentityProviderProvisioningUnavailable if it fails. Keep the request ID for troubleshooting and do not interpret a read failure as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call failure to an upstream service may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret a read failure as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
      * 409 IdentityProviderAlreadyBound: An external binding already exists. Query and reuse the correct binding first. Do not automatically unbind the entire binding. Asynchronous initialization failure does not equal HTTP request failure. You must continue to query the status.
      *
      * @param request - CreateIdentityProviderRequest
      * @returns CreateIdentityProviderResponse
      */
     createIdentityProvider(workspaceId: string, request: $_model.CreateIdentityProviderRequest): Promise<$_model.CreateIdentityProviderResponse>;
+    /**
+     * Issues a SCIM credential explicitly and returns the plaintext token only for the current call. A maximum of two credentials are allowed in the same pool. This operation does not automatically revoke old credentials or enable AC user synchronization.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * Issues a new credential explicitly. This requires an available shared pool and the AgentIdentity SCIM reception to be Enabled. This operation does not automatically enable reception. If it is not enabled, call prepare first. Returns the configuration, credential summary, and the current token. The limit of a maximum of two credentials is enforced by AgentIdentity. An existing available token does not prevent users from explicitly creating a second one. Old credentials are not automatically revoked, and no extended rotation process is provided.
+     * The token is returned only once and cannot be retrieved again in subsequent list and query operations. Do not automatically retry the issuance. If the response is lost, check the list first to verify whether it has been created. Creating a credential does not enable AC syncEnabled, start a full user import, or switch SAML logon. Deleting an old token should be performed explicitly after the user confirms the actual usage of the external provisioning system.
+     * ## Request and examples
+     * POST /workspaces/{workspaceId}/scim-provisioning/credentials
+     * Call conventions: Call the operation in the region of the target workspace, using an AK/STS identity that has permissions for the identity source resources of the corresponding workspace. The ws-example, URL, certificate, and token in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameter content of the public API, not the extra body wrapper of the backend direct connection API. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not log the key. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * ```text
+     * POST /workspaces/ws-example/scim-provisioning/credentials
+     * No business request body.
+     * ```
+     * ## Response example
+     * ```json
+     * {
+     *   "data": {
+     *     "configuration": {
+     *       "status": "Enabled",
+     *       "baseUrl": "https://example.com/scim/v2"
+     *     },
+     *     "credential": {
+     *       "credentialId": "credential-example",
+     *       "status": "Enabled",
+     *       "expireTime": "<Upstream expiration time>"
+     *     },
+     *     "token": "<Newly issued token for the current request>"
+     *   }
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that there is no binding of the matching type. Synchronous calls to the upstream may fail and return 503 IdentityProviderProvisioningUnavailable. Keep the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
+     * 400 LimitExceeded.ScimCredential: A maximum of two credentials are allowed. Delete one before you can continue to create. 400 InvalidParameter: Reception is not enabled or the shared pool is unavailable. Do not retry quota errors as system failures.
+     * ## Call relationships and usage boundaries
+     * After creation, securely save the token that is returned only once and configure it in the external provisioning system. Existing tokens remain valid. Only DeleteIdentityProviderSCIMCredential revokes the specified credential. Do not automatically retry when the response is lost. Call ListIdentityProviderSCIMCredentials to check first. This operation does not provide automatic rotation or scaling.
+     *
+     * @param request - CreateIdentityProviderSCIMCredentialRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns CreateIdentityProviderSCIMCredentialResponse
+     */
+    createIdentityProviderSCIMCredentialWithOptions(workspaceId: string, request: $_model.CreateIdentityProviderSCIMCredentialRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.CreateIdentityProviderSCIMCredentialResponse>;
+    /**
+     * Issues a SCIM credential explicitly and returns the plaintext token only for the current call. A maximum of two credentials are allowed in the same pool. This operation does not automatically revoke old credentials or enable AC user synchronization.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * Issues a new credential explicitly. This requires an available shared pool and the AgentIdentity SCIM reception to be Enabled. This operation does not automatically enable reception. If it is not enabled, call prepare first. Returns the configuration, credential summary, and the current token. The limit of a maximum of two credentials is enforced by AgentIdentity. An existing available token does not prevent users from explicitly creating a second one. Old credentials are not automatically revoked, and no extended rotation process is provided.
+     * The token is returned only once and cannot be retrieved again in subsequent list and query operations. Do not automatically retry the issuance. If the response is lost, check the list first to verify whether it has been created. Creating a credential does not enable AC syncEnabled, start a full user import, or switch SAML logon. Deleting an old token should be performed explicitly after the user confirms the actual usage of the external provisioning system.
+     * ## Request and examples
+     * POST /workspaces/{workspaceId}/scim-provisioning/credentials
+     * Call conventions: Call the operation in the region of the target workspace, using an AK/STS identity that has permissions for the identity source resources of the corresponding workspace. The ws-example, URL, certificate, and token in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameter content of the public API, not the extra body wrapper of the backend direct connection API. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not log the key. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * ```text
+     * POST /workspaces/ws-example/scim-provisioning/credentials
+     * No business request body.
+     * ```
+     * ## Response example
+     * ```json
+     * {
+     *   "data": {
+     *     "configuration": {
+     *       "status": "Enabled",
+     *       "baseUrl": "https://example.com/scim/v2"
+     *     },
+     *     "credential": {
+     *       "credentialId": "credential-example",
+     *       "status": "Enabled",
+     *       "expireTime": "<Upstream expiration time>"
+     *     },
+     *     "token": "<Newly issued token for the current request>"
+     *   }
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that there is no binding of the matching type. Synchronous calls to the upstream may fail and return 503 IdentityProviderProvisioningUnavailable. Keep the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
+     * 400 LimitExceeded.ScimCredential: A maximum of two credentials are allowed. Delete one before you can continue to create. 400 InvalidParameter: Reception is not enabled or the shared pool is unavailable. Do not retry quota errors as system failures.
+     * ## Call relationships and usage boundaries
+     * After creation, securely save the token that is returned only once and configure it in the external provisioning system. Existing tokens remain valid. Only DeleteIdentityProviderSCIMCredential revokes the specified credential. Do not automatically retry when the response is lost. Call ListIdentityProviderSCIMCredentials to check first. This operation does not provide automatic rotation or scaling.
+     *
+     * @param request - CreateIdentityProviderSCIMCredentialRequest
+     * @returns CreateIdentityProviderSCIMCredentialResponse
+     */
+    createIdentityProviderSCIMCredential(workspaceId: string, request: $_model.CreateIdentityProviderSCIMCredentialRequest): Promise<$_model.CreateIdentityProviderSCIMCredentialResponse>;
     /**
      * Initiates a manual synchronization of an identity provider.
      *
@@ -799,15 +885,15 @@ export default class Client extends OpenApi {
      */
     deleteExternalAgent(workspaceId: string, agentId: string, request: $_model.DeleteExternalAgentRequest): Promise<$_model.DeleteExternalAgentResponse>;
     /**
-     * Disconnects the external identity provider from a specified workspace and cleans up the users synchronized by the identity provider. The disconnection is an asynchronous operation. After the API returns a response, you can call GetIdentityProvider to query the status and track the progress.
+     * Disconnects the identity source integration of a workspace. For CustomSSO, this operation clears the shared user pool and related SAML and SCIM resources. To disable only logon or synchronization, use the corresponding switch API operations.
      *
      * @remarks
      * ## Features and prerequisites
-     * This is a complete disconnection, not just disabling logon. Disconnecting CustomSSO cleans up the AC users imported from this identity source, remote shared user pools and related resources, logon publishing configurations, and bindings. Therefore, both SAML and SCIM are affected. It does not delete the enterprise applications created by users on external platforms such as Azure. The system first checks the references between users and Teams. If references exist, the disconnection is rejected.
-     * After the request is accepted, the system returns DISCONNECTING. You can call GetIdentityProvider to query the status. The cleanup is complete only when the binding does not exist (IdentityProviderNotFound). The binding should also no longer appear in the list. DISCONNECT_FAILED indicates that a partial cleanup may have occurred and the state cannot be restored to a brand new unconfigured state. You can retry based on the returned status. If the binding does not exist in the first place, the API returns a placeholder result indicating no binding without creating new resources. An ongoing disconnection task may return the current binding. Do not use this API as a substitute for setting loginEnabled=false, syncEnabled=false, or deleting a single token.
+     * This operation completely disconnects the integration, rather than simply disabling logon. Disconnecting CustomSSO clears the AC users imported from this identity source, the remote shared user pool and related resources, and the logon publishing configurations and bindings. Therefore, both SAML and SCIM are affected. However, this operation does not delete the enterprise applications created by users on external platforms such as Azure. Before disconnecting, the system checks for references between users and teams. If references exist, the disconnection is rejected.
+     * After the request is accepted, the status returned is DISCONNECTING. You can query the status by calling GetIdentityProvider. The cleanup is complete only when the binding no longer exists (IdentityProviderNotFound). The binding should also no longer appear in the list. DISCONNECT_FAILED indicates that partial cleanup may have occurred, and the state cannot be restored to a completely unconfigured state. You can retry based on the returned status. If the binding does not exist in the first place, the API operation returns a placeholder result indicating no binding without creating new resources. An ongoing disconnection task may return the current binding. Do not use this API operation as a substitute for setting loginEnabled=false, syncEnabled=false, or deleting a single token.
      * ## Requests and examples
      * DELETE /workspaces/{workspaceId}/identity-providers/{identityProviderType}
-     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or STS credential that has permissions on the identity source resources of the workspace. The ws-example, URLs, certificates, and tokens in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameter content of the public API, not the extra body wrapper of the backend direct connection API. The response example only shows the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * Calling conventions: Call the API operation in the region of the target workspace, using an AK/STS identity that has the corresponding workspace identity source resource permissions. The ws-example, URLs, certificates, and tokens in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API operation, not the extra body wrapper of the backend direct connection API operation. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not log secrets. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
      * ```text
      * DELETE /workspaces/ws-example/identity-providers/CustomSSO
      * ```
@@ -822,8 +908,10 @@ export default class Client extends OpenApi {
      * }
      * ```
      * ## Errors and handling
-     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call failure to the upstream may return 503 IdentityProviderProvisioningUnavailable. Keep the request ID for troubleshooting and do not interpret a read failure as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
-     * 409 IdentityProvider.Disconnect.Conflict: Users of this identity source still belong to a Team. Remove the references first. 409 IdentityProviderOperationConflict: The current status does not allow disconnection. 404 IdentityProviderNotFound: An external binding exists but the type does not match. An asynchronous failure may result in a partial cleanup. You cannot claim completion based solely on the first response.
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. Synchronous calls to upstream services that fail may return 503 IdentityProviderProvisioningUnavailable. Keep the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
+     * 409 IdentityProvider.Disconnect.Conflict: Users of this identity source still belong to a team. Remove the references first. 409 IdentityProviderOperationConflict: The current status does not allow disconnection. 404 IdentityProviderNotFound: An external binding exists but the type does not match. Asynchronous failures may result in partial cleanup. You cannot claim completion based solely on the first response.
+     * ## Calling relationships and usage boundaries
+     * If you only need to disable a specific capability: To disable SAML logon, use UpdateIdentityProvider and set loginEnabled=false. To disable SCIM, use UpdateIdentityProviderSCIM and set syncEnabled=false. To revoke a single token, use DeleteIdentityProviderSCIMCredential. Call this API operation only when you need to completely disconnect the integration.
      *
      * @param request - DeleteIdentityProviderRequest
      * @param headers - map
@@ -834,15 +922,15 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.DeleteIdentityProviderResponse>;
     /**
-     * Disconnects the external identity provider from a specified workspace and cleans up the users synchronized by the identity provider. The disconnection is an asynchronous operation. After the API returns a response, you can call GetIdentityProvider to query the status and track the progress.
+     * Disconnects the identity source integration of a workspace. For CustomSSO, this operation clears the shared user pool and related SAML and SCIM resources. To disable only logon or synchronization, use the corresponding switch API operations.
      *
      * @remarks
      * ## Features and prerequisites
-     * This is a complete disconnection, not just disabling logon. Disconnecting CustomSSO cleans up the AC users imported from this identity source, remote shared user pools and related resources, logon publishing configurations, and bindings. Therefore, both SAML and SCIM are affected. It does not delete the enterprise applications created by users on external platforms such as Azure. The system first checks the references between users and Teams. If references exist, the disconnection is rejected.
-     * After the request is accepted, the system returns DISCONNECTING. You can call GetIdentityProvider to query the status. The cleanup is complete only when the binding does not exist (IdentityProviderNotFound). The binding should also no longer appear in the list. DISCONNECT_FAILED indicates that a partial cleanup may have occurred and the state cannot be restored to a brand new unconfigured state. You can retry based on the returned status. If the binding does not exist in the first place, the API returns a placeholder result indicating no binding without creating new resources. An ongoing disconnection task may return the current binding. Do not use this API as a substitute for setting loginEnabled=false, syncEnabled=false, or deleting a single token.
+     * This operation completely disconnects the integration, rather than simply disabling logon. Disconnecting CustomSSO clears the AC users imported from this identity source, the remote shared user pool and related resources, and the logon publishing configurations and bindings. Therefore, both SAML and SCIM are affected. However, this operation does not delete the enterprise applications created by users on external platforms such as Azure. Before disconnecting, the system checks for references between users and teams. If references exist, the disconnection is rejected.
+     * After the request is accepted, the status returned is DISCONNECTING. You can query the status by calling GetIdentityProvider. The cleanup is complete only when the binding no longer exists (IdentityProviderNotFound). The binding should also no longer appear in the list. DISCONNECT_FAILED indicates that partial cleanup may have occurred, and the state cannot be restored to a completely unconfigured state. You can retry based on the returned status. If the binding does not exist in the first place, the API operation returns a placeholder result indicating no binding without creating new resources. An ongoing disconnection task may return the current binding. Do not use this API operation as a substitute for setting loginEnabled=false, syncEnabled=false, or deleting a single token.
      * ## Requests and examples
      * DELETE /workspaces/{workspaceId}/identity-providers/{identityProviderType}
-     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or STS credential that has permissions on the identity source resources of the workspace. The ws-example, URLs, certificates, and tokens in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameter content of the public API, not the extra body wrapper of the backend direct connection API. The response example only shows the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * Calling conventions: Call the API operation in the region of the target workspace, using an AK/STS identity that has the corresponding workspace identity source resource permissions. The ws-example, URLs, certificates, and tokens in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API operation, not the extra body wrapper of the backend direct connection API operation. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not log secrets. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
      * ```text
      * DELETE /workspaces/ws-example/identity-providers/CustomSSO
      * ```
@@ -857,13 +945,39 @@ export default class Client extends OpenApi {
      * }
      * ```
      * ## Errors and handling
-     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call failure to the upstream may return 503 IdentityProviderProvisioningUnavailable. Keep the request ID for troubleshooting and do not interpret a read failure as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
-     * 409 IdentityProvider.Disconnect.Conflict: Users of this identity source still belong to a Team. Remove the references first. 409 IdentityProviderOperationConflict: The current status does not allow disconnection. 404 IdentityProviderNotFound: An external binding exists but the type does not match. An asynchronous failure may result in a partial cleanup. You cannot claim completion based solely on the first response.
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. Synchronous calls to upstream services that fail may return 503 IdentityProviderProvisioningUnavailable. Keep the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
+     * 409 IdentityProvider.Disconnect.Conflict: Users of this identity source still belong to a team. Remove the references first. 409 IdentityProviderOperationConflict: The current status does not allow disconnection. 404 IdentityProviderNotFound: An external binding exists but the type does not match. Asynchronous failures may result in partial cleanup. You cannot claim completion based solely on the first response.
+     * ## Calling relationships and usage boundaries
+     * If you only need to disable a specific capability: To disable SAML logon, use UpdateIdentityProvider and set loginEnabled=false. To disable SCIM, use UpdateIdentityProviderSCIM and set syncEnabled=false. To revoke a single token, use DeleteIdentityProviderSCIMCredential. Call this API operation only when you need to completely disconnect the integration.
      *
      * @param request - DeleteIdentityProviderRequest
      * @returns DeleteIdentityProviderResponse
      */
     deleteIdentityProvider(workspaceId: string, identityProviderType: string, request: $_model.DeleteIdentityProviderRequest): Promise<$_model.DeleteIdentityProviderResponse>;
+    /**
+     * 删除 SCIM 凭据
+     *
+     * @remarks
+     * ## 功能与前提\n撤销指定凭据，credentialId 必填且非空，从凭据列表取得。要求共享池可用，但不要求 SAML 已配置或 SCIM 接收为 Enabled。删除后使用该 Token 的外部预配请求会失效；只影响选定凭据，不自动关闭接收、不自动关闭 AC syncEnabled，也不影响另一枚凭据或 SAML。\n即使删除最后一枚凭据，也不自动回写同步开关或重发新 Token；用户应按需要先停用外部预配或更换其使用的 Token。成功返回公共响应，无业务 data 内容；刷新列表确认。对未知或已删除 ID 的结果由上游决定，不承诺统一 404 或无条件幂等成功。\n\n## 请求与示例\nDELETE /workspaces/{workspaceId}/scim-provisioning/credentials/{credentialId}\n调用约定：按目标 Workspace 的地域调用，使用有相应 Workspace 身份源资源权限的 AK/STS 身份。下文示例中的 ws-example、URL、证书和 Token 均为占位值，需替换为真实值。请求体示例表示公开 API 的 body 参数内容，不是后端直连接口额外的 body 包装。返回示例只展示业务部分，外层还包括 requestId、success、code、message、httpStatusCode；排障请保留 requestId，不记录密钥。业务任务异步不意味着 HTTP 请求长连接等待完成。\n```text\nDELETE /workspaces/ws-example/scim-provisioning/credentials/credential-example\n```\n\n## 返回示例\n```json\n{\n  "success": true,\n  "httpStatusCode": 200\n}\n```\n\n## 错误与处理\n错误处理：400 InvalidParameter 表示参数或当前配置前提不满足；404 IdentityProviderNotFound 表示没有匹配类型的绑定。同步调用上游失败可能返回 503 IdentityProviderProvisioningUnavailable；保留请求 ID 排查，不把读取失败解释为未配置。实际鉴权和 Workspace 不存在错误沿用公共错误处理。\n400 InvalidParameter：credentialId 为空或共享池不可用。404 IdentityProviderNotFound 指绑定不存在，不代表所有未知凭据 ID 都返回该码。其他删除错误按上游结果处理，失败时刷新列表核对，不自动创建替代 Token。\n\n## 调用关系与使用边界\n使用 ListIdentityProviderSCIMCredentials 取得 credentialId 后删除指定凭据。若外部预配系统仍使用该 Token，后续预配可能鉴权失败，因此应先确认实际使用情况。删除后不会自动创建新凭据、关闭 AC 同步开关或关闭 SAML 登录。
+     *
+     * @param request - DeleteIdentityProviderSCIMCredentialRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns DeleteIdentityProviderSCIMCredentialResponse
+     */
+    deleteIdentityProviderSCIMCredentialWithOptions(workspaceId: string, credentialId: string, request: $_model.DeleteIdentityProviderSCIMCredentialRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.DeleteIdentityProviderSCIMCredentialResponse>;
+    /**
+     * 删除 SCIM 凭据
+     *
+     * @remarks
+     * ## 功能与前提\n撤销指定凭据，credentialId 必填且非空，从凭据列表取得。要求共享池可用，但不要求 SAML 已配置或 SCIM 接收为 Enabled。删除后使用该 Token 的外部预配请求会失效；只影响选定凭据，不自动关闭接收、不自动关闭 AC syncEnabled，也不影响另一枚凭据或 SAML。\n即使删除最后一枚凭据，也不自动回写同步开关或重发新 Token；用户应按需要先停用外部预配或更换其使用的 Token。成功返回公共响应，无业务 data 内容；刷新列表确认。对未知或已删除 ID 的结果由上游决定，不承诺统一 404 或无条件幂等成功。\n\n## 请求与示例\nDELETE /workspaces/{workspaceId}/scim-provisioning/credentials/{credentialId}\n调用约定：按目标 Workspace 的地域调用，使用有相应 Workspace 身份源资源权限的 AK/STS 身份。下文示例中的 ws-example、URL、证书和 Token 均为占位值，需替换为真实值。请求体示例表示公开 API 的 body 参数内容，不是后端直连接口额外的 body 包装。返回示例只展示业务部分，外层还包括 requestId、success、code、message、httpStatusCode；排障请保留 requestId，不记录密钥。业务任务异步不意味着 HTTP 请求长连接等待完成。\n```text\nDELETE /workspaces/ws-example/scim-provisioning/credentials/credential-example\n```\n\n## 返回示例\n```json\n{\n  "success": true,\n  "httpStatusCode": 200\n}\n```\n\n## 错误与处理\n错误处理：400 InvalidParameter 表示参数或当前配置前提不满足；404 IdentityProviderNotFound 表示没有匹配类型的绑定。同步调用上游失败可能返回 503 IdentityProviderProvisioningUnavailable；保留请求 ID 排查，不把读取失败解释为未配置。实际鉴权和 Workspace 不存在错误沿用公共错误处理。\n400 InvalidParameter：credentialId 为空或共享池不可用。404 IdentityProviderNotFound 指绑定不存在，不代表所有未知凭据 ID 都返回该码。其他删除错误按上游结果处理，失败时刷新列表核对，不自动创建替代 Token。\n\n## 调用关系与使用边界\n使用 ListIdentityProviderSCIMCredentials 取得 credentialId 后删除指定凭据。若外部预配系统仍使用该 Token，后续预配可能鉴权失败，因此应先确认实际使用情况。删除后不会自动创建新凭据、关闭 AC 同步开关或关闭 SAML 登录。
+     *
+     * @param request - DeleteIdentityProviderSCIMCredentialRequest
+     * @returns DeleteIdentityProviderSCIMCredentialResponse
+     */
+    deleteIdentityProviderSCIMCredential(workspaceId: string, credentialId: string, request: $_model.DeleteIdentityProviderSCIMCredentialRequest): Promise<$_model.DeleteIdentityProviderSCIMCredentialResponse>;
     /**
      * Deletes an image cache.
      *
@@ -1559,19 +1673,19 @@ export default class Client extends OpenApi {
      */
     getExternalAgentBootstrapOptions(workspaceId: string, agentId: string, request: $_model.GetExternalAgentBootstrapOptionsRequest): Promise<$_model.GetExternalAgentBootstrapOptionsResponse>;
     /**
-     * Queries the binding details of an external identity provider for a specified workspace, including the binding status, application configurations, and the callback URL to be configured on the identity provider side. Application secret configurations are not returned.
+     * Queries the binding and expected configuration of a specified identity provider. When CustomSSO is configured with SAML, this operation reads back the actual upstream SSO configuration. The SCIM status is queried through a separate API operation.
      *
      * @remarks
      * ## Features and prerequisites
-     * Reads existing bindings by type. For CustomSSO, the API returns the saved protocol, standardized SAML, expected loginEnabled, syncEnabled, and shared binding status. If SAML is not configured, the saml and configuration fields may not be returned. If SAML is configured, the API additionally queries AgentIdentity, and the configuration field represents the actual SSO/JIT configuration. The saml field serves as the data source for the edit form. The status switches in the configuration field are Enabled and Disabled. If the upstream query fails, an error is returned. This failure must not be treated as an unconfigured state.
-     * Only this API reads back the actual SAML configuration. The list and write APIs do not guarantee that the configuration field is returned. A READY user pool does not indicate that SAML is configured. The UPDATING and UPDATE_FAILED statuses describe logon configuration tasks, not SCIM tasks. The vendor callback URL for CustomSSO is empty. Use GetIdentityProviderSCIM.operationStatus to query SCIM operation results.
-     * ## Requests and examples
+     * Reads existing bindings by type. CustomSSO returns the saved protocol, standardized saml, expected loginEnabled, syncEnabled, and shared binding status. If SAML is not configured, the saml and configuration fields may not be returned. When saml is configured, the system additionally queries AgentIdentity, and configuration represents the actual SSO configuration. The saml field is the data source for the edit form. The status switch for configuration can be Enabled or Disabled. If the upstream query fails, an error is reported. Do not treat this as an unconfigured state.
+     * Only this operation reads back the actual SAML configuration. List and write operations do not guarantee that configuration is returned. A user pool in the READY state does not indicate that SAML is configured. UPDATING and UPDATE_FAILED describe logon configuration tasks, not SCIM tasks. The vendor callback URL for CustomSSO is empty. Use GetIdentityProviderSCIM.operationStatus to query SCIM operation results.
+     * ## Request and examples
      * GET /workspaces/{workspaceId}/identity-providers/{identityProviderType}
-     * Calling convention: Call this API in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity source resources of the workspace. The ws-example, URLs, certificates, and tokens in the following examples are placeholder values and must be replaced with actual values. The request body example shows the body parameters of the public API, rather than the extra body wrapper of the backend direct-connection API. The response example shows only the business data. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not log secrets. Asynchronous business tasks do not imply that the HTTP request uses a persistent connection to wait for completion.
+     * Calling conventions: Call the API operation in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity provider resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request body example shows the body parameters of the public API operation, not the extra body wrapper of the backend direct connection API operation. The response example shows only the business data. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not log keys. Asynchronous business tasks do not mean that the HTTP request uses a persistent connection to wait for completion.
      * ```text
      * GET /workspaces/ws-example/identity-providers/CustomSSO
      * ```
-     * ## Response example
+     * ## Response examples
      * ```json
      * {
      *   "data": {
@@ -1584,8 +1698,10 @@ export default class Client extends OpenApi {
      * }
      * ```
      * ## Errors and handling
-     * Error handling: A 400 InvalidParameter error indicates that the parameters or current configuration prerequisites are not met. A 404 IdentityProviderNotFound error indicates that no binding of the specified type exists. Synchronous calls to the upstream service may return a 503 IdentityProviderProvisioningUnavailable error if they fail. Retain the request ID for troubleshooting and do not interpret read failures as an unconfigured state. Authentication errors and workspace-not-found errors follow common error handling procedures.
-     * 404 IdentityProviderNotFound: No binding exists, or the specified type is inconsistent with the current binding. If SAML is already configured, an upstream read failure does not degrade to a successful empty configuration.
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call to the upstream service may fail and return 503 IdentityProviderProvisioningUnavailable. Keep the request ID for troubleshooting and do not interpret a read failure as an unconfigured state. Actual authentication and workspace not found errors follow common error handling.
+     * 404 IdentityProviderNotFound: No binding exists, or the input type is inconsistent with the current binding. If SAML is already configured, an upstream readback failure does not degrade to a successful empty configuration.
+     * ## Call relationships and usage boundaries
+     * SAML configuration completion and logon enabling are independent operations. protocol=SAML and the presence of saml indicate that the logon configuration has been submitted, and loginEnabled indicates the expected logon switch. Check the effective status based on the actual SSO status in configuration. SCIM uses an independent query API operation. Do not use status=READY of this API operation as the basis for successful SCIM synchronization. Currently, OIDC, JIT configuration, or JIT status fields are not provided.
      *
      * @param request - GetIdentityProviderRequest
      * @param headers - map
@@ -1596,19 +1712,19 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.GetIdentityProviderResponse>;
     /**
-     * Queries the binding details of an external identity provider for a specified workspace, including the binding status, application configurations, and the callback URL to be configured on the identity provider side. Application secret configurations are not returned.
+     * Queries the binding and expected configuration of a specified identity provider. When CustomSSO is configured with SAML, this operation reads back the actual upstream SSO configuration. The SCIM status is queried through a separate API operation.
      *
      * @remarks
      * ## Features and prerequisites
-     * Reads existing bindings by type. For CustomSSO, the API returns the saved protocol, standardized SAML, expected loginEnabled, syncEnabled, and shared binding status. If SAML is not configured, the saml and configuration fields may not be returned. If SAML is configured, the API additionally queries AgentIdentity, and the configuration field represents the actual SSO/JIT configuration. The saml field serves as the data source for the edit form. The status switches in the configuration field are Enabled and Disabled. If the upstream query fails, an error is returned. This failure must not be treated as an unconfigured state.
-     * Only this API reads back the actual SAML configuration. The list and write APIs do not guarantee that the configuration field is returned. A READY user pool does not indicate that SAML is configured. The UPDATING and UPDATE_FAILED statuses describe logon configuration tasks, not SCIM tasks. The vendor callback URL for CustomSSO is empty. Use GetIdentityProviderSCIM.operationStatus to query SCIM operation results.
-     * ## Requests and examples
+     * Reads existing bindings by type. CustomSSO returns the saved protocol, standardized saml, expected loginEnabled, syncEnabled, and shared binding status. If SAML is not configured, the saml and configuration fields may not be returned. When saml is configured, the system additionally queries AgentIdentity, and configuration represents the actual SSO configuration. The saml field is the data source for the edit form. The status switch for configuration can be Enabled or Disabled. If the upstream query fails, an error is reported. Do not treat this as an unconfigured state.
+     * Only this operation reads back the actual SAML configuration. List and write operations do not guarantee that configuration is returned. A user pool in the READY state does not indicate that SAML is configured. UPDATING and UPDATE_FAILED describe logon configuration tasks, not SCIM tasks. The vendor callback URL for CustomSSO is empty. Use GetIdentityProviderSCIM.operationStatus to query SCIM operation results.
+     * ## Request and examples
      * GET /workspaces/{workspaceId}/identity-providers/{identityProviderType}
-     * Calling convention: Call this API in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity source resources of the workspace. The ws-example, URLs, certificates, and tokens in the following examples are placeholder values and must be replaced with actual values. The request body example shows the body parameters of the public API, rather than the extra body wrapper of the backend direct-connection API. The response example shows only the business data. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not log secrets. Asynchronous business tasks do not imply that the HTTP request uses a persistent connection to wait for completion.
+     * Calling conventions: Call the API operation in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity provider resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request body example shows the body parameters of the public API operation, not the extra body wrapper of the backend direct connection API operation. The response example shows only the business data. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not log keys. Asynchronous business tasks do not mean that the HTTP request uses a persistent connection to wait for completion.
      * ```text
      * GET /workspaces/ws-example/identity-providers/CustomSSO
      * ```
-     * ## Response example
+     * ## Response examples
      * ```json
      * {
      *   "data": {
@@ -1621,13 +1737,115 @@ export default class Client extends OpenApi {
      * }
      * ```
      * ## Errors and handling
-     * Error handling: A 400 InvalidParameter error indicates that the parameters or current configuration prerequisites are not met. A 404 IdentityProviderNotFound error indicates that no binding of the specified type exists. Synchronous calls to the upstream service may return a 503 IdentityProviderProvisioningUnavailable error if they fail. Retain the request ID for troubleshooting and do not interpret read failures as an unconfigured state. Authentication errors and workspace-not-found errors follow common error handling procedures.
-     * 404 IdentityProviderNotFound: No binding exists, or the specified type is inconsistent with the current binding. If SAML is already configured, an upstream read failure does not degrade to a successful empty configuration.
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call to the upstream service may fail and return 503 IdentityProviderProvisioningUnavailable. Keep the request ID for troubleshooting and do not interpret a read failure as an unconfigured state. Actual authentication and workspace not found errors follow common error handling.
+     * 404 IdentityProviderNotFound: No binding exists, or the input type is inconsistent with the current binding. If SAML is already configured, an upstream readback failure does not degrade to a successful empty configuration.
+     * ## Call relationships and usage boundaries
+     * SAML configuration completion and logon enabling are independent operations. protocol=SAML and the presence of saml indicate that the logon configuration has been submitted, and loginEnabled indicates the expected logon switch. Check the effective status based on the actual SSO status in configuration. SCIM uses an independent query API operation. Do not use status=READY of this API operation as the basis for successful SCIM synchronization. Currently, OIDC, JIT configuration, or JIT status fields are not provided.
      *
      * @param request - GetIdentityProviderRequest
      * @returns GetIdentityProviderResponse
      */
     getIdentityProvider(workspaceId: string, identityProviderType: string, request: $_model.GetIdentityProviderRequest): Promise<$_model.GetIdentityProviderResponse>;
+    /**
+     * Queries the actual SCIM receiving configuration, the expected AC synchronization switch, and the status of the most recent independent SCIM task. Prior SAML configuration is not required.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * The shared CustomSSO user pool must be created and must not be in the overall dissociation process or have failed to be dissociated. Prior SAML configuration is not required. SAML updates in progress or failed SAML updates do not block the query. The configuration.status and baseUrl parameters are obtained from AgentIdentity. The syncEnabled parameter is the expected AC synchronization switch. The operationStatus parameter indicates the most recent independent SCIM switch and the first full import task when the switch is enabled. The presence of a URL does not mean that external provisioning is complete, nor does it mean that AC synchronization is enabled.
+     * operationStatus: PENDING (waiting), RUNNING (in progress), PAUSED (paused), SUCCESS (succeeded), FAILED (failed), CANCELED (canceled). If there are no historical tasks, it returns null or is not returned. You can poll when the status is PENDING or RUNNING. Stop polling when a terminal state is reached. You can manually refresh when the status is PAUSED. This operation does not provide taskId or failure details, and does not indicate credential issuance, external provisioning connection tests, or the health of continuous incremental synchronization. After it is disabled, the URL, credentials, and historical task records may still be retained.
+     * ## Requests and examples
+     * GET /workspaces/{workspaceId}/scim-provisioning
+     * Calling conventions: Call this operation in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity provider resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API operation, not the extra body wrapper of the backend direct connection API operation. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * ```text
+     * GET /workspaces/ws-example/scim-provisioning
+     * ```
+     * ## Response example
+     * ```json
+     * {
+     *   "data": {
+     *     "configuration": {
+     *       "status": "Enabled",
+     *       "baseUrl": "https://example.com/scim/v2"
+     *     },
+     *     "syncEnabled": true,
+     *     "operationStatus": "SUCCESS"
+     *   }
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that there is no binding of the matching type. Synchronous calls to upstream services that fail may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow common error handling.
+     * 400 InvalidParameter: The shared user pool is unavailable, being dissociated, or failed to be dissociated. If there is no binding, 404 IdentityProviderNotFound is returned. Upstream read failures must retain the error and cannot be mapped to Disabled, unconfigured, or synchronization success.
+     * ## Call relationships and usage boundaries
+     * SCIM configuration sequence: After preparing the shared pool, call PrepareIdentityProviderSCIM and configure the returned baseUrl and newly issued token to the provisioning system of the external IdP. After completing the external connection test, call UpdateIdentityProviderSCIM to enable synchronization, and then call this operation to query operationStatus. SUCCESS only indicates that the most recent SCIM task is completed, and does not represent the health of continuous incremental synchronization or the success of the external provisioning connection test.
+     *
+     * @param request - GetIdentityProviderSCIMRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns GetIdentityProviderSCIMResponse
+     */
+    getIdentityProviderSCIMWithOptions(workspaceId: string, request: $_model.GetIdentityProviderSCIMRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.GetIdentityProviderSCIMResponse>;
+    /**
+     * Queries the actual SCIM receiving configuration, the expected AC synchronization switch, and the status of the most recent independent SCIM task. Prior SAML configuration is not required.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * The shared CustomSSO user pool must be created and must not be in the overall dissociation process or have failed to be dissociated. Prior SAML configuration is not required. SAML updates in progress or failed SAML updates do not block the query. The configuration.status and baseUrl parameters are obtained from AgentIdentity. The syncEnabled parameter is the expected AC synchronization switch. The operationStatus parameter indicates the most recent independent SCIM switch and the first full import task when the switch is enabled. The presence of a URL does not mean that external provisioning is complete, nor does it mean that AC synchronization is enabled.
+     * operationStatus: PENDING (waiting), RUNNING (in progress), PAUSED (paused), SUCCESS (succeeded), FAILED (failed), CANCELED (canceled). If there are no historical tasks, it returns null or is not returned. You can poll when the status is PENDING or RUNNING. Stop polling when a terminal state is reached. You can manually refresh when the status is PAUSED. This operation does not provide taskId or failure details, and does not indicate credential issuance, external provisioning connection tests, or the health of continuous incremental synchronization. After it is disabled, the URL, credentials, and historical task records may still be retained.
+     * ## Requests and examples
+     * GET /workspaces/{workspaceId}/scim-provisioning
+     * Calling conventions: Call this operation in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity provider resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API operation, not the extra body wrapper of the backend direct connection API operation. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * ```text
+     * GET /workspaces/ws-example/scim-provisioning
+     * ```
+     * ## Response example
+     * ```json
+     * {
+     *   "data": {
+     *     "configuration": {
+     *       "status": "Enabled",
+     *       "baseUrl": "https://example.com/scim/v2"
+     *     },
+     *     "syncEnabled": true,
+     *     "operationStatus": "SUCCESS"
+     *   }
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that there is no binding of the matching type. Synchronous calls to upstream services that fail may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow common error handling.
+     * 400 InvalidParameter: The shared user pool is unavailable, being dissociated, or failed to be dissociated. If there is no binding, 404 IdentityProviderNotFound is returned. Upstream read failures must retain the error and cannot be mapped to Disabled, unconfigured, or synchronization success.
+     * ## Call relationships and usage boundaries
+     * SCIM configuration sequence: After preparing the shared pool, call PrepareIdentityProviderSCIM and configure the returned baseUrl and newly issued token to the provisioning system of the external IdP. After completing the external connection test, call UpdateIdentityProviderSCIM to enable synchronization, and then call this operation to query operationStatus. SUCCESS only indicates that the most recent SCIM task is completed, and does not represent the health of continuous incremental synchronization or the success of the external provisioning connection test.
+     *
+     * @param request - GetIdentityProviderSCIMRequest
+     * @returns GetIdentityProviderSCIMResponse
+     */
+    getIdentityProviderSCIM(workspaceId: string, request: $_model.GetIdentityProviderSCIMRequest): Promise<$_model.GetIdentityProviderSCIMResponse>;
+    /**
+     * 查询 SAML 服务提供商信息
+     *
+     * @remarks
+     * ## 功能与前提\n要求已有可用 CustomSSO 共享用户池，identityProviderType=CustomSSO，protocol 必填且仅支持精确值 SAML；不要求先上传 IdP Metadata。返回我方 SP 的 entityId、acsUrl、metadataXml，供用户配置外部 IdP。它们不是外部 IdP 的登录 URL 或 IdP Entity ID，不能将 SP XML 作为 IdP XML 提交 UpdateIdentityProvider。\n本接口只读取，不启用登录、不开启 SCIM、不创建凭据、不执行登录连接测试。共享池初始化中、解绑中或解绑失败时不可读取。\n\n## 请求与示例\nGET /workspaces/{workspaceId}/identity-providers/{identityProviderType}/service-provider\n调用约定：按目标 Workspace 的地域调用，使用有相应 Workspace 身份源资源权限的 AK/STS 身份。下文示例中的 ws-example、URL、证书和 Token 均为占位值，需替换为真实值。请求体示例表示公开 API 的 body 参数内容，不是后端直连接口额外的 body 包装。返回示例只展示业务部分，外层还包括 requestId、success、code、message、httpStatusCode；排障请保留 requestId，不记录密钥。业务任务异步不意味着 HTTP 请求长连接等待完成。\n```text\nGET /workspaces/ws-example/identity-providers/CustomSSO/service-provider?protocol=SAML\n```\n\n## 返回示例\n```json\n{\n  "data": {\n    "protocol": "SAML",\n    "entityId": "<我方 SP Entity ID>",\n    "acsUrl": "https://example.com/saml/acs",\n    "metadataXml": "<我方 SP Metadata XML>"\n  }\n}\n```\n\n## 错误与处理\n错误处理：400 InvalidParameter 表示参数或当前配置前提不满足；404 IdentityProviderNotFound 表示没有匹配类型的绑定。同步调用上游失败可能返回 503 IdentityProviderProvisioningUnavailable；保留请求 ID 排查，不把读取失败解释为未配置。实际鉴权和 Workspace 不存在错误沿用公共错误处理。\n400 InvalidParameter：identityProviderType 或 protocol 不支持。404 IdentityProviderNotFound：尚无 CustomSSO 绑定。409 IdentityProviderOperationConflict：用户池未准备好、解绑中或解绑失败。\n\n## 调用关系与使用边界\nSAML 配置顺序：CreateIdentityProvider 初始化 CustomSSO 共享池，等待 GetIdentityProvider 返回 READY；调用本接口取得 SP 信息并配置到外部 IdP；再将外部 IdP Metadata XML 或完整手填配置提交 UpdateIdentityProvider。保存后按需单独启用 loginEnabled。SP 信息查询不会完成外部 IdP 配置或验证登录。
+     *
+     * @param request - GetIdentityProviderServiceProviderRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns GetIdentityProviderServiceProviderResponse
+     */
+    getIdentityProviderServiceProviderWithOptions(workspaceId: string, identityProviderType: string, request: $_model.GetIdentityProviderServiceProviderRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.GetIdentityProviderServiceProviderResponse>;
+    /**
+     * 查询 SAML 服务提供商信息
+     *
+     * @remarks
+     * ## 功能与前提\n要求已有可用 CustomSSO 共享用户池，identityProviderType=CustomSSO，protocol 必填且仅支持精确值 SAML；不要求先上传 IdP Metadata。返回我方 SP 的 entityId、acsUrl、metadataXml，供用户配置外部 IdP。它们不是外部 IdP 的登录 URL 或 IdP Entity ID，不能将 SP XML 作为 IdP XML 提交 UpdateIdentityProvider。\n本接口只读取，不启用登录、不开启 SCIM、不创建凭据、不执行登录连接测试。共享池初始化中、解绑中或解绑失败时不可读取。\n\n## 请求与示例\nGET /workspaces/{workspaceId}/identity-providers/{identityProviderType}/service-provider\n调用约定：按目标 Workspace 的地域调用，使用有相应 Workspace 身份源资源权限的 AK/STS 身份。下文示例中的 ws-example、URL、证书和 Token 均为占位值，需替换为真实值。请求体示例表示公开 API 的 body 参数内容，不是后端直连接口额外的 body 包装。返回示例只展示业务部分，外层还包括 requestId、success、code、message、httpStatusCode；排障请保留 requestId，不记录密钥。业务任务异步不意味着 HTTP 请求长连接等待完成。\n```text\nGET /workspaces/ws-example/identity-providers/CustomSSO/service-provider?protocol=SAML\n```\n\n## 返回示例\n```json\n{\n  "data": {\n    "protocol": "SAML",\n    "entityId": "<我方 SP Entity ID>",\n    "acsUrl": "https://example.com/saml/acs",\n    "metadataXml": "<我方 SP Metadata XML>"\n  }\n}\n```\n\n## 错误与处理\n错误处理：400 InvalidParameter 表示参数或当前配置前提不满足；404 IdentityProviderNotFound 表示没有匹配类型的绑定。同步调用上游失败可能返回 503 IdentityProviderProvisioningUnavailable；保留请求 ID 排查，不把读取失败解释为未配置。实际鉴权和 Workspace 不存在错误沿用公共错误处理。\n400 InvalidParameter：identityProviderType 或 protocol 不支持。404 IdentityProviderNotFound：尚无 CustomSSO 绑定。409 IdentityProviderOperationConflict：用户池未准备好、解绑中或解绑失败。\n\n## 调用关系与使用边界\nSAML 配置顺序：CreateIdentityProvider 初始化 CustomSSO 共享池，等待 GetIdentityProvider 返回 READY；调用本接口取得 SP 信息并配置到外部 IdP；再将外部 IdP Metadata XML 或完整手填配置提交 UpdateIdentityProvider。保存后按需单独启用 loginEnabled。SP 信息查询不会完成外部 IdP 配置或验证登录。
+     *
+     * @param request - GetIdentityProviderServiceProviderRequest
+     * @returns GetIdentityProviderServiceProviderResponse
+     */
+    getIdentityProviderServiceProvider(workspaceId: string, identityProviderType: string, request: $_model.GetIdentityProviderServiceProviderRequest): Promise<$_model.GetIdentityProviderServiceProviderResponse>;
     /**
      * Queries an identity provider synchronization task.
      *
@@ -2506,7 +2724,31 @@ export default class Client extends OpenApi {
      * Queries the departments of an identity provider by page.
      *
      * @remarks
-     * Queries DingTalk or Feishu departments by hierarchy and page. Prerequisites include a bound identity provider, a user pool, valid application credentials, and address book read authorization. If you do not specify parentDepartmentId, the root hierarchy is queried. When expanding a node, specify the ID of the node to query its direct child departments. The hasChildren field indicates whether the node can be expanded and does not mean that child nodes are returned. The nextToken field is used only to query the next page of child departments under the current parent department. This query only reads the directory. It does not save the synchronization scope or import users. If a new department is added to a DingTalk or Feishu organization, re-query the corresponding parent department because the previous list does not reflect the latest directory.\\n\\nAuthorization information: The RAM action is agentcore:ListIdentityProviderDepartments, the access level is List, and the resource ARN is acs:agentcore:{regionId}:{accountId}:workspace/{workspaceId}/identityProvider/{identityProviderType}. This resource is required for authorization.\\n\\nIdempotency and retry: This operation is read-only and can be called repeatedly.\\n\\nCalling this API is free of charge. Operation records support ActionTrail auditing.\\n\\nResponse example:\\n```json\\n{\\n  "requestId": "01234567-89AB-CDEF-0123-456789ABCDEF",\\n  "message": "success",\\n  "httpStatusCode": 200,\\n  "code": "SUCCESS",\\n  "success": true,\\n  "maxResults": 50,\\n  "nextToken": "",\\n  "items": [\\n    {\\n      "id": "10001",\\n      "name": "R&D Department",\\n      "parentId": "1",\\n      "memberCount": 12,\\n      "hasChildren": true\\n    }\\n  ]\\n}\\n```
+     * Queries DingTalk or Lark departments by hierarchy and page. Prerequisites include an existing identity provider binding, a user pool, valid application credentials, and address book read authorization. If parentDepartmentId is not specified, the root hierarchy is queried. When expanding a node, use the ID of the node to query its direct child departments. The hasChildren field is used to determine expandability and does not indicate that child nodes have been returned. The nextToken field is only used to continue querying the next page under the current parent department. The query only reads the directory, does not save the synchronization scope, and does not import users. After a new department is added to a DingTalk or Lark organization, re-query the corresponding parent department because the old list does not represent the latest directory.
+     * Authorization information: The RAM operation is agentcore:ListIdentityProviderDepartments, the access level is List, and the resource ARN is acs:agentcore:{regionId}:{accountId}:workspace/{workspaceId}/identityProvider/{identityProviderType}. This resource requires authorization.
+     * Idempotence and retry: This operation is read-only and can be invoked repeatedly.
+     * It is free of charge to invoke this API operation, and operation records support ActionTrail auditing.
+     * Sample response:
+     * ```json
+     * {
+     *   "requestId": "01234567-89AB-CDEF-0123-456789ABCDEF",
+     *   "message": "success",
+     *   "httpStatusCode": 200,
+     *   "code": "SUCCESS",
+     *   "success": true,
+     *   "maxResults": 50,
+     *   "nextToken": "",
+     *   "items": [
+     *     {
+     *       "id": "10001",
+     *       "name": "R&D Department",
+     *       "parentId": "1",
+     *       "memberCount": 12,
+     *       "hasChildren": true
+     *     }
+     *   ]
+     * }
+     * ```
      *
      * @param request - ListIdentityProviderDepartmentsRequest
      * @param headers - map
@@ -2520,26 +2762,126 @@ export default class Client extends OpenApi {
      * Queries the departments of an identity provider by page.
      *
      * @remarks
-     * Queries DingTalk or Feishu departments by hierarchy and page. Prerequisites include a bound identity provider, a user pool, valid application credentials, and address book read authorization. If you do not specify parentDepartmentId, the root hierarchy is queried. When expanding a node, specify the ID of the node to query its direct child departments. The hasChildren field indicates whether the node can be expanded and does not mean that child nodes are returned. The nextToken field is used only to query the next page of child departments under the current parent department. This query only reads the directory. It does not save the synchronization scope or import users. If a new department is added to a DingTalk or Feishu organization, re-query the corresponding parent department because the previous list does not reflect the latest directory.\\n\\nAuthorization information: The RAM action is agentcore:ListIdentityProviderDepartments, the access level is List, and the resource ARN is acs:agentcore:{regionId}:{accountId}:workspace/{workspaceId}/identityProvider/{identityProviderType}. This resource is required for authorization.\\n\\nIdempotency and retry: This operation is read-only and can be called repeatedly.\\n\\nCalling this API is free of charge. Operation records support ActionTrail auditing.\\n\\nResponse example:\\n```json\\n{\\n  "requestId": "01234567-89AB-CDEF-0123-456789ABCDEF",\\n  "message": "success",\\n  "httpStatusCode": 200,\\n  "code": "SUCCESS",\\n  "success": true,\\n  "maxResults": 50,\\n  "nextToken": "",\\n  "items": [\\n    {\\n      "id": "10001",\\n      "name": "R&D Department",\\n      "parentId": "1",\\n      "memberCount": 12,\\n      "hasChildren": true\\n    }\\n  ]\\n}\\n```
+     * Queries DingTalk or Lark departments by hierarchy and page. Prerequisites include an existing identity provider binding, a user pool, valid application credentials, and address book read authorization. If parentDepartmentId is not specified, the root hierarchy is queried. When expanding a node, use the ID of the node to query its direct child departments. The hasChildren field is used to determine expandability and does not indicate that child nodes have been returned. The nextToken field is only used to continue querying the next page under the current parent department. The query only reads the directory, does not save the synchronization scope, and does not import users. After a new department is added to a DingTalk or Lark organization, re-query the corresponding parent department because the old list does not represent the latest directory.
+     * Authorization information: The RAM operation is agentcore:ListIdentityProviderDepartments, the access level is List, and the resource ARN is acs:agentcore:{regionId}:{accountId}:workspace/{workspaceId}/identityProvider/{identityProviderType}. This resource requires authorization.
+     * Idempotence and retry: This operation is read-only and can be invoked repeatedly.
+     * It is free of charge to invoke this API operation, and operation records support ActionTrail auditing.
+     * Sample response:
+     * ```json
+     * {
+     *   "requestId": "01234567-89AB-CDEF-0123-456789ABCDEF",
+     *   "message": "success",
+     *   "httpStatusCode": 200,
+     *   "code": "SUCCESS",
+     *   "success": true,
+     *   "maxResults": 50,
+     *   "nextToken": "",
+     *   "items": [
+     *     {
+     *       "id": "10001",
+     *       "name": "R&D Department",
+     *       "parentId": "1",
+     *       "memberCount": 12,
+     *       "hasChildren": true
+     *     }
+     *   ]
+     * }
+     * ```
      *
      * @param request - ListIdentityProviderDepartmentsRequest
      * @returns ListIdentityProviderDepartmentsResponse
      */
     listIdentityProviderDepartments(workspaceId: string, identityProviderType: string, request: $_model.ListIdentityProviderDepartmentsRequest): Promise<$_model.ListIdentityProviderDepartmentsResponse>;
     /**
-     * Queries the external identity providers bound to a specified workspace. Each workspace can be bound to at most one external identity provider, so the response returns at most one record. Application secret configurations are not returned.
+     * Queries the complete summary list of up to two SCIM credentials in the shared user pool, without returning plaintext tokens or supporting pagination.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * Retrieves the current credential summary list from AgentIdentity and returns a data array. Each item contains credentialId, status, createTime, and expireTime. If no credentials exist, an empty array is returned. This operation does not support maxResults, nextToken, or pagination. Do not call this operation with fake pagination fields. The list never returns plaintext tokens, nor does it enable the receiving or issuing of new credentials.
+     * Receiving is not required to be enabled, but the shared pool must be available. A credential is considered available if its status is Enabled and its expireTime is later than the current time. The maximum limit of two credentials is determined by AgentIdentity. Client-side counting is for reference only. The list may contain unavailable or expired credentials. Do not use this list to claim that available tokens exist.
+     * ## Requests and examples
+     * GET /workspaces/{workspaceId}/scim-provisioning/credentials
+     * Call conventions: Call this operation in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity source resources of the workspace. The ws-example, URL, certificate, and token in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API operation, not the extra body wrapper of the backend direct connection API operation. The response example shows only the business data. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a persistent connection to wait for completion.
+     * ```text
+     * GET /workspaces/ws-example/scim-provisioning/credentials
+     * ```
+     * ## Response examples
+     * ```json
+     * {
+     *   "data": [
+     *     {
+     *       "credentialId": "credential-example",
+     *       "status": "Enabled",
+     *       "createTime": "<Upstream creation time>",
+     *       "expireTime": "<Upstream expiration time>"
+     *     }
+     *   ]
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. Synchronous calls to the upstream service that fail may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling process.
+     * 400 InvalidParameter: The shared user pool is unavailable. 404 IdentityProviderNotFound: No corresponding binding exists. Upstream query failures cannot be replaced with an empty list, which may mislead users into repeatedly creating credentials.
+     * ## Call relationships and usage boundaries
+     * Used for configuration recovery and credential management: Existing plaintext tokens cannot be queried and retrieved again. The list provides only credential summaries. To obtain a new token, call CreateIdentityProviderSCIMCredential. To revoke a credential, submit the credentialId from the list to DeleteIdentityProviderSCIMCredential. A maximum of two credentials are allowed in the same pool. This operation returns the complete array and does not support or fabricate pagination parameters.
+     *
+     * @param request - ListIdentityProviderSCIMCredentialsRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns ListIdentityProviderSCIMCredentialsResponse
+     */
+    listIdentityProviderSCIMCredentialsWithOptions(workspaceId: string, request: $_model.ListIdentityProviderSCIMCredentialsRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.ListIdentityProviderSCIMCredentialsResponse>;
+    /**
+     * Queries the complete summary list of up to two SCIM credentials in the shared user pool, without returning plaintext tokens or supporting pagination.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * Retrieves the current credential summary list from AgentIdentity and returns a data array. Each item contains credentialId, status, createTime, and expireTime. If no credentials exist, an empty array is returned. This operation does not support maxResults, nextToken, or pagination. Do not call this operation with fake pagination fields. The list never returns plaintext tokens, nor does it enable the receiving or issuing of new credentials.
+     * Receiving is not required to be enabled, but the shared pool must be available. A credential is considered available if its status is Enabled and its expireTime is later than the current time. The maximum limit of two credentials is determined by AgentIdentity. Client-side counting is for reference only. The list may contain unavailable or expired credentials. Do not use this list to claim that available tokens exist.
+     * ## Requests and examples
+     * GET /workspaces/{workspaceId}/scim-provisioning/credentials
+     * Call conventions: Call this operation in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity source resources of the workspace. The ws-example, URL, certificate, and token in the following examples are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API operation, not the extra body wrapper of the backend direct connection API operation. The response example shows only the business data. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a persistent connection to wait for completion.
+     * ```text
+     * GET /workspaces/ws-example/scim-provisioning/credentials
+     * ```
+     * ## Response examples
+     * ```json
+     * {
+     *   "data": [
+     *     {
+     *       "credentialId": "credential-example",
+     *       "status": "Enabled",
+     *       "createTime": "<Upstream creation time>",
+     *       "expireTime": "<Upstream expiration time>"
+     *     }
+     *   ]
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. Synchronous calls to the upstream service that fail may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling process.
+     * 400 InvalidParameter: The shared user pool is unavailable. 404 IdentityProviderNotFound: No corresponding binding exists. Upstream query failures cannot be replaced with an empty list, which may mislead users into repeatedly creating credentials.
+     * ## Call relationships and usage boundaries
+     * Used for configuration recovery and credential management: Existing plaintext tokens cannot be queried and retrieved again. The list provides only credential summaries. To obtain a new token, call CreateIdentityProviderSCIMCredential. To revoke a credential, submit the credentialId from the list to DeleteIdentityProviderSCIMCredential. A maximum of two credentials are allowed in the same pool. This operation returns the complete array and does not support or fabricate pagination parameters.
+     *
+     * @param request - ListIdentityProviderSCIMCredentialsRequest
+     * @returns ListIdentityProviderSCIMCredentialsResponse
+     */
+    listIdentityProviderSCIMCredentials(workspaceId: string, request: $_model.ListIdentityProviderSCIMCredentialsRequest): Promise<$_model.ListIdentityProviderSCIMCredentialsResponse>;
+    /**
+     * Queries the summary of existing identity provider bindings for a workspace, including CustomSSO. Returns local binding information without querying the actual upstream SAML or SCIM configurations.
      *
      * @remarks
      * ## Features and prerequisites
-     * Returns the local binding summary without querying the actual SAML or SCIM configurations of AgentIdentity. If no binding exists, items is an empty array. A workspace currently supports only one external binding. The default value of maxResults is 10, and the valid range is 1 to 100. Currently, nextToken must be omitted or left empty. A non-empty value returns InvalidParameter, and fictitious multi-page results are not supported.
-     * The status of CustomSSO indicates the task status of shared resources and logon configurations. You must check protocol and saml to determine whether SAML is configured. To query SCIM configurations, independently call GetIdentityProviderSCIM. The list operation does not issue tokens and does not return the vendor appSecret, encryptKey, or verificationToken.
+     * Returns the local binding summary without querying the actual SAML and SCIM configurations of AgentIdentity. If no bindings exist, items is an empty array. A workspace currently supports only one external binding. The default value of maxResults is 10, and the valid values are 1 to 100. Currently, nextToken must be omitted or left empty. A non-empty value returns InvalidParameter, and multi-page results cannot be fabricated.
+     * The status of CustomSSO indicates the task status of shared resources and logon configurations. You must combine protocol and saml to determine whether SAML is configured. SCIM queries are independently performed by using GetIdentityProviderSCIM. The list does not issue tokens and does not return the vendor appSecret, encryptKey, or verificationToken.
      * ## Requests and examples
      * GET /workspaces/{workspaceId}/identity-providers
-     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or Security Token Service (STS) token that has the required permissions on the identity source resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request body example shows the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not record secrets. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity provider resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request example shows the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
      * ```text
      * GET /workspaces/ws-example/identity-providers?maxResults=10
      * ```
-     * ## Response examples
+     * ## Response example
      * ```json
      * {
      *   "items": [
@@ -2556,8 +2898,10 @@ export default class Client extends OpenApi {
      * }
      * ```
      * ## Errors and handling
-     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. Synchronous calls to upstream services that fail may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow common error handling.
-     * 400 InvalidParameter: maxResults is out of bounds, or nextToken is not empty, which is currently not supported. If a query fails, an error is displayed instead of resetting the status to unconfigured.
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call failure to the upstream may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret a read failure as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
+     * 400 InvalidParameter: maxResults is out of bounds or nextToken is non-empty, which is currently not supported. When a query fails, an error is displayed instead of being cleared as unconfigured.
+     * ## Call relationships and usage boundaries
+     * This API is used to discover current bindings. The specific SAML configuration of CustomSSO is queried by using GetIdentityProvider. The SP address is queried by using GetIdentityProviderServiceProvider. The actual SCIM configuration and independent operation results are queried by using GetIdentityProviderSCIM.
      *
      * @param request - ListIdentityProvidersRequest
      * @param headers - map
@@ -2568,19 +2912,19 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.ListIdentityProvidersResponse>;
     /**
-     * Queries the external identity providers bound to a specified workspace. Each workspace can be bound to at most one external identity provider, so the response returns at most one record. Application secret configurations are not returned.
+     * Queries the summary of existing identity provider bindings for a workspace, including CustomSSO. Returns local binding information without querying the actual upstream SAML or SCIM configurations.
      *
      * @remarks
      * ## Features and prerequisites
-     * Returns the local binding summary without querying the actual SAML or SCIM configurations of AgentIdentity. If no binding exists, items is an empty array. A workspace currently supports only one external binding. The default value of maxResults is 10, and the valid range is 1 to 100. Currently, nextToken must be omitted or left empty. A non-empty value returns InvalidParameter, and fictitious multi-page results are not supported.
-     * The status of CustomSSO indicates the task status of shared resources and logon configurations. You must check protocol and saml to determine whether SAML is configured. To query SCIM configurations, independently call GetIdentityProviderSCIM. The list operation does not issue tokens and does not return the vendor appSecret, encryptKey, or verificationToken.
+     * Returns the local binding summary without querying the actual SAML and SCIM configurations of AgentIdentity. If no bindings exist, items is an empty array. A workspace currently supports only one external binding. The default value of maxResults is 10, and the valid values are 1 to 100. Currently, nextToken must be omitted or left empty. A non-empty value returns InvalidParameter, and multi-page results cannot be fabricated.
+     * The status of CustomSSO indicates the task status of shared resources and logon configurations. You must combine protocol and saml to determine whether SAML is configured. SCIM queries are independently performed by using GetIdentityProviderSCIM. The list does not issue tokens and does not return the vendor appSecret, encryptKey, or verificationToken.
      * ## Requests and examples
      * GET /workspaces/{workspaceId}/identity-providers
-     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or Security Token Service (STS) token that has the required permissions on the identity source resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request body example shows the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not record secrets. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity provider resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request example shows the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
      * ```text
      * GET /workspaces/ws-example/identity-providers?maxResults=10
      * ```
-     * ## Response examples
+     * ## Response example
      * ```json
      * {
      *   "items": [
@@ -2597,8 +2941,10 @@ export default class Client extends OpenApi {
      * }
      * ```
      * ## Errors and handling
-     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. Synchronous calls to upstream services that fail may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow common error handling.
-     * 400 InvalidParameter: maxResults is out of bounds, or nextToken is not empty, which is currently not supported. If a query fails, an error is displayed instead of resetting the status to unconfigured.
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call failure to the upstream may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret a read failure as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
+     * 400 InvalidParameter: maxResults is out of bounds or nextToken is non-empty, which is currently not supported. When a query fails, an error is displayed instead of being cleared as unconfigured.
+     * ## Call relationships and usage boundaries
+     * This API is used to discover current bindings. The specific SAML configuration of CustomSSO is queried by using GetIdentityProvider. The SP address is queried by using GetIdentityProviderServiceProvider. The actual SCIM configuration and independent operation results are queried by using GetIdentityProviderSCIM.
      *
      * @param request - ListIdentityProvidersRequest
      * @returns ListIdentityProvidersResponse
@@ -3156,6 +3502,92 @@ export default class Client extends OpenApi {
      * @returns PrecheckSkillUploadViaOssResponse
      */
     precheckSkillUploadViaOss(workspaceId: string, request: $_model.PrecheckSkillUploadViaOssRequest): Promise<$_model.PrecheckSkillUploadViaOssResponse>;
+    /**
+     * Prepares the SCIM receiving configuration, and returns the provisioning URL and credential summary. Issues a token if no available credentials exist and returns the plaintext only in the current response. Does not automatically enable user synchronization.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * A CustomSSO shared user pool must be available. This operation does not depend on SAML metadata and is not blocked by SAML updating or update failure states. It synchronously calls AgentIdentity to enable SCIM receiving, and reads the configuration and credential list. If a credential in the Enabled state that has not expired already exists, its summary is returned and the token is set to null. If no available credentials exist, a new credential is created and the token is returned only in the current response. Existing invalid or expired credentials are not automatically deleted and may still trigger the upstream limit of up to two credentials.
+     * The prepare operation has the side effects of enabling receiving and potentially issuing credentials, but it does not set the AC syncEnabled parameter, initiate the first import, or indicate that the external provisioning connection test has passed. After configuring the baseUrl and the current token in the external provisioning system, call UpdateIdentityProviderSCIM to confirm and enable synchronization. Existing tokens cannot be retrieved again. If the response is lost, query the credential list first. Tokens are not automatically reissued. Tokens must not be logged or persisted in frontend caches.
+     * ## Requests and examples
+     * POST /workspaces/{workspaceId}/scim-provisioning/prepare
+     * Calling conventions: Call this operation in the region of the target workspace by using an AccessKey ID/STS identity that has permissions on the identity source resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API operation, not the extra body wrapper of the backend direct connection API operation. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not log secrets. Asynchronous business tasks do not mean that the HTTP request uses a persistent connection to wait for completion.
+     * ```text
+     * POST /workspaces/ws-example/scim-provisioning/prepare
+     * No business request body.
+     * ```
+     * ## Response examples
+     * ```json
+     * {
+     *   "data": {
+     *     "configuration": {
+     *       "status": "Enabled",
+     *       "baseUrl": "https://example.com/scim/v2"
+     *     },
+     *     "credential": {
+     *       "credentialId": "credential-example",
+     *       "status": "Enabled",
+     *       "expireTime": "<Expiration time returned by the upstream service>"
+     *     },
+     *     "token": "<Token issued only in the current response; null if an available credential already exists>"
+     *   }
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. Synchronous calls to the upstream service that fail may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace not found errors follow the common error handling process.
+     * 400 LimitExceeded.ScimCredential: The maximum limit of two credentials has been reached. You must explicitly delete one credential and try again. Credentials are not automatically deleted, rotated, or expanded. 400 InvalidParameter: The shared pool is unavailable. This call may have enabled upstream receiving and then reported an error due to issuance failure. The error does not mean that the operation has been automatically rolled back.
+     * ## Call relationships and usage boundaries
+     * The shared pool is created by using CreateIdentityProvider with identityProviderType set to CustomSSO. SAML configuration is not required. If an existing credential is reused and token is null, use the token that the user has already saved. Do not configure a null value in the external system. If the token is lost, call ListIdentityProviderSCIMCredentials to check first, and then explicitly call CreateIdentityProviderSCIMCredential to issue a new token. When the limit of two credentials is reached, the user must confirm and delete the unused credential.
+     *
+     * @param request - PrepareIdentityProviderSCIMRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns PrepareIdentityProviderSCIMResponse
+     */
+    prepareIdentityProviderSCIMWithOptions(workspaceId: string, request: $_model.PrepareIdentityProviderSCIMRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.PrepareIdentityProviderSCIMResponse>;
+    /**
+     * Prepares the SCIM receiving configuration, and returns the provisioning URL and credential summary. Issues a token if no available credentials exist and returns the plaintext only in the current response. Does not automatically enable user synchronization.
+     *
+     * @remarks
+     * ## Features and prerequisites
+     * A CustomSSO shared user pool must be available. This operation does not depend on SAML metadata and is not blocked by SAML updating or update failure states. It synchronously calls AgentIdentity to enable SCIM receiving, and reads the configuration and credential list. If a credential in the Enabled state that has not expired already exists, its summary is returned and the token is set to null. If no available credentials exist, a new credential is created and the token is returned only in the current response. Existing invalid or expired credentials are not automatically deleted and may still trigger the upstream limit of up to two credentials.
+     * The prepare operation has the side effects of enabling receiving and potentially issuing credentials, but it does not set the AC syncEnabled parameter, initiate the first import, or indicate that the external provisioning connection test has passed. After configuring the baseUrl and the current token in the external provisioning system, call UpdateIdentityProviderSCIM to confirm and enable synchronization. Existing tokens cannot be retrieved again. If the response is lost, query the credential list first. Tokens are not automatically reissued. Tokens must not be logged or persisted in frontend caches.
+     * ## Requests and examples
+     * POST /workspaces/{workspaceId}/scim-provisioning/prepare
+     * Calling conventions: Call this operation in the region of the target workspace by using an AccessKey ID/STS identity that has permissions on the identity source resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API operation, not the extra body wrapper of the backend direct connection API operation. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not log secrets. Asynchronous business tasks do not mean that the HTTP request uses a persistent connection to wait for completion.
+     * ```text
+     * POST /workspaces/ws-example/scim-provisioning/prepare
+     * No business request body.
+     * ```
+     * ## Response examples
+     * ```json
+     * {
+     *   "data": {
+     *     "configuration": {
+     *       "status": "Enabled",
+     *       "baseUrl": "https://example.com/scim/v2"
+     *     },
+     *     "credential": {
+     *       "credentialId": "credential-example",
+     *       "status": "Enabled",
+     *       "expireTime": "<Expiration time returned by the upstream service>"
+     *     },
+     *     "token": "<Token issued only in the current response; null if an available credential already exists>"
+     *   }
+     * }
+     * ```
+     * ## Errors and handling
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. Synchronous calls to the upstream service that fail may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace not found errors follow the common error handling process.
+     * 400 LimitExceeded.ScimCredential: The maximum limit of two credentials has been reached. You must explicitly delete one credential and try again. Credentials are not automatically deleted, rotated, or expanded. 400 InvalidParameter: The shared pool is unavailable. This call may have enabled upstream receiving and then reported an error due to issuance failure. The error does not mean that the operation has been automatically rolled back.
+     * ## Call relationships and usage boundaries
+     * The shared pool is created by using CreateIdentityProvider with identityProviderType set to CustomSSO. SAML configuration is not required. If an existing credential is reused and token is null, use the token that the user has already saved. Do not configure a null value in the external system. If the token is lost, call ListIdentityProviderSCIMCredentials to check first, and then explicitly call CreateIdentityProviderSCIMCredential to issue a new token. When the limit of two credentials is reached, the user must confirm and delete the unused credential.
+     *
+     * @param request - PrepareIdentityProviderSCIMRequest
+     * @returns PrepareIdentityProviderSCIMResponse
+     */
+    prepareIdentityProviderSCIM(workspaceId: string, request: $_model.PrepareIdentityProviderSCIMRequest): Promise<$_model.PrepareIdentityProviderSCIMResponse>;
     /**
      * Publishes a specified Skill version to transition it to the published state.
      *
@@ -3509,32 +3941,66 @@ export default class Client extends OpenApi {
      */
     updateExternalAgent(workspaceId: string, agentId: string, request: $_model.UpdateExternalAgentRequest): Promise<$_model.UpdateExternalAgentResponse>;
     /**
-     * Updates the logon switch, member synchronization switch, or application configuration of a specified external identity provider for a workspace. Unspecified properties remain unchanged. The update is an asynchronous operation. After the API returns, you can call GetIdentityProvider to query the status and track the progress.
+     * Modifies the logon configuration of a bound identity provider in a specified workspace. DingTalk and Lark support logon switches, incremental synchronization switches, application configurations, and synchronization scopes. CustomSSO supports SAML configurations and logon switches. Actual updates take effect asynchronously. Call GetIdentityProvider to query the status.
+     *
+     * @remarks
+     * ### Prerequisites and update methods
+     * The workspace must be bound to an identity provider of the corresponding type. For DingTalk and Lark, you must submit at least one of loginEnabled, syncEnabled, metadata, and syncScope. protocol and saml are not accepted. For CustomSSO, use protocol, saml, and loginEnabled. metadata, syncEnabled, and syncScope are not accepted. The SCIM synchronization switch is managed separately through UpdateIdentityProviderSCIM.
+     * ### DingTalk and Lark
+     * The metadata is merged by field. Submit only the fields that need to be updated. Omitted fields and existing keys remain unchanged. Explicitly submitting null, empty strings, or blank strings will be rejected. The server validates the complete configuration after merging. When incremental synchronization is enabled, the merged configuration must include encryptKey and verificationToken.
+     * syncEnabled controls subsequent address book change events and does not control the initial synchronization or manual synchronization. syncScope applies only to DingTalk and Lark. If it is omitted or set to null, the current scope is retained. Saving the scope does not automatically trigger a full synchronization. To perform manual synchronization, call CreateIdentityProviderSyncJob after saving and waiting for the identity provider to be ready, and then call GetIdentityProviderSyncJob to query the task result.
+     * ### Custom SAML identity provider
+     * CustomSSO currently supports only SAML. The saml parameter supports two mutually exclusive methods: providing metadataXml, or providing the four manual configuration fields: entityId, loginUrl, bindingType, and x509Certificates.
+     * metadataXml is a single IdP EntityDescriptor XML text of up to 1 MiB, not a URL or file path. DTDs and external entities are prohibited. For manual configuration, entityId must be non-empty and up to 2,048 characters, and cannot be changed after saving. loginUrl must be an absolute HTTPS URL without user credentials and fragments. bindingType must be HTTP-Redirect or HTTP-POST. Certificates must be valid X.509 signing certificates, with a maximum of 10 certificates.
+     * jitProvisionEnabled controls the automatic creation of users during the initial logon, and jitUpdateEnabled controls whether user information is updated during logon. Omitting these switches during an update retains the existing values. Modifying only the JIT switches also requires an existing valid SAML configuration. Saving the SAML configuration does not automatically enable logon. A valid configuration must exist before enabling logon. Setting loginEnabled to false only triggers a shutdown of logon and does not delete the saved SAML or SCIM configurations.
+     * ### Asynchronous results and retries
+     * When actual changes exist, the expected configuration and the UPDATING status of the identity provider are returned. The CONFIGURED status may also be returned when resource configurations are restored. Call GetIdentityProvider to wait for the READY status. If the operation fails, check for statuses such as UPDATE_FAILED. If the configuration is identical and no restoration is required, the current binding may be returned directly without generating a new task. A successful HTTP request does not indicate that the background task or upstream configuration has taken effect.
+     * Operation conflicts occur when in-flight operations exist. If a submission times out, query the configuration and status before deciding whether to retry. The status parameter describes the status of the identity provider resource and logon configuration. The SCIM operation results for CustomSSO must be queried through GetIdentityProviderSCIM and cannot be inferred from this operation.
+     *
+     * @param tmpReq - UpdateIdentityProviderRequest
+     * @param headers - map
+     * @param runtime - runtime options for this request RuntimeOptions
+     * @returns UpdateIdentityProviderResponse
+     */
+    updateIdentityProviderWithOptions(workspaceId: string, identityProviderType: string, tmpReq: $_model.UpdateIdentityProviderRequest, headers: {
+        [key: string]: string;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.UpdateIdentityProviderResponse>;
+    /**
+     * Modifies the logon configuration of a bound identity provider in a specified workspace. DingTalk and Lark support logon switches, incremental synchronization switches, application configurations, and synchronization scopes. CustomSSO supports SAML configurations and logon switches. Actual updates take effect asynchronously. Call GetIdentityProvider to query the status.
+     *
+     * @remarks
+     * ### Prerequisites and update methods
+     * The workspace must be bound to an identity provider of the corresponding type. For DingTalk and Lark, you must submit at least one of loginEnabled, syncEnabled, metadata, and syncScope. protocol and saml are not accepted. For CustomSSO, use protocol, saml, and loginEnabled. metadata, syncEnabled, and syncScope are not accepted. The SCIM synchronization switch is managed separately through UpdateIdentityProviderSCIM.
+     * ### DingTalk and Lark
+     * The metadata is merged by field. Submit only the fields that need to be updated. Omitted fields and existing keys remain unchanged. Explicitly submitting null, empty strings, or blank strings will be rejected. The server validates the complete configuration after merging. When incremental synchronization is enabled, the merged configuration must include encryptKey and verificationToken.
+     * syncEnabled controls subsequent address book change events and does not control the initial synchronization or manual synchronization. syncScope applies only to DingTalk and Lark. If it is omitted or set to null, the current scope is retained. Saving the scope does not automatically trigger a full synchronization. To perform manual synchronization, call CreateIdentityProviderSyncJob after saving and waiting for the identity provider to be ready, and then call GetIdentityProviderSyncJob to query the task result.
+     * ### Custom SAML identity provider
+     * CustomSSO currently supports only SAML. The saml parameter supports two mutually exclusive methods: providing metadataXml, or providing the four manual configuration fields: entityId, loginUrl, bindingType, and x509Certificates.
+     * metadataXml is a single IdP EntityDescriptor XML text of up to 1 MiB, not a URL or file path. DTDs and external entities are prohibited. For manual configuration, entityId must be non-empty and up to 2,048 characters, and cannot be changed after saving. loginUrl must be an absolute HTTPS URL without user credentials and fragments. bindingType must be HTTP-Redirect or HTTP-POST. Certificates must be valid X.509 signing certificates, with a maximum of 10 certificates.
+     * jitProvisionEnabled controls the automatic creation of users during the initial logon, and jitUpdateEnabled controls whether user information is updated during logon. Omitting these switches during an update retains the existing values. Modifying only the JIT switches also requires an existing valid SAML configuration. Saving the SAML configuration does not automatically enable logon. A valid configuration must exist before enabling logon. Setting loginEnabled to false only triggers a shutdown of logon and does not delete the saved SAML or SCIM configurations.
+     * ### Asynchronous results and retries
+     * When actual changes exist, the expected configuration and the UPDATING status of the identity provider are returned. The CONFIGURED status may also be returned when resource configurations are restored. Call GetIdentityProvider to wait for the READY status. If the operation fails, check for statuses such as UPDATE_FAILED. If the configuration is identical and no restoration is required, the current binding may be returned directly without generating a new task. A successful HTTP request does not indicate that the background task or upstream configuration has taken effect.
+     * Operation conflicts occur when in-flight operations exist. If a submission times out, query the configuration and status before deciding whether to retry. The status parameter describes the status of the identity provider resource and logon configuration. The SCIM operation results for CustomSSO must be queried through GetIdentityProviderSCIM and cannot be inferred from this operation.
+     *
+     * @param request - UpdateIdentityProviderRequest
+     * @returns UpdateIdentityProviderResponse
+     */
+    updateIdentityProvider(workspaceId: string, identityProviderType: string, request: $_model.UpdateIdentityProviderRequest): Promise<$_model.UpdateIdentityProviderResponse>;
+    /**
+     * Enables or disables SCIM user synchronization independently. When enabled, the initial full import is executed asynchronously. You can query the result by calling GetIdentityProviderSCIM. The SAML logon configuration is retained.
      *
      * @remarks
      * ## Features and prerequisites
-     * CustomSSO uses protocol=SAML and saml to save logon configurations. It does not accept legacy metadata or syncEnabled. To toggle the SCIM switch, you must call UpdateIdentityProviderSCIM. OIDC is not supported. You can either import XML or manually enter fields. If you import XML, metadataXml must be a single IdP EntityDescriptor XML text of up to 1 MiB. URLs or file paths are not accepted, and DTDs or external entities are prohibited. If you manually enter fields, you must provide entityId, loginUrl, bindingType, and a non-empty x509Certificates array at the same time. The entityId must be non-empty and up to 2,048 characters in length, and cannot be replaced after configuration. The loginUrl must be an absolute HTTPS URL without user credentials or fragments. The bindingType must be HTTP-Redirect or HTTP-POST. Signing certificates must be valid X.509 certificates, and up to 10 certificates are supported.
-     * Saving the configuration does not automatically enable logon. A valid SAML configuration must exist before you enable logon. Setting loginEnabled=false only disables logon and does not clear SAML or SCIM configurations. You can independently pass Boolean values for jitProvisionEnabled and jitUpdateEnabled. If omitted, the existing values are retained. If omitted for the first time, the default value is false. Updating only the JIT switches also requires a valid SAML configuration. If the request is unchanged, the current binding may be returned directly without generating a new task. A successful update returns UPDATING. You can call GetIdentityProvider and wait for READY or UPDATE_FAILED. If the update fails, you can resubmit the request. An HTTP success response does not indicate that the upstream configuration has taken effect.
-     * DingTalk and Feishu continue to use vendor metadata and logon or synchronization switches. They do not accept protocol or saml. Updating vendor metadata supports partial updates. You only need to submit the fields to be modified. Unsubmitted fields and saved credentials remain unchanged. The server merges the new and old values and then validates the complete configuration. Explicitly submitted fields cannot be null, empty strings, or blank strings. For example, you can submit only appSecret to update the secret. The existing vendor semantics of syncScope are retained. Saving the scope does not automatically trigger full synchronization.
-     * ## Request and examples
-     * PUT /workspaces/{workspaceId}/identity-providers/{identityProviderType}
-     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity provider resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request body example shows the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not log secrets. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * The syncEnabled parameter is required. If you set this parameter to true, a task is submitted to independently enable SCIM and perform the initial full user import. During execution, the AgentIdentity receiving status must be Enabled, and an enabled and unexpired credential must exist. Therefore, you must first call the prepare operation and complete the URL and token configuration in the external system. If you set this parameter to false, a task is submitted to disable synchronization and upstream receiving. Existing users, credentials, and SAML logon configurations are retained. If you re-enable synchronization later and receiving is disabled, you must call the prepare operation again.
+     * Request acceptance only saves the expected switch status in AC and submits the task. The returned data is still the shared binding and does not contain the SCIM taskId. The status is not overwritten by this task and may be READY or UPDATE_FAILED from a previous logon task. Neither can be used to determine the success or failure of SCIM. Query GetIdentityProviderSCIM.operationStatus to wait for the result. Prerequisite checks for enabling are executed within the task. If the prerequisites are not met, you may receive a successful request response first, and then operationStatus=FAILED. A failure does not automatically roll back the expected switch status.
+     * SCIM does not depend on SAML configuration and does not affect the SAML status or switch. A successful task and a successful full import of empty users do not prove that continuous incremental synchronization is healthy. Whether users exist depends on whether the external system has actually pre-provisioned them.
+     * ## Requests and examples
+     * PUT /workspaces/{workspaceId}/scim-provisioning
+     * Call conventions: Call the API in the region of the target workspace by using an AK/STS identity that has permissions on the identity provider resources of the corresponding workspace. In the following examples, ws-example, URL, certificate, and Token are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API, not the additional body wrapper of the backend direct connection API. The response example only shows the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
      * ```text
-     * PUT /workspaces/ws-example/identity-providers/CustomSSO
-     * {
-     *   "protocol": "SAML",
-     *   "saml": {
-     *     "entityId": "https://idp.example.com/entity",
-     *     "loginUrl": "https://idp.example.com/sso",
-     *     "bindingType": "HTTP-Redirect",
-     *     "x509Certificates": [
-     *       "<Valid PEM X.509 certificate text>"
-     *     ],
-     *     "jitProvisionEnabled": false,
-     *     "jitUpdateEnabled": false
-     *   }
-     * }
-     * Toggle logon only: {"loginEnabled": true}
+     * PUT /workspaces/ws-example/scim-provisioning
+     * {"syncEnabled": true}
+     * To disable: {"syncEnabled": false}
      * ```
      * ## Response example
      * ```json
@@ -3542,52 +4008,41 @@ export default class Client extends OpenApi {
      *   "data": {
      *     "workspaceId": "ws-example",
      *     "identityProviderType": "CustomSSO",
-     *     "protocol": "SAML",
+     *     "status": "READY",
      *     "loginEnabled": false,
-     *     "syncEnabled": false,
-     *     "status": "UPDATING"
+     *     "syncEnabled": true
      *   }
      * }
      * ```
      * ## Errors and handling
-     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. Synchronous calls to the upstream may return 503 IdentityProviderProvisioningUnavailable if they fail. Keep the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow common error handling.
-     * 400 InvalidParameter: XML and manual entry are mixed, manual entry items are missing, certificates are invalid, the protocol is not supported, entityId is changed, logon is enabled without configuration, or CustomSSO submits metadata or syncEnabled. 409 IdentityProviderOperationConflict: The current binding does not allow updates. CustomSSO supports resubmitting configurations from UPDATE_FAILED.
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call to the upstream system that fails may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret a read failure as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
+     * 400 InvalidParameter: syncEnabled is missing. 404 IdentityProviderNotFound: No CustomSSO binding exists. 409 IdentityProviderOperationConflict: The user pool is not ready, is being unbound, failed to unbind, or has a concurrent status conflict. Upstream not being enabled or having no valid credentials may manifest as an asynchronous FAILED after acceptance. You cannot only handle HTTP errors.
+     * ## Call relationships and usage boundaries
+     * The call example for enabling is body={"syncEnabled":true}, and for disabling is body={"syncEnabled":false}. This API returns a snapshot of the shared binding, and its status is not the status of this SCIM task. After acceptance, use GetIdentityProviderSCIM to query operationStatus. Pre-provisioning tests or user assignments for external IdPs must still be completed in the external system. AC does not configure external IdPs for users.
      *
-     * @param tmpReq - UpdateIdentityProviderRequest
+     * @param tmpReq - UpdateIdentityProviderSCIMRequest
      * @param headers - map
      * @param runtime - runtime options for this request RuntimeOptions
-     * @returns UpdateIdentityProviderResponse
+     * @returns UpdateIdentityProviderSCIMResponse
      */
-    updateIdentityProviderWithOptions(workspaceId: string, identityProviderType: string, tmpReq: $_model.UpdateIdentityProviderRequest, headers: {
+    updateIdentityProviderSCIMWithOptions(workspaceId: string, tmpReq: $_model.UpdateIdentityProviderSCIMRequest, headers: {
         [key: string]: string;
-    }, runtime: $dara.RuntimeOptions): Promise<$_model.UpdateIdentityProviderResponse>;
+    }, runtime: $dara.RuntimeOptions): Promise<$_model.UpdateIdentityProviderSCIMResponse>;
     /**
-     * Updates the logon switch, member synchronization switch, or application configuration of a specified external identity provider for a workspace. Unspecified properties remain unchanged. The update is an asynchronous operation. After the API returns, you can call GetIdentityProvider to query the status and track the progress.
+     * Enables or disables SCIM user synchronization independently. When enabled, the initial full import is executed asynchronously. You can query the result by calling GetIdentityProviderSCIM. The SAML logon configuration is retained.
      *
      * @remarks
      * ## Features and prerequisites
-     * CustomSSO uses protocol=SAML and saml to save logon configurations. It does not accept legacy metadata or syncEnabled. To toggle the SCIM switch, you must call UpdateIdentityProviderSCIM. OIDC is not supported. You can either import XML or manually enter fields. If you import XML, metadataXml must be a single IdP EntityDescriptor XML text of up to 1 MiB. URLs or file paths are not accepted, and DTDs or external entities are prohibited. If you manually enter fields, you must provide entityId, loginUrl, bindingType, and a non-empty x509Certificates array at the same time. The entityId must be non-empty and up to 2,048 characters in length, and cannot be replaced after configuration. The loginUrl must be an absolute HTTPS URL without user credentials or fragments. The bindingType must be HTTP-Redirect or HTTP-POST. Signing certificates must be valid X.509 certificates, and up to 10 certificates are supported.
-     * Saving the configuration does not automatically enable logon. A valid SAML configuration must exist before you enable logon. Setting loginEnabled=false only disables logon and does not clear SAML or SCIM configurations. You can independently pass Boolean values for jitProvisionEnabled and jitUpdateEnabled. If omitted, the existing values are retained. If omitted for the first time, the default value is false. Updating only the JIT switches also requires a valid SAML configuration. If the request is unchanged, the current binding may be returned directly without generating a new task. A successful update returns UPDATING. You can call GetIdentityProvider and wait for READY or UPDATE_FAILED. If the update fails, you can resubmit the request. An HTTP success response does not indicate that the upstream configuration has taken effect.
-     * DingTalk and Feishu continue to use vendor metadata and logon or synchronization switches. They do not accept protocol or saml. Updating vendor metadata supports partial updates. You only need to submit the fields to be modified. Unsubmitted fields and saved credentials remain unchanged. The server merges the new and old values and then validates the complete configuration. Explicitly submitted fields cannot be null, empty strings, or blank strings. For example, you can submit only appSecret to update the secret. The existing vendor semantics of syncScope are retained. Saving the scope does not automatically trigger full synchronization.
-     * ## Request and examples
-     * PUT /workspaces/{workspaceId}/identity-providers/{identityProviderType}
-     * Call conventions: Call the API in the region of the target workspace by using an AccessKey pair or STS token that has permissions on the identity provider resources of the workspace. In the following examples, ws-example, URLs, certificates, and tokens are placeholder values and must be replaced with actual values. The request body example shows the body parameters of the public API, not the extra body wrapper of the backend direct connection API. The response example shows only the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Keep the requestId for troubleshooting and do not log secrets. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
+     * The syncEnabled parameter is required. If you set this parameter to true, a task is submitted to independently enable SCIM and perform the initial full user import. During execution, the AgentIdentity receiving status must be Enabled, and an enabled and unexpired credential must exist. Therefore, you must first call the prepare operation and complete the URL and token configuration in the external system. If you set this parameter to false, a task is submitted to disable synchronization and upstream receiving. Existing users, credentials, and SAML logon configurations are retained. If you re-enable synchronization later and receiving is disabled, you must call the prepare operation again.
+     * Request acceptance only saves the expected switch status in AC and submits the task. The returned data is still the shared binding and does not contain the SCIM taskId. The status is not overwritten by this task and may be READY or UPDATE_FAILED from a previous logon task. Neither can be used to determine the success or failure of SCIM. Query GetIdentityProviderSCIM.operationStatus to wait for the result. Prerequisite checks for enabling are executed within the task. If the prerequisites are not met, you may receive a successful request response first, and then operationStatus=FAILED. A failure does not automatically roll back the expected switch status.
+     * SCIM does not depend on SAML configuration and does not affect the SAML status or switch. A successful task and a successful full import of empty users do not prove that continuous incremental synchronization is healthy. Whether users exist depends on whether the external system has actually pre-provisioned them.
+     * ## Requests and examples
+     * PUT /workspaces/{workspaceId}/scim-provisioning
+     * Call conventions: Call the API in the region of the target workspace by using an AK/STS identity that has permissions on the identity provider resources of the corresponding workspace. In the following examples, ws-example, URL, certificate, and Token are placeholder values and must be replaced with actual values. The request body example represents the body parameters of the public API, not the additional body wrapper of the backend direct connection API. The response example only shows the business part. The outer layer also includes requestId, success, code, message, and httpStatusCode. Retain the requestId for troubleshooting and do not record keys. Asynchronous business tasks do not mean that the HTTP request uses a long connection to wait for completion.
      * ```text
-     * PUT /workspaces/ws-example/identity-providers/CustomSSO
-     * {
-     *   "protocol": "SAML",
-     *   "saml": {
-     *     "entityId": "https://idp.example.com/entity",
-     *     "loginUrl": "https://idp.example.com/sso",
-     *     "bindingType": "HTTP-Redirect",
-     *     "x509Certificates": [
-     *       "<Valid PEM X.509 certificate text>"
-     *     ],
-     *     "jitProvisionEnabled": false,
-     *     "jitUpdateEnabled": false
-     *   }
-     * }
-     * Toggle logon only: {"loginEnabled": true}
+     * PUT /workspaces/ws-example/scim-provisioning
+     * {"syncEnabled": true}
+     * To disable: {"syncEnabled": false}
      * ```
      * ## Response example
      * ```json
@@ -3595,21 +4050,22 @@ export default class Client extends OpenApi {
      *   "data": {
      *     "workspaceId": "ws-example",
      *     "identityProviderType": "CustomSSO",
-     *     "protocol": "SAML",
+     *     "status": "READY",
      *     "loginEnabled": false,
-     *     "syncEnabled": false,
-     *     "status": "UPDATING"
+     *     "syncEnabled": true
      *   }
      * }
      * ```
      * ## Errors and handling
-     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. Synchronous calls to the upstream may return 503 IdentityProviderProvisioningUnavailable if they fail. Keep the request ID for troubleshooting and do not interpret read failures as unconfigured. Actual authentication and workspace non-existence errors follow common error handling.
-     * 400 InvalidParameter: XML and manual entry are mixed, manual entry items are missing, certificates are invalid, the protocol is not supported, entityId is changed, logon is enabled without configuration, or CustomSSO submits metadata or syncEnabled. 409 IdentityProviderOperationConflict: The current binding does not allow updates. CustomSSO supports resubmitting configurations from UPDATE_FAILED.
+     * Error handling: 400 InvalidParameter indicates that the parameters or current configuration prerequisites are not met. 404 IdentityProviderNotFound indicates that no binding of the matching type exists. A synchronous call to the upstream system that fails may return 503 IdentityProviderProvisioningUnavailable. Retain the request ID for troubleshooting and do not interpret a read failure as unconfigured. Actual authentication and workspace non-existence errors follow the common error handling.
+     * 400 InvalidParameter: syncEnabled is missing. 404 IdentityProviderNotFound: No CustomSSO binding exists. 409 IdentityProviderOperationConflict: The user pool is not ready, is being unbound, failed to unbind, or has a concurrent status conflict. Upstream not being enabled or having no valid credentials may manifest as an asynchronous FAILED after acceptance. You cannot only handle HTTP errors.
+     * ## Call relationships and usage boundaries
+     * The call example for enabling is body={"syncEnabled":true}, and for disabling is body={"syncEnabled":false}. This API returns a snapshot of the shared binding, and its status is not the status of this SCIM task. After acceptance, use GetIdentityProviderSCIM to query operationStatus. Pre-provisioning tests or user assignments for external IdPs must still be completed in the external system. AC does not configure external IdPs for users.
      *
-     * @param request - UpdateIdentityProviderRequest
-     * @returns UpdateIdentityProviderResponse
+     * @param request - UpdateIdentityProviderSCIMRequest
+     * @returns UpdateIdentityProviderSCIMResponse
      */
-    updateIdentityProvider(workspaceId: string, identityProviderType: string, request: $_model.UpdateIdentityProviderRequest): Promise<$_model.UpdateIdentityProviderResponse>;
+    updateIdentityProviderSCIM(workspaceId: string, request: $_model.UpdateIdentityProviderSCIMRequest): Promise<$_model.UpdateIdentityProviderSCIMResponse>;
     /**
      * Updates the configuration of a specified managed agent.
      *
@@ -3989,10 +4445,11 @@ export default class Client extends OpenApi {
      */
     validateAgentCodePackageFromOss(workspaceId: string, request: $_model.ValidateAgentCodePackageFromOssRequest): Promise<$_model.ValidateAgentCodePackageFromOssResponse>;
     /**
-     * 检查智能体代码包 OSS RAM 授权状态
+     * Checks the OSS RAM authorization status of the agent code package.
      *
      * @remarks
-     * 检查当前 Workspace 角色是否绑定所选源 Bucket 对应的自定义 RAM 策略，复用已有挂载授权。仅返回策略绑定状态，不验证代码包存在或可读、不修改默认桶。授权状态不能替代 ValidateAgentCodePackageFromOss 的实际对象读取校验。
+     * Queries the binding status of the authorization policy for a specified source bucket to the current workspace role. AUTHORIZED indicates that the policy is bound. UNAUTHORIZED indicates that the policy is not bound. A bound policy does not indicate that a specific code package object exists or is readable.
+     * To check a specific object, call ValidateAgentCodePackageFromOss. This operation does not copy code packages or modify the default OSS binding of the workspace.
      *
      * @param request - VerifyAgentCodePackageOssRamAuthorizationRequest
      * @param headers - map
@@ -4003,10 +4460,11 @@ export default class Client extends OpenApi {
         [key: string]: string;
     }, runtime: $dara.RuntimeOptions): Promise<$_model.VerifyAgentCodePackageOssRamAuthorizationResponse>;
     /**
-     * 检查智能体代码包 OSS RAM 授权状态
+     * Checks the OSS RAM authorization status of the agent code package.
      *
      * @remarks
-     * 检查当前 Workspace 角色是否绑定所选源 Bucket 对应的自定义 RAM 策略，复用已有挂载授权。仅返回策略绑定状态，不验证代码包存在或可读、不修改默认桶。授权状态不能替代 ValidateAgentCodePackageFromOss 的实际对象读取校验。
+     * Queries the binding status of the authorization policy for a specified source bucket to the current workspace role. AUTHORIZED indicates that the policy is bound. UNAUTHORIZED indicates that the policy is not bound. A bound policy does not indicate that a specific code package object exists or is readable.
+     * To check a specific object, call ValidateAgentCodePackageFromOss. This operation does not copy code packages or modify the default OSS binding of the workspace.
      *
      * @param request - VerifyAgentCodePackageOssRamAuthorizationRequest
      * @returns VerifyAgentCodePackageOssRamAuthorizationResponse