@canopy-io/node 0.1.1 → 0.3.0

package/dist/index.d.ts

@@ -327,6 +327,26 @@ interface paths {
         patch: operations["ApiPermissionsController_updatePermission"];
         trace?: never;
     };
+    "/api/v1/permissions/{id}/usage": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get where a permission is used
+         * @description Returns the roles that grant a permission, each with the number of distinct identities holding that role, plus `role_count` and the distinct `identity_count` the permission reaches overall. Because a permission is only ever held through a role, this is the full blast radius of deleting it — the listed roles are exactly the ones a delete would strip it from. Deactivated roles are included; `identity_count` is not the sum of the per-role counts, since one identity may hold several granting roles. Returns `404` when no permission with that id exists in the Environment. Requires the `rbac.view_roles` permission.
+         */
+        get: operations["ApiPermissionsController_getPermissionUsage"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/permissions/evaluate": {
         parameters: {
             query?: never;
@@ -878,7 +898,7 @@ interface paths {
         put?: never;
         /**
          * Create a hierarchy node
-         * @description Creates a hierarchy node in the active Application's current Environment. Authorization is evaluated against `hierarchy.manage` on the parent node when `parent_node_id` is supplied, or Application-wide when creating the root. The node type and the parent/child relationship are validated against the Environment's hierarchy schema, only one root node is permitted per Environment (a second returns `409`), and the configured `max_depth` is enforced; a missing `slug` is derived from the name. Returns `201` with the created node and writes a `node.created` audit row.
+         * @description Creates a hierarchy node in the active Application's current Environment. Prerequisite: the Environment must have a hierarchy schema — define it first via `PATCH /api/v1/hierarchy-schema` (or the Console's enable-hierarchy wizard), or this endpoint returns `400` ("Hierarchy schema is not configured"). Authorization is evaluated against `hierarchy.manage` on the parent node when `parent_node_id` is supplied, or Application-wide when creating the root. The node type and the parent/child relationship are validated against the schema, only one root node is permitted per Environment (a second returns `409`), and the configured `max_depth` is enforced; a missing `slug` is derived from the name. Returns `201` with the created node and writes a `node.created` audit row.
          */
         post: operations["ApiNodesController_createNode"];
         delete?: never;
@@ -1055,6 +1075,222 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/organizations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List organizations
+         * @description Lists the Environment's organizations with `member_count` and `pending_invite_count` per row, paginated and searchable by name or slug (`q`). Empty while the Environment has organizations disabled. Requires the `hierarchy.view` permission.
+         */
+        get: operations["ApiOrganizationsController_listOrganizations"];
+        put?: never;
+        /**
+         * Create an organization
+         * @description Creates an organization from a `name` (slug auto-derived, display-only) with optional `description` and `metadata`. The Environment must have organizations enabled (`409 organization.not_enabled` otherwise); the container is independent of the access model, so flat and hierarchy Environments both hold organizations. Requires the `hierarchy.manage` permission and emits `organization.created`.
+         */
+        post: operations["ApiOrganizationsController_createOrganization"];
+        /**
+         * Delete every organization
+         * @description Deletes every live organization in the Environment the way the single delete does: memberships and every assignment beneath each organization are removed, pending invitations bound to the organization or its tree are revoked, and each organization is soft-deleted with its subtree. Member identities are untouched. This is the step before switching the container off. Responds `204 No Content`, requires the `hierarchy.manage` permission, and emits `organization.deleted_all` with the counts.
+         */
+        delete: operations["ApiOrganizationsController_deleteAllOrganizations"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get an organization
+         * @description Returns a single organization by `id` with `member_count` and `pending_invite_count`. Returns `404` when the id does not name a live organization in the current Environment. Requires the `hierarchy.view` permission at the organization.
+         */
+        get: operations["ApiOrganizationsController_getOrganization"];
+        put?: never;
+        post?: never;
+        /**
+         * Delete an organization
+         * @description Deletes an organization by `id`: removes every membership and every assignment beneath the organization, revokes every pending invitation bound to it or its tree, and soft-deletes the organization with its subtree. Member identities themselves are untouched and keep their memberships in other organizations. Supports optimistic concurrency via the `If-Match` header (`409` on a version mismatch). Responds `204 No Content`, requires the `hierarchy.manage` permission at the organization, and emits `organization.deleted`.
+         */
+        delete: operations["ApiOrganizationsController_deleteOrganization"];
+        options?: never;
+        head?: never;
+        /**
+         * Update an organization
+         * @description Updates an organization's `name`, `description`, and/or `metadata` by `id`. The slug is frozen at create and never changes. Supports optimistic concurrency via the `If-Match` header carrying the organization's current version (`409` on a version mismatch). Requires the `hierarchy.manage` permission at the organization and emits `organization.updated`.
+         */
+        patch: operations["ApiOrganizationsController_updateOrganization"];
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/policy": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get an organization's authentication policy
+         * @description Returns the organization's own authentication policy (null fields inherit the Environment) alongside the effective policy its members sign in under. Requires the `hierarchy.view` permission at the organization.
+         */
+        get: operations["ApiOrganizationsController_getPolicy"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Update an organization's authentication policy
+         * @description Sets the organization's own authentication policy. A field set to `null` inherits the Environment again. The policy can only tighten the Environment's settings: `mfa_required` can be true where the Environment leaves MFA optional, `mfa_factor_allowlist` must be a subset of the Environment's, `mfa_after_sso` can be `require` where the Environment exempts, and `require_sso` refuses password and code logins for members. Returns `400` (`organization.policy_loosens`) when a value would loosen the Environment, `409` when `If-Match` does not match the policy version. Requires the `hierarchy.manage` permission at the organization and emits `organization.policy.updated`.
+         */
+        patch: operations["ApiOrganizationsController_updatePolicy"];
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/sso-connections": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List an organization's SSO connections
+         * @description Lists the end-user SSO connections bound to this organization, oldest first, each with the membership role a just-in-time provisioned login receives. Requires the `hierarchy.view` permission at the organization. The response is an unpaginated `{ items }` array.
+         */
+        get: operations["ApiOrganizationsController_listSsoConnections"];
+        put?: never;
+        /**
+         * Bind an SSO connection to an organization
+         * @description Binds an `end_user` SSO connection to the organization: a login through the connection lands in this organization, joining as a member with `default_role_id` when the identity is provisioned or is not yet a member, and the session starts here. The connection must already be bound to the organization's Environment (that binding routes the email domain), and the role must belong to the Environment (`400` otherwise). A connection binds to one organization per Environment (`409`). Requires the `hierarchy.manage` permission at the organization and emits `organization.sso_connection.bound`.
+         */
+        post: operations["ApiOrganizationsController_bindSsoConnection"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/sso-connections/{connectionId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Unbind an SSO connection from an organization
+         * @description Removes the binding; logins through the connection fall back to the Environment's placement. Existing memberships are untouched. Returns `404` when the connection is not bound to this organization. Requires the `hierarchy.manage` permission at the organization and emits `organization.sso_connection.unbound`.
+         */
+        delete: operations["ApiOrganizationsController_unbindSsoConnection"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/members": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List an organization's members
+         * @description Lists the organization's members: each row is the member's identity, their single role in this organization, effective dates, when they joined, and `node_assignments`, the grants the member also holds at nodes beneath the organization (empty in a flat Environment). Paginated; `q` searches name and email. Requires the `rbac.view_assignments` permission at the organization.
+         */
+        get: operations["ApiOrganizationsController_listMembers"];
+        put?: never;
+        /**
+         * Add a member to an organization
+         * @description Adds a member: assigns `role_id` to `identity_id` at the organization. The identity must already hold an active membership in this Environment (invite by email instead for someone who does not). A member holds exactly one role per organization, so an identity that is already a member returns `409` — use the change-role operation. Requires the `rbac.manage_assignments` permission at the organization and emits `organization.member.added`.
+         */
+        post: operations["ApiOrganizationsController_addMember"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/members/{identityId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove a member from an organization
+         * @description Removes the member from this organization, revoking their role here and nothing else — the identity and its memberships in other organizations are untouched. Returns `404` when the identity is not a member. Responds `204 No Content`, requires the `rbac.manage_assignments` permission at the organization, and emits `organization.member.removed`.
+         */
+        delete: operations["ApiOrganizationsController_removeMember"];
+        options?: never;
+        head?: never;
+        /**
+         * Change a member's role
+         * @description Replaces the member's role in this organization with `role_id`. A member holds exactly one role per organization, so this updates the existing membership in place; changing to the role already held is a no-op. Returns `404` when the identity is not a member. Requires the `rbac.manage_assignments` permission at the organization and emits `organization.member.role_changed`.
+         */
+        patch: operations["ApiOrganizationsController_changeMemberRole"];
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/invites": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List an organization's invitations
+         * @description Lists the organization's invitations (pending, accepted, revoked, and expired — filter with `status`), paginated. Requires the `identity.view` permission.
+         */
+        get: operations["ApiOrganizationsController_listInvites"];
+        put?: never;
+        /**
+         * Invite a member into an organization
+         * @description Invites an email into the organization with the role bound to the invitation; acceptance creates the Environment membership and the organization membership in one step. Works for emails with no identity in the Environment — one is created on acceptance. Requires the `identity.manage` permission and emits `invite.created`.
+         */
+        post: operations["ApiOrganizationsController_createInvite"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/invites/{inviteId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Revoke an organization invitation
+         * @description Revokes an invitation on this organization; the emailed link stops working immediately. Returns `404` when the invitation does not belong to this organization. Requires the `identity.manage` permission and emits `invite.revoked`.
+         */
+        delete: operations["ApiOrganizationsController_revokeInvite"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/roles": {
         parameters: {
             query?: never;
@@ -1598,6 +1834,24 @@ interface components {
             /** @description One or more permissions to register */
             permissions: components["schemas"]["PermissionItemDto"][];
         };
+        PermissionUsageRoleDto: {
+            id: string;
+            name: string;
+            description?: string | null;
+            is_system_role: boolean;
+            /** @description Deactivated roles still carry the grant, so they are listed too — deleting the permission strips it from them as well. */
+            is_active: boolean;
+            /** @description Number of distinct identities assigned this role, across all nodes. */
+            member_count: number;
+        };
+        PermissionUsageDto: {
+            permission_id: string;
+            /** @description Number of roles that grant this permission. */
+            role_count: number;
+            /** @description Distinct identities that hold this permission through any granting role. Lower than the sum of `member_count` when an identity holds more than one granting role. */
+            identity_count: number;
+            roles: components["schemas"]["PermissionUsageRoleDto"][];
+        };
         UpdatePermissionDto: {
             /** @description Updated name */
             name?: string;
@@ -1606,18 +1860,6 @@ interface components {
             /** @description Updated category */
             category?: string;
         };
-        EvaluatePermissionDto: {
-            /** @description Identity ID (from the `identities` table — the end user being evaluated, not an admin). */
-            identity_id: string;
-            permission: string;
-            /**
-             * @description Required. `node` asks 'does this identity have the permission *at* `node_id`?' (lineage walk). `app_wide` asks the coarse-grained 'does this identity have the permission *anywhere* in the org?' question — useful for UI gating, **never** for resource-scoped enforcement. `node` requires `node_id`; `app_wide` forbids it.
-             * @enum {string}
-             */
-            scope: "node" | "app_wide";
-            /** @description Required when `scope` is `node`; must be omitted when `scope` is `app_wide`. */
-            node_id?: string;
-        };
         EvaluateResponseDto: {
             allowed: boolean;
             permission: string;
@@ -1631,6 +1873,18 @@ interface components {
             granting_roles: string[];
             denial_reason?: string | null;
         };
+        EvaluatePermissionDto: {
+            /** @description Identity ID (from the `identities` table — the end user being evaluated, not an admin). */
+            identity_id: string;
+            permission: string;
+            /**
+             * @description Required. `node` asks 'does this identity have the permission *at* `node_id`?' (lineage walk). `app_wide` asks the coarse-grained 'does this identity have the permission *anywhere* in the org?' question — useful for UI gating, **never** for resource-scoped enforcement. `node` requires `node_id`; `app_wide` forbids it.
+             * @enum {string}
+             */
+            scope: "node" | "app_wide";
+            /** @description Required when `scope` is `node`; must be omitted when `scope` is `app_wide`. */
+            node_id?: string;
+        };
         EvaluateCheckDto: {
             /** @description Identity ID (from the `identities` table — the end user being evaluated, not an admin). */
             identity_id: string;
@@ -1646,13 +1900,6 @@ interface components {
         BulkEvaluatePermissionDto: {
             checks: components["schemas"]["EvaluateCheckDto"][];
         };
-        ExplainPermissionDto: {
-            /** @description Identity ID (from the `identities` table — the end user being explained, not an admin). */
-            identity_id: string;
-            permission: string;
-            /** @description The hierarchy node to explain the decision at. The lineage from the root to this node is walked and returned in the trace. */
-            node_id: string;
-        };
         PermissionTraceAssignmentDto: {
             assignment_id: string;
             role_id: string;
@@ -1688,6 +1935,13 @@ interface components {
             /** @description Root-first lineage of the target node, each with the identity's assignments observed at that node. */
             lineage: components["schemas"]["PermissionTraceNodeDto"][];
         };
+        ExplainPermissionDto: {
+            /** @description Identity ID (from the `identities` table — the end user being explained, not an admin). */
+            identity_id: string;
+            permission: string;
+            /** @description The hierarchy node to explain the decision at. The lineage from the root to this node is walked and returned in the trace. */
+            node_id: string;
+        };
         PageMetaDto: {
             /** @description Current page number (1-based) */
             page: number;
@@ -1720,6 +1974,10 @@ interface components {
             name: string;
             node_id: string;
             node_name: string;
+            /** @description When this assignment starts; null means it is already active */
+            effective_from: string | null;
+            /** @description When this assignment expires; null means it never does */
+            effective_to: string | null;
         };
         IdentityRowDto: {
             id: string;
@@ -1891,29 +2149,6 @@ interface components {
             expired_count: number;
             revoked_count: number;
         };
-        CreateIdentityInviteDto: {
-            /** @description OAuth client ID — determines which app the invite links to. If omitted, uses Canopy hosted fallback. */
-            client_id?: string;
-            /**
-             * @description Optional. `activate` (default) creates a net-new identity OR — if an identity with this email already exists in the Account but has no active membership in this App — auto-derives an `add_to_app` invite that adds them to this App without touching their existing password. `password_reset` is the explicit admin-driven credential-rotation flow for an existing identity; it cannot carry a role/node assignment. The legacy `onboard` value is accepted and treated as `activate`.
-             * @enum {string}
-             */
-            intent?: "activate" | "password_reset" | "onboard";
-            email: string;
-            /** @description Required for `activate`. Ignored for `add_to_app` (the existing identity's name wins) and for `password_reset`. */
-            first_name?: string;
-            /** @description Required for `activate`. Ignored for `add_to_app` and `password_reset`. */
-            last_name?: string;
-            /** @description Role ID — required if node_id is provided */
-            role_id?: string;
-            /** @description Node ID — required if role_id is provided */
-            node_id?: string;
-            /**
-             * @description Whether Canopy should send the invite email. Set false to suppress delivery and handle it yourself — the API response includes accept_url with the tokenized link. Defaults to true.
-             * @default true
-             */
-            send_email: boolean;
-        };
         ApiIdentityInviteResponseDto: {
             id: string;
             email: string;
@@ -1942,27 +2177,36 @@ interface components {
             /** @description Tokenized URL the invitee would land on. Returned so callers that pass send_email=false can deliver it themselves. */
             accept_url: string;
         };
-        BulkCreateIdentityInvitesDto: {
-            invites: components["schemas"]["CreateIdentityInviteDto"][];
-        };
-        ApiIdentityInviteResendResponseDto: {
-            message: string;
-            /** @description Tokenized URL for the regenerated invite. Resend rotates the token, which invalidates any accept_url returned from the original create call. Self-delivery callers must replace the stored URL with this one. */
-            accept_url: string;
-        };
-        CreateNodeDto: {
-            /** @description Parent node ID (null for root) */
-            parent_node_id?: string;
-            /** @description Node type (org-defined, e.g. 'department', 'team') */
-            node_type: string;
-            /** @description Display name for the node */
-            name: string;
-            /** @description Optional free-text description shown under the node name */
-            description?: string;
-            /** @description URL-friendly slug (auto-generated if omitted) */
-            slug?: string;
-            /** @description Arbitrary metadata */
-            metadata?: Record<string, unknown>;
+        CreateIdentityInviteDto: {
+            /** @description OAuth client ID — determines which app the invite links to. If omitted, uses Canopy hosted fallback. */
+            client_id?: string;
+            /**
+             * @description Optional. `activate` (default) creates a net-new identity OR — if an identity with this email already exists in the Account but has no active membership in this App — auto-derives an `add_to_app` invite that adds them to this App without touching their existing password. `password_reset` is the explicit admin-driven credential-rotation flow for an existing identity; it cannot carry a role/node assignment. The legacy `onboard` value is accepted and treated as `activate`.
+             * @enum {string}
+             */
+            intent?: "activate" | "password_reset" | "onboard";
+            email: string;
+            /** @description Required for `activate`. Ignored for `add_to_app` (the existing identity's name wins) and for `password_reset`. */
+            first_name?: string;
+            /** @description Required for `activate`. Ignored for `add_to_app` and `password_reset`. */
+            last_name?: string;
+            /** @description Role ID — required if node_id is provided */
+            role_id?: string;
+            /** @description Node ID — required if role_id is provided */
+            node_id?: string;
+            /**
+             * @description Whether Canopy should send the invite email. Set false to suppress delivery and handle it yourself — the API response includes accept_url with the tokenized link. Defaults to true.
+             * @default true
+             */
+            send_email: boolean;
+        };
+        BulkCreateIdentityInvitesDto: {
+            invites: components["schemas"]["CreateIdentityInviteDto"][];
+        };
+        ApiIdentityInviteResendResponseDto: {
+            message: string;
+            /** @description Tokenized URL for the regenerated invite. Resend rotates the token, which invalidates any accept_url returned from the original create call. Self-delivery callers must replace the stored URL with this one. */
+            accept_url: string;
         };
         NodeResponseDto: {
             id: string;
@@ -1982,6 +2226,20 @@ interface components {
             /** @description Optimistic-lock version. Send back as the `If-Match` header when updating, moving, or deleting to detect concurrent edits. */
             version: number;
         };
+        CreateNodeDto: {
+            /** @description Parent node ID (null for root) */
+            parent_node_id?: string;
+            /** @description Node type (org-defined, e.g. 'department', 'team') */
+            node_type: string;
+            /** @description Display name for the node */
+            name: string;
+            /** @description Optional free-text description shown under the node name */
+            description?: string;
+            /** @description URL-friendly slug (auto-generated if omitted) */
+            slug?: string;
+            /** @description Arbitrary metadata */
+            metadata?: Record<string, unknown>;
+        };
         HierarchyTreeNodeDto: {
             id: string;
             name: string;
@@ -2107,6 +2365,163 @@ interface components {
             distinct_role_count: number;
             recent_identities: components["schemas"]["RecentIdentityDto"][];
         };
+        OrganizationResponseDto: {
+            id: string;
+            name: string;
+            description?: string | null;
+            /** @description Display label derived from the name at create; frozen afterwards. Organizations are addressed by `id`. */
+            slug: string;
+            metadata: Record<string, unknown>;
+            /** @description Members (one role each) in this organization. */
+            member_count: number;
+            /** @description Unexpired, unaccepted, unrevoked invitations. */
+            pending_invite_count: number;
+            /** Format: date-time */
+            created_at: string;
+            /** Format: date-time */
+            updated_at: string;
+            /** @description Optimistic-lock version. Send back as the `If-Match` header when updating or deleting to detect concurrent edits. */
+            version: number;
+        };
+        CreateOrganizationDto: {
+            /** @description Organization name. The slug is auto-derived from it at create and never changes afterwards. */
+            name: string;
+            /** @description Organization description */
+            description?: string;
+            /** @description Free-form metadata stored on the organization, returned as sent. */
+            metadata?: Record<string, unknown>;
+        };
+        UpdateOrganizationDto: {
+            /** @description New organization name. The slug does not change. */
+            name?: string;
+            /** @description Organization description */
+            description?: string;
+            /** @description Free-form metadata stored on the organization, returned as sent. */
+            metadata?: Record<string, unknown>;
+        };
+        EffectiveOrganizationPolicyDto: {
+            mfa_required: boolean;
+            mfa_factor_allowlist: ("totp" | "webauthn" | "email_otp")[];
+            /** @enum {string} */
+            mfa_after_sso: "exempt" | "require";
+            require_sso: boolean;
+        };
+        OrganizationPolicyResponseDto: {
+            /** @description The organization this policy belongs to. */
+            organization_id: string;
+            mfa_required?: boolean | null;
+            mfa_factor_allowlist?: ("totp" | "webauthn" | "email_otp")[] | null;
+            /** @enum {string|null} */
+            mfa_after_sso?: "exempt" | "require" | null;
+            require_sso: boolean;
+            /** @description The Environment's own settings, the floor this organization's policy tightens from. */
+            environment: components["schemas"]["EffectiveOrganizationPolicyDto"];
+            /** @description The policy the organization's members sign in under. */
+            effective: components["schemas"]["EffectiveOrganizationPolicyDto"];
+            /** @description Optimistic-concurrency version. 0 until the organization sets a policy of its own. */
+            version: number;
+        };
+        UpdateOrganizationPolicyDto: {
+            /** @description Require MFA for this organization's members. `true` tightens an Environment that leaves MFA optional; `false` is only accepted where the Environment does not require MFA; `null` inherits. */
+            mfa_required?: boolean | null;
+            /** @description Factors this organization's members may enroll and use. Must be a non-empty subset of the Environment's allowlist; `null` inherits. */
+            mfa_factor_allowlist?: ("totp" | "webauthn" | "email_otp")[] | null;
+            /**
+             * @description Whether an SSO login still owes an MFA challenge. `require` tightens an Environment that exempts SSO; `exempt` is only accepted where the Environment exempts; `null` inherits.
+             * @enum {string|null}
+             */
+            mfa_after_sso?: "exempt" | "require" | null;
+            /** @description Members must sign in through SSO. Password and email-code logins are refused for the organization's members and for any email whose domain routes to a connection bound to this organization. */
+            require_sso?: boolean;
+        };
+        OrganizationSsoConnectionSummaryDto: {
+            id: string;
+            name: string;
+            /** @enum {string} */
+            type: "saml" | "oidc";
+            status: string;
+        };
+        OrganizationSsoRoleSummaryDto: {
+            id: string;
+            name: string;
+        };
+        OrganizationSsoConnectionResponseDto: {
+            organization_node_id: string;
+            sso_connection_id: string;
+            sso_connection: components["schemas"]["OrganizationSsoConnectionSummaryDto"];
+            /** @description The membership role a login through this connection receives when it joins the organization. */
+            default_role_id: string;
+            default_role: components["schemas"]["OrganizationSsoRoleSummaryDto"];
+            /** Format: date-time */
+            created_at: string;
+        };
+        BindOrganizationSsoConnectionDto: {
+            /** @description An end-user SSO connection already bound to the organization's Environment. */
+            sso_connection_id: string;
+            /** @description The membership role a login through this connection receives when it joins the organization. Must belong to the organization's Environment. */
+            default_role_id: string;
+        };
+        OrganizationMemberIdentityDto: {
+            id: string;
+            email: string;
+            first_name?: string | null;
+            last_name?: string | null;
+        };
+        OrganizationMemberRoleDto: {
+            id: string;
+            name: string;
+        };
+        OrganizationMemberNodeDto: {
+            id: string;
+            name: string;
+            node_type: string;
+        };
+        OrganizationMemberNodeAssignmentDto: {
+            /** @description The assignment id. */
+            id: string;
+            application_node: components["schemas"]["OrganizationMemberNodeDto"];
+            role: components["schemas"]["OrganizationMemberRoleDto"];
+        };
+        OrganizationMemberResponseDto: {
+            /** @description The membership (role assignment) id. */
+            id: string;
+            identity: components["schemas"]["OrganizationMemberIdentityDto"];
+            role: components["schemas"]["OrganizationMemberRoleDto"];
+            /** Format: date-time */
+            effective_from?: string | null;
+            /** Format: date-time */
+            effective_to?: string | null;
+            /**
+             * Format: date-time
+             * @description When the membership was created.
+             */
+            created_at: string;
+            /** @description Assignments the member also holds at nodes beneath the organization. Empty in a flat Environment. */
+            node_assignments: components["schemas"]["OrganizationMemberNodeAssignmentDto"][];
+        };
+        AddOrganizationMemberDto: {
+            /** @description Identity to add. Must already hold an active membership in this Environment; invite by email instead for someone who does not. */
+            identity_id: string;
+            /** @description The single role the member holds in this organization, from the Environment's roles. */
+            role_id: string;
+        };
+        ChangeOrganizationMemberRoleDto: {
+            /** @description The replacement role. A member holds exactly one role per organization, so this updates the existing membership in place. */
+            role_id: string;
+        };
+        CreateOrganizationInviteDto: {
+            /** @description Email to invite. Works for people with no identity in this Environment — one is created when they accept. */
+            email: string;
+            /** @description The role the member will hold in this organization on acceptance. */
+            role_id: string;
+            first_name?: string;
+            last_name?: string;
+            /**
+             * @description Set false to skip the email and deliver the returned accept URL yourself.
+             * @default true
+             */
+            send_email: boolean;
+        };
         RoleResponseDto: {
             id: string;
             application_id: string;
@@ -2210,7 +2625,7 @@ interface components {
              * @description Broad classification from the action catalog (e.g. `auth`, `rbac`). NULL on legacy rows whose action key was unknown at backfill time — those carry the `unknown` value in storage.
              * @enum {string|null}
              */
-            category?: "auth" | "identity" | "admin_user" | "tenancy" | "hierarchy" | "rbac" | "authorization" | "api_keys" | "oauth" | "webhooks" | "invites" | "mfa" | "audit" | "billing" | "sso" | "unknown" | null;
+            category?: "auth" | "identity" | "admin_user" | "tenancy" | "hierarchy" | "organization" | "rbac" | "authorization" | "api_keys" | "oauth" | "webhooks" | "invites" | "mfa" | "audit" | "billing" | "sso" | "unknown" | null;
             /**
              * @description `info` for normal-flow events, `notice` for important state changes, `warning` for failures, `critical` for security events.
              * @enum {string}
@@ -2221,6 +2636,44 @@ interface components {
             /** @description Whether this row should appear on a future end-user `My security activity` surface. Not consumed by current reads. */
             identity_visible: boolean;
         };
+        ExportJobDto: {
+            /** Format: uuid */
+            id: string;
+            /**
+             * @description `pending` (enqueued), `processing` (worker rendering), `completed` (file ready), or `failed` (see `error`).
+             * @enum {string}
+             */
+            status: "pending" | "processing" | "completed" | "failed";
+            /**
+             * @description The audit surface the export was taken from.
+             * @enum {string}
+             */
+            surface: "admin" | "identities";
+            /**
+             * @description Wire format of the rendered file.
+             * @enum {string}
+             */
+            format: "csv" | "ndjson";
+            /** Format: uuid */
+            application_id?: string | null;
+            /** Format: uuid */
+            environment_id?: string | null;
+            /** @description Rows written, set once the job completes. */
+            row_count?: number | null;
+            /** @description Failure detail, present only when `status` is `failed`. */
+            error?: string | null;
+            /** Format: date-time */
+            created_at: string;
+            /** Format: date-time */
+            completed_at?: string | null;
+            /**
+             * Format: date-time
+             * @description When the stored file + this record become eligible for sweep.
+             */
+            expires_at?: string | null;
+            /** @description Short-lived signed download URL. Present only on the single-job read of a completed job; `null` otherwise. */
+            download_url?: string | null;
+        };
         AuditExportQueryDto: {
             /**
              * Format: date-time
@@ -2235,7 +2688,7 @@ interface components {
             /** @description Filter by one or more action keys. Repeat the query param (`?action=a&action=b`) or pass a comma-separated string. */
             action?: string[];
             /** @enum {string} */
-            category?: "auth" | "identity" | "admin_user" | "tenancy" | "hierarchy" | "rbac" | "authorization" | "api_keys" | "oauth" | "webhooks" | "invites" | "mfa" | "audit" | "billing" | "sso" | "unknown";
+            category?: "auth" | "identity" | "admin_user" | "tenancy" | "hierarchy" | "organization" | "rbac" | "authorization" | "api_keys" | "oauth" | "webhooks" | "invites" | "mfa" | "audit" | "billing" | "sso" | "unknown";
             /** @enum {string} */
             severity?: "info" | "notice" | "warning" | "critical";
             /** @enum {string} */
@@ -2269,44 +2722,6 @@ interface components {
              */
             format: "csv" | "ndjson";
         };
-        ExportJobDto: {
-            /** Format: uuid */
-            id: string;
-            /**
-             * @description `pending` (enqueued), `processing` (worker rendering), `completed` (file ready), or `failed` (see `error`).
-             * @enum {string}
-             */
-            status: "pending" | "processing" | "completed" | "failed";
-            /**
-             * @description The audit surface the export was taken from.
-             * @enum {string}
-             */
-            surface: "admin" | "identities";
-            /**
-             * @description Wire format of the rendered file.
-             * @enum {string}
-             */
-            format: "csv" | "ndjson";
-            /** Format: uuid */
-            application_id?: string | null;
-            /** Format: uuid */
-            environment_id?: string | null;
-            /** @description Rows written, set once the job completes. */
-            row_count?: number | null;
-            /** @description Failure detail, present only when `status` is `failed`. */
-            error?: string | null;
-            /** Format: date-time */
-            created_at: string;
-            /** Format: date-time */
-            completed_at?: string | null;
-            /**
-             * Format: date-time
-             * @description When the stored file + this record become eligible for sweep.
-             */
-            expires_at?: string | null;
-            /** @description Short-lived signed download URL. Present only on the single-job read of a completed job; `null` otherwise. */
-            download_url?: string | null;
-        };
         AuditLogDetailResponseDto: {
             id: string;
             account_id?: string | null;
@@ -2338,7 +2753,7 @@ interface components {
              * @description Broad classification from the action catalog (e.g. `auth`, `rbac`). NULL on legacy rows whose action key was unknown at backfill time — those carry the `unknown` value in storage.
              * @enum {string|null}
              */
-            category?: "auth" | "identity" | "admin_user" | "tenancy" | "hierarchy" | "rbac" | "authorization" | "api_keys" | "oauth" | "webhooks" | "invites" | "mfa" | "audit" | "billing" | "sso" | "unknown" | null;
+            category?: "auth" | "identity" | "admin_user" | "tenancy" | "hierarchy" | "organization" | "rbac" | "authorization" | "api_keys" | "oauth" | "webhooks" | "invites" | "mfa" | "audit" | "billing" | "sso" | "unknown" | null;
             /**
              * @description `info` for normal-flow events, `notice` for important state changes, `warning` for failures, `critical` for security events.
              * @enum {string}
@@ -2399,11 +2814,6 @@ interface components {
             /** @description Node type used when the root node is auto-created. Must be one of `node_types`. */
             root_node_type: string;
         };
-        CreateWebhookDto: {
-            url: string;
-            event_types: string[];
-            description?: string;
-        };
         WebhookCreatedResponseDto: {
             id: string;
             /** @enum {string} */
@@ -2417,6 +2827,11 @@ interface components {
             /** @description HMAC secret — only shown once on creation */
             secret: string;
         };
+        CreateWebhookDto: {
+            url: string;
+            event_types: string[];
+            description?: string;
+        };
         WebhookResponseDto: {
             id: string;
             /** @enum {string} */
@@ -2452,21 +2867,6 @@ interface components {
             description?: string | null;
             is_active?: boolean;
         };
-        CreateApiKeyDto: {
-            /** @description API key name */
-            name: string;
-            /** @description API key description */
-            description?: string;
-            /**
-             * @description Required. `scoped` enforces the `scopes` array on every authorization check (deny if the requested permission isn't listed). `full_access` bypasses RBAC entirely within the key's Application — every permission is granted. Pick `scoped` whenever possible; `full_access` should be a deliberate choice (use cases: bootstrap automation, trusted backend services that legitimately need App-wide access). `scoped` requires a non-empty `scopes` array; `full_access` forbids `scopes`.
-             * @enum {string}
-             */
-            access_mode: "scoped" | "full_access";
-            /** @description Permission scopes this key is authorized for. Required and must be non-empty when `access_mode` is `scoped`. Must be omitted when `access_mode` is `full_access`. */
-            scopes?: string[];
-            /** @description Expiration date (ISO 8601). Omit for no expiration. */
-            expires_at?: string;
-        };
         ApiKeyCreatedResponseDto: {
             id: string;
             name: string;
@@ -2485,6 +2885,21 @@ interface components {
             /** Format: date-time */
             created_at: string;
         };
+        CreateApiKeyDto: {
+            /** @description API key name */
+            name: string;
+            /** @description API key description */
+            description?: string;
+            /**
+             * @description Required. `scoped` enforces the `scopes` array on every authorization check (deny if the requested permission isn't listed). `full_access` bypasses RBAC entirely within the key's Application — every permission is granted. Pick `scoped` whenever possible; `full_access` should be a deliberate choice (use cases: bootstrap automation, trusted backend services that legitimately need App-wide access). `scoped` requires a non-empty `scopes` array; `full_access` forbids `scopes`.
+             * @enum {string}
+             */
+            access_mode: "scoped" | "full_access";
+            /** @description Permission scopes this key is authorized for. Required and must be non-empty when `access_mode` is `scoped`. Must be omitted when `access_mode` is `full_access`. */
+            scopes?: string[];
+            /** @description Expiration date (ISO 8601). Omit for no expiration. */
+            expires_at?: string;
+        };
         ApiKeyResponseDto: {
             id: string;
             client_id: string;
@@ -2563,7 +2978,8 @@ interface operations {
     ApiPermissionsController_listPermissions: {
         parameters: {
             query?: {
-                source?: string;
+                /** @description Filter by permission origin. */
+                source?: "system" | "custom";
             };
             header?: never;
             path?: never;
@@ -2645,7 +3061,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["PermissionResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["PermissionResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -2709,7 +3127,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["PermissionResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["PermissionResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -2868,7 +3288,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["PermissionResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["PermissionResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -2936,26 +3358,115 @@ interface operations {
             };
         };
     };
-    ApiPermissionsController_evaluate: {
+    ApiPermissionsController_getPermissionUsage: {
         parameters: {
             query?: never;
             header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["EvaluatePermissionDto"];
+            path: {
+                id: string;
             };
+            cookie?: never;
         };
+        requestBody?: never;
         responses: {
-            /** @description Authorization decision returned */
+            /** @description Granting roles and identity reach returned */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["EvaluateResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["PermissionUsageDto"];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/permissions",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/permissions",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No permission with that id exists in this Environment */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "No permission with that id exists in this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/permissions/{id}/usage",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiPermissionsController_evaluate: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["EvaluatePermissionDto"];
+            };
+        };
+        responses: {
+            /** @description Authorization decision returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["EvaluateResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -3089,7 +3600,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["PermissionTraceDto"];
+                    "application/json": {
+                        data: components["schemas"]["PermissionTraceDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -3252,7 +3765,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["IdentityResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["IdentityResponseDto"];
+                    };
                 };
             };
             /** @description Password rejected — appeared in a known data breach (HaveIBeenPwned check) */
@@ -3436,7 +3951,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["IdentitiesSummaryDto"];
+                    "application/json": {
+                        data: components["schemas"]["IdentitiesSummaryDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -3624,7 +4141,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["IdentityResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["IdentityResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -3796,7 +4315,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["IdentityResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["IdentityResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -3881,7 +4402,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["IdentityDetailResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["IdentityDetailResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -3966,7 +4489,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["MessageResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["MessageResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -4051,7 +4576,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["MessageResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["MessageResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -4410,7 +4937,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["AccountIdentityMfaResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["AccountIdentityMfaResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -4578,7 +5107,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["IdentityAuthStateResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["IdentityAuthStateResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -5080,7 +5611,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ApiIdentityInviteResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["ApiIdentityInviteResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -5142,7 +5675,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["IdentityInvitesSummaryDto"];
+                    "application/json": {
+                        data: components["schemas"]["IdentityInvitesSummaryDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -5330,7 +5865,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ApiIdentityInviteResendResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["ApiIdentityInviteResendResponseDto"];
+                    };
                 };
             };
             /** @description Invite is no longer pending */
@@ -5541,7 +6078,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ScopedHierarchyTreeResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["ScopedHierarchyTreeResponseDto"];
+                    };
                 };
             };
             /** @description The hierarchy is unchanged since the supplied `ETag`. No body; keep using the cached tree. */
@@ -5614,7 +6153,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["NodeResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["NodeResponseDto"];
+                    };
                 };
             };
             /** @description Invalid parent-child relationship */
@@ -5794,7 +6335,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["NodeAccessResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["NodeAccessResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -5995,7 +6538,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["NodeResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["NodeResponseDto"];
+                    };
                 };
             };
             /** @description Invalid parent-child relationship */
@@ -6122,7 +6667,141 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["HierarchyTreeNodeDto"];
+                    "application/json": {
+                        data: components["schemas"]["HierarchyTreeNodeDto"];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiNodesController_getAncestors: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ancestors returned root-first */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["NodeResponseDto"][];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiNodesController_getChildren: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Children returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["NodeResponseDto"][];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -6155,12 +6834,1601 @@ interface operations {
                     /**
                      * @example {
                      *       "error": {
-                     *         "statusCode": 403,
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiNodesController_moveNode: {
+        parameters: {
+            query?: never;
+            header: {
+                "if-match": string;
+                /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
+                "If-Match"?: string;
+            };
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["MoveNodeDto"];
+            };
+        };
+        responses: {
+            /** @description Node moved successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["NodeResponseDto"];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Node not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Node not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes/{id}/move",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Version mismatch — the resource was modified since the version supplied in If-Match. Refresh and retry. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "Version mismatch — the resource was modified since the version supplied in If-Match. Refresh and retry.",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes/{id}/move",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiNodesController_listIdentityAssignments: {
+        parameters: {
+            query?: {
+                /** @description Page number (1-based) */
+                page?: number;
+                /** @description Items per page (1-100, default 20) */
+                take?: number;
+                /** @description Search term */
+                q?: string;
+                /** @description Sort field */
+                sort_by?: "name" | "role" | "access_type" | "created_at";
+                /** @description Sort order */
+                order?: "asc" | "desc";
+                /** @description Filter by role ID */
+                role_id?: string;
+                /** @description Filter by access type */
+                access_type?: "direct" | "inherited";
+                /** @description Filter by assignment status */
+                status?: "active" | "scheduled" | "expired";
+                /** @description Filter by source node ID */
+                source_node_id?: string;
+            };
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Paginated list */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["IdentityAssignmentRowDto"][];
+                        pagination: components["schemas"]["PageMetaDto"];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Node not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Node not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes/{id}/identities",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiNodesController_getIdentityAssignmentsSummary: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Identity counts by status returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["NodeIdentitiesSummaryDto"];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Node not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Node not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes/{id}/identities/summary",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationsController_listOrganizations: {
+        parameters: {
+            query?: {
+                /** @description Page number (1-based) */
+                page?: number;
+                /** @description Items per page (1-100, default 20) */
+                take?: number;
+                /** @description Search term */
+                q?: string;
+                /** @description Column to sort by. Allowed values depend on the endpoint. */
+                sort_by?: string;
+                /** @description Sort direction */
+                order?: "asc" | "desc";
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Paginated list */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["OrganizationResponseDto"][];
+                        pagination: components["schemas"]["PageMetaDto"];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationsController_createOrganization: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateOrganizationDto"];
+            };
+        };
+        responses: {
+            /** @description Organization created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["OrganizationResponseDto"];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organizations are not enabled on this Environment; switch the container on first */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "Organizations are not enabled on this Environment; switch the container on first",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationsController_deleteAllOrganizations: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Every organization deleted with its memberships, pending invitations, and subtree */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationsController_getOrganization: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Organization returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["OrganizationResponseDto"];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationsController_deleteOrganization: {
+        parameters: {
+            query?: never;
+            header: {
+                "if-match": string;
+                /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
+                "If-Match"?: string;
+            };
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Organization deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}",
+                     *         "method": "DELETE"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Version mismatch — the resource was modified since the version supplied in If-Match. Refresh and retry. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "Version mismatch — the resource was modified since the version supplied in If-Match. Refresh and retry.",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}",
+                     *         "method": "DELETE"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationsController_updateOrganization: {
+        parameters: {
+            query?: never;
+            header: {
+                "if-match": string;
+                /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
+                "If-Match"?: string;
+            };
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateOrganizationDto"];
+            };
+        };
+        responses: {
+            /** @description Organization updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["OrganizationResponseDto"];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}",
+                     *         "method": "PATCH"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Version mismatch — the resource was modified since the version supplied in If-Match. Refresh and retry. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "Version mismatch — the resource was modified since the version supplied in If-Match. Refresh and retry.",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}",
+                     *         "method": "PATCH"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationsController_getPolicy: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Policy returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["OrganizationPolicyResponseDto"];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/policy",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationsController_updatePolicy: {
+        parameters: {
+            query?: never;
+            header: {
+                "if-match": string;
+                /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
+                "If-Match"?: string;
+            };
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateOrganizationPolicyDto"];
+            };
+        };
+        responses: {
+            /** @description Policy updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["OrganizationPolicyResponseDto"];
+                    };
+                };
+            };
+            /** @description The policy would loosen the Environment's authentication settings */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The policy would loosen the Environment's authentication settings",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/policy",
+                     *         "method": "PATCH"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/policy",
+                     *         "method": "PATCH"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Version mismatch — the resource was modified since the version supplied in If-Match. Refresh and retry. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "Version mismatch — the resource was modified since the version supplied in If-Match. Refresh and retry.",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/policy",
+                     *         "method": "PATCH"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationsController_listSsoConnections: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Bindings returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["OrganizationSsoConnectionResponseDto"][];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/sso-connections",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationsController_bindSsoConnection: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["BindOrganizationSsoConnectionDto"];
+            };
+        };
+        responses: {
+            /** @description Connection bound */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["OrganizationSsoConnectionResponseDto"];
+                    };
+                };
+            };
+            /** @description The connection is not an end-user connection bound to the organization's Environment, or the role is not in that Environment */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The connection is not an end-user connection bound to the organization's Environment, or the role is not in that Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/sso-connections",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/sso-connections",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The connection is already bound to an organization in this Environment */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "The connection is already bound to an organization in this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/sso-connections",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationsController_unbindSsoConnection: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                connectionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Connection unbound */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This SSO connection is not bound to the organization */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "This SSO connection is not bound to the organization",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/sso-connections/{connectionId}",
+                     *         "method": "DELETE"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationsController_listMembers: {
+        parameters: {
+            query?: {
+                /** @description Page number (1-based) */
+                page?: number;
+                /** @description Items per page (1-100, default 20) */
+                take?: number;
+                /** @description Search term */
+                q?: string;
+                /** @description Column to sort by. Allowed values depend on the endpoint. */
+                sort_by?: string;
+                /** @description Sort direction */
+                order?: "asc" | "desc";
+                /** @description Only members holding this role */
+                role_id?: string;
+                /** @description Filter by the membership's effective window: active now, scheduled to start, or already expired */
+                status?: "active" | "scheduled" | "expired";
+            };
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Paginated list */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["OrganizationMemberResponseDto"][];
+                        pagination: components["schemas"]["PageMetaDto"];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/members",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationsController_addMember: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AddOrganizationMemberDto"];
+            };
+        };
+        responses: {
+            /** @description Member added */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["OrganizationMemberResponseDto"];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/members",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The identity is already a member of this organization */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "message": "The identity is already a member of this organization",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
-                     *         "method": "GET"
+                     *         "path": "/api/v1/organizations/{id}/members",
+                     *         "method": "POST"
                      *       }
                      *     }
                      */
@@ -6169,27 +8437,24 @@ interface operations {
             };
         };
     };
-    ApiNodesController_getAncestors: {
+    ApiOrganizationsController_removeMember: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 id: string;
+                identityId: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Ancestors returned root-first */
-            200: {
+            /** @description Member removed */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": {
-                        items: components["schemas"]["NodeResponseDto"][];
-                    };
-                };
+                content?: never;
             };
             /** @description Invalid or expired token */
             401: {
@@ -6204,7 +8469,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "Invalid or expired token",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
+                     *         "path": "/api/v1/organizations",
                      *         "method": "GET"
                      *       }
                      *     }
@@ -6225,7 +8490,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
+                     *         "path": "/api/v1/organizations",
                      *         "method": "GET"
                      *       }
                      *     }
@@ -6233,27 +8498,53 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description The identity is not a member of this organization */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The identity is not a member of this organization",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/members/{identityId}",
+                     *         "method": "DELETE"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
-    ApiNodesController_getChildren: {
+    ApiOrganizationsController_changeMemberRole: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 id: string;
+                identityId: string;
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ChangeOrganizationMemberRoleDto"];
+            };
+        };
         responses: {
-            /** @description Children returned */
+            /** @description Member role changed */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        items: components["schemas"]["NodeResponseDto"][];
+                        data: components["schemas"]["OrganizationMemberResponseDto"];
                     };
                 };
             };
@@ -6270,7 +8561,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "Invalid or expired token",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
+                     *         "path": "/api/v1/organizations",
                      *         "method": "GET"
                      *       }
                      *     }
@@ -6291,7 +8582,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
+                     *         "path": "/api/v1/organizations",
                      *         "method": "GET"
                      *       }
                      *     }
@@ -6299,34 +8590,63 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description The identity is not a member of this organization */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The identity is not a member of this organization",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/members/{identityId}",
+                     *         "method": "PATCH"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
-    ApiNodesController_moveNode: {
+    ApiOrganizationsController_listInvites: {
         parameters: {
-            query?: never;
-            header: {
-                "if-match": string;
-                /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
-                "If-Match"?: string;
+            query?: {
+                /** @description Page number (1-based) */
+                page?: number;
+                /** @description Items per page (1-100, default 20) */
+                take?: number;
+                /** @description Search term */
+                q?: string;
+                /** @description Column to sort by. Allowed values depend on the endpoint. */
+                sort_by?: string;
+                /** @description Sort direction */
+                order?: "asc" | "desc";
+                /** @description Filter by invitation status */
+                status?: "pending" | "accepted" | "revoked" | "expired";
             };
+            header?: never;
             path: {
                 id: string;
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["MoveNodeDto"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Node moved successfully */
+            /** @description Paginated list */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["NodeResponseDto"];
+                    "application/json": {
+                        items: components["schemas"]["IdentityInviteResponseDto"][];
+                        pagination: components["schemas"]["PageMetaDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -6342,7 +8662,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "Invalid or expired token",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
+                     *         "path": "/api/v1/organizations",
                      *         "method": "GET"
                      *       }
                      *     }
@@ -6363,7 +8683,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
+                     *         "path": "/api/v1/organizations",
                      *         "method": "GET"
                      *       }
                      *     }
@@ -6371,7 +8691,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Node not found */
+            /** @description Organization not found */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -6382,31 +8702,10 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 404,
                      *         "code": null,
-                     *         "message": "Node not found",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes/{id}/move",
-                     *         "method": "POST"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description Version mismatch — the resource was modified since the version supplied in If-Match. Refresh and retry. */
-            409: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 409,
-                     *         "code": null,
-                     *         "message": "Version mismatch — the resource was modified since the version supplied in If-Match. Refresh and retry.",
+                     *         "message": "Organization not found",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes/{id}/move",
-                     *         "method": "POST"
+                     *         "path": "/api/v1/organizations/{id}/invites",
+                     *         "method": "GET"
                      *       }
                      *     }
                      */
@@ -6415,45 +8714,29 @@ interface operations {
             };
         };
     };
-    ApiNodesController_listIdentityAssignments: {
+    ApiOrganizationsController_createInvite: {
         parameters: {
-            query?: {
-                /** @description Page number (1-based) */
-                page?: number;
-                /** @description Items per page (1-100, default 20) */
-                take?: number;
-                /** @description Search term */
-                q?: string;
-                /** @description Sort field */
-                sort_by?: "name" | "role" | "access_type" | "created_at";
-                /** @description Sort order */
-                order?: "asc" | "desc";
-                /** @description Filter by role ID */
-                role_id?: string;
-                /** @description Filter by access type */
-                access_type?: "direct" | "inherited";
-                /** @description Filter by assignment status */
-                status?: "active" | "scheduled" | "expired";
-                /** @description Filter by source node ID */
-                source_node_id?: string;
-            };
+            query?: never;
             header?: never;
             path: {
                 id: string;
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateOrganizationInviteDto"];
+            };
+        };
         responses: {
-            /** @description Paginated list */
-            200: {
+            /** @description Invitation created */
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        items: components["schemas"]["IdentityAssignmentRowDto"][];
-                        pagination: components["schemas"]["PageMetaDto"];
+                        data: components["schemas"]["ApiIdentityInviteResponseDto"];
                     };
                 };
             };
@@ -6470,7 +8753,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "Invalid or expired token",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
+                     *         "path": "/api/v1/organizations",
                      *         "method": "GET"
                      *       }
                      *     }
@@ -6491,7 +8774,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
+                     *         "path": "/api/v1/organizations",
                      *         "method": "GET"
                      *       }
                      *     }
@@ -6499,7 +8782,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Node not found */
+            /** @description Organization not found */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -6510,10 +8793,10 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 404,
                      *         "code": null,
-                     *         "message": "Node not found",
+                     *         "message": "Organization not found",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes/{id}/identities",
-                     *         "method": "GET"
+                     *         "path": "/api/v1/organizations/{id}/invites",
+                     *         "method": "POST"
                      *       }
                      *     }
                      */
@@ -6522,25 +8805,24 @@ interface operations {
             };
         };
     };
-    ApiNodesController_getIdentityAssignmentsSummary: {
+    ApiOrganizationsController_revokeInvite: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 id: string;
+                inviteId: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Identity counts by status returned */
-            200: {
+            /** @description Invitation revoked */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": components["schemas"]["NodeIdentitiesSummaryDto"];
-                };
+                content?: never;
             };
             /** @description Invalid or expired token */
             401: {
@@ -6555,7 +8837,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "Invalid or expired token",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
+                     *         "path": "/api/v1/organizations",
                      *         "method": "GET"
                      *       }
                      *     }
@@ -6576,7 +8858,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
+                     *         "path": "/api/v1/organizations",
                      *         "method": "GET"
                      *       }
                      *     }
@@ -6584,7 +8866,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Node not found */
+            /** @description No such invitation on this organization */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -6595,10 +8877,10 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 404,
                      *         "code": null,
-                     *         "message": "Node not found",
+                     *         "message": "No such invitation on this organization",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes/{id}/identities/summary",
-                     *         "method": "GET"
+                     *         "path": "/api/v1/organizations/{id}/invites/{inviteId}",
+                     *         "method": "DELETE"
                      *       }
                      *     }
                      */
@@ -6610,8 +8892,10 @@ interface operations {
     ApiRolesController_listRoles: {
         parameters: {
             query?: {
-                include_inactive?: string;
-                type?: string;
+                /** @description Include deactivated roles in the list. */
+                include_inactive?: "true" | "false";
+                /** @description Filter by role origin. */
+                type?: "system" | "custom";
             };
             header?: never;
             path?: never;
@@ -6693,7 +8977,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["RoleResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["RoleResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -6778,7 +9064,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["RoleResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["RoleResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -6979,7 +9267,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["RoleResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["RoleResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -7176,7 +9466,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["MessageResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["MessageResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -7341,7 +9633,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["AssignmentsSummaryDto"];
+                    "application/json": {
+                        data: components["schemas"]["AssignmentsSummaryDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -7407,7 +9701,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["AssignmentResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["AssignmentResponseDto"];
+                    };
                 };
             };
             /** @description System roles cannot be assigned to identities — they are reserved for platform administration */
@@ -7600,7 +9896,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["AssignmentResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["AssignmentResponseDto"];
+                    };
                 };
             };
             /** @description System roles cannot be assigned to identities — they are reserved for platform administration */
@@ -7772,7 +10070,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["MessageResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["MessageResponseDto"];
+                    };
                 };
             };
             /** @description System roles cannot be assigned to identities — they are reserved for platform administration */
@@ -7970,7 +10270,7 @@ interface operations {
                 to?: string;
                 /** @description Filter by one or more action keys. Repeat the query param (`?action=a&action=b`) or pass a comma-separated string. */
                 action?: string[];
-                category?: "auth" | "identity" | "admin_user" | "tenancy" | "hierarchy" | "rbac" | "authorization" | "api_keys" | "oauth" | "webhooks" | "invites" | "mfa" | "audit" | "billing" | "sso" | "unknown";
+                category?: "auth" | "identity" | "admin_user" | "tenancy" | "hierarchy" | "organization" | "rbac" | "authorization" | "api_keys" | "oauth" | "webhooks" | "invites" | "mfa" | "audit" | "billing" | "sso" | "unknown";
                 severity?: "info" | "notice" | "warning" | "critical";
                 outcome?: "success" | "failure" | "denied";
                 actor_id?: string;
@@ -8160,7 +10460,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ExportJobDto"];
+                    "application/json": {
+                        data: components["schemas"]["ExportJobDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -8224,7 +10526,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ExportJobDto"];
+                    "application/json": {
+                        data: components["schemas"]["ExportJobDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -8392,7 +10696,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["AuditLogDetailResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["AuditLogDetailResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -8569,7 +10875,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["HierarchySchemaResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["HierarchySchemaResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -8639,7 +10947,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["HierarchySchemaResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["HierarchySchemaResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -8802,7 +11112,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["WebhookCreatedResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["WebhookCreatedResponseDto"];
+                    };
                 };
             };
             /** @description One or more event types are not supported */
@@ -9050,7 +11362,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["WebhookResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["WebhookResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -9222,7 +11536,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["WebhookResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["WebhookResponseDto"];
+                    };
                 };
             };
             /** @description One or more event types are not supported */
@@ -9406,7 +11722,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ApiKeyCreatedResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["ApiKeyCreatedResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -9557,7 +11875,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ApiKeyResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["ApiKeyResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -9642,7 +11962,9 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ApiKeyCreatedResponseDto"];
+                    "application/json": {
+                        data: components["schemas"]["ApiKeyCreatedResponseDto"];
+                    };
                 };
             };
             /** @description Invalid or expired token */
@@ -9829,8 +12151,8 @@ declare class Assignments {
     /** Same partial-success contract as `bulkCreate`. */
     bulkChangeRole(input: RequestBody<"ApiAssignmentsController_bulkChangeRole">): Promise<ResponseBody<"ApiAssignmentsController_bulkChangeRole">>;
 }
-type AssignmentItem = ItemOf$3<ResponseBody<"ApiAssignmentsController_listAppWideAssignments">>;
-type ItemOf$3<T> = T extends {
+type AssignmentItem = ItemOf$4<ResponseBody<"ApiAssignmentsController_listAppWideAssignments">>;
+type ItemOf$4<T> = T extends {
     items: (infer Item)[];
 } ? Item : never;
 
@@ -9871,9 +12193,71 @@ declare class Identities {
      */
     permissions(id: string): Promise<ResponseBody<"ApiIdentitiesController_getIdentityPermissions">>;
 }
-type IdentityItem = ItemOf$2<ResponseBody<"ApiIdentitiesController_listIdentities">>;
+type IdentityItem = ItemOf$3<ResponseBody<"ApiIdentitiesController_listIdentities">>;
 /** One role grant from an identity's assignments collection. */
-type IdentityAssignmentItem = ItemOf$2<ResponseBody<"ApiIdentitiesController_getIdentityAssignments">>;
+type IdentityAssignmentItem = ItemOf$3<ResponseBody<"ApiIdentitiesController_getIdentityAssignments">>;
+type ItemOf$3<T> = T extends {
+    items: (infer Item)[];
+} ? Item : never;
+
+/**
+ * Tenant organizations: one per business customer, a role per membership,
+ * each with its own authentication policy and identity provider. Every
+ * call here needs the Environment's organizations container switched on.
+ */
+declare class Organizations {
+    private readonly client;
+    constructor(client: CanopyClient);
+    list(query?: QueryParams<"ApiOrganizationsController_listOrganizations">): Paginator<OrganizationItem>;
+    get(id: string): Promise<ResponseBody<"ApiOrganizationsController_getOrganization">>;
+    create(input: RequestBody<"ApiOrganizationsController_createOrganization">): Promise<ResponseBody<"ApiOrganizationsController_createOrganization">>;
+    /**
+     * Pass `ifMatch` with the organization's current `version` to make a
+     * read-modify-write safe — a concurrent edit answers 409 instead of being
+     * silently overwritten.
+     */
+    update(id: string, input: RequestBody<"ApiOrganizationsController_updateOrganization">, options?: ConcurrencyOptions): Promise<ResponseBody<"ApiOrganizationsController_updateOrganization">>;
+    /**
+     * Removes the organization with its memberships, pending invitations,
+     * policy, connection bindings, and the tree beneath it. Member identities
+     * survive.
+     */
+    delete(id: string, options?: ConcurrencyOptions): Promise<void>;
+    /** Empties the container: every organization goes, the step before switching it off. */
+    deleteAll(): Promise<void>;
+    listMembers(id: string, query?: QueryParams<"ApiOrganizationsController_listMembers">): Paginator<OrganizationMemberItem>;
+    addMember(id: string, input: RequestBody<"ApiOrganizationsController_addMember">): Promise<ResponseBody<"ApiOrganizationsController_addMember">>;
+    changeMemberRole(id: string, identityId: string, input: RequestBody<"ApiOrganizationsController_changeMemberRole">): Promise<ResponseBody<"ApiOrganizationsController_changeMemberRole">>;
+    /** Revokes that organization's one role; the identity and its other memberships are untouched. */
+    removeMember(id: string, identityId: string): Promise<void>;
+    listInvites(id: string, query?: QueryParams<"ApiOrganizationsController_listInvites">): Paginator<OrganizationInviteItem>;
+    createInvite(id: string, input: RequestBody<"ApiOrganizationsController_createInvite">): Promise<ResponseBody<"ApiOrganizationsController_createInvite">>;
+    revokeInvite(id: string, inviteId: string): Promise<void>;
+    /**
+     * The organization's own values (null inherits), the Environment baseline
+     * they tighten from, and the effective policy its members sign in under.
+     */
+    getPolicy(id: string): Promise<ResponseBody<"ApiOrganizationsController_getPolicy">>;
+    /**
+     * Can only tighten the Environment: a value that would loosen it answers
+     * 400 `organization.policy_loosens`. Pass `ifMatch` with the policy's
+     * `version` (0 until the organization sets one) for a safe
+     * read-modify-write.
+     */
+    updatePolicy(id: string, input: RequestBody<"ApiOrganizationsController_updatePolicy">, options?: ConcurrencyOptions): Promise<ResponseBody<"ApiOrganizationsController_updatePolicy">>;
+    listSsoConnections(id: string): Promise<ResponseBody<"ApiOrganizationsController_listSsoConnections">>;
+    /**
+     * Sign-ins through the connection then land in this organization, joining
+     * as a member with `default_role_id`. The connection must already be bound
+     * to the organization's Environment, and a connection binds to one
+     * organization per Environment.
+     */
+    bindSsoConnection(id: string, input: RequestBody<"ApiOrganizationsController_bindSsoConnection">): Promise<ResponseBody<"ApiOrganizationsController_bindSsoConnection">>;
+    unbindSsoConnection(id: string, connectionId: string): Promise<void>;
+}
+type OrganizationItem = ItemOf$2<ResponseBody<"ApiOrganizationsController_listOrganizations">>;
+type OrganizationMemberItem = ItemOf$2<ResponseBody<"ApiOrganizationsController_listMembers">>;
+type OrganizationInviteItem = ItemOf$2<ResponseBody<"ApiOrganizationsController_listInvites">>;
 type ItemOf$2<T> = T extends {
     items: (infer Item)[];
 } ? Item : never;
@@ -9980,7 +12364,7 @@ type ItemOf<T> = T extends {
  * ```
  *
  * `client` is public because the wrapped resources cover the paths integrators
- * hit most, not all 81 operations. Anything not wrapped is still reachable —
+ * hit most, not all 102 operations. Anything not wrapped is still reachable —
  * `canopy.client.request("GET", "/api/v1/audit-events")` — with the same
  * envelope handling, typed errors and retry policy, so no endpoint is a dead
  * end while the ergonomic surface catches up.
@@ -9991,6 +12375,7 @@ declare class Canopy {
     readonly identities: Identities;
     readonly roles: Roles;
     readonly assignments: Assignments;
+    readonly organizations: Organizations;
     constructor(options: CanopyClientOptions);
 }
 
@@ -10075,10 +12460,26 @@ declare class LocalAuthorizer {
     /** Counters for observability — how much traffic the cache is actually saving. */
     snapshot(): LocalAuthorizerStats;
     /**
-     * Drop everything held. Not needed in normal operation, where entries expire
-     * on their own; useful in tests and after a known change.
+     * Drop what is held so the next evaluate refetches.
+     *
+     * With an `identityId`, only that identity's grants are dropped — the
+     * cached hierarchy and every other identity's entries stay warm. This is
+     * the shape an assignment webhook wants: the event names the identity
+     * whose authority moved, and nothing else needs to pay a refetch for it.
+     *
+     * With no argument, everything goes: grants and the hierarchy tree. Not
+     * needed in normal operation, where entries expire on their own; useful in
+     * tests and after a change whose reach you cannot name (a role's
+     * permissions edited, a node moved).
+     *
+     * Multi-instance honesty: an invalidation reaches THIS process only. A
+     * webhook lands on one instance behind a load balancer; the others serve
+     * their cached grants until their own TTL expires. Unless the app fans the
+     * event out over its own pub/sub, the fleet-wide revocation guarantee is
+     * the TTL, and webhook-driven invalidation is a latency optimization on
+     * top of it — size the TTL to the revocation latency you can promise.
      */
-    invalidate(): void;
+    invalidate(identityId?: string): void;
     /** Climb from `nodeId` and look for a grant root among its ancestors. */
     private holdsAtNode;
     private grantRootsFor;
@@ -10315,8 +12716,54 @@ interface CanopyTokenClaims {
     permissions?: string[];
     /** True when `permissions` was truncated; query the API for the full set. */
     permissions_overflow?: boolean;
+    /**
+     * How the session was proven: `pwd`, `otp`, or `sso`, plus `mfa` once a
+     * second factor was verified. Identity tokens carry it; check for `mfa`
+     * before allowing a sensitive action.
+     */
+    amr?: string[];
+    /**
+     * The organization this session is acting in — present only on identity
+     * tokens from an Environment with the organizations container on, for an
+     * identity that belongs to at least one organization. Always minted
+     * together with `org_role`; read the pair through {@link orgContext}
+     * rather than separately.
+     */
+    org_id?: string;
+    /** The name of the single role the identity holds in `org_id`. */
+    org_role?: string;
     [claim: string]: unknown;
 }
+/**
+ * The organization context a verified token carries: which organization the
+ * session is acting in, and the one role it holds there.
+ */
+interface CanopyOrgContext {
+    /** The organization's id — also a hierarchy node id, usable as `node_id`. */
+    orgId: string;
+    /** The role's name (not its id): what `org_role` carries. */
+    orgRole: string;
+}
+/**
+ * The organization context of a verified token, or `null` when it has none.
+ *
+ * `null` is an ordinary answer, not a failure: it is every token from an
+ * Environment without the organizations container on, and every identity
+ * that belongs to no organization yet. Branch on it rather than on the raw claims —
+ * Canopy mints `org_id` and `org_role` together, and this helper refuses a
+ * half-present pair instead of letting one claim be read as though the other
+ * were there.
+ *
+ * ```ts
+ * const claims = await verifier.verify(token);
+ * const org = orgContext(claims);
+ *
+ * if (org) {
+ *   // acting inside org.orgId as org.orgRole
+ * }
+ * ```
+ */
+declare function orgContext(claims: CanopyTokenClaims): CanopyOrgContext | null;
 declare class TokenVerifier {
     private readonly issuer;
     private readonly audience;
@@ -10376,4 +12823,4 @@ declare class TokenVerifier {
     private fetchKeys;
 }
 
-export { type AssignmentItem, Assignments, type CallOptions, Canopy, CanopyAuthorizerError, CanopyClient, type CanopyClientOptions, CanopyConnectionError, CanopyError, type CanopyErrorBody, type CanopyTokenClaims, CanopyTokenError, type Collection, type ConcurrencyOptions, type ConditionalResult, type CursorPagination, Identities, type IdentityAssignmentItem, type IdentityItem, type LocalAuthorizationQuery, LocalAuthorizer, type LocalAuthorizerOptions, type LocalAuthorizerStats, type OffsetPagination, type OperationId, type PageFetcher, type PageParams, type PaginateOptions, type Pagination, Paginator, type PartialSuccess, type PermissionItem, Permissions, type QueryParams, type RequestBody, type RequestOptions, type ResponseBody, type RoleItem, Roles, type Schema, TokenVerifier, type TokenVerifierOptions, type components, isCanopyAuthorizerError, isCanopyConnectionError, isCanopyError, isCanopyTokenError, isCursorPagination, type operations, paginate, type paths, withConcurrency };
+export { type AssignmentItem, Assignments, type CallOptions, Canopy, CanopyAuthorizerError, CanopyClient, type CanopyClientOptions, CanopyConnectionError, CanopyError, type CanopyErrorBody, type CanopyOrgContext, type CanopyTokenClaims, CanopyTokenError, type Collection, type ConcurrencyOptions, type ConditionalResult, type CursorPagination, Identities, type IdentityAssignmentItem, type IdentityItem, type LocalAuthorizationQuery, LocalAuthorizer, type LocalAuthorizerOptions, type LocalAuthorizerStats, type OffsetPagination, type OperationId, type OrganizationInviteItem, type OrganizationItem, type OrganizationMemberItem, Organizations, type PageFetcher, type PageParams, type PaginateOptions, type Pagination, Paginator, type PartialSuccess, type PermissionItem, Permissions, type QueryParams, type RequestBody, type RequestOptions, type ResponseBody, type RoleItem, Roles, type Schema, TokenVerifier, type TokenVerifierOptions, type components, isCanopyAuthorizerError, isCanopyConnectionError, isCanopyError, isCanopyTokenError, isCursorPagination, type operations, orgContext, paginate, type paths, withConcurrency };