@canopy-io/node 0.3.4 → 0.3.5

package/dist/index.d.cts

@@ -1679,6 +1679,30 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/organizations/{id}/directory/grantable-roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the roles an organization's directory may grant
+         * @description What this organization's identity provider is allowed to hand out, and which role arriving people hold.
+         */
+        get: operations["ApiOrganizationDirectoryController_listGrantableRoles"];
+        /**
+         * Replace the roles an organization's directory may grant
+         * @description Replaces the whole list in one act. Withdrawing a role unmaps the groups that name it and releases the grants those mappings produced. An empty list disables directory sync for the organization.
+         */
+        put: operations["ApiOrganizationDirectoryController_setGrantableRoles"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/organizations/{id}/directory/groups": {
         parameters: {
             query?: never;
@@ -3223,7 +3247,7 @@ interface components {
         OrganizationDirectoryResponseDto: {
             /** @description The directory's id, or null when none has been created. */
             id?: string | null;
-            /** @description The SCIM 2.0 base URL to paste into the identity provider's connector, or null when no directory exists. */
+            /** @description The full SCIM 2.0 base URL (the instance's public origin and the directory's path) to paste into the identity provider's connector, or null when no directory exists. */
             base_url?: string | null;
             /** Format: date-time */
             created_at?: string | null;
@@ -3251,7 +3275,7 @@ interface components {
             /** @description Plaintext SCIM token — shown only once */
             token: string;
             token_preview: string;
-            /** @description The directory's SCIM 2.0 base URL, to paste into the identity provider's connector. */
+            /** @description The directory's full SCIM 2.0 base URL (the instance's public origin and the directory's path), to paste into the identity provider's connector. */
             base_url: string;
             /**
              * Format: date-time
@@ -3284,6 +3308,19 @@ interface components {
             /** Format: date-time */
             created_at: string;
         };
+        DirectoryGrantableRoleResponseDto: {
+            id: string;
+            name: string;
+            description?: string | null;
+            /** @description The role an arriving person holds when no mapped group says otherwise. */
+            is_default: boolean;
+        };
+        SetDirectoryGrantableRolesDto: {
+            /** @description The roles this organization's directory may grant. An empty list disables directory sync for the organization. */
+            role_ids: string[];
+            /** @description The role somebody arrives with when no mapped group says otherwise. Required unless the list is empty, and must be one of `role_ids`. */
+            default_role_id?: string | null;
+        };
         ScimGroupResponseDto: {
             id: string;
             external_id?: string | null;
@@ -12299,6 +12336,226 @@ interface operations {
             };
         };
     };
+    ApiOrganizationDirectoryController_listGrantableRoles: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Grantable roles returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["DirectoryGrantableRoleResponseDto"][];
+                    };
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/directory",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/directory",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/directory/grantable-roles",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationDirectoryController_setGrantableRoles: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SetDirectoryGrantableRolesDto"];
+            };
+        };
+        responses: {
+            /** @description Grantable roles replaced */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["DirectoryGrantableRoleResponseDto"][];
+                    };
+                };
+            };
+            /** @description The list names a role that does not exist here, a system role, or no role for arriving people to hold */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The list names a role that does not exist here, a system role, or no role for arriving people to hold",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/directory/grantable-roles",
+                     *         "method": "PUT"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/directory",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Only the application owner may change this list. An organization's own administrator can read it, not change it. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "Only the application owner may change this list. An organization's own administrator can read it, not change it.",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/directory/grantable-roles",
+                     *         "method": "PUT"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/directory/grantable-roles",
+                     *         "method": "PUT"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The list cannot be emptied while the organization's directory is connected; remove the directory first */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "The list cannot be emptied while the organization's directory is connected; remove the directory first",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/directory/grantable-roles",
+                     *         "method": "PUT"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
     ApiOrganizationDirectoryGroupsController_list: {
         parameters: {
             query?: never;
@@ -16105,6 +16362,57 @@ declare class Organizations {
      */
     bindSsoConnection(id: string, input: RequestBody<"ApiOrganizationsController_bindSsoConnection">): Promise<ResponseBody<"ApiOrganizationsController_bindSsoConnection">>;
     unbindSsoConnection(id: string, connectionId: string): Promise<void>;
+    /**
+     * The roles this organization's identity provider may grant, and the one
+     * people arrive with. An empty list means directory sync is not open for
+     * the organization.
+     */
+    listDirectoryGrantableRoles(id: string): Promise<ResponseBody<"ApiOrganizationDirectoryController_listGrantableRoles">>;
+    /**
+     * Replace the list in one act, which is how directory sync is opened for
+     * an organization. Exactly one role is `default_role_id`, the one people
+     * arrive with. Withdrawing a role unmaps the groups naming it and keeps
+     * their members in the organization; an empty list is refused while a
+     * directory is connected. Your API key only: an organization admin's
+     * token can read the list but is refused changing it.
+     */
+    setDirectoryGrantableRoles(id: string, input: RequestBody<"ApiOrganizationDirectoryController_setGrantableRoles">): Promise<ResponseBody<"ApiOrganizationDirectoryController_setGrantableRoles">>;
+    /**
+     * The organization's directory, its full SCIM base URL, and the roles it
+     * may grant. `id` is null until a directory is connected.
+     */
+    getDirectory(id: string): Promise<ResponseBody<"ApiOrganizationDirectoryController_get">>;
+    /** Connect a directory. Refused until the organization's roles are set. */
+    createDirectory(id: string): Promise<ResponseBody<"ApiOrganizationDirectoryController_create">>;
+    /**
+     * End the connection. The people it provisioned keep their accounts and
+     * their membership; what ends is the provider's ability to push.
+     */
+    removeDirectory(id: string): Promise<void>;
+    listDirectoryTokens(id: string): Promise<ResponseBody<"ApiOrganizationDirectoryController_listTokens">>;
+    /**
+     * The raw token is in this answer and nowhere else, alongside the full
+     * base URL the identity provider's connector needs with it.
+     */
+    mintDirectoryToken(id: string, input?: RequestBody<"ApiOrganizationDirectoryController_mintToken">): Promise<ResponseBody<"ApiOrganizationDirectoryController_mintToken">>;
+    /**
+     * A replacement token, shown once. The old one keeps working for a short
+     * overlap, so the provider can be moved across without an outage.
+     */
+    rotateDirectoryToken(id: string, tokenId: string, input?: RequestBody<"ApiOrganizationDirectoryController_rotateToken">): Promise<ResponseBody<"ApiOrganizationDirectoryController_rotateToken">>;
+    revokeDirectoryToken(id: string, tokenId: string): Promise<void>;
+    /** The organization's own provisioning events, newest first. */
+    listDirectoryActivity(id: string): Promise<ResponseBody<"ApiOrganizationDirectoryController_activity">>;
+    /** The groups the provider has pushed, each with its role mapping. */
+    listDirectoryGroups(id: string): Promise<ResponseBody<"ApiOrganizationDirectoryGroupsController_list">>;
+    /**
+     * Grant a listed role to every member of a pushed group, at the
+     * organization. A role not on the organization's list is refused with
+     * `scim.role_not_grantable`.
+     */
+    mapDirectoryGroup(id: string, groupId: string, input: RequestBody<"ApiOrganizationDirectoryGroupsController_map">): Promise<ResponseBody<"ApiOrganizationDirectoryGroupsController_map">>;
+    /** Members fall back to the arrival role and stay in the organization. */
+    unmapDirectoryGroup(id: string, groupId: string): Promise<ResponseBody<"ApiOrganizationDirectoryGroupsController_unmap">>;
 }
 type OrganizationItem = ItemOf$2<ResponseBody<"ApiOrganizationsController_listOrganizations">>;
 type OrganizationMemberItem = ItemOf$2<ResponseBody<"ApiOrganizationsController_listMembers">>;