@canopy-io/node 0.3.9 → 0.3.11

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @canopy-io/node
 
+## 0.3.11
+
+### Patch Changes
+
+- 4b08934: Organization policy types regenerated from the live spec. `updatePolicy` accepts `allowed_sign_in_methods`, a non-empty subset of the methods the Environment offers (`password`, `email_otp`, `sso`) or `null` to inherit them all; a method the Environment has off is refused with `organization.policy_loosens`. `getPolicy` returns the field on the organization's own values, on `environment` (what is offered) and on `effective` (what members may use, `["sso"]` alone while `require_sso` is on).
+
+## 0.3.10
+
+### Patch Changes
+
+- b71e786: Webhook types regenerated from the live spec. Deliveries for a change directory sync made (`identity.created`, `identity.env_membership.*`, `organization.member.*`, `assignment.bulk_*`) now type `source: "scim"` and `directory_id`, and the directory's own activity is subscribable: `scim.user.provisioned` / `updated` / `deprovisioned` / `reactivated`, `scim.group.created` / `updated` / `deleted` / `member_added` / `member_removed` / `mapped` / `unmapped`. `identity.created` also types `source: "sso_jit"` with `connection_id` for an identity a first SSO sign-in created.
+
 ## 0.3.9
 
 ### Patch Changes

package/README.md

@@ -147,7 +147,12 @@ await canopy.organizations.addMember(acme.id, {
   role_id: ownerRoleId,
 });
 
-await canopy.organizations.updatePolicy(acme.id, { mfa_required: true });
+// An organization only tightens the Environment: a second factor where the
+// Environment leaves it optional, and only some of the Environment's ways in.
+await canopy.organizations.updatePolicy(acme.id, {
+  mfa_required: true,
+  allowed_sign_in_methods: ["password", "sso"],
+});
 ```
 
 Directory sync (SCIM) opens when you name the roles an organization's identity

package/dist/index.d.cts

@@ -2935,6 +2935,8 @@ interface components {
             mfa_factor_allowlist: ("totp" | "webauthn" | "email_otp")[];
             /** @enum {string} */
             mfa_after_sso: "exempt" | "require";
+            /** @description The sign-in methods on offer: on the Environment, the ones it has turned on; on the effective policy, those narrowed by the organization, and `["sso"]` alone while it requires SSO. */
+            allowed_sign_in_methods: ("password" | "email_otp" | "sso")[];
             require_sso: boolean;
         };
         OrganizationPolicyResponseDto: {
@@ -2944,6 +2946,8 @@ interface components {
             mfa_factor_allowlist?: ("totp" | "webauthn" | "email_otp")[] | null;
             /** @enum {string|null} */
             mfa_after_sso?: "exempt" | "require" | null;
+            /** @description The methods the organization keeps of the Environment's, or null to inherit them all. */
+            allowed_sign_in_methods?: ("password" | "email_otp" | "sso")[] | null;
             require_sso: boolean;
             /** @description The Environment's own settings, the floor this organization's policy tightens from. */
             environment: components["schemas"]["EffectiveOrganizationPolicyDto"];
@@ -2968,6 +2972,8 @@ interface components {
              * @enum {string|null}
              */
             mfa_after_sso?: "exempt" | "require" | null;
+            /** @description The sign-in methods this organization's members may use. A non-empty subset of the methods the Environment offers (`password` unless the Environment turned it off, `email_otp` where the Environment turned it on, and `sso`); a method the Environment does not offer is refused with `organization.policy_loosens`. `null` inherits the Environment's. While `require_sso` is on, SSO is the only method whatever this says. */
+            allowed_sign_in_methods?: ("password" | "email_otp" | "sso")[] | null;
             /** @description Members must sign in through SSO. Password and email-code logins are refused for the organization's members and for any email whose domain routes to a connection bound to this organization. */
             require_sso?: boolean;
         };
@@ -3900,10 +3906,20 @@ interface components {
                      */
                     environment_id?: string | null;
                     /**
-                     * @description Set when the change came from an accepted invitation.
+                     * Format: uuid
+                     * @description The SSO connection the identity first signed in through, for one created just in time.
+                     */
+                    connection_id?: string;
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
+                    /**
+                     * @description How the identity was created, when it was not created directly.
                      * @enum {string}
                      */
-                    source?: "invite";
+                    source?: "invite" | "sso_jit" | "scim";
                 };
             };
         };
@@ -3984,11 +4000,16 @@ interface components {
                      * @description The invitation that was accepted.
                      */
                     invite_id?: string;
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
                     /**
                      * @description How the membership was created, when known.
                      * @enum {string}
                      */
-                    source?: "identity_create" | "sso_jit" | "invite";
+                    source?: "identity_create" | "sso_jit" | "invite" | "scim";
                 };
             };
         };
@@ -4002,6 +4023,16 @@ interface components {
                 metadata: {
                     /** @description Pending invitations into the Environment revoked with the membership. */
                     revoked_pending_invites: number;
+                    /**
+                     * @description Set when directory sync made the change rather than somebody directly.
+                     * @enum {string}
+                     */
+                    source?: "scim";
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
                 };
             };
         };
@@ -4102,6 +4133,16 @@ interface components {
                     succeeded: number;
                     /** @description How many were refused. */
                     failed: number;
+                    /**
+                     * @description Set when directory sync made the change rather than somebody directly.
+                     * @enum {string}
+                     */
+                    source?: "scim";
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
                 };
             };
         };
@@ -4133,6 +4174,16 @@ interface components {
                          */
                         role_id: string;
                     }[];
+                    /**
+                     * @description Set when directory sync made the change rather than somebody directly.
+                     * @enum {string}
+                     */
+                    source?: "scim";
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
                 };
             };
         };
@@ -4167,6 +4218,250 @@ interface components {
                 };
             };
         };
+        /** @description A delivery of the `scim.user.provisioned` webhook event. */
+        WebhookScimUserProvisionedEvent: {
+            /** @enum {string} */
+            event: "scim.user.provisioned";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "identity";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory that pushed the person.
+                     */
+                    directory_id: string;
+                    /** @description The address the provider pushed. */
+                    user_name: string;
+                    /** @description The provider's own id for the person. */
+                    external_id: string | null;
+                    /** @description True when the address already had an identity, which was linked rather than created. */
+                    linked: boolean;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.user.updated` webhook event. */
+        WebhookScimUserUpdatedEvent: {
+            /** @enum {string} */
+            event: "scim.user.updated";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "identity";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory that changed the person.
+                     */
+                    directory_id: string;
+                    /** @description The address the provider holds for the person now. */
+                    user_name: string;
+                    /** @description The provider's own id for the person. */
+                    external_id: string | null;
+                    /** @description Whether the person is active in this directory. */
+                    active: boolean;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.user.deprovisioned` webhook event. */
+        WebhookScimUserDeprovisionedEvent: {
+            /** @enum {string} */
+            event: "scim.user.deprovisioned";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "identity";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory that deactivated the person.
+                     */
+                    directory_id: string;
+                    /** @description The address the provider held for the person. */
+                    user_name: string;
+                    /** @description The provider's own id for the person. */
+                    external_id: string | null;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.user.reactivated` webhook event. */
+        WebhookScimUserReactivatedEvent: {
+            /** @enum {string} */
+            event: "scim.user.reactivated";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "identity";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory that brought the person back.
+                     */
+                    directory_id: string;
+                    /** @description The address the provider holds for the person. */
+                    user_name: string;
+                    /** @description The provider's own id for the person. */
+                    external_id: string | null;
+                    /** @description True when the address already had an identity, which was linked rather than created. */
+                    linked: boolean;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.group.created` webhook event. */
+        WebhookScimGroupCreatedEvent: {
+            /** @enum {string} */
+            event: "scim.group.created";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "scim_group";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory that pushed the group.
+                     */
+                    directory_id: string;
+                    /** @description The group's name. */
+                    display_name: string;
+                    /** @description The provider's own id for the group. */
+                    external_id: string | null;
+                    /** @description How many of its members this directory holds. */
+                    member_count: number;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.group.updated` webhook event. */
+        WebhookScimGroupUpdatedEvent: {
+            /** @enum {string} */
+            event: "scim.group.updated";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "scim_group";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory that changed the group.
+                     */
+                    directory_id: string;
+                    /** @description The group's name now. */
+                    display_name: string;
+                    /** @description The provider's own id for the group. */
+                    external_id: string | null;
+                    /** @description How many of its members this directory holds now. */
+                    member_count: number;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.group.deleted` webhook event. */
+        WebhookScimGroupDeletedEvent: {
+            /** @enum {string} */
+            event: "scim.group.deleted";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "scim_group";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory that removed the group.
+                     */
+                    directory_id: string;
+                    /** @description The group's name. */
+                    display_name: string;
+                    /** @description The provider's own id for the group. */
+                    external_id: string | null;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.group.member_added` webhook event. */
+        WebhookScimGroupMemberAddedEvent: {
+            /** @enum {string} */
+            event: "scim.group.member_added";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "scim_group";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory the group belongs to.
+                     */
+                    directory_id: string;
+                    /**
+                     * Format: uuid
+                     * @description The person added.
+                     */
+                    identity_id: string;
+                    /**
+                     * Format: uuid
+                     * @description The directory's own id for the person.
+                     */
+                    directory_user_id: string;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.group.member_removed` webhook event. */
+        WebhookScimGroupMemberRemovedEvent: {
+            /** @enum {string} */
+            event: "scim.group.member_removed";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "scim_group";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory the group belongs to.
+                     */
+                    directory_id: string;
+                    /**
+                     * Format: uuid
+                     * @description The person removed.
+                     */
+                    identity_id: string;
+                    /**
+                     * Format: uuid
+                     * @description The directory's own id for the person.
+                     */
+                    directory_user_id: string;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.group.mapped` webhook event. */
+        WebhookScimGroupMappedEvent: {
+            /** @enum {string} */
+            event: "scim.group.mapped";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "scim_group";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory the group belongs to.
+                     */
+                    directory_id: string;
+                    /**
+                     * Format: uuid
+                     * @description The role the group's members now hold.
+                     */
+                    role_id: string;
+                    /**
+                     * Format: uuid
+                     * @description The node they hold it at.
+                     */
+                    application_node_id: string;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.group.unmapped` webhook event. */
+        WebhookScimGroupUnmappedEvent: {
+            /** @enum {string} */
+            event: "scim.group.unmapped";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "scim_group";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory the group belongs to.
+                     */
+                    directory_id: string;
+                };
+            };
+        };
         /** @description A delivery of the `role.created` webhook event. */
         WebhookRoleCreatedEvent: {
             /** @enum {string} */
@@ -4480,11 +4775,16 @@ interface components {
                      * @description The invitation that was accepted.
                      */
                     invite_id?: string;
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
                     /**
                      * @description How the member joined, when it was not added directly.
                      * @enum {string}
                      */
-                    source?: "sso_jit" | "invite";
+                    source?: "sso_jit" | "invite" | "scim";
                 };
             };
         };
@@ -4513,6 +4813,16 @@ interface components {
                      * @description The role it holds now.
                      */
                     to_role_id: string;
+                    /**
+                     * @description Set when directory sync made the change rather than somebody directly.
+                     * @enum {string}
+                     */
+                    source?: "scim";
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
                 };
             };
         };
@@ -4538,6 +4848,16 @@ interface components {
                     role_id: string;
                     /** @description Grants it held beneath the organization, removed with the membership. */
                     scoped_assignments_removed: number;
+                    /**
+                     * @description Set when directory sync made the change rather than somebody directly.
+                     * @enum {string}
+                     */
+                    source?: "scim";
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
                 };
             };
         };
@@ -4560,6 +4880,8 @@ interface components {
                      * @enum {string|null}
                      */
                     mfa_after_sso: "exempt" | "require" | null;
+                    /** @description The sign-in methods members may use, or null to inherit the Environment's. */
+                    allowed_sign_in_methods: ("password" | "email_otp" | "sso")[] | null;
                     /** @description Whether members must sign in with SSO. */
                     require_sso: boolean;
                 };

package/dist/index.d.ts

@@ -2935,6 +2935,8 @@ interface components {
             mfa_factor_allowlist: ("totp" | "webauthn" | "email_otp")[];
             /** @enum {string} */
             mfa_after_sso: "exempt" | "require";
+            /** @description The sign-in methods on offer: on the Environment, the ones it has turned on; on the effective policy, those narrowed by the organization, and `["sso"]` alone while it requires SSO. */
+            allowed_sign_in_methods: ("password" | "email_otp" | "sso")[];
             require_sso: boolean;
         };
         OrganizationPolicyResponseDto: {
@@ -2944,6 +2946,8 @@ interface components {
             mfa_factor_allowlist?: ("totp" | "webauthn" | "email_otp")[] | null;
             /** @enum {string|null} */
             mfa_after_sso?: "exempt" | "require" | null;
+            /** @description The methods the organization keeps of the Environment's, or null to inherit them all. */
+            allowed_sign_in_methods?: ("password" | "email_otp" | "sso")[] | null;
             require_sso: boolean;
             /** @description The Environment's own settings, the floor this organization's policy tightens from. */
             environment: components["schemas"]["EffectiveOrganizationPolicyDto"];
@@ -2968,6 +2972,8 @@ interface components {
              * @enum {string|null}
              */
             mfa_after_sso?: "exempt" | "require" | null;
+            /** @description The sign-in methods this organization's members may use. A non-empty subset of the methods the Environment offers (`password` unless the Environment turned it off, `email_otp` where the Environment turned it on, and `sso`); a method the Environment does not offer is refused with `organization.policy_loosens`. `null` inherits the Environment's. While `require_sso` is on, SSO is the only method whatever this says. */
+            allowed_sign_in_methods?: ("password" | "email_otp" | "sso")[] | null;
             /** @description Members must sign in through SSO. Password and email-code logins are refused for the organization's members and for any email whose domain routes to a connection bound to this organization. */
             require_sso?: boolean;
         };
@@ -3900,10 +3906,20 @@ interface components {
                      */
                     environment_id?: string | null;
                     /**
-                     * @description Set when the change came from an accepted invitation.
+                     * Format: uuid
+                     * @description The SSO connection the identity first signed in through, for one created just in time.
+                     */
+                    connection_id?: string;
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
+                    /**
+                     * @description How the identity was created, when it was not created directly.
                      * @enum {string}
                      */
-                    source?: "invite";
+                    source?: "invite" | "sso_jit" | "scim";
                 };
             };
         };
@@ -3984,11 +4000,16 @@ interface components {
                      * @description The invitation that was accepted.
                      */
                     invite_id?: string;
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
                     /**
                      * @description How the membership was created, when known.
                      * @enum {string}
                      */
-                    source?: "identity_create" | "sso_jit" | "invite";
+                    source?: "identity_create" | "sso_jit" | "invite" | "scim";
                 };
             };
         };
@@ -4002,6 +4023,16 @@ interface components {
                 metadata: {
                     /** @description Pending invitations into the Environment revoked with the membership. */
                     revoked_pending_invites: number;
+                    /**
+                     * @description Set when directory sync made the change rather than somebody directly.
+                     * @enum {string}
+                     */
+                    source?: "scim";
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
                 };
             };
         };
@@ -4102,6 +4133,16 @@ interface components {
                     succeeded: number;
                     /** @description How many were refused. */
                     failed: number;
+                    /**
+                     * @description Set when directory sync made the change rather than somebody directly.
+                     * @enum {string}
+                     */
+                    source?: "scim";
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
                 };
             };
         };
@@ -4133,6 +4174,16 @@ interface components {
                          */
                         role_id: string;
                     }[];
+                    /**
+                     * @description Set when directory sync made the change rather than somebody directly.
+                     * @enum {string}
+                     */
+                    source?: "scim";
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
                 };
             };
         };
@@ -4167,6 +4218,250 @@ interface components {
                 };
             };
         };
+        /** @description A delivery of the `scim.user.provisioned` webhook event. */
+        WebhookScimUserProvisionedEvent: {
+            /** @enum {string} */
+            event: "scim.user.provisioned";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "identity";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory that pushed the person.
+                     */
+                    directory_id: string;
+                    /** @description The address the provider pushed. */
+                    user_name: string;
+                    /** @description The provider's own id for the person. */
+                    external_id: string | null;
+                    /** @description True when the address already had an identity, which was linked rather than created. */
+                    linked: boolean;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.user.updated` webhook event. */
+        WebhookScimUserUpdatedEvent: {
+            /** @enum {string} */
+            event: "scim.user.updated";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "identity";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory that changed the person.
+                     */
+                    directory_id: string;
+                    /** @description The address the provider holds for the person now. */
+                    user_name: string;
+                    /** @description The provider's own id for the person. */
+                    external_id: string | null;
+                    /** @description Whether the person is active in this directory. */
+                    active: boolean;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.user.deprovisioned` webhook event. */
+        WebhookScimUserDeprovisionedEvent: {
+            /** @enum {string} */
+            event: "scim.user.deprovisioned";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "identity";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory that deactivated the person.
+                     */
+                    directory_id: string;
+                    /** @description The address the provider held for the person. */
+                    user_name: string;
+                    /** @description The provider's own id for the person. */
+                    external_id: string | null;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.user.reactivated` webhook event. */
+        WebhookScimUserReactivatedEvent: {
+            /** @enum {string} */
+            event: "scim.user.reactivated";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "identity";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory that brought the person back.
+                     */
+                    directory_id: string;
+                    /** @description The address the provider holds for the person. */
+                    user_name: string;
+                    /** @description The provider's own id for the person. */
+                    external_id: string | null;
+                    /** @description True when the address already had an identity, which was linked rather than created. */
+                    linked: boolean;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.group.created` webhook event. */
+        WebhookScimGroupCreatedEvent: {
+            /** @enum {string} */
+            event: "scim.group.created";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "scim_group";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory that pushed the group.
+                     */
+                    directory_id: string;
+                    /** @description The group's name. */
+                    display_name: string;
+                    /** @description The provider's own id for the group. */
+                    external_id: string | null;
+                    /** @description How many of its members this directory holds. */
+                    member_count: number;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.group.updated` webhook event. */
+        WebhookScimGroupUpdatedEvent: {
+            /** @enum {string} */
+            event: "scim.group.updated";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "scim_group";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory that changed the group.
+                     */
+                    directory_id: string;
+                    /** @description The group's name now. */
+                    display_name: string;
+                    /** @description The provider's own id for the group. */
+                    external_id: string | null;
+                    /** @description How many of its members this directory holds now. */
+                    member_count: number;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.group.deleted` webhook event. */
+        WebhookScimGroupDeletedEvent: {
+            /** @enum {string} */
+            event: "scim.group.deleted";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "scim_group";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory that removed the group.
+                     */
+                    directory_id: string;
+                    /** @description The group's name. */
+                    display_name: string;
+                    /** @description The provider's own id for the group. */
+                    external_id: string | null;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.group.member_added` webhook event. */
+        WebhookScimGroupMemberAddedEvent: {
+            /** @enum {string} */
+            event: "scim.group.member_added";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "scim_group";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory the group belongs to.
+                     */
+                    directory_id: string;
+                    /**
+                     * Format: uuid
+                     * @description The person added.
+                     */
+                    identity_id: string;
+                    /**
+                     * Format: uuid
+                     * @description The directory's own id for the person.
+                     */
+                    directory_user_id: string;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.group.member_removed` webhook event. */
+        WebhookScimGroupMemberRemovedEvent: {
+            /** @enum {string} */
+            event: "scim.group.member_removed";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "scim_group";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory the group belongs to.
+                     */
+                    directory_id: string;
+                    /**
+                     * Format: uuid
+                     * @description The person removed.
+                     */
+                    identity_id: string;
+                    /**
+                     * Format: uuid
+                     * @description The directory's own id for the person.
+                     */
+                    directory_user_id: string;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.group.mapped` webhook event. */
+        WebhookScimGroupMappedEvent: {
+            /** @enum {string} */
+            event: "scim.group.mapped";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "scim_group";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory the group belongs to.
+                     */
+                    directory_id: string;
+                    /**
+                     * Format: uuid
+                     * @description The role the group's members now hold.
+                     */
+                    role_id: string;
+                    /**
+                     * Format: uuid
+                     * @description The node they hold it at.
+                     */
+                    application_node_id: string;
+                };
+            };
+        };
+        /** @description A delivery of the `scim.group.unmapped` webhook event. */
+        WebhookScimGroupUnmappedEvent: {
+            /** @enum {string} */
+            event: "scim.group.unmapped";
+            data: components["schemas"]["ChangeEventDataDto"] & {
+                /** @enum {string} */
+                resource_type: "scim_group";
+                metadata: {
+                    /**
+                     * Format: uuid
+                     * @description The directory the group belongs to.
+                     */
+                    directory_id: string;
+                };
+            };
+        };
         /** @description A delivery of the `role.created` webhook event. */
         WebhookRoleCreatedEvent: {
             /** @enum {string} */
@@ -4480,11 +4775,16 @@ interface components {
                      * @description The invitation that was accepted.
                      */
                     invite_id?: string;
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
                     /**
                      * @description How the member joined, when it was not added directly.
                      * @enum {string}
                      */
-                    source?: "sso_jit" | "invite";
+                    source?: "sso_jit" | "invite" | "scim";
                 };
             };
         };
@@ -4513,6 +4813,16 @@ interface components {
                      * @description The role it holds now.
                      */
                     to_role_id: string;
+                    /**
+                     * @description Set when directory sync made the change rather than somebody directly.
+                     * @enum {string}
+                     */
+                    source?: "scim";
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
                 };
             };
         };
@@ -4538,6 +4848,16 @@ interface components {
                     role_id: string;
                     /** @description Grants it held beneath the organization, removed with the membership. */
                     scoped_assignments_removed: number;
+                    /**
+                     * @description Set when directory sync made the change rather than somebody directly.
+                     * @enum {string}
+                     */
+                    source?: "scim";
+                    /**
+                     * Format: uuid
+                     * @description The directory that made the change, when directory sync did.
+                     */
+                    directory_id?: string | null;
                 };
             };
         };
@@ -4560,6 +4880,8 @@ interface components {
                      * @enum {string|null}
                      */
                     mfa_after_sso: "exempt" | "require" | null;
+                    /** @description The sign-in methods members may use, or null to inherit the Environment's. */
+                    allowed_sign_in_methods: ("password" | "email_otp" | "sso")[] | null;
                     /** @description Whether members must sign in with SSO. */
                     require_sso: boolean;
                 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canopy-io/node",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "description": "Official TypeScript SDK for Canopy — hierarchical identity and access management.",
   "license": "MIT",
   "author": "Canopy Identity Inc.",