@atlasauth/backend 0.24.0 → 0.26.0

package/dist/client/ssf.d.ts

@@ -0,0 +1,112 @@
+import { type RequestFn } from './request';
+/** Event type URIs (CAEP + RISC) a stream can subscribe to. */
+export type SsfEventType = 'https://schemas.openid.net/secevent/caep/event-type/session-revoked' | 'https://schemas.openid.net/secevent/caep/event-type/credential-change' | 'https://schemas.openid.net/secevent/caep/event-type/assurance-level-change' | 'https://schemas.openid.net/secevent/caep/event-type/token-claims-change' | 'https://schemas.openid.net/secevent/caep/event-type/risk-level-change' | 'https://schemas.openid.net/secevent/risc/event-type/account-disabled' | 'https://schemas.openid.net/secevent/risc/event-type/account-enabled' | 'https://schemas.openid.net/secevent/risc/event-type/account-purged' | 'https://schemas.openid.net/secevent/risc/event-type/credential-compromise';
+export interface SsfStream {
+    object: 'ssf_stream';
+    id: string;
+    description: string | null;
+    delivery: {
+        method: string;
+        endpoint_url?: string | null;
+    };
+    delivery_method: 'push' | 'poll';
+    audience: string;
+    events_requested: string[];
+    events_supported: string[];
+    status: 'enabled' | 'paused' | 'disabled';
+    created_at: number;
+    updated_at: number;
+    pending_events?: number;
+}
+/** Returned once on create for a poll stream. */
+export interface SsfStreamCreated extends SsfStream {
+    poll_token?: string;
+    poll_endpoint?: string;
+}
+export interface CreateSsfStreamBody {
+    delivery_method: 'push' | 'poll';
+    /** Push only: the https endpoint that receives each SET. */
+    endpoint_url?: string;
+    /** Push only: sent as the `Authorization` header (write-only). */
+    authorization_header?: string;
+    audience?: string;
+    description?: string;
+    events_requested?: string[];
+}
+export interface UpdateSsfStreamBody {
+    endpoint_url?: string;
+    authorization_header?: string;
+    description?: string;
+    events_requested?: string[];
+    status?: 'enabled' | 'paused' | 'disabled';
+}
+export interface SsfEventRecord {
+    object: 'ssf_event';
+    id: string;
+    event_type: string;
+    user_id: string | null;
+    status: 'pending' | 'delivered' | 'failed';
+    attempts: number;
+    last_error: string | null;
+    delivered_at: number | null;
+    created_at: number;
+}
+/** `sync_posture` (device-compliance-change only) records the device's compliance in Atlas device posture and nothing else. */
+export type SsfReceiverAction = 'revoke_sessions' | 'refresh_claims' | 'ban' | 'sync_posture' | 'ignore';
+export interface SsfReceiver {
+    object: 'ssf_receiver';
+    id: string;
+    name: string;
+    issuer: string;
+    jwks_uri: string;
+    audience: string | null;
+    actions: Record<string, SsfReceiverAction>;
+    enabled: boolean;
+    last_received_at: number | null;
+    created_at: number;
+    /** Only on create. */
+    receive_endpoint?: string;
+}
+export interface CreateSsfReceiverBody {
+    name: string;
+    issuer: string;
+    jwks_uri: string;
+    audience?: string;
+    actions?: Record<string, SsfReceiverAction>;
+}
+/** Shared Signals Framework (SSF 1.0) with CAEP and RISC: transmitter streams and inbound receivers. */
+export declare function ssfResource(request: RequestFn): {
+    streams: {
+        list(): Promise<{
+            object: "list";
+            data: SsfStream[];
+        }>;
+        create(body: CreateSsfStreamBody): Promise<SsfStreamCreated>;
+        get(id: string): Promise<SsfStream>;
+        update(id: string, body: UpdateSsfStreamBody): Promise<SsfStream>;
+        delete(id: string): Promise<void>;
+        /** Queue a verification event so the receiver can confirm the stream works. */
+        verify(id: string, state?: string): Promise<{
+            object: "ssf_verification";
+            stream_id: string;
+            state: string;
+        }>;
+        events(id: string, query?: {
+            limit?: number;
+        }): Promise<{
+            object: "list";
+            data: SsfEventRecord[];
+        }>;
+    };
+    receivers: {
+        list(): Promise<{
+            object: "list";
+            data: SsfReceiver[];
+        }>;
+        create(body: CreateSsfReceiverBody): Promise<SsfReceiver>;
+        update(id: string, body: Partial<Omit<CreateSsfReceiverBody, "issuer">> & {
+            enabled?: boolean;
+        }): Promise<SsfReceiver>;
+        delete(id: string): Promise<void>;
+    };
+};

package/dist/client/ssf.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ssfResource = ssfResource;
+/** Shared Signals Framework (SSF 1.0) with CAEP and RISC: transmitter streams and inbound receivers. */
+function ssfResource(request) {
+    const stream = (id) => `/v1/ssf/streams/${encodeURIComponent(id)}`;
+    const receiver = (id) => `/v1/ssf/receivers/${encodeURIComponent(id)}`;
+    return {
+        streams: {
+            list() {
+                return request({ method: 'GET', path: '/v1/ssf/streams' });
+            },
+            create(body) {
+                return request({ method: 'POST', path: '/v1/ssf/streams', body });
+            },
+            get(id) {
+                return request({ method: 'GET', path: stream(id) });
+            },
+            update(id, body) {
+                return request({ method: 'PATCH', path: stream(id), body });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: stream(id) });
+            },
+            /** Queue a verification event so the receiver can confirm the stream works. */
+            verify(id, state) {
+                return request({ method: 'POST', path: `${stream(id)}/verify`, body: { state } });
+            },
+            events(id, query = {}) {
+                return request({ method: 'GET', path: `${stream(id)}/events`, query });
+            },
+        },
+        receivers: {
+            list() {
+                return request({ method: 'GET', path: '/v1/ssf/receivers' });
+            },
+            create(body) {
+                return request({ method: 'POST', path: '/v1/ssf/receivers', body });
+            },
+            update(id, body) {
+                return request({ method: 'PATCH', path: receiver(id), body });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: receiver(id) });
+            },
+        },
+    };
+}
+//# sourceMappingURL=ssf.js.map

package/dist/client/ssf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssf.js","sourceRoot":"","sources":["../../src/client/ssf.ts"],"names":[],"mappings":";;AA6FA,kCA2CC;AA5CD,wGAAwG;AACxG,SAAgB,WAAW,CAAC,OAAkB;IAC5C,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,OAAO;QACL,OAAO,EAAE;YACP,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,CAAC,IAAyB;gBAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAyB;gBAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,+EAA+E;YAC/E,MAAM,CAAC,EAAU,EAAE,KAAc;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,QAA4B,EAAE;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACzE,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,CAAC,IAA2B;gBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA4E;gBAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/sso-onboarding.d.ts

@@ -5,6 +5,8 @@ import type { ListPage } from './types';
  * self-service-profiles model. It fixes which protocols an end-customer may
  * configure and either binds an org or promises to name one at ticket issue.
  */
+/** An Admin Portal task a ticket may perform for its organization. */
+export type SsoPortalIntent = 'sso' | 'directory_sync' | 'domain_verification' | 'log_stream' | 'audit_log' | 'certificate_renewal' | 'api_keys' | 'webhooks';
 export interface SsoOnboardingProfile {
     object: 'sso_onboarding_profile';
     id: string;
@@ -14,6 +16,8 @@ export interface SsoOnboardingProfile {
     organization_id: string | null;
     company_name: string | null;
     allow_scim: boolean;
+    /** The Admin Portal tasks this profile's tickets may perform. */
+    intents: SsoPortalIntent[];
     created_at: number;
     updated_at: number;
 }
@@ -49,6 +53,8 @@ export interface CreateSsoOnboardingProfileBody {
     organization_id?: string | null;
     company_name?: string | null;
     allow_scim?: boolean;
+    /** Admin Portal tasks to grant; omit for the classic SSO (+ domain) profile. */
+    intents?: SsoPortalIntent[];
 }
 export interface CreateSsoOnboardingTicketBody {
     /** Required for an unbound profile; must match (or be omitted) for a bound one. */

package/dist/client/sso-onboarding.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-onboarding.js","sourceRoot":"","sources":["../../src/client/sso-onboarding.ts"],"names":[],"mappings":";;AAgEA,sDA6CC;AA7GD,uCAAgD;AAgEhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CACJ,IAAoC,EACpC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B;gBACnC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,+EAA+E;QAC/E,YAAY,CACV,SAAiB,EACjB,OAAsC,EAAE,EACxC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,SAAS,CAAC,UAAU;gBAC7D,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,YAAY,CACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;aAC3D,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sso-onboarding.js","sourceRoot":"","sources":["../../src/client/sso-onboarding.ts"],"names":[],"mappings":";;AA+EA,sDA6CC;AA5HD,uCAAgD;AA+EhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CACJ,IAAoC,EACpC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B;gBACnC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,+EAA+E;QAC/E,YAAY,CACV,SAAiB,EACjB,OAAsC,EAAE,EACxC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,SAAS,CAAC,UAAU;gBAC7D,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,YAAY,CACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;aAC3D,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/users.d.ts

@@ -1,4 +1,5 @@
 import { type RequestFn } from './request';
+import type { ImportedMfa } from './mfa-factors';
 import type { CursorPage, CursorParams, DeletedObject, ListPage, Metadata } from './types';
 /** A user as the BAPI serves it. `private_metadata` is never returned. */
 export interface User {
@@ -10,6 +11,8 @@ export interface User {
     image_url: string | null;
     public_metadata: Metadata;
     mfa_enabled: boolean;
+    /** Factor classes this user must always use; empty = none. */
+    required_factors?: string[];
     banned: boolean;
     /** A timed ban's expiry (epoch ms); null for a permanent ban or none. */
     ban_expires_at?: number | null;
@@ -208,6 +211,8 @@ export interface CreateUserBody {
     first_name?: string;
     last_name?: string;
     email_verified?: boolean;
+    /** The user must choose a new password at their first sign-in (`update_password` required action). */
+    password_change_required?: boolean;
     public_metadata?: Metadata;
     private_metadata?: Metadata;
     unsafe_metadata?: Metadata;
@@ -223,8 +228,12 @@ export interface CreateUserBody {
     referral?: CreateUserReferralInput;
     /** The user's own referral code; unique per instance (`409 REFERRAL_CODE_TAKEN`). */
     referral_code?: string;
+    /** An existing authenticator (TOTP or HOTP) and recovery codes to import, so the user keeps their second factor. */
+    mfa?: ImportedMfa;
 }
 export interface UpdateUserBody {
+    /** Force a second factor at every sign-in; `null`/`[]` clears. */
+    required_factors?: Array<'totp' | 'sms' | 'passkey' | 'push'> | null;
     first_name?: string;
     last_name?: string;
     /**
@@ -274,6 +283,7 @@ export declare function usersResource(request: RequestFn): {
     unban(id: string): Promise<User>;
     lock(id: string, body?: {
         duration_in_seconds?: number;
+        reason?: string;
     }): Promise<User>;
     unlock(id: string): Promise<User>;
     /**
@@ -424,6 +434,17 @@ export declare function usersResource(request: RequestFn): {
     setPassword(id: string, body: SetUserPasswordBody): Promise<User>;
     /** `DELETE /v1/users/:id/profile_image` — clear the profile image. */
     deleteProfileImage(id: string): Promise<User>;
+    /** `GET /v1/users/:id/device_keys` — the user's device keys (native biometric sign-in). */
+    listDeviceKeys(id: string): Promise<{
+        object: "list";
+        data: DeviceKey[];
+    }>;
+    /** `DELETE /v1/users/:id/device_keys/:keyId` — revoke one device key. */
+    deleteDeviceKey(id: string, keyId: string): Promise<{
+        object: "device_key";
+        id: string;
+        deleted: true;
+    }>;
     /** `DELETE /v1/users/:id/passkeys/:passkeyId` — remove one of the user's passkeys. */
     deletePasskey(id: string, passkeyId: string): Promise<{
         object: "passkey";
@@ -458,6 +479,126 @@ export declare function usersResource(request: RequestFn): {
      * every app's contributed payload, in one package.
      */
     erasureExport(id: string): Promise<UserErasureExport>;
+    /**
+     * `POST /v1/users/:id/links` — mint an email-verification or password-reset
+     * link (and code) for a user WITHOUT sending it, for tools that deliver it
+     * themselves. The response is a credential: single-use, `expires_in_seconds`
+     * 60 to 86400 (default 3600), audited without the secret.
+     */
+    createLink(id: string, body: UserLinkBody, idempotencyKey?: string): Promise<UserLink>;
+    /**
+     * Advanced search: a boolean filter tree (and / or / not) over profile
+     * columns, traits and metadata, roles, MFA, last country and dates; plus
+     * export and saved views.
+     */
+    search: {
+        /** `POST /v1/users/search` */
+        query(body: UserSearchBody): Promise<CursorPage<User> & {
+            total_count?: number;
+        }>;
+        /** `POST /v1/users/search/export` — the matching users (up to 10,000) as CSV or NDJSON text. */
+        export(body: UserSearchExportBody): Promise<string>;
+        views: {
+            list(): Promise<{
+                object: "list";
+                data: UserSearchView[];
+                has_more: boolean;
+            }>;
+            create(body: UserSearchViewBody & {
+                name: string;
+            }, idempotencyKey?: string): Promise<UserSearchView>;
+            update(id: string, body: UserSearchViewBody): Promise<UserSearchView>;
+            delete(id: string): Promise<{
+                object: "user_search_view";
+                id: string;
+                deleted: true;
+            }>;
+        };
+    };
+    /**
+     * Required actions: make a user owe a step at their next sign-in (any
+     * method). The sign-in holds until the user finishes it, except a `custom`
+     * step, which you close with `clear` once they have completed it in your app.
+     */
+    requiredActions: {
+        /** `POST /v1/users/:id/required_actions` — 201 when newly opened, 200 when it already was. */
+        request(id: string, body: RequiredActionBody, idempotencyKey?: string): Promise<RequiredAction>;
+        /** `GET /v1/users/:id/required_actions` — what the user owes. */
+        list(id: string): Promise<{
+            object: "list";
+            data: RequiredAction[];
+            has_more: boolean;
+        }>;
+        /** `DELETE /v1/users/:id/required_actions/:requiredActionId` — withdraw it (or close a `custom` step). */
+        clear(id: string, requiredActionId: string, idempotencyKey?: string): Promise<{
+            object: "required_action";
+            id: string;
+            deleted: true;
+        }>;
+        /** `POST /v1/required_actions/bulk` — the same action for an organization's members or a list of user ids (max 5000). */
+        bulk(body: RequiredActionBody & ({
+            organization_id: string;
+        } | {
+            user_ids: string[];
+        }), idempotencyKey?: string): Promise<RequiredActionBulkResult>;
+    };
+    /** Notes an operator keeps on a user (never shown to the user). */
+    notes: {
+        /** `GET /v1/users/:id/notes` — pinned first, then newest. */
+        list(id: string): Promise<{
+            object: "list";
+            data: UserNote[];
+            has_more: boolean;
+            total_count: number;
+        }>;
+        /** `POST /v1/users/:id/notes` */
+        create(id: string, body: {
+            body: string;
+            pinned?: boolean;
+        }, idempotencyKey?: string): Promise<UserNote>;
+        /** `PATCH /v1/users/:id/notes/:noteId` */
+        update(id: string, noteId: string, body: {
+            body?: string;
+            pinned?: boolean;
+        }, idempotencyKey?: string): Promise<UserNote>;
+        /** `DELETE /v1/users/:id/notes/:noteId` */
+        delete(id: string, noteId: string, idempotencyKey?: string): Promise<{
+            object: "user_note";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    /**
+     * `GET /v1/users/:id/history` — every recorded profile, metadata and status
+     * change, newest first, with values before and after.
+     */
+    history(id: string, params?: {
+        limit?: number;
+        starting_after?: string;
+        action?: string[];
+    }): Promise<UserHistoryPage>;
+    /** Family accounts: a minor's parental-consent state, and their guardians. */
+    minorStatus(id: string): Promise<MinorStatus>;
+    /** Re-assess a user from their date-of-birth trait (for users created before age gating). */
+    assessMinor(id: string): Promise<MinorStatus>;
+    guardians: {
+        /** `POST /v1/users/:id/guardians` — a pending link with a one-time `consent_url`; `send_email` mails it. */
+        request(id: string, body: {
+            email?: string;
+            guardian_user_id?: string;
+            relationship?: string;
+            send_email?: boolean;
+        }, idempotencyKey?: string): Promise<GuardianLink & {
+            consent_url: string;
+            emailed: boolean;
+        }>;
+        /** Record consent obtained another way (a signed form, a call). */
+        approve(id: string, linkId: string, body?: {
+            note?: string;
+        }): Promise<GuardianLink>;
+        /** Withdraw a guardian link. */
+        revoke(id: string, linkId: string): Promise<GuardianLink>;
+    };
     /** Graceful deletion with a cancellation window (`DELETE /v1/users/:id` stays the immediate path). */
     deletion: {
         /** `POST /v1/users/:id/deletion` — schedule; `grace_seconds` defaults to the instance erasure grace. */
@@ -755,6 +896,16 @@ export interface UserProgressionEvent {
     delta: number;
 }
 /** One sign-in identity on a user: the base Atlas anchor, or a linked provider. */
+/** A device-bound biometric sign-in key (public metadata only). */
+export interface DeviceKey {
+    object: 'device_key';
+    id: string;
+    label: string | null;
+    platform: string | null;
+    biometric_bound: boolean;
+    last_used_at: number | null;
+    created_at: number;
+}
 export interface Identity {
     object: 'identity';
     id: string;
@@ -785,3 +936,154 @@ export interface OAuthAccessToken {
     scopes: string[];
     refreshed: boolean;
 }
+export type UserSearchOp = 'eq' | 'ne' | 'in' | 'nin' | 'contains' | 'starts_with' | 'gt' | 'gte' | 'lt' | 'lte' | 'between' | 'exists';
+/** A condition `{ field, op, value }` or a group `{ and }` / `{ or }` / `{ not }`. */
+export type UserSearchFilter = {
+    field: string;
+    op: UserSearchOp;
+    value?: unknown;
+} | {
+    and: UserSearchFilter[];
+} | {
+    or: UserSearchFilter[];
+} | {
+    not: UserSearchFilter;
+};
+export interface UserSearchBody {
+    filter?: UserSearchFilter;
+    /** Free text over id, names, username, emails and phones, ANDed with the filter. */
+    query?: string;
+    order_by?: string;
+    limit?: number;
+    starting_after?: string;
+    offset?: number;
+    include_total_count?: boolean;
+    include_deleted?: boolean;
+}
+export interface UserSearchExportBody extends Omit<UserSearchBody, 'limit' | 'starting_after' | 'offset' | 'include_total_count'> {
+    format?: 'csv' | 'ndjson';
+    fields?: string[];
+}
+export interface UserSearchViewBody {
+    name?: string;
+    filter?: UserSearchFilter;
+    order_by?: string | null;
+}
+export interface UserSearchView {
+    object: 'user_search_view';
+    id: string;
+    name: string;
+    filter: UserSearchFilter;
+    order_by: string | null;
+    created_by: string | null;
+    created_at: number;
+    updated_at: number;
+}
+export type RequiredActionName = 'update_password' | 'verify_email' | 'accept_policy' | 'configure_mfa' | 'update_profile' | 'identity_verification' | 'custom';
+export interface RequiredActionBody {
+    action: RequiredActionName;
+    /** `custom` only: the https URL the user is sent to. */
+    url?: string;
+    reason?: string;
+}
+export interface RequiredAction {
+    object: 'required_action';
+    id: string;
+    user_id: string;
+    action: RequiredActionName;
+    url: string | null;
+    reason: string | null;
+    created_by: string | null;
+    created_at: number;
+}
+export interface RequiredActionBulkResult {
+    object: 'required_action_bulk_result';
+    action: RequiredActionName;
+    matched: number;
+    created: number;
+    already_open: number;
+    skipped: number;
+}
+export interface UserLinkBody {
+    type: 'password_reset' | 'email_verification';
+    /** One of the user's addresses; default the primary. */
+    email_address_id?: string;
+    expires_in_seconds?: number;
+}
+export interface UserLink {
+    object: 'user_link';
+    type: 'password_reset' | 'email_verification';
+    user_id: string;
+    email_address_id: string;
+    email_address: string;
+    /** Present when the instance delivers this proof as a link. */
+    url?: string;
+    /** Present when the instance delivers this proof as a code. */
+    code?: string;
+    /** Password reset only: the reset attempt the link and code belong to. */
+    attempt_id?: string;
+    expires_at: number;
+}
+export interface UserNote {
+    object: 'user_note';
+    id: string;
+    user_id: string;
+    body: string;
+    pinned: boolean;
+    author: {
+        type: 'api_key' | 'dashboard_user';
+        id: string | null;
+    };
+    created_at: number;
+    updated_at: number;
+}
+export interface UserHistoryEntry {
+    object: 'user_history_entry';
+    id: string;
+    user_id: string;
+    action: string;
+    actor: {
+        type: 'api_key' | 'dashboard_user' | 'user' | 'system';
+        id: string | null;
+    };
+    /** Each changed field; a password or private_metadata value carries `redacted: true` and no values. */
+    changes: Array<{
+        field: string;
+        before?: unknown;
+        after?: unknown;
+        redacted?: boolean;
+    }>;
+    reason: string | null;
+    expires_at: number | null;
+    created_at: number;
+}
+export interface UserHistoryPage {
+    object: 'list';
+    data: UserHistoryEntry[];
+    has_more: boolean;
+    next_cursor: string | null;
+}
+export interface GuardianLink {
+    object: 'guardian_link';
+    id: string;
+    child_user_id: string;
+    guardian_user_id: string | null;
+    guardian_email: string | null;
+    relationship: string | null;
+    status: 'pending' | 'active' | 'declined' | 'revoked' | 'expired';
+    expires_at: number | null;
+    consent_method: 'email_link' | 'admin' | null;
+    consented_at: number | null;
+    created_at: number;
+}
+export interface MinorStatus {
+    object: 'minor_status';
+    /** not_required for anyone at or above the age of digital consent. */
+    status: 'not_required' | 'consent_required' | 'consented' | 'declined';
+    birthdate?: string;
+    age_at_assessment?: number;
+    consent_age?: number;
+    jurisdiction?: string | null;
+    consented_at?: number | null;
+    guardians: GuardianLink[];
+}