@augstash/sdk 0.2.0 → 0.3.0

package/dist/generated/src/apis/AdAccountApi.d.ts

@@ -23,7 +23,7 @@ export interface SyncAnalyticsRequest {
     connectionId: string;
     xIdempotencyKey?: string;
 }
-export interface UnlinkRequest {
+export interface UnlinkAnalyticsRequest {
     connectionId: string;
     xIdempotencyKey?: string;
 }
@@ -48,7 +48,7 @@ export interface AdAccountApiInterface {
      */
     authorizeUrlAnalytics(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AdsAuthorizeUrlResponse>;
     /**
-     * Writes < 300ms. Moves the account to LINKED; the daily job then pulls its trailing insights window. Linking alone does not fetch anything — call the sync endpoint if the tenant wants figures immediately. Requires API-key scope: analytics:write.
+     * Writes < 300ms. Moves the account to LINKED. Its first sync — the daily job, or the sync endpoint if the tenant wants figures immediately — imports the account\'s spend history (up to 37 months), so ads that ran before linking appear; later syncs re-read the trailing window. Linking alone does not fetch anything. Requires API-key scope: analytics:write.
      * @summary Link a Meta ad account
      * @param {string} connectionId
      * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
@@ -58,7 +58,7 @@ export interface AdAccountApiInterface {
      */
     linkAnalyticsRaw(requestParameters: LinkAnalyticsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AdAccountConnectionResponse>>;
     /**
-     * Writes < 300ms. Moves the account to LINKED; the daily job then pulls its trailing insights window. Linking alone does not fetch anything — call the sync endpoint if the tenant wants figures immediately. Requires API-key scope: analytics:write.
+     * Writes < 300ms. Moves the account to LINKED. Its first sync — the daily job, or the sync endpoint if the tenant wants figures immediately — imports the account\'s spend history (up to 37 months), so ads that ran before linking appear; later syncs re-read the trailing window. Linking alone does not fetch anything. Requires API-key scope: analytics:write.
      * Link a Meta ad account
      */
     linkAnalytics(requestParameters: LinkAnalyticsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AdAccountConnectionResponse>;
@@ -78,7 +78,7 @@ export interface AdAccountApiInterface {
      */
     listAnalyticsAdaccounts(requestParameters: ListAnalyticsAdaccountsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PageResponseAdAccountConnectionResponse>;
     /**
-     * Writes < 5s — this endpoint deliberately waits on Meta\'s Marketing API, which is slow and rate-limited. Re-reads the trailing restatement window (default 7 days, ending yesterday) and OVERWRITES the stored figure for each (ad, day). Do not call it on page render; the daily job is the normal path. Requires API-key scope: analytics:write.
+     * Writes < 5s — this endpoint deliberately waits on Meta\'s Marketing API, which is slow and rate-limited. Re-reads the trailing restatement window (default 7 days, ending yesterday) and OVERWRITES the stored figure for each (ad, day). Exception: the account\'s first sync after linking imports its history (up to 37 months, one request per quarter) and takes correspondingly longer, once. Do not call it on page render; the daily job is the normal path. Requires API-key scope: analytics:write.
      * @summary Sync a Meta ad account\'s spend now
      * @param {string} connectionId
      * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
@@ -88,7 +88,7 @@ export interface AdAccountApiInterface {
      */
     syncAnalyticsRaw(requestParameters: SyncAnalyticsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AdAccountConnectionResponse>>;
     /**
-     * Writes < 5s — this endpoint deliberately waits on Meta\'s Marketing API, which is slow and rate-limited. Re-reads the trailing restatement window (default 7 days, ending yesterday) and OVERWRITES the stored figure for each (ad, day). Do not call it on page render; the daily job is the normal path. Requires API-key scope: analytics:write.
+     * Writes < 5s — this endpoint deliberately waits on Meta\'s Marketing API, which is slow and rate-limited. Re-reads the trailing restatement window (default 7 days, ending yesterday) and OVERWRITES the stored figure for each (ad, day). Exception: the account\'s first sync after linking imports its history (up to 37 months, one request per quarter) and takes correspondingly longer, once. Do not call it on page render; the daily job is the normal path. Requires API-key scope: analytics:write.
      * Sync a Meta ad account\'s spend now
      */
     syncAnalytics(requestParameters: SyncAnalyticsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AdAccountConnectionResponse>;
@@ -101,12 +101,12 @@ export interface AdAccountApiInterface {
      * @throws {RequiredError}
      * @memberof AdAccountApiInterface
      */
-    unlinkRaw(requestParameters: UnlinkRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AdAccountConnectionResponse>>;
+    unlinkAnalyticsRaw(requestParameters: UnlinkAnalyticsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AdAccountConnectionResponse>>;
     /**
      * Writes < 300ms. Wipes the stored credential and stops the daily sync. Spend rows already pulled are RETAINED — historical ROAS must not change because an account was disconnected today. Reconnecting needs the OAuth flow again. Requires API-key scope: analytics:write.
      * Unlink a Meta ad account
      */
-    unlink(requestParameters: UnlinkRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AdAccountConnectionResponse>;
+    unlinkAnalytics(requestParameters: UnlinkAnalyticsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AdAccountConnectionResponse>;
 }
 /**
  *
@@ -123,12 +123,12 @@ export declare class AdAccountApi extends runtime.BaseAPI implements AdAccountAp
      */
     authorizeUrlAnalytics(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AdsAuthorizeUrlResponse>;
     /**
-     * Writes < 300ms. Moves the account to LINKED; the daily job then pulls its trailing insights window. Linking alone does not fetch anything — call the sync endpoint if the tenant wants figures immediately. Requires API-key scope: analytics:write.
+     * Writes < 300ms. Moves the account to LINKED. Its first sync — the daily job, or the sync endpoint if the tenant wants figures immediately — imports the account\'s spend history (up to 37 months), so ads that ran before linking appear; later syncs re-read the trailing window. Linking alone does not fetch anything. Requires API-key scope: analytics:write.
      * Link a Meta ad account
      */
     linkAnalyticsRaw(requestParameters: LinkAnalyticsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AdAccountConnectionResponse>>;
     /**
-     * Writes < 300ms. Moves the account to LINKED; the daily job then pulls its trailing insights window. Linking alone does not fetch anything — call the sync endpoint if the tenant wants figures immediately. Requires API-key scope: analytics:write.
+     * Writes < 300ms. Moves the account to LINKED. Its first sync — the daily job, or the sync endpoint if the tenant wants figures immediately — imports the account\'s spend history (up to 37 months), so ads that ran before linking appear; later syncs re-read the trailing window. Linking alone does not fetch anything. Requires API-key scope: analytics:write.
      * Link a Meta ad account
      */
     linkAnalytics(requestParameters: LinkAnalyticsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AdAccountConnectionResponse>;
@@ -143,12 +143,12 @@ export declare class AdAccountApi extends runtime.BaseAPI implements AdAccountAp
      */
     listAnalyticsAdaccounts(requestParameters: ListAnalyticsAdaccountsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PageResponseAdAccountConnectionResponse>;
     /**
-     * Writes < 5s — this endpoint deliberately waits on Meta\'s Marketing API, which is slow and rate-limited. Re-reads the trailing restatement window (default 7 days, ending yesterday) and OVERWRITES the stored figure for each (ad, day). Do not call it on page render; the daily job is the normal path. Requires API-key scope: analytics:write.
+     * Writes < 5s — this endpoint deliberately waits on Meta\'s Marketing API, which is slow and rate-limited. Re-reads the trailing restatement window (default 7 days, ending yesterday) and OVERWRITES the stored figure for each (ad, day). Exception: the account\'s first sync after linking imports its history (up to 37 months, one request per quarter) and takes correspondingly longer, once. Do not call it on page render; the daily job is the normal path. Requires API-key scope: analytics:write.
      * Sync a Meta ad account\'s spend now
      */
     syncAnalyticsRaw(requestParameters: SyncAnalyticsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AdAccountConnectionResponse>>;
     /**
-     * Writes < 5s — this endpoint deliberately waits on Meta\'s Marketing API, which is slow and rate-limited. Re-reads the trailing restatement window (default 7 days, ending yesterday) and OVERWRITES the stored figure for each (ad, day). Do not call it on page render; the daily job is the normal path. Requires API-key scope: analytics:write.
+     * Writes < 5s — this endpoint deliberately waits on Meta\'s Marketing API, which is slow and rate-limited. Re-reads the trailing restatement window (default 7 days, ending yesterday) and OVERWRITES the stored figure for each (ad, day). Exception: the account\'s first sync after linking imports its history (up to 37 months, one request per quarter) and takes correspondingly longer, once. Do not call it on page render; the daily job is the normal path. Requires API-key scope: analytics:write.
      * Sync a Meta ad account\'s spend now
      */
     syncAnalytics(requestParameters: SyncAnalyticsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AdAccountConnectionResponse>;
@@ -156,12 +156,12 @@ export declare class AdAccountApi extends runtime.BaseAPI implements AdAccountAp
      * Writes < 300ms. Wipes the stored credential and stops the daily sync. Spend rows already pulled are RETAINED — historical ROAS must not change because an account was disconnected today. Reconnecting needs the OAuth flow again. Requires API-key scope: analytics:write.
      * Unlink a Meta ad account
      */
-    unlinkRaw(requestParameters: UnlinkRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AdAccountConnectionResponse>>;
+    unlinkAnalyticsRaw(requestParameters: UnlinkAnalyticsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AdAccountConnectionResponse>>;
     /**
      * Writes < 300ms. Wipes the stored credential and stops the daily sync. Spend rows already pulled are RETAINED — historical ROAS must not change because an account was disconnected today. Reconnecting needs the OAuth flow again. Requires API-key scope: analytics:write.
      * Unlink a Meta ad account
      */
-    unlink(requestParameters: UnlinkRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AdAccountConnectionResponse>;
+    unlinkAnalytics(requestParameters: UnlinkAnalyticsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AdAccountConnectionResponse>;
 }
 /**
  * @export

package/dist/generated/src/apis/AdAccountApi.js

@@ -88,7 +88,7 @@ class AdAccountApi extends runtime.BaseAPI {
         return await response.value();
     }
     /**
-     * Writes < 300ms. Moves the account to LINKED; the daily job then pulls its trailing insights window. Linking alone does not fetch anything — call the sync endpoint if the tenant wants figures immediately. Requires API-key scope: analytics:write.
+     * Writes < 300ms. Moves the account to LINKED. Its first sync — the daily job, or the sync endpoint if the tenant wants figures immediately — imports the account\'s spend history (up to 37 months), so ads that ran before linking appear; later syncs re-read the trailing window. Linking alone does not fetch anything. Requires API-key scope: analytics:write.
      * Link a Meta ad account
      */
     async linkAnalyticsRaw(requestParameters, initOverrides) {
@@ -121,7 +121,7 @@ class AdAccountApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.AdAccountConnectionResponseFromJSON)(jsonValue));
     }
     /**
-     * Writes < 300ms. Moves the account to LINKED; the daily job then pulls its trailing insights window. Linking alone does not fetch anything — call the sync endpoint if the tenant wants figures immediately. Requires API-key scope: analytics:write.
+     * Writes < 300ms. Moves the account to LINKED. Its first sync — the daily job, or the sync endpoint if the tenant wants figures immediately — imports the account\'s spend history (up to 37 months), so ads that ran before linking appear; later syncs re-read the trailing window. Linking alone does not fetch anything. Requires API-key scope: analytics:write.
      * Link a Meta ad account
      */
     async linkAnalytics(requestParameters, initOverrides) {
@@ -172,7 +172,7 @@ class AdAccountApi extends runtime.BaseAPI {
         return await response.value();
     }
     /**
-     * Writes < 5s — this endpoint deliberately waits on Meta\'s Marketing API, which is slow and rate-limited. Re-reads the trailing restatement window (default 7 days, ending yesterday) and OVERWRITES the stored figure for each (ad, day). Do not call it on page render; the daily job is the normal path. Requires API-key scope: analytics:write.
+     * Writes < 5s — this endpoint deliberately waits on Meta\'s Marketing API, which is slow and rate-limited. Re-reads the trailing restatement window (default 7 days, ending yesterday) and OVERWRITES the stored figure for each (ad, day). Exception: the account\'s first sync after linking imports its history (up to 37 months, one request per quarter) and takes correspondingly longer, once. Do not call it on page render; the daily job is the normal path. Requires API-key scope: analytics:write.
      * Sync a Meta ad account\'s spend now
      */
     async syncAnalyticsRaw(requestParameters, initOverrides) {
@@ -205,7 +205,7 @@ class AdAccountApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.AdAccountConnectionResponseFromJSON)(jsonValue));
     }
     /**
-     * Writes < 5s — this endpoint deliberately waits on Meta\'s Marketing API, which is slow and rate-limited. Re-reads the trailing restatement window (default 7 days, ending yesterday) and OVERWRITES the stored figure for each (ad, day). Do not call it on page render; the daily job is the normal path. Requires API-key scope: analytics:write.
+     * Writes < 5s — this endpoint deliberately waits on Meta\'s Marketing API, which is slow and rate-limited. Re-reads the trailing restatement window (default 7 days, ending yesterday) and OVERWRITES the stored figure for each (ad, day). Exception: the account\'s first sync after linking imports its history (up to 37 months, one request per quarter) and takes correspondingly longer, once. Do not call it on page render; the daily job is the normal path. Requires API-key scope: analytics:write.
      * Sync a Meta ad account\'s spend now
      */
     async syncAnalytics(requestParameters, initOverrides) {
@@ -216,9 +216,9 @@ class AdAccountApi extends runtime.BaseAPI {
      * Writes < 300ms. Wipes the stored credential and stops the daily sync. Spend rows already pulled are RETAINED — historical ROAS must not change because an account was disconnected today. Reconnecting needs the OAuth flow again. Requires API-key scope: analytics:write.
      * Unlink a Meta ad account
      */
-    async unlinkRaw(requestParameters, initOverrides) {
+    async unlinkAnalyticsRaw(requestParameters, initOverrides) {
         if (requestParameters['connectionId'] == null) {
-            throw new runtime.RequiredError('connectionId', 'Required parameter "connectionId" was null or undefined when calling unlink().');
+            throw new runtime.RequiredError('connectionId', 'Required parameter "connectionId" was null or undefined when calling unlinkAnalytics().');
         }
         const queryParameters = {};
         const headerParameters = {};
@@ -249,8 +249,8 @@ class AdAccountApi extends runtime.BaseAPI {
      * Writes < 300ms. Wipes the stored credential and stops the daily sync. Spend rows already pulled are RETAINED — historical ROAS must not change because an account was disconnected today. Reconnecting needs the OAuth flow again. Requires API-key scope: analytics:write.
      * Unlink a Meta ad account
      */
-    async unlink(requestParameters, initOverrides) {
-        const response = await this.unlinkRaw(requestParameters, initOverrides);
+    async unlinkAnalytics(requestParameters, initOverrides) {
+        const response = await this.unlinkAnalyticsRaw(requestParameters, initOverrides);
         return await response.value();
     }
 }

package/dist/generated/src/apis/AdminEmailReputationApi.d.ts

@@ -23,7 +23,7 @@ export interface RequestProductionAccessRequest {
  */
 export interface AdminEmailReputationApiInterface {
     /**
-     * Reads < 300ms. 204 when production access has never been requested.
+     * Reads < 300ms. 204 when production access has never been requested. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * @summary The latest SES production-access request
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -31,12 +31,12 @@ export interface AdminEmailReputationApiInterface {
      */
     productionAccessRequestRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ProductionAccessRequestResponse>>;
     /**
-     * Reads < 300ms. 204 when production access has never been requested.
+     * Reads < 300ms. 204 when production access has never been requested. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * The latest SES production-access request
      */
     productionAccessRequest(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ProductionAccessRequestResponse>;
     /**
-     * Reads < 300ms. Account-wide figures across every tenant — quota ceilings, trailing-24h volume, sandbox and enforcement status. `available` is false when SES could not be reached, so zeros are not mistaken for a stalled account.
+     * Reads < 300ms. Account-wide figures across every tenant — quota ceilings, trailing-24h volume, sandbox and enforcement status. `available` is false when SES could not be reached, so zeros are not mistaken for a stalled account. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * @summary The shared SES account\'s sending state
      * @param {*} [options] Override http request option.
      * @throws {RequiredError}
@@ -44,12 +44,12 @@ export interface AdminEmailReputationApiInterface {
      */
     reputationAdminRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AdminEmailAccountReputationResponse>>;
     /**
-     * Reads < 300ms. Account-wide figures across every tenant — quota ceilings, trailing-24h volume, sandbox and enforcement status. `available` is false when SES could not be reached, so zeros are not mistaken for a stalled account.
+     * Reads < 300ms. Account-wide figures across every tenant — quota ceilings, trailing-24h volume, sandbox and enforcement status. `available` is false when SES could not be reached, so zeros are not mistaken for a stalled account. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * The shared SES account\'s sending state
      */
     reputationAdmin(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AdminEmailAccountReputationResponse>;
     /**
-     * Writes < 300ms. Guided sandbox-to-production scaling flow. This applies to the SHARED sending account and therefore to every tenant at once, which is why it is an operator action rather than a tenant one.
+     * Writes < 300ms. Guided sandbox-to-production scaling flow. This applies to the SHARED sending account and therefore to every tenant at once, which is why it is an operator action rather than a tenant one. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * @summary Submit a request for SES production access
      * @param {SubmitProductionAccessRequest} submitProductionAccessRequest
      * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
@@ -59,7 +59,7 @@ export interface AdminEmailReputationApiInterface {
      */
     requestProductionAccessRaw(requestParameters: RequestProductionAccessRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ProductionAccessRequestResponse>>;
     /**
-     * Writes < 300ms. Guided sandbox-to-production scaling flow. This applies to the SHARED sending account and therefore to every tenant at once, which is why it is an operator action rather than a tenant one.
+     * Writes < 300ms. Guided sandbox-to-production scaling flow. This applies to the SHARED sending account and therefore to every tenant at once, which is why it is an operator action rather than a tenant one. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Submit a request for SES production access
      */
     requestProductionAccess(requestParameters: RequestProductionAccessRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ProductionAccessRequestResponse>;
@@ -69,32 +69,32 @@ export interface AdminEmailReputationApiInterface {
  */
 export declare class AdminEmailReputationApi extends runtime.BaseAPI implements AdminEmailReputationApiInterface {
     /**
-     * Reads < 300ms. 204 when production access has never been requested.
+     * Reads < 300ms. 204 when production access has never been requested. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * The latest SES production-access request
      */
     productionAccessRequestRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ProductionAccessRequestResponse>>;
     /**
-     * Reads < 300ms. 204 when production access has never been requested.
+     * Reads < 300ms. 204 when production access has never been requested. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * The latest SES production-access request
      */
     productionAccessRequest(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ProductionAccessRequestResponse>;
     /**
-     * Reads < 300ms. Account-wide figures across every tenant — quota ceilings, trailing-24h volume, sandbox and enforcement status. `available` is false when SES could not be reached, so zeros are not mistaken for a stalled account.
+     * Reads < 300ms. Account-wide figures across every tenant — quota ceilings, trailing-24h volume, sandbox and enforcement status. `available` is false when SES could not be reached, so zeros are not mistaken for a stalled account. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * The shared SES account\'s sending state
      */
     reputationAdminRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AdminEmailAccountReputationResponse>>;
     /**
-     * Reads < 300ms. Account-wide figures across every tenant — quota ceilings, trailing-24h volume, sandbox and enforcement status. `available` is false when SES could not be reached, so zeros are not mistaken for a stalled account.
+     * Reads < 300ms. Account-wide figures across every tenant — quota ceilings, trailing-24h volume, sandbox and enforcement status. `available` is false when SES could not be reached, so zeros are not mistaken for a stalled account. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * The shared SES account\'s sending state
      */
     reputationAdmin(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AdminEmailAccountReputationResponse>;
     /**
-     * Writes < 300ms. Guided sandbox-to-production scaling flow. This applies to the SHARED sending account and therefore to every tenant at once, which is why it is an operator action rather than a tenant one.
+     * Writes < 300ms. Guided sandbox-to-production scaling flow. This applies to the SHARED sending account and therefore to every tenant at once, which is why it is an operator action rather than a tenant one. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Submit a request for SES production access
      */
     requestProductionAccessRaw(requestParameters: RequestProductionAccessRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<ProductionAccessRequestResponse>>;
     /**
-     * Writes < 300ms. Guided sandbox-to-production scaling flow. This applies to the SHARED sending account and therefore to every tenant at once, which is why it is an operator action rather than a tenant one.
+     * Writes < 300ms. Guided sandbox-to-production scaling flow. This applies to the SHARED sending account and therefore to every tenant at once, which is why it is an operator action rather than a tenant one. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Submit a request for SES production access
      */
     requestProductionAccess(requestParameters: RequestProductionAccessRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<ProductionAccessRequestResponse>;

package/dist/generated/src/apis/AdminEmailReputationApi.js

@@ -54,7 +54,7 @@ const index_1 = require("../models/index");
  */
 class AdminEmailReputationApi extends runtime.BaseAPI {
     /**
-     * Reads < 300ms. 204 when production access has never been requested.
+     * Reads < 300ms. 204 when production access has never been requested. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * The latest SES production-access request
      */
     async productionAccessRequestRaw(initOverrides) {
@@ -80,7 +80,7 @@ class AdminEmailReputationApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.ProductionAccessRequestResponseFromJSON)(jsonValue));
     }
     /**
-     * Reads < 300ms. 204 when production access has never been requested.
+     * Reads < 300ms. 204 when production access has never been requested. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * The latest SES production-access request
      */
     async productionAccessRequest(initOverrides) {
@@ -88,7 +88,7 @@ class AdminEmailReputationApi extends runtime.BaseAPI {
         return await response.value();
     }
     /**
-     * Reads < 300ms. Account-wide figures across every tenant — quota ceilings, trailing-24h volume, sandbox and enforcement status. `available` is false when SES could not be reached, so zeros are not mistaken for a stalled account.
+     * Reads < 300ms. Account-wide figures across every tenant — quota ceilings, trailing-24h volume, sandbox and enforcement status. `available` is false when SES could not be reached, so zeros are not mistaken for a stalled account. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * The shared SES account\'s sending state
      */
     async reputationAdminRaw(initOverrides) {
@@ -114,7 +114,7 @@ class AdminEmailReputationApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.AdminEmailAccountReputationResponseFromJSON)(jsonValue));
     }
     /**
-     * Reads < 300ms. Account-wide figures across every tenant — quota ceilings, trailing-24h volume, sandbox and enforcement status. `available` is false when SES could not be reached, so zeros are not mistaken for a stalled account.
+     * Reads < 300ms. Account-wide figures across every tenant — quota ceilings, trailing-24h volume, sandbox and enforcement status. `available` is false when SES could not be reached, so zeros are not mistaken for a stalled account. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * The shared SES account\'s sending state
      */
     async reputationAdmin(initOverrides) {
@@ -122,7 +122,7 @@ class AdminEmailReputationApi extends runtime.BaseAPI {
         return await response.value();
     }
     /**
-     * Writes < 300ms. Guided sandbox-to-production scaling flow. This applies to the SHARED sending account and therefore to every tenant at once, which is why it is an operator action rather than a tenant one.
+     * Writes < 300ms. Guided sandbox-to-production scaling flow. This applies to the SHARED sending account and therefore to every tenant at once, which is why it is an operator action rather than a tenant one. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Submit a request for SES production access
      */
     async requestProductionAccessRaw(requestParameters, initOverrides) {
@@ -156,7 +156,7 @@ class AdminEmailReputationApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.ProductionAccessRequestResponseFromJSON)(jsonValue));
     }
     /**
-     * Writes < 300ms. Guided sandbox-to-production scaling flow. This applies to the SHARED sending account and therefore to every tenant at once, which is why it is an operator action rather than a tenant one.
+     * Writes < 300ms. Guided sandbox-to-production scaling flow. This applies to the SHARED sending account and therefore to every tenant at once, which is why it is an operator action rather than a tenant one. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Submit a request for SES production access
      */
     async requestProductionAccess(requestParameters, initOverrides) {

package/dist/generated/src/apis/AdminFirstPartyAppApi.d.ts

@@ -18,6 +18,10 @@ export interface DeregisterAdminRequest {
 export interface GetAdminRequest {
     id: string;
 }
+export interface IssueApiKeyRequest {
+    id: string;
+    xIdempotencyKey?: string;
+}
 export interface ListAdminFirstpartyappsRequest {
     pageable: Pageable;
     search?: string;
@@ -39,7 +43,7 @@ export interface UpdateAdminRequest {
  */
 export interface AdminFirstPartyAppApiInterface {
     /**
-     * Writes < 300ms. The workspace is charged normally from the next send onwards; sends already made while it was exempt stay free.
+     * Writes < 300ms. The workspace is charged normally from the next send onwards; sends already made while it was exempt stay free. The SDK credential the console issued is revoked with the registration. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * @summary Remove a registration, resuming billing for that workspace
      * @param {string} id
      * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
@@ -49,12 +53,12 @@ export interface AdminFirstPartyAppApiInterface {
      */
     deregisterAdminRaw(requestParameters: DeregisterAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
     /**
-     * Writes < 300ms. The workspace is charged normally from the next send onwards; sends already made while it was exempt stay free.
+     * Writes < 300ms. The workspace is charged normally from the next send onwards; sends already made while it was exempt stay free. The SDK credential the console issued is revoked with the registration. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Remove a registration, resuming billing for that workspace
      */
     deregisterAdmin(requestParameters: DeregisterAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
     /**
-     * Reads < 300ms.
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * @summary One registered first-party app
      * @param {string} id
      * @param {*} [options] Override http request option.
@@ -63,10 +67,25 @@ export interface AdminFirstPartyAppApiInterface {
      */
     getAdminRaw(requestParameters: GetAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<FirstPartyApp>>;
     /**
-     * Reads < 300ms.
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * One registered first-party app
      */
     getAdmin(requestParameters: GetAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<FirstPartyApp>;
+    /**
+     * Writes < 300ms. Rotates the secret of the app\'s live key in place (same key id), or mints a fresh key when none was ever issued or the previous one is revoked. The previous secret stops verifying immediately. The response carries the new plaintext in apiKey — the ONLY time it is shown. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * @summary Issue the app\'s SDK credential, or rotate the one it has
+     * @param {string} id
+     * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof AdminFirstPartyAppApiInterface
+     */
+    issueApiKeyRaw(requestParameters: IssueApiKeyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<FirstPartyApp>>;
+    /**
+     * Writes < 300ms. Rotates the secret of the app\'s live key in place (same key id), or mints a fresh key when none was ever issued or the previous one is revoked. The previous secret stops verifying immediately. The response carries the new plaintext in apiKey — the ONLY time it is shown. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * Issue the app\'s SDK credential, or rotate the one it has
+     */
+    issueApiKey(requestParameters: IssueApiKeyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<FirstPartyApp>;
     /**
      * Reads < 300ms. Optionally narrowed by a term matched against the code, name or domain. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * @summary List the apps that are ours
@@ -83,8 +102,8 @@ export interface AdminFirstPartyAppApiInterface {
      */
     listAdminFirstpartyapps(requestParameters: ListAdminFirstpartyappsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PageResponseFirstPartyApp>;
     /**
-     * Writes < 300ms. Name the workspace by EITHER its tenant id OR its subdomain. From the next send onwards the workspace is charged nothing and is issued no invoice; nothing already charged is revisited.
-     * @summary Register one of our products, so it stops being billed
+     * Writes < 300ms. Name the workspace by EITHER its tenant id OR its subdomain. From the next send onwards the workspace is charged nothing and is issued no invoice; nothing already charged is revisited. The response carries the app\'s freshly minted ask_live_* credential in apiKey — the ONLY time it is shown. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * @summary Register one of our products, so it stops being billed and gets its SDK key
      * @param {RegisterFirstPartyAppRequest} registerFirstPartyAppRequest
      * @param {string} [xIdempotencyKey] Makes this call replayable instead of re-executed on retry (AS-TGT-001). The first 2xx response is cached per (tenant, key) for 24h and replayed verbatim, with &#x60;X-Idempotent-Replay&#x60; set. Reusing a key with a different body is refused with 409 IDEMPOTENCY_KEY_REUSED. The SDKs send one automatically on mutating calls.
      * @param {*} [options] Override http request option.
@@ -93,12 +112,12 @@ export interface AdminFirstPartyAppApiInterface {
      */
     registerAdminRaw(requestParameters: RegisterAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<FirstPartyApp>>;
     /**
-     * Writes < 300ms. Name the workspace by EITHER its tenant id OR its subdomain. From the next send onwards the workspace is charged nothing and is issued no invoice; nothing already charged is revisited.
-     * Register one of our products, so it stops being billed
+     * Writes < 300ms. Name the workspace by EITHER its tenant id OR its subdomain. From the next send onwards the workspace is charged nothing and is issued no invoice; nothing already charged is revisited. The response carries the app\'s freshly minted ask_live_* credential in apiKey — the ONLY time it is shown. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * Register one of our products, so it stops being billed and gets its SDK key
      */
     registerAdmin(requestParameters: RegisterAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<FirstPartyApp>;
     /**
-     * Writes < 300ms. Omitted fields are left as they were. Setting billingExempt to false resumes charging the workspace while keeping the record that it is ours.
+     * Writes < 300ms. Omitted fields are left as they were. Setting billingExempt to false resumes charging the workspace while keeping the record that it is ours. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * @summary Change a registration, or switch its billing back on
      * @param {string} id
      * @param {UpdateFirstPartyAppRequest} updateFirstPartyAppRequest
@@ -109,7 +128,7 @@ export interface AdminFirstPartyAppApiInterface {
      */
     updateAdminRaw(requestParameters: UpdateAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<FirstPartyApp>>;
     /**
-     * Writes < 300ms. Omitted fields are left as they were. Setting billingExempt to false resumes charging the workspace while keeping the record that it is ours.
+     * Writes < 300ms. Omitted fields are left as they were. Setting billingExempt to false resumes charging the workspace while keeping the record that it is ours. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Change a registration, or switch its billing back on
      */
     updateAdmin(requestParameters: UpdateAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<FirstPartyApp>;
@@ -119,25 +138,35 @@ export interface AdminFirstPartyAppApiInterface {
  */
 export declare class AdminFirstPartyAppApi extends runtime.BaseAPI implements AdminFirstPartyAppApiInterface {
     /**
-     * Writes < 300ms. The workspace is charged normally from the next send onwards; sends already made while it was exempt stay free.
+     * Writes < 300ms. The workspace is charged normally from the next send onwards; sends already made while it was exempt stay free. The SDK credential the console issued is revoked with the registration. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Remove a registration, resuming billing for that workspace
      */
     deregisterAdminRaw(requestParameters: DeregisterAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<void>>;
     /**
-     * Writes < 300ms. The workspace is charged normally from the next send onwards; sends already made while it was exempt stay free.
+     * Writes < 300ms. The workspace is charged normally from the next send onwards; sends already made while it was exempt stay free. The SDK credential the console issued is revoked with the registration. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Remove a registration, resuming billing for that workspace
      */
     deregisterAdmin(requestParameters: DeregisterAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<void>;
     /**
-     * Reads < 300ms.
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * One registered first-party app
      */
     getAdminRaw(requestParameters: GetAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<FirstPartyApp>>;
     /**
-     * Reads < 300ms.
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * One registered first-party app
      */
     getAdmin(requestParameters: GetAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<FirstPartyApp>;
+    /**
+     * Writes < 300ms. Rotates the secret of the app\'s live key in place (same key id), or mints a fresh key when none was ever issued or the previous one is revoked. The previous secret stops verifying immediately. The response carries the new plaintext in apiKey — the ONLY time it is shown. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * Issue the app\'s SDK credential, or rotate the one it has
+     */
+    issueApiKeyRaw(requestParameters: IssueApiKeyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<FirstPartyApp>>;
+    /**
+     * Writes < 300ms. Rotates the secret of the app\'s live key in place (same key id), or mints a fresh key when none was ever issued or the previous one is revoked. The previous secret stops verifying immediately. The response carries the new plaintext in apiKey — the ONLY time it is shown. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * Issue the app\'s SDK credential, or rotate the one it has
+     */
+    issueApiKey(requestParameters: IssueApiKeyRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<FirstPartyApp>;
     /**
      * Reads < 300ms. Optionally narrowed by a term matched against the code, name or domain. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * List the apps that are ours
@@ -149,22 +178,22 @@ export declare class AdminFirstPartyAppApi extends runtime.BaseAPI implements Ad
      */
     listAdminFirstpartyapps(requestParameters: ListAdminFirstpartyappsRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PageResponseFirstPartyApp>;
     /**
-     * Writes < 300ms. Name the workspace by EITHER its tenant id OR its subdomain. From the next send onwards the workspace is charged nothing and is issued no invoice; nothing already charged is revisited.
-     * Register one of our products, so it stops being billed
+     * Writes < 300ms. Name the workspace by EITHER its tenant id OR its subdomain. From the next send onwards the workspace is charged nothing and is issued no invoice; nothing already charged is revisited. The response carries the app\'s freshly minted ask_live_* credential in apiKey — the ONLY time it is shown. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * Register one of our products, so it stops being billed and gets its SDK key
      */
     registerAdminRaw(requestParameters: RegisterAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<FirstPartyApp>>;
     /**
-     * Writes < 300ms. Name the workspace by EITHER its tenant id OR its subdomain. From the next send onwards the workspace is charged nothing and is issued no invoice; nothing already charged is revisited.
-     * Register one of our products, so it stops being billed
+     * Writes < 300ms. Name the workspace by EITHER its tenant id OR its subdomain. From the next send onwards the workspace is charged nothing and is issued no invoice; nothing already charged is revisited. The response carries the app\'s freshly minted ask_live_* credential in apiKey — the ONLY time it is shown. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * Register one of our products, so it stops being billed and gets its SDK key
      */
     registerAdmin(requestParameters: RegisterAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<FirstPartyApp>;
     /**
-     * Writes < 300ms. Omitted fields are left as they were. Setting billingExempt to false resumes charging the workspace while keeping the record that it is ours.
+     * Writes < 300ms. Omitted fields are left as they were. Setting billingExempt to false resumes charging the workspace while keeping the record that it is ours. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Change a registration, or switch its billing back on
      */
     updateAdminRaw(requestParameters: UpdateAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<FirstPartyApp>>;
     /**
-     * Writes < 300ms. Omitted fields are left as they were. Setting billingExempt to false resumes charging the workspace while keeping the record that it is ours.
+     * Writes < 300ms. Omitted fields are left as they were. Setting billingExempt to false resumes charging the workspace while keeping the record that it is ours. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Change a registration, or switch its billing back on
      */
     updateAdmin(requestParameters: UpdateAdminRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<FirstPartyApp>;

package/dist/generated/src/apis/AdminFirstPartyAppApi.js

@@ -54,7 +54,7 @@ const index_1 = require("../models/index");
  */
 class AdminFirstPartyAppApi extends runtime.BaseAPI {
     /**
-     * Writes < 300ms. The workspace is charged normally from the next send onwards; sends already made while it was exempt stay free.
+     * Writes < 300ms. The workspace is charged normally from the next send onwards; sends already made while it was exempt stay free. The SDK credential the console issued is revoked with the registration. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Remove a registration, resuming billing for that workspace
      */
     async deregisterAdminRaw(requestParameters, initOverrides) {
@@ -87,14 +87,14 @@ class AdminFirstPartyAppApi extends runtime.BaseAPI {
         return new runtime.VoidApiResponse(response);
     }
     /**
-     * Writes < 300ms. The workspace is charged normally from the next send onwards; sends already made while it was exempt stay free.
+     * Writes < 300ms. The workspace is charged normally from the next send onwards; sends already made while it was exempt stay free. The SDK credential the console issued is revoked with the registration. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Remove a registration, resuming billing for that workspace
      */
     async deregisterAdmin(requestParameters, initOverrides) {
         await this.deregisterAdminRaw(requestParameters, initOverrides);
     }
     /**
-     * Reads < 300ms.
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * One registered first-party app
      */
     async getAdminRaw(requestParameters, initOverrides) {
@@ -124,13 +124,54 @@ class AdminFirstPartyAppApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.FirstPartyAppFromJSON)(jsonValue));
     }
     /**
-     * Reads < 300ms.
+     * Reads < 300ms. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * One registered first-party app
      */
     async getAdmin(requestParameters, initOverrides) {
         const response = await this.getAdminRaw(requestParameters, initOverrides);
         return await response.value();
     }
+    /**
+     * Writes < 300ms. Rotates the secret of the app\'s live key in place (same key id), or mints a fresh key when none was ever issued or the previous one is revoked. The previous secret stops verifying immediately. The response carries the new plaintext in apiKey — the ONLY time it is shown. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * Issue the app\'s SDK credential, or rotate the one it has
+     */
+    async issueApiKeyRaw(requestParameters, initOverrides) {
+        if (requestParameters['id'] == null) {
+            throw new runtime.RequiredError('id', 'Required parameter "id" was null or undefined when calling issueApiKey().');
+        }
+        const queryParameters = {};
+        const headerParameters = {};
+        if (requestParameters['xIdempotencyKey'] != null) {
+            headerParameters['X-Idempotency-Key'] = String(requestParameters['xIdempotencyKey']);
+        }
+        if (this.configuration && this.configuration.apiKey) {
+            headerParameters["X-Api-Key"] = await this.configuration.apiKey("X-Api-Key"); // ApiKeyAuth authentication
+        }
+        if (this.configuration && this.configuration.accessToken) {
+            const token = this.configuration.accessToken;
+            const tokenString = await token("BearerAuth", []);
+            if (tokenString) {
+                headerParameters["Authorization"] = `Bearer ${tokenString}`;
+            }
+        }
+        let urlPath = `/api/v1/admin/first-party-apps/{id}/api-key`;
+        urlPath = urlPath.replace(`{${"id"}}`, encodeURIComponent(String(requestParameters['id'])));
+        const response = await this.request({
+            path: urlPath,
+            method: 'POST',
+            headers: headerParameters,
+            query: queryParameters,
+        }, initOverrides);
+        return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.FirstPartyAppFromJSON)(jsonValue));
+    }
+    /**
+     * Writes < 300ms. Rotates the secret of the app\'s live key in place (same key id), or mints a fresh key when none was ever issued or the previous one is revoked. The previous secret stops verifying immediately. The response carries the new plaintext in apiKey — the ONLY time it is shown. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * Issue the app\'s SDK credential, or rotate the one it has
+     */
+    async issueApiKey(requestParameters, initOverrides) {
+        const response = await this.issueApiKeyRaw(requestParameters, initOverrides);
+        return await response.value();
+    }
     /**
      * Reads < 300ms. Optionally narrowed by a term matched against the code, name or domain. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * List the apps that are ours
@@ -175,8 +216,8 @@ class AdminFirstPartyAppApi extends runtime.BaseAPI {
         return await response.value();
     }
     /**
-     * Writes < 300ms. Name the workspace by EITHER its tenant id OR its subdomain. From the next send onwards the workspace is charged nothing and is issued no invoice; nothing already charged is revisited.
-     * Register one of our products, so it stops being billed
+     * Writes < 300ms. Name the workspace by EITHER its tenant id OR its subdomain. From the next send onwards the workspace is charged nothing and is issued no invoice; nothing already charged is revisited. The response carries the app\'s freshly minted ask_live_* credential in apiKey — the ONLY time it is shown. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * Register one of our products, so it stops being billed and gets its SDK key
      */
     async registerAdminRaw(requestParameters, initOverrides) {
         if (requestParameters['registerFirstPartyAppRequest'] == null) {
@@ -209,15 +250,15 @@ class AdminFirstPartyAppApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.FirstPartyAppFromJSON)(jsonValue));
     }
     /**
-     * Writes < 300ms. Name the workspace by EITHER its tenant id OR its subdomain. From the next send onwards the workspace is charged nothing and is issued no invoice; nothing already charged is revisited.
-     * Register one of our products, so it stops being billed
+     * Writes < 300ms. Name the workspace by EITHER its tenant id OR its subdomain. From the next send onwards the workspace is charged nothing and is issued no invoice; nothing already charged is revisited. The response carries the app\'s freshly minted ask_live_* credential in apiKey — the ONLY time it is shown. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
+     * Register one of our products, so it stops being billed and gets its SDK key
      */
     async registerAdmin(requestParameters, initOverrides) {
         const response = await this.registerAdminRaw(requestParameters, initOverrides);
         return await response.value();
     }
     /**
-     * Writes < 300ms. Omitted fields are left as they were. Setting billingExempt to false resumes charging the workspace while keeping the record that it is ours.
+     * Writes < 300ms. Omitted fields are left as they were. Setting billingExempt to false resumes charging the workspace while keeping the record that it is ours. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Change a registration, or switch its billing back on
      */
     async updateAdminRaw(requestParameters, initOverrides) {
@@ -255,7 +296,7 @@ class AdminFirstPartyAppApi extends runtime.BaseAPI {
         return new runtime.JSONApiResponse(response, (jsonValue) => (0, index_1.FirstPartyAppFromJSON)(jsonValue));
     }
     /**
-     * Writes < 300ms. Omitted fields are left as they were. Setting billingExempt to false resumes charging the workspace while keeping the record that it is ours.
+     * Writes < 300ms. Omitted fields are left as they were. Setting billingExempt to false resumes charging the workspace while keeping the record that it is ours. Not reachable with an ask_live_* API key - needs a signed-in user\'s token.
      * Change a registration, or switch its billing back on
      */
     async updateAdmin(requestParameters, initOverrides) {