@canopy-io/node 0.11.0 → 0.13.0

package/dist/index.d.ts

@@ -1095,6 +1095,170 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/organizations/{id}/me": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * What the caller administers in an organization
+         * @description The authority read a customer's admin screen renders from: whether the caller holds `canopy:organization.manage` at the organization node (`administers_organization`), the topmost nodes where they hold `canopy:access.manage` inside it (`access_roots`, each with its name, type and the path of names from the organization down to it; the organization node itself when they administer the organization), the same for the structure and roles keys (empty until those ship), and whether the Environment's schema allows nodes beneath an organization (`has_hierarchy`). Computed from assignments at or beneath the organization node only, so a role held above every organization does not count. The developer's key answers as administering the whole organization. Refused with `403` for a caller holding nothing inside the organization.
+         */
+        get: operations["ApiOrganizationAccessController_me"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/tree": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the organization's tree as the caller sees it
+         * @description The organization's subtree pruned to the caller: every node beneath a node they administer is `accessible`, the ancestors between the organization node and such a node are `context_only`, and nothing else is returned. A paged flat list, each row carrying its parent, in the shape of the developer's node listing. Admitted to whoever the authority read admits.
+         */
+        get: operations["ApiOrganizationAccessController_tree"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/nodes/{nodeId}/access": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List who holds a role at a node in the organization
+         * @description Who holds a role at the node, directly or inherited from a node above it inside the organization: one row per assignment with the identity, the role, where it was granted and its window. Paginated; filtered and sorted as the developer's node identities listing is. Requires `hierarchy.view` at the node, or `canopy:organization.manage` at the organization, or `canopy:access.manage` at the node or above it.
+         */
+        get: operations["ApiOrganizationAccessController_listAccess"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/nodes/{nodeId}/access/summary": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Summarize who holds a role at a node in the organization
+         * @description The counts over the node's assignments: direct and inherited people, by status, roles in use and the most recent arrivals, with `can_manage_assignments` saying whether the caller may change them. Requires the same as the node access listing.
+         */
+        get: operations["ApiOrganizationAccessController_accessSummary"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/nodes/{nodeId}/grantable-roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the roles the caller may grant at a node
+         * @description The active, assignable roles of the Environment kept to the ones the caller may grant at the node under the grant ceiling: for an identity, those whose every permission it holds at the node or above; every assignable role for the developer's key and Console users. The list a picker offers, so nothing it shows is refused on write. Requires `canopy:access.manage` at the node or above it, `canopy:organization.manage` at the organization, or `hierarchy.manage` at the node. The response is an unpaginated `{ items }` array.
+         */
+        get: operations["ApiOrganizationAccessController_grantableRoles"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/nodes/{nodeId}/members": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the organization's members, for granting a role at a node
+         * @description The organization's members as candidates for a role at the node: each row names the identity only. Paginated; `q` searches name and email. Requires the same as the grantable-roles read at the node, so an administrator of one office may choose from the whole organization's roster without reading what anyone else holds.
+         */
+        get: operations["ApiOrganizationAccessController_listMembersAt"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/assignments": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Grant a role at a node beneath the organization
+         * @description Grants `role_id` to `identity_id` at `node_id`, the organization node or one beneath it. The identity must be a member of the organization (`409 organization.membership_required` otherwise). Requires `rbac.manage_assignments` at the node, `canopy:organization.manage` at the organization, or `canopy:access.manage` at the node or above it, within the grant ceiling. Emits `assignment.created`.
+         */
+        post: operations["ApiOrganizationAccessController_createAssignment"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/assignments/{assignmentId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Take a grant in the organization away
+         * @description Removes an assignment at the organization node or beneath it; the membership stays. Never bounded by the grant ceiling, but the last administrator's role at the organization node cannot be removed (`409 organization.last_admin`). Requires the same as creating one.
+         */
+        delete: operations["ApiOrganizationAccessController_removeAssignment"];
+        options?: never;
+        head?: never;
+        /**
+         * Change a grant in the organization
+         * @description Changes the role or the window of an assignment at the organization node or beneath it. A new role meets the grant ceiling; dates alone do not. The last administrator's role at the organization node cannot be changed away (`409 organization.last_admin`). Requires the same as creating one.
+         */
+        patch: operations["ApiOrganizationAccessController_updateAssignment"];
+        trace?: never;
+    };
     "/api/v1/organizations": {
         parameters: {
             query?: never;
@@ -1352,13 +1516,13 @@ interface paths {
         };
         /**
          * List an organization's members
-         * @description Lists the organization's members: each row is the member's identity, their single role in this organization, effective dates, when they joined, and `node_assignments`, the grants the member also holds at nodes beneath the organization (empty in a flat Environment). Paginated; `q` searches name and email. Requires the `rbac.view_assignments` permission at the organization.
+         * @description Lists the organization's members: each row is the membership (its `status`, `source` and `joined_at`), the member's identity, and `roles`, every role assignment the member holds in the organization, at its node and beneath, with the node and the effective window. Active members by default; `status=deactivated` lists those who left and `status=all` both. Paginated; `q` searches name and email, `role_id` keeps members holding that role anywhere in the organization. Requires the `rbac.view_assignments` permission at the organization.
          */
         get: operations["ApiOrganizationsController_listMembers"];
         put?: never;
         /**
          * Add a member to an organization
-         * @description Adds a member: assigns `role_id` to `identity_id` at the organization. The identity must already hold an active membership in this Environment (invite by email instead for someone who does not). A member holds exactly one role per organization, so an identity that is already a member returns `409` — use the change-role operation. Requires the `rbac.manage_assignments` permission at the organization and emits `organization.member.added`. An organization's own administrator, signed in with an identity token and admitted by `canopy:organization.manage` alone, is refused with `403` (`organization.member_add_requires_invite`): the person never agreed to join, so the administrator invites them instead.
+         * @description Adds a member. Membership is admission, not authority: with `role_id` the member also holds that role from the start, at the organization node or at the office or team `node_id` names, for the `effective_from` to `effective_to` window when given; without it they belong and hold nothing until a role is assigned (a place or dates need a role, `400 invite.window_requires_role`). The identity must already hold an active membership in this Environment (invite by email instead for someone who does not). An identity that is already a member returns `409`; roles are added through the assignment routes. Requires the `rbac.manage_assignments` permission at the organization and emits `organization.member.added`. An organization's own administrator, signed in with an identity token and admitted by `canopy:organization.manage` alone, is refused with `403` (`organization.member_add_requires_invite`): the person never agreed to join, so the administrator invites them instead.
          */
         post: operations["ApiOrganizationsController_addMember"];
         delete?: never;
@@ -1379,16 +1543,12 @@ interface paths {
         post?: never;
         /**
          * Remove a member from an organization
-         * @description Removes the member from this organization, revoking their role here and nothing else — the identity and its memberships in other organizations are untouched. Returns `404` when the identity is not a member. Responds `204 No Content`, requires the `rbac.manage_assignments` permission at the organization, and emits `organization.member.removed`.
+         * @description Removes the member from this organization: the membership is deactivated and every role assignment they hold at the organization's nodes goes with it, and nothing else; the identity and its memberships in other organizations are untouched. Returns `404` when the identity is not an active member and `409` when they are the last administrator. Responds `204 No Content`, requires the `rbac.manage_assignments` permission at the organization, and emits `organization.member.removed`.
          */
         delete: operations["ApiOrganizationsController_removeMember"];
         options?: never;
         head?: never;
-        /**
-         * Change a member's role
-         * @description Replaces the member's role in this organization with `role_id`. A member holds exactly one role per organization, so this updates the existing membership in place; changing to the role already held is a no-op. Returns `404` when the identity is not a member. Requires the `rbac.manage_assignments` permission at the organization and emits `organization.member.role_changed`.
-         */
-        patch: operations["ApiOrganizationsController_changeMemberRole"];
+        patch?: never;
         trace?: never;
     };
     "/api/v1/organizations/{id}/members/{identityId}/mfa/reset": {
@@ -1426,7 +1586,7 @@ interface paths {
         put?: never;
         /**
          * Invite a member into an organization
-         * @description Invites an email into the organization with the role bound to the invitation; acceptance creates the Environment membership and the organization membership in one step. Works for emails with no identity in the Environment — one is created on acceptance. Requires the `identity.manage` permission and emits `invite.created`.
+         * @description Invites an email into the organization. `role_id` is held on acceptance at `node_id`, the organization node (the default) or an office or team beneath it, for the `effective_from` to `effective_to` window when given; with no `role_id` the invitation admits a member holding nothing, which only the organization node allows (`400 invite.malformed_assignment` beneath it). Acceptance creates what is missing in one transaction: the identity, its Environment membership, the organization membership and the role. For someone who already holds an active membership in this Environment the invitation is a request to join (`intent: grant`): accepting is their consent, proven by their password or their own sign-in. Requires the `identity.manage` permission, or `canopy:organization.manage` at the organization or `canopy:access.manage` at the place for the organization's own administrators, and emits `invite.created`.
          */
         post: operations["ApiOrganizationsController_createInvite"];
         delete?: never;
@@ -1444,7 +1604,7 @@ interface paths {
         };
         /**
          * List the roles an organization may assign
-         * @description The active, assignable roles of the organization's Environment, for choosing a member's role or an invitation's. System roles are left out, since they cannot be assigned. Requires `hierarchy.view` or `canopy:organization.manage` at the organization. The response is an unpaginated `{ items }` array.
+         * @description The active, assignable roles of the organization's Environment, for choosing a member's role or an invitation's, each with `grantable`: whether the caller may grant it at the organization node under the grant ceiling (always true for the developer's key). System roles are left out, since they cannot be assigned. Requires `hierarchy.view`, `canopy:organization.manage` at the organization, or `canopy:access.manage` at the organization node. The response is an unpaginated `{ items }` array.
          */
         get: operations["ApiOrganizationsController_listRoles"];
         put?: never;
@@ -2504,6 +2664,7 @@ interface components {
             effective_node_id?: string | null;
             /** @description Ids of the roles whose assignments produced a node-scoped allow. Always empty for `scope_evaluated: "app_wide"`, whose answer is not tied to a node, and for a deny. */
             granting_roles: string[];
+            /** @description Why the check was refused: `NO_ROLE_ASSIGNMENT`, `PERMISSION_NOT_GRANTED`, `NODE_SCOPE_VIOLATION`, `ROLE_EXPIRED`, `IDENTITY_INACTIVE`, `IDENTITY_NOT_ENV_MEMBER`, or `ORGANIZATION_MEMBERSHIP_INACTIVE` (assignments sit on the lineage inside an organization the identity's membership in is deactivated, so none count). Null on an allow. */
             denial_reason?: string | null;
         };
         EvaluatePermissionDto: {
@@ -2538,7 +2699,7 @@ interface components {
             assignment_id: string;
             role_id: string;
             role_name: string;
-            /** @description Whether the assignment counts right now: within its effective_from/effective_to window, and its role is active. An inactive role's assignments are kept but grant nothing. */
+            /** @description Whether the assignment counts right now: within its effective_from/effective_to window, its role active, and, inside an organization, the holder's membership there active. An assignment that fails any of these is listed but grants nothing. */
             active: boolean;
             effective_from?: string | null;
             effective_to?: string | null;
@@ -2612,6 +2773,8 @@ interface components {
             effective_from: string | null;
             /** @description When this assignment expires; null means it never does */
             effective_to: string | null;
+            /** @description Optimistic-lock version; send it back as `If-Match` */
+            version: number;
         };
         IdentityRowDto: {
             id: string;
@@ -2758,6 +2921,8 @@ interface components {
             created_at: string;
             /** Format: date-time */
             updated_at: string;
+            /** @description Optimistic-lock version; send it back as `If-Match` */
+            version: number;
         };
         IdentityAccessibleNodesResponseDto: {
             /** @example reports.view */
@@ -2803,12 +2968,28 @@ interface components {
             name: string;
             role_id?: string | null;
             node_id?: string | null;
+            /** @description The name of the node at `node_id`, when it has one. */
+            node_name?: string | null;
+            /** @description The organization the invitation joins, when `node_id` is an organization node or sits beneath one. */
+            organization_node_id?: string | null;
+            /**
+             * Format: date-time
+             * @description When the role it grants starts to count.
+             */
+            effective_from?: string | null;
+            /**
+             * Format: date-time
+             * @description When the role it grants stops counting.
+             */
+            effective_to?: string | null;
             has_initial_assignment: boolean;
             /** @enum {string} */
             status: "pending" | "accepted" | "revoked" | "expired";
             /** Format: date-time */
             expires_at: string;
             invited_by: string;
+            /** @description The customer's own administrator who sent it with their identity token; `invited_by` names a platform user instead. */
+            invited_by_identity_id?: string | null;
             /** Format: date-time */
             created_at: string;
         };
@@ -2834,12 +3015,28 @@ interface components {
             name: string;
             role_id?: string | null;
             node_id?: string | null;
+            /** @description The name of the node at `node_id`, when it has one. */
+            node_name?: string | null;
+            /** @description The organization the invitation joins, when `node_id` is an organization node or sits beneath one. */
+            organization_node_id?: string | null;
+            /**
+             * Format: date-time
+             * @description When the role it grants starts to count.
+             */
+            effective_from?: string | null;
+            /**
+             * Format: date-time
+             * @description When the role it grants stops counting.
+             */
+            effective_to?: string | null;
             has_initial_assignment: boolean;
             /** @enum {string} */
             status: "pending" | "accepted" | "revoked" | "expired";
             /** Format: date-time */
             expires_at: string;
             invited_by: string;
+            /** @description The customer's own administrator who sent it with their identity token; `invited_by` names a platform user instead. */
+            invited_by_identity_id?: string | null;
             /** Format: date-time */
             created_at: string;
             /** @description Tokenized URL the invitee would land on. Returned so callers that pass send_email=false can deliver it themselves. */
@@ -2858,7 +3055,7 @@ interface components {
             first_name?: string;
             /** @description Required for `activate`. Ignored for `add_to_app` and `password_reset`. */
             last_name?: string;
-            /** @description Role ID — required if node_id is provided */
+            /** @description The role the invitation grants at `node_id`. Required with a `node_id`, except an organization node, where an invitation may admit a member with no role. */
             role_id?: string;
             /** @description Node ID — required if role_id is provided */
             node_id?: string;
@@ -2867,6 +3064,16 @@ interface components {
              * @default true
              */
             send_email: boolean;
+            /**
+             * Format: date-time
+             * @description When the role starts to count (ISO 8601). Copied onto the assignment the invitation grants; needs a role.
+             */
+            effective_from?: string;
+            /**
+             * Format: date-time
+             * @description When the role stops counting (ISO 8601), after `effective_from`. Copied onto the assignment; an invitation whose window has ended by acceptance is refused with `400 invite.window_ended`.
+             */
+            effective_to?: string;
         };
         BulkCreateIdentityInvitesDto: {
             invites: components["schemas"]["CreateIdentityInviteDto"][];
@@ -2999,6 +3206,8 @@ interface components {
             status: "active" | "scheduled" | "expired";
             /** Format: date-time */
             created_at: string;
+            /** @description Optimistic-lock version; send it back as `If-Match` */
+            version: number;
         };
         IdentityAssignmentRowDto: {
             identity: components["schemas"]["AssignmentIdentityDto"];
@@ -3023,6 +3232,65 @@ interface components {
             distinct_role_count: number;
             recent_identities: components["schemas"]["RecentIdentityDto"][];
         };
+        OrganizationAuthorityRootDto: {
+            node_id: string;
+            name: string;
+            /** @description The node's type, as the schema names it */
+            node_type: string;
+            /** @description The names from the organization node down to this node's parent, so the node can be named in context; empty for the organization node itself */
+            path: string[];
+        };
+        OrganizationMeResponseDto: {
+            /** @description Holds `canopy:organization.manage` at the organization node, or is the developer's key */
+            administers_organization: boolean;
+            /** @description The topmost nodes where `canopy:access.manage` is held inside the organization; the organization node when `administers_organization` */
+            access_roots: components["schemas"]["OrganizationAuthorityRootDto"][];
+            /** @description The same for `canopy:structure.manage`, a key no role carries yet; always empty */
+            structure_roots: components["schemas"]["OrganizationAuthorityRootDto"][];
+            /** @description The same for `canopy:roles.manage`, a key no role carries yet; always empty */
+            roles_roots: components["schemas"]["OrganizationAuthorityRootDto"][];
+            /** @description Whether the Environment's schema allows nodes beneath an organization; false in a flat Environment, where the organization is its only node */
+            has_hierarchy: boolean;
+        };
+        RoleResponseDto: {
+            id: string;
+            application_id: string;
+            name: string;
+            description?: string | null;
+            is_system_role: boolean;
+            system_key?: string | null;
+            is_active: boolean;
+            /** Format: date-time */
+            created_at: string;
+            /** Format: date-time */
+            updated_at: string;
+            /** @description Optimistic-lock version. Send back as the `If-Match` header when updating to detect concurrent edits. */
+            version: number;
+            /** @description Number of permissions currently assigned to this role. Populated on list responses; omitted on single-role responses where the join isn't computed. */
+            permission_count?: number;
+            /** @description Number of distinct identities assigned this role. Populated on list responses; omitted on single-role responses where the join isn't computed. */
+            member_count?: number;
+        };
+        OrganizationMemberCandidateResponseDto: {
+            identity: components["schemas"]["AssignmentIdentityDto"];
+        };
+        CreateOrganizationAssignmentDto: {
+            /** @description A member of the organization */
+            identity_id: string;
+            /** @description The organization node, or a node beneath it; the identity must be an active member of the organization */
+            node_id: string;
+            /** @description An active, assignable role of the Environment */
+            role_id: string;
+            /** @description When the grant starts (ISO 8601); now when omitted */
+            effective_from?: Record<string, unknown>;
+            /** @description When the grant ends (ISO 8601); never when omitted */
+            effective_to?: Record<string, unknown>;
+        };
+        UpdateAssignmentDto: {
+            role_id: string;
+            effective_from?: string | null;
+            effective_to?: string | null;
+        };
         OrganizationResponseDto: {
             id: string;
             name: string;
@@ -3032,7 +3300,7 @@ interface components {
             metadata: Record<string, unknown>;
             /** @description Your own id for this organization, unique per Environment. */
             external_id?: string | null;
-            /** @description Members (one role each) in this organization. */
+            /** @description Active members of this organization, whatever roles they hold. */
             member_count: number;
             /** @description Unexpired, unaccepted, unrevoked invitations. */
             pending_invite_count: number;
@@ -3223,44 +3491,82 @@ interface components {
             name: string;
             node_type: string;
         };
-        OrganizationMemberNodeAssignmentDto: {
+        OrganizationMemberAssignmentDto: {
             /** @description The assignment id. */
             id: string;
-            application_node: components["schemas"]["OrganizationMemberNodeDto"];
-            role: components["schemas"]["OrganizationMemberRoleDto"];
-        };
-        OrganizationMemberResponseDto: {
-            /** @description The membership (role assignment) id. */
-            id: string;
-            identity: components["schemas"]["OrganizationMemberIdentityDto"];
             role: components["schemas"]["OrganizationMemberRoleDto"];
+            node: components["schemas"]["OrganizationMemberNodeDto"];
             /** Format: date-time */
             effective_from?: string | null;
             /** Format: date-time */
             effective_to?: string | null;
+            /** @description The assignment's version, for `If-Match` on a change. */
+            version: number;
+        };
+        OrganizationMemberResponseDto: {
+            /** @description The membership id. */
+            id: string;
+            identity: components["schemas"]["OrganizationMemberIdentityDto"];
+            /**
+             * @description `active` while the identity belongs; `deactivated` once removed, kept for the organization's history.
+             * @enum {string}
+             */
+            status: "active" | "deactivated";
+            /**
+             * @description How the membership began: added by an administrator, an accepted invitation, single sign-on, directory sync, or the organization's own creation on sign-up.
+             * @enum {string}
+             */
+            source: "added" | "invitation" | "sso" | "directory_sync" | "signup";
             /**
              * Format: date-time
-             * @description When the membership was created.
+             * @description When the current membership began.
              */
-            created_at: string;
-            /** @description Assignments the member also holds at nodes beneath the organization. Empty in a flat Environment. */
-            node_assignments: components["schemas"]["OrganizationMemberNodeAssignmentDto"][];
+            joined_at: string;
+            /**
+             * Format: date-time
+             * @description When the member was removed; null while active.
+             */
+            deactivated_at?: string | null;
+            /** @description Every role assignment the member holds in the organization, the organization node first, then beneath it. Empty for a member who holds none. */
+            roles: components["schemas"]["OrganizationMemberAssignmentDto"][];
+            /** @description The membership's version. */
+            version: number;
         };
         AddOrganizationMemberDto: {
             /** @description Identity to add. Must already hold an active membership in this Environment; invite by email instead for someone who does not. */
             identity_id: string;
-            /** @description The single role the member holds in this organization, from the Environment's roles. */
-            role_id: string;
-        };
-        ChangeOrganizationMemberRoleDto: {
-            /** @description The replacement role. A member holds exactly one role per organization, so this updates the existing membership in place. */
-            role_id: string;
+            /** @description A role to hold at the organization node from the start, from the Environment's roles. Left out, the member belongs and holds nothing until a role is assigned. */
+            role_id?: string;
+            /** @description Where the role is held: the organization node (the default) or an office or team beneath it. Needs a role. */
+            node_id?: string;
+            /**
+             * Format: date-time
+             * @description When the role starts to count (ISO 8601). Needs a role.
+             */
+            effective_from?: string;
+            /**
+             * Format: date-time
+             * @description When the role stops counting (ISO 8601), after `effective_from`. Needs a role.
+             */
+            effective_to?: string;
         };
         CreateOrganizationInviteDto: {
             /** @description Email to invite. Works for people with no identity in this Environment — one is created when they accept. */
             email: string;
-            /** @description The role the member will hold in this organization on acceptance. */
-            role_id: string;
+            /** @description The role the person holds on acceptance, at `node_id`. Optional at the organization node, where accepting admits a member with no role; required for a place beneath it. */
+            role_id?: string;
+            /** @description Where the role is held: the organization node (the default) or an office or team beneath it. Accepting admits the person to the organization either way. */
+            node_id?: string;
+            /**
+             * Format: date-time
+             * @description When the role starts to count (ISO 8601). Copied onto the assignment the invitation grants; needs a role.
+             */
+            effective_from?: string;
+            /**
+             * Format: date-time
+             * @description When the role stops counting (ISO 8601), after `effective_from`. Copied onto the assignment; an invitation whose window has ended by acceptance is refused with `400 invite.window_ended`.
+             */
+            effective_to?: string;
             first_name?: string;
             last_name?: string;
             /**
@@ -3269,7 +3575,7 @@ interface components {
              */
             send_email: boolean;
         };
-        RoleResponseDto: {
+        OrganizationRoleResponseDto: {
             id: string;
             application_id: string;
             name: string;
@@ -3287,6 +3593,8 @@ interface components {
             permission_count?: number;
             /** @description Number of distinct identities assigned this role. Populated on list responses; omitted on single-role responses where the join isn't computed. */
             member_count?: number;
+            /** @description Whether the caller may grant this role at the organization node under the grant ceiling: for an identity, it holds every permission the role carries there; always true for the developer's key and Console users */
+            grantable: boolean;
         };
         SsoConnectionTestSummaryDto: {
             test_id: string;
@@ -3596,11 +3904,6 @@ interface components {
             effective_from?: string;
             effective_to?: string;
         };
-        UpdateAssignmentDto: {
-            role_id: string;
-            effective_from?: string | null;
-            effective_to?: string | null;
-        };
         BulkRemoveAssignmentsDto: {
             assignment_ids: string[];
         };
@@ -5041,16 +5344,21 @@ interface components {
                      * @description The identity that joined.
                      */
                     identity_id: string;
+                    /** @description Your own identifier for the organization, when you set one. */
+                    external_id?: string | null;
                     /**
                      * Format: uuid
-                     * @description The role it holds in the organization.
+                     * @description The membership record.
                      */
-                    role_id: string;
-                    /** @description Your own identifier for the organization, when you set one. */
-                    external_id?: string | null;
+                    membership_id?: string;
                     /**
                      * Format: uuid
-                     * @description The role assignment that is the membership.
+                     * @description The role given at the organization node on joining, when one was.
+                     */
+                    role_id?: string;
+                    /**
+                     * Format: uuid
+                     * @description That role's assignment, when a role was given.
                      */
                     assignment_id?: string;
                     /**
@@ -5072,7 +5380,7 @@ interface components {
                      * @description How the member joined, when it was not added directly.
                      * @enum {string}
                      */
-                    source?: "sso_jit" | "invite" | "scim";
+                    source?: "sso_jit" | "invite" | "scim" | "self_signup";
                 };
             };
         };
@@ -5129,13 +5437,13 @@ interface components {
                      * @description The identity removed.
                      */
                     identity_id: string;
+                    /** @description Role assignments it held at the organization's nodes, removed with the membership. */
+                    assignments_removed: number;
                     /**
                      * Format: uuid
-                     * @description The role it held.
+                     * @description The membership record, now deactivated.
                      */
-                    role_id: string;
-                    /** @description Grants it held beneath the organization, removed with the membership. */
-                    scoped_assignments_removed: number;
+                    membership_id?: string;
                     /**
                      * @description Set when directory sync made the change rather than somebody directly.
                      * @enum {string}
@@ -5583,8 +5891,7 @@ interface operations {
     ApiPermissionsController_deletePermission: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -5712,8 +6019,7 @@ interface operations {
     ApiPermissionsController_updatePermission: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -8863,7 +9169,7 @@ interface operations {
                     };
                 };
             };
-            /** @description The request failed validation; `role_id` and `node_id` were not given together; a `password_reset` invite carries a role assignment or names an email with no identity; or `client_id` names no active OAuth client in this Environment, or one with no invite redirect URL; or the request sent both an `X-API-Key` and an `Authorization` header */
+            /** @description The request failed validation; `role_id` came with no `node_id`, or a `node_id` with no `role_id` outside an organization node (`invite.malformed_assignment`); dates came with no role (`invite.window_requires_role`), end before they start, or have already ended (`invite.window_ended`); a `password_reset` invite carries a role assignment or names an email with no identity; or `client_id` names no active OAuth client in this Environment, or one with no invite redirect URL; or the request sent both an `X-API-Key` and an `Authorization` header */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -8874,7 +9180,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 400,
                      *         "code": null,
-                     *         "message": "The request failed validation; `role_id` and `node_id` were not given together; a `password_reset` invite carries a role assignment or names an email with no identity; or `client_id` names no active OAuth client in this Environment, or one with no invite redirect URL; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "message": "The request failed validation; `role_id` came with no `node_id`, or a `node_id` with no `role_id` outside an organization node (`invite.malformed_assignment`); dates came with no role (`invite.window_requires_role`), end before they start, or have already ended (`invite.window_ended`); a `password_reset` invite carries a role assignment or names an email with no identity; or `client_id` names no active OAuth client in this Environment, or one with no invite redirect URL; or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/identity-invites",
                      *         "method": "POST"
@@ -8926,7 +9232,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description A pending invite already exists for this email at this scope, the identity already has access to this Environment, or the node sits inside an organization the identity is not a member of */
+            /** @description A pending invite already exists for this email at this scope, the identity already has access to this Environment and the invitation joins no organization (`invite.identity_already_in_app`), or the identity is already an active member of the organization it joins (`organization.member_exists`) */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -8937,7 +9243,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "A pending invite already exists for this email at this scope, the identity already has access to this Environment, or the node sits inside an organization the identity is not a member of",
+                     *         "message": "A pending invite already exists for this email at this scope, the identity already has access to this Environment and the invitation joins no organization (`invite.identity_already_in_app`), or the identity is already an active member of the organization it joins (`organization.member_exists`)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/identity-invites",
                      *         "method": "POST"
@@ -9843,8 +10149,7 @@ interface operations {
     ApiNodesController_deleteNode: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -9972,8 +10277,7 @@ interface operations {
     ApiNodesController_updateNode: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -10394,8 +10698,7 @@ interface operations {
     ApiNodesController_moveNode: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -10642,12 +10945,1075 @@ interface operations {
                     /**
                      * @example {
                      *       "error": {
-                     *         "statusCode": 404,
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Node not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes/{id}/identities",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiNodesController_getIdentityAssignmentsSummary: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Identity counts by status returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["NodeIdentitiesSummaryDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes/{id}/identities/summary",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Node not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Node not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes/{id}/identities/summary",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_me: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The caller's authority in the organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["OrganizationMeResponseDto"];
+                    };
+                };
+            };
+            /** @description The request sent both an `X-API-Key` and an `Authorization` header; send one */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request sent both an `X-API-Key` and an `Authorization` header; send one",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The caller holds no delegated key inside the organization and no developer key over it, or the token is not an admin, API key or identity token */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The caller holds no delegated key inside the organization and no developer key over it, or the token is not an admin, API key or identity token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_tree: {
+        parameters: {
+            query?: {
+                /** @description Page number (1-based) */
+                page?: number;
+                /** @description Items per page (1-100, default 20) */
+                take?: number;
+                /** @description Search node names and slugs */
+                q?: string;
+                /** @description Sort column. Defaults to `created`, oldest first. */
+                sort_by?: "name" | "created";
+                /** @description Sort direction */
+                order?: "asc" | "desc";
+            };
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Nodes returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["ScopedNodeResponseDto"][];
+                        pagination: components["schemas"]["PageMetaDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/tree",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The caller holds no delegated key inside the organization and no developer key over it, or the token is not an admin, API key or identity token */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The caller holds no delegated key inside the organization and no developer key over it, or the token is not an admin, API key or identity token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/tree",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/tree",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_listAccess: {
+        parameters: {
+            query?: {
+                /** @description Page number (1-based) */
+                page?: number;
+                /** @description Items per page (1-100, default 20) */
+                take?: number;
+                /** @description Search term */
+                q?: string;
+                /** @description Sort field */
+                sort_by?: "name" | "role" | "access_type" | "created_at";
+                /** @description Sort order */
+                order?: "asc" | "desc";
+                /** @description Filter by role ID */
+                role_id?: string;
+                /** @description Filter by access type */
+                access_type?: "direct" | "inherited";
+                /** @description Filter by assignment status */
+                status?: "active" | "scheduled" | "expired";
+                /** @description Filter by source node ID */
+                source_node_id?: string;
+            };
+            header?: never;
+            path: {
+                id: string;
+                nodeId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Assignments returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["IdentityAssignmentRowDto"][];
+                        pagination: components["schemas"]["PageMetaDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/access",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/access",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The organization is not in this Environment, or the node is not inside it */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The organization is not in this Environment, or the node is not inside it",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/access",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_accessSummary: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                nodeId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Summary returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["NodeIdentitiesSummaryDto"];
+                    };
+                };
+            };
+            /** @description The request sent both an `X-API-Key` and an `Authorization` header; send one */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request sent both an `X-API-Key` and an `Authorization` header; send one",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/access",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The organization is not in this Environment, or the node is not inside it */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The organization is not in this Environment, or the node is not inside it",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/access/summary",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_grantableRoles: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                nodeId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Roles returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["RoleResponseDto"][];
+                    };
+                };
+            };
+            /** @description The request sent both an `X-API-Key` and an `Authorization` header; send one */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request sent both an `X-API-Key` and an `Authorization` header; send one",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/access",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The organization is not in this Environment, or the node is not inside it */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The organization is not in this Environment, or the node is not inside it",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/grantable-roles",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_listMembersAt: {
+        parameters: {
+            query?: {
+                /** @description Page number (1-based) */
+                page?: number;
+                /** @description Items per page (1-100, default 20) */
+                take?: number;
+                /** @description Search member names and emails */
+                q?: string;
+                /** @description Sort column. Defaults to `joined`, longest-standing member first. */
+                sort_by?: "name" | "email" | "joined";
+                /** @description Sort direction */
+                order?: "asc" | "desc";
+            };
+            header?: never;
+            path: {
+                id: string;
+                nodeId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Members returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["OrganizationMemberCandidateResponseDto"][];
+                        pagination: components["schemas"]["PageMetaDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/members",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/access",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The organization is not in this Environment, or the node is not inside it */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The organization is not in this Environment, or the node is not inside it",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/members",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_createAssignment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateOrganizationAssignmentDto"];
+            };
+        };
+        responses: {
+            /** @description Assignment created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["AssignmentResponseDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The token is not an admin, API key or identity token, or the caller holds none of the keys the operation needs at the node, or is an identity outside the grant ceiling for the role (`assignment.grant_ceiling`) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The token is not an admin, API key or identity token, or the caller holds none of the keys the operation needs at the node, or is an identity outside the grant ceiling for the role (`assignment.grant_ceiling`)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The organization is not in this Environment, or the node is not inside it */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The organization is not in this Environment, or the node is not inside it",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The identity already holds this role at this node, or is not a member of the organization (`organization.membership_required`) */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "The identity already holds this role at this node, or is not a member of the organization (`organization.membership_required`)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_removeAssignment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                assignmentId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Assignment removed */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The request sent both an `X-API-Key` and an `Authorization` header; send one */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request sent both an `X-API-Key` and an `Authorization` header; send one",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The token is not an admin, API key or identity token, or the caller holds none of the keys the operation needs at the node */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The token is not an admin, API key or identity token, or the caller holds none of the keys the operation needs at the node",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments/{assignmentId}",
+                     *         "method": "DELETE"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The organization is not in this Environment, or the assignment is not at one of its nodes */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The organization is not in this Environment, or the assignment is not at one of its nodes",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments/{assignmentId}",
+                     *         "method": "DELETE"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The member is the organization's last administrator (`organization.last_admin`); make someone else one first */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "Node not found",
+                     *         "message": "The member is the organization's last administrator (`organization.last_admin`); make someone else one first",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes/{id}/identities",
-                     *         "method": "GET"
+                     *         "path": "/api/v1/organizations/{id}/assignments/{assignmentId}",
+                     *         "method": "DELETE"
                      *       }
                      *     }
                      */
@@ -10656,25 +12022,33 @@ interface operations {
             };
         };
     };
-    ApiNodesController_getIdentityAssignmentsSummary: {
+    ApiOrganizationAccessController_updateAssignment: {
         parameters: {
             query?: never;
-            header?: never;
+            header?: {
+                /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
+                "If-Match"?: string;
+            };
             path: {
                 id: string;
+                assignmentId: string;
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateAssignmentDto"];
+            };
+        };
         responses: {
-            /** @description Identity counts by status returned */
+            /** @description Assignment updated */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        data: components["schemas"]["NodeIdentitiesSummaryDto"];
+                        data: components["schemas"]["AssignmentResponseDto"];
                     };
                 };
             };
@@ -10691,8 +12065,8 @@ interface operations {
                      *         "code": null,
                      *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes/{id}/identities/summary",
-                     *         "method": "GET"
+                     *         "path": "/api/v1/organizations/{id}/assignments/{assignmentId}",
+                     *         "method": "PATCH"
                      *       }
                      *     }
                      */
@@ -10712,7 +12086,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "Invalid or expired token",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
+                     *         "path": "/api/v1/organizations/{id}/me",
                      *         "method": "GET"
                      *       }
                      *     }
@@ -10720,7 +12094,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment */
+            /** @description The token is not an admin, API key or identity token, or the caller holds none of the keys the operation needs at the node, or is an identity outside the grant ceiling for the role (`assignment.grant_ceiling`) */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -10731,17 +12105,17 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 403,
                      *         "code": null,
-                     *         "message": "The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment",
+                     *         "message": "The token is not an admin, API key or identity token, or the caller holds none of the keys the operation needs at the node, or is an identity outside the grant ceiling for the role (`assignment.grant_ceiling`)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
-                     *         "method": "GET"
+                     *         "path": "/api/v1/organizations/{id}/assignments/{assignmentId}",
+                     *         "method": "PATCH"
                      *       }
                      *     }
                      */
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Node not found */
+            /** @description The organization is not in this Environment, or the assignment is not at one of its nodes */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -10752,10 +12126,31 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 404,
                      *         "code": null,
-                     *         "message": "Node not found",
+                     *         "message": "The organization is not in this Environment, or the assignment is not at one of its nodes",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes/{id}/identities/summary",
-                     *         "method": "GET"
+                     *         "path": "/api/v1/organizations/{id}/assignments/{assignmentId}",
+                     *         "method": "PATCH"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The identity already holds this role at this node, the assignment has been modified since the version named in If-Match was read (`assignment.version_mismatch`), or it is the last administrator's role at the organization node (`organization.last_admin`) */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "The identity already holds this role at this node, the assignment has been modified since the version named in If-Match was read (`assignment.version_mismatch`), or it is the last administrator's role at the organization node (`organization.last_admin`)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments/{assignmentId}",
+                     *         "method": "PATCH"
                      *       }
                      *     }
                      */
@@ -11165,8 +12560,7 @@ interface operations {
     ApiOrganizationsController_deleteOrganization: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -11294,8 +12688,7 @@ interface operations {
     ApiOrganizationsController_updateOrganization: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -11539,8 +12932,7 @@ interface operations {
     ApiOrganizationsController_updatePolicy: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -12850,14 +14242,14 @@ interface operations {
                 take?: number;
                 /** @description Search member names and emails */
                 q?: string;
-                /** @description Sort column. Defaults to `created`, oldest membership first. */
-                sort_by?: "name" | "email" | "role" | "created";
+                /** @description Sort column. Defaults to `joined`, longest-standing member first. */
+                sort_by?: "name" | "email" | "joined";
                 /** @description Sort direction */
                 order?: "asc" | "desc";
-                /** @description Only members holding this role */
+                /** @description Only members holding this role anywhere in the organization, at its node or beneath */
                 role_id?: string;
-                /** @description Filter by the membership's effective window: active now, scheduled to start, or already expired */
-                status?: "active" | "scheduled" | "expired";
+                /** @description Which memberships to list: `active` (the default), `deactivated` for members who left, or `all` */
+                status?: "active" | "deactivated" | "all";
             };
             header?: never;
             path: {
@@ -12991,7 +14383,7 @@ interface operations {
                     };
                 };
             };
-            /** @description The request failed validation, or the role is a system role, which cannot be assigned; or the request sent both an `X-API-Key` and an `Authorization` header */
+            /** @description The request failed validation, the role is a system role, which cannot be assigned, a place or dates came with no role (`invite.window_requires_role`), or the dates end before they start; or the request sent both an `X-API-Key` and an `Authorization` header */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -13002,7 +14394,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 400,
                      *         "code": null,
-                     *         "message": "The request failed validation, or the role is a system role, which cannot be assigned; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "message": "The request failed validation, the role is a system role, which cannot be assigned, a place or dates came with no role (`invite.window_requires_role`), or the dates end before they start; or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/members",
                      *         "method": "POST"
@@ -13054,7 +14446,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description The organization, the identity or the role does not exist in this Environment */
+            /** @description The organization, the identity or the role does not exist in this Environment, or `node_id` is not the organization or a place beneath it */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -13065,7 +14457,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 404,
                      *         "code": null,
-                     *         "message": "The organization, the identity or the role does not exist in this Environment",
+                     *         "message": "The organization, the identity or the role does not exist in this Environment, or `node_id` is not the organization or a place beneath it",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/members",
                      *         "method": "POST"
@@ -13075,7 +14467,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description The identity is already a member of this organization */
+            /** @description The identity is already a member of this organization (`organization.member_exists`); give them a role through the assignment routes */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -13086,7 +14478,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "The identity is already a member of this organization",
+                     *         "message": "The identity is already a member of this organization (`organization.member_exists`); give them a role through the assignment routes",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/members",
                      *         "method": "POST"
@@ -13224,140 +14616,6 @@ interface operations {
             };
         };
     };
-    ApiOrganizationsController_changeMemberRole: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                id: string;
-                identityId: string;
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["ChangeOrganizationMemberRoleDto"];
-            };
-        };
-        responses: {
-            /** @description Member role changed */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        data: components["schemas"]["OrganizationMemberResponseDto"];
-                    };
-                };
-            };
-            /** @description The request failed validation, or the role is inactive or a system role; or the request sent both an `X-API-Key` and an `Authorization` header */
-            400: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 400,
-                     *         "code": null,
-                     *         "message": "The request failed validation, or the role is inactive or a system role; or the request sent both an `X-API-Key` and an `Authorization` header",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/organizations/{id}/members/{identityId}",
-                     *         "method": "PATCH"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description Invalid or expired token */
-            401: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 401,
-                     *         "code": null,
-                     *         "message": "Invalid or expired token",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/organizations",
-                     *         "method": "GET"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
-            403: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 403,
-                     *         "code": null,
-                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/organizations",
-                     *         "method": "GET"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description The organization or the role does not exist, or the identity is not a member of this organization */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 404,
-                     *         "code": null,
-                     *         "message": "The organization or the role does not exist, or the identity is not a member of this organization",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/organizations/{id}/members/{identityId}",
-                     *         "method": "PATCH"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description The member is the organization's last administrator (`organization.last_admin`); make someone else one first */
-            409: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 409,
-                     *         "code": null,
-                     *         "message": "The member is the organization's last administrator (`organization.last_admin`); make someone else one first",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/organizations/{id}/members/{identityId}",
-                     *         "method": "PATCH"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-        };
-    };
     ApiOrganizationsController_resetMemberMfa: {
         parameters: {
             query?: never;
@@ -13632,7 +14890,7 @@ interface operations {
                     };
                 };
             };
-            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            /** @description The request failed validation; a place beneath the organization was named with no role (`invite.malformed_assignment`); dates came with no role (`invite.window_requires_role`), end before they start, or have already ended (`invite.window_ended`); or the request sent both an `X-API-Key` and an `Authorization` header */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -13643,7 +14901,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 400,
                      *         "code": null,
-                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "message": "The request failed validation; a place beneath the organization was named with no role (`invite.malformed_assignment`); dates came with no role (`invite.window_requires_role`), end before they start, or have already ended (`invite.window_ended`); or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/invites",
                      *         "method": "POST"
@@ -13674,7 +14932,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            /** @description The token is not an admin, API key or identity token, or the caller is an identity that does not hold, at the organization node or above, every permission the role carries (`assignment.grant_ceiling`); Console users and API keys are not bounded */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -13685,17 +14943,17 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 403,
                      *         "code": null,
-                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "message": "The token is not an admin, API key or identity token, or the caller is an identity that does not hold, at the organization node or above, every permission the role carries (`assignment.grant_ceiling`); Console users and API keys are not bounded",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/organizations",
-                     *         "method": "GET"
+                     *         "path": "/api/v1/organizations/{id}/invites",
+                     *         "method": "POST"
                      *       }
                      *     }
                      */
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Organization not found */
+            /** @description The organization does not exist, or `node_id` is not the organization or a place beneath it */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -13706,7 +14964,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 404,
                      *         "code": null,
-                     *         "message": "Organization not found",
+                     *         "message": "The organization does not exist, or `node_id` is not the organization or a place beneath it",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/invites",
                      *         "method": "POST"
@@ -13716,7 +14974,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description A pending invitation already exists for this email, or the identity already has active access to this Environment */
+            /** @description A pending invitation already exists for this email at this place, or the identity is already an active member of the organization (`organization.member_exists`); give a member a role through the assignment routes */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -13727,7 +14985,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "A pending invitation already exists for this email, or the identity already has active access to this Environment",
+                     *         "message": "A pending invitation already exists for this email at this place, or the identity is already an active member of the organization (`organization.member_exists`); give a member a role through the assignment routes",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/invites",
                      *         "method": "POST"
@@ -13757,7 +15015,7 @@ interface operations {
                 };
                 content: {
                     "application/json": {
-                        items: components["schemas"]["RoleResponseDto"][];
+                        items: components["schemas"]["OrganizationRoleResponseDto"][];
                     };
                 };
             };
@@ -17031,8 +18289,7 @@ interface operations {
     ApiRolesController_deleteRole: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -17160,8 +18417,7 @@ interface operations {
     ApiRolesController_updateRole: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -17810,7 +19066,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description The identity already has this role at this node, already holds its one role at this organization, or the node sits beneath an organization the identity has no membership in effect at */
+            /** @description The identity already has this role at this node, or the node sits beneath an organization the identity is not an active member of (`organization.membership_required`) */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -17821,7 +19077,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "The identity already has this role at this node, already holds its one role at this organization, or the node sits beneath an organization the identity has no membership in effect at",
+                     *         "message": "The identity already has this role at this node, or the node sits beneath an organization the identity is not an active member of (`organization.membership_required`)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/assignments",
                      *         "method": "POST"
@@ -17935,12 +19191,36 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description The member is the organization's last administrator (`organization.last_admin`); make someone else one first */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "The member is the organization's last administrator (`organization.last_admin`); make someone else one first",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/assignments/{id}",
+                     *         "method": "DELETE"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     ApiAssignmentsController_updateAssignment: {
         parameters: {
             query?: never;
-            header?: never;
+            header?: {
+                /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
+                "If-Match"?: string;
+            };
             path: {
                 id: string;
             };
@@ -18047,7 +19327,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Identity already has this role at this node */
+            /** @description The identity already holds this role at this node, the assignment has been modified since the version named in If-Match was read (`assignment.version_mismatch`), or the role is the last administrator's at an organization node (`organization.last_admin`) */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -18058,7 +19338,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "Identity already has this role at this node",
+                     *         "message": "The identity already holds this role at this node, the assignment has been modified since the version named in If-Match was read (`assignment.version_mismatch`), or the role is the last administrator's at an organization node (`organization.last_admin`)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/assignments/{id}",
                      *         "method": "PATCH"
@@ -18174,6 +19454,27 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description The member is the organization's last administrator (`organization.last_admin`); make someone else one first */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "The member is the organization's last administrator (`organization.last_admin`); make someone else one first",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/assignments/bulk-remove",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     ApiAssignmentsController_bulkChangeRole: {
@@ -18284,7 +19585,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Identity already has this role at this node */
+            /** @description The identity already holds this role at this node, the assignment has been modified since the version named in If-Match was read (`assignment.version_mismatch`), or the role is the last administrator's at an organization node (`organization.last_admin`) */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -18295,7 +19596,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "Identity already has this role at this node",
+                     *         "message": "The identity already holds this role at this node, the assignment has been modified since the version named in If-Match was read (`assignment.version_mismatch`), or the role is the last administrator's at an organization node (`organization.last_admin`)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/assignments/bulk-change-role",
                      *         "method": "POST"
@@ -19241,8 +20542,7 @@ interface operations {
     ApiHierarchySchemaController_updateSchema: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock token. Pass the `version` you read from the Environment — request fails 409 when the row has moved on. */
                 "If-Match"?: string;
             };
@@ -21646,7 +22946,12 @@ declare class Assignments {
      * answer, read the current assignments before retrying.
      */
     create(input: RequestBody<"ApiAssignmentsController_assignRole">): Promise<ResponseBody<"ApiAssignmentsController_assignRole">>;
-    update(id: string, input: RequestBody<"ApiAssignmentsController_updateAssignment">): Promise<ResponseBody<"ApiAssignmentsController_updateAssignment">>;
+    /**
+     * Change the role or the window of a grant. Pass the `version` the
+     * assignment was read with as `ifMatch`; a stale one answers 409
+     * `assignment.version_mismatch` rather than overwriting a newer change.
+     */
+    update(id: string, input: RequestBody<"ApiAssignmentsController_updateAssignment">, options?: ConcurrencyOptions): Promise<ResponseBody<"ApiAssignmentsController_updateAssignment">>;
     delete(id: string): Promise<void>;
     /**
      * Grant many at once. Answers 207 with a per-item result rather than failing
@@ -21750,8 +23055,8 @@ type ItemOf$3<T> = T extends {
 } ? Item : never;
 
 /**
- * Tenant organizations: one per business customer, a role per membership,
- * each with its own authentication policy and identity provider. Every
+ * Tenant organizations: one per business customer, membership apart from
+ * the roles held inside it, each with its own authentication policy and identity provider. Every
  * call here needs the Environment's organizations container switched on.
  */
 declare class Organizations {
@@ -21776,8 +23081,12 @@ declare class Organizations {
     deleteAll(): Promise<void>;
     listMembers(id: string, query?: QueryParams<"ApiOrganizationsController_listMembers">): Paginator<OrganizationMemberItem>;
     addMember(id: string, input: RequestBody<"ApiOrganizationsController_addMember">): Promise<ResponseBody<"ApiOrganizationsController_addMember">>;
-    changeMemberRole(id: string, identityId: string, input: RequestBody<"ApiOrganizationsController_changeMemberRole">): Promise<ResponseBody<"ApiOrganizationsController_changeMemberRole">>;
-    /** Revokes that organization's one role; the identity and its other memberships are untouched. */
+    /**
+     * Deactivates the membership and revokes every role the member holds at
+     * the organization's nodes; the identity and its other memberships are
+     * untouched. A role in the organization is changed through the
+     * organization's assignment routes, not here.
+     */
     removeMember(id: string, identityId: string): Promise<void>;
     /**
      * Clears a member's second factor, for one who lost their authenticator:
@@ -22579,23 +23888,28 @@ interface CanopyTokenClaims {
      * The organization this session is acting in — present only on identity
      * tokens from an Environment with the organizations container on, for an
      * identity that belongs to at least one organization. Always minted
-     * together with `org_role`; read the pair through {@link orgContext}
+     * together with `org_roles`; read the pair through {@link orgContext}
      * rather than separately.
      */
     org_id?: string;
-    /** The name of the single role the identity holds in `org_id`. */
-    org_role?: string;
+    /**
+     * The names of the roles the identity holds at the organization's own node,
+     * sorted; empty for a member who holds none there. Membership is admission,
+     * not a role: a member may hold roles only beneath the organization, or
+     * none at all.
+     */
+    org_roles?: string[];
     [claim: string]: unknown;
 }
 /**
  * The organization context a verified token carries: which organization the
- * session is acting in, and the one role it holds there.
+ * session is acting in, and the roles it holds at that organization's node.
  */
 interface CanopyOrgContext {
     /** The organization's id — also a hierarchy node id, usable as `node_id`. */
     orgId: string;
-    /** The role's name (not its id): what `org_role` carries. */
-    orgRole: string;
+    /** The roles' names (not ids) held at the organization node: what `org_roles` carries. Empty for a member holding none there. */
+    orgRoles: string[];
 }
 /**
  * The organization context of a verified token, or `null` when it has none.
@@ -22603,16 +23917,18 @@ interface CanopyOrgContext {
  * `null` is an ordinary answer, not a failure: it is every token from an
  * Environment without the organizations container on, and every identity
  * that belongs to no organization yet. Branch on it rather than on the raw claims —
- * Canopy mints `org_id` and `org_role` together, and this helper refuses a
+ * Canopy mints `org_id` and `org_roles` together, and this helper refuses a
  * half-present pair instead of letting one claim be read as though the other
- * were there.
+ * were there. An empty `orgRoles` is a member of the organization holding no
+ * role at its node; authorize such a session by evaluating, never by the
+ * list's length.
  *
  * ```ts
  * const claims = await verifier.verify(token);
  * const org = orgContext(claims);
  *
  * if (org) {
- *   // acting inside org.orgId as org.orgRole
+ *   // acting inside org.orgId, holding org.orgRoles at its node
  * }
  * ```
  */