@canopy-io/node 0.5.0 → 0.7.0

package/dist/index.d.cts

@@ -514,7 +514,7 @@ interface paths {
         head?: never;
         /**
          * Update an identity
-         * @description Updates an identity's mutable profile fields (`first_name`, `last_name`, `is_active`, `metadata`) in the current Environment. `email` and `external_id` are immutable here — `external_id` is owned by the SSO/SCIM provisioning path and cannot be re-pointed through this endpoint. Returns the updated identity and writes an `identity.updated` audit row for the profile fields; a change to `is_active` writes `identity.status_set` instead, the account-wide activation switch. Returns `404` when the identity has no membership in this Environment.
+         * @description Updates an identity's mutable profile fields (`first_name`, `last_name`, `metadata`) in the current Environment. `email` and `external_id` are immutable here — `external_id` is owned by the SSO/SCIM provisioning path and cannot be re-pointed through this endpoint. The account-wide `is_active` switch is not settable from an Environment; to cut off access here, remove the identity from the Environment. Returns the updated identity and writes an `identity.updated` audit row. Returns `404` when the identity has no membership in this Environment.
          */
         patch: operations["ApiIdentitiesController_updateIdentity"];
         trace?: never;
@@ -539,46 +539,6 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/api/v1/identities/{id}/activate": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Activate an identity
-         * @description Reactivates an identity by setting `is_active = true`, the account-wide switch, allowing it to authenticate again in every Environment it belongs to. Writes an `identity.status_set` audit row (the same event the Console's account route emits), delivered to the account's subscriptions and to those of every Environment the identity is a member of. Returns a `200` message envelope. Returns `404` when the identity has no membership in this Environment.
-         */
-        post: operations["ApiIdentitiesController_activateIdentity"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/v1/identities/{id}/deactivate": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Deactivate an identity
-         * @description Deactivates an identity by setting `is_active = false`, the account-wide switch, blocking future sign-in in every Environment it belongs to. Writes an `identity.status_set` audit row (the same event the Console's account route emits), delivered to the account's subscriptions and to those of every Environment the identity is a member of. Returns a `200` message envelope. Returns `404` when the identity has no membership in this Environment.
-         */
-        post: operations["ApiIdentitiesController_deactivateIdentity"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/api/v1/identities/{id}/password": {
         parameters: {
             query?: never;
@@ -834,7 +794,7 @@ interface paths {
         put?: never;
         /**
          * Create an invite
-         * @description Creates a single identity invite in the active Environment and returns it along with a tokenized `accept_url`. The effective intent is derived server-side from existing identity state — a net-new email becomes `activate`, an existing identity without active access becomes `add_to_app`, and `password_reset` is honored only for an existing identity. An optional `role_id` + `node_id` pair (both or neither) seeds an initial role assignment applied at acceptance. Invites expire after 7 days; the email is sent unless `send_email: false`, in which case the caller delivers `accept_url` itself. A duplicate pending invite for the same recipient returns `409`.
+         * @description Creates a single identity invite in the active Environment and returns it along with a tokenized `accept_url`. The effective intent is derived server-side from existing identity state — a net-new email becomes `activate`, an existing identity without active access becomes `add_to_app`, and `password_reset` is honored only for an existing identity. An optional `role_id` + `node_id` pair (both or neither) seeds an initial role assignment applied at acceptance. Invites expire after 7 days, or 24 hours for `password_reset`; the email is sent unless `send_email: false`, in which case the caller delivers `accept_url` itself. A duplicate pending invite for the same recipient returns `409`.
          */
         post: operations["ApiIdentityInvitesController_createInvite"];
         delete?: never;
@@ -894,7 +854,7 @@ interface paths {
         put?: never;
         /**
          * Resend an invite
-         * @description Resends the email for a `pending` invite in the active Environment, generating a fresh token, invalidating the previous one, and resetting the 7-day expiry. Returns the new tokenized `accept_url`. Subject to a 5-minute cooldown between resends. Returns `404` when the invite is not found and `400` when it is not in `pending` status or the cooldown has not elapsed.
+         * @description Resends the email for a `pending` invite in the active Environment, generating a fresh token, invalidating the previous one, and resetting the expiry (7 days, or 24 hours for `password_reset`). Returns the new tokenized `accept_url`. Subject to a 5-minute cooldown between resends. Returns `404` when the invite is not found and `400` when it is not in `pending` status or the cooldown has not elapsed.
          */
         post: operations["ApiIdentityInvitesController_resendInvite"];
         delete?: never;
@@ -1355,7 +1315,7 @@ interface paths {
         post?: never;
         /**
          * Unbind an SSO connection from an organization
-         * @description Removes the binding; logins through the connection fall back to the Environment's placement. Existing memberships are untouched. Returns `404` when the connection is not bound to this organization. Requires the `hierarchy.manage` permission at the organization and emits `organization.sso_connection.unbound`.
+         * @description Removes the binding; logins through the connection fall back to the Environment's placement. Existing memberships are untouched. Returns `404` when the connection is not bound to this organization, and `409` (`organization.sso_connection_owned_cannot_unbind`) when the organization set the connection up itself: an owned connection stays with its organization, so disable or delete it instead. Requires the `hierarchy.manage` permission at the organization and emits `organization.sso_connection.unbound`.
          */
         delete: operations["ApiOrganizationsController_unbindSsoConnection"];
         options?: never;
@@ -1748,7 +1708,7 @@ interface paths {
         };
         /**
          * Recent directory-sync activity for an organization
-         * @description The organization's own provisioning events, newest first
+         * @description The organization's own directory events (provisioning, group mapping, and changes to its connection, tokens and allowed roles), newest first
          */
         get: operations["ApiOrganizationDirectoryController_activity"];
         put?: never;
@@ -1874,7 +1834,7 @@ interface paths {
         head?: never;
         /**
          * Update a role
-         * @description Updates a role's `name`, `description`, and/or `is_active` flag by `id`. A name that collides with another role in the Environment returns `409`, and a missing role returns `404`. Supports optimistic concurrency via the `If-Match` header carrying the role's current version (`409` on a version mismatch). Requires the `rbac.manage_roles` permission.
+         * @description Updates a role's `name`, `description`, and/or `is_active` flag by `id`. Setting `is_active` to `false` hides the role from pickers, refuses new assignments to it, and withholds its permissions from every current holder until it is set back to `true`; the assignments themselves are kept. A name that collides with another role in the Environment returns `409`, and a missing role returns `404`. Supports optimistic concurrency via the `If-Match` header carrying the role's current version (`409` on a version mismatch). Requires the `rbac.manage_roles` permission.
          */
         patch: operations["ApiRolesController_updateRole"];
         trace?: never;
@@ -2295,6 +2255,98 @@ interface paths {
         patch: operations["ApiWebhooksController_update"];
         trace?: never;
     };
+    "/api/v1/oauth-clients": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List OAuth clients for Application
+         * @description Returns a paginated list of the OAuth clients registered in the current Environment, newest first by default. Supports `q` to filter by client name and the standard sort/pagination query options. Client secrets are never included.
+         */
+        get: operations["ApiOAuthClientsController_list"];
+        put?: never;
+        /**
+         * Register a new OAuth client
+         * @description Registers a new confidential OAuth client in the current Environment with the given `name`, `redirect_uris`, and optional `scopes` (defaulting to `openid profile email`). Generates the `client_id` and a `client_secret` that is bcrypt-hashed at rest; the raw secret is returned in this response only and is never retrievable again. Responds `201 Created`.
+         */
+        post: operations["ApiOAuthClientsController_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/oauth-clients/summary": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Active/inactive OAuth client counts for the environment
+         * @description Returns Environment-wide active and inactive OAuth client counts (not just the current page), optionally narrowed by the same `q` name filter the list endpoint uses. Drives the client stat card.
+         */
+        get: operations["ApiOAuthClientsController_summary"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/oauth-clients/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get OAuth client details
+         * @description Returns a single OAuth client by `id`, scoped to the current Environment — a client that exists in a sibling Environment reads as `404`. The `client_secret` is never included.
+         */
+        get: operations["ApiOAuthClientsController_get"];
+        put?: never;
+        post?: never;
+        /**
+         * Delete OAuth client
+         * @description Deletes an OAuth client from the current Environment by `id`. Responds `204 No Content` on success, or `404` when the client is not found in this Environment.
+         */
+        delete: operations["ApiOAuthClientsController_remove"];
+        options?: never;
+        head?: never;
+        /**
+         * Update OAuth client
+         * @description Updates an OAuth client's mutable fields (`name`, `redirect_uris`, `post_logout_redirect_uris`, `backchannel_logout_uri`, `scopes`, `is_active`, `invite_redirect_url`, `initiate_login_uri`), scoped to the current Environment. Returns the updated client, or `404` when the client is not found in this Environment. The secret is not rotated here.
+         */
+        patch: operations["ApiOAuthClientsController_update"];
+        trace?: never;
+    };
+    "/api/v1/oauth-clients/{id}/rotate-secret": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Rotate an OAuth client's secret
+         * @description Rotates the OAuth client's `client_secret`, generating and hashing a new secret and invalidating the old one. The new raw secret is returned in this response only and cannot be retrieved again. Returns `404` when the client is not found in the current Environment.
+         */
+        post: operations["ApiOAuthClientsController_rotateSecret"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/api-keys": {
         parameters: {
             query?: never;
@@ -2430,6 +2482,7 @@ interface components {
             scope_evaluated: "node" | "app_wide";
             /** @description The hierarchy node the decision was anchored to. Always set for `scope_evaluated: "node"`; always null for `scope_evaluated: "app_wide"` because the answer is org-scoped, not node-scoped. */
             effective_node_id?: string | null;
+            /** @description Ids of the roles whose assignments produced a node-scoped allow. Always empty for `scope_evaluated: "app_wide"`, whose answer is not tied to a node, and for a deny. */
             granting_roles: string[];
             denial_reason?: string | null;
         };
@@ -2464,7 +2517,7 @@ interface components {
             assignment_id: string;
             role_id: string;
             role_name: string;
-            /** @description Whether the assignment is within its effective_from/effective_to window right now. */
+            /** @description Whether the assignment counts right now: within its effective_from/effective_to window, and its role is active. An inactive role's assignments are kept but grant nothing. */
             active: boolean;
             effective_from?: string | null;
             effective_to?: string | null;
@@ -2560,11 +2613,13 @@ interface components {
             email: string;
             first_name: string;
             last_name: string;
-            /** @description Initial password. 8-64 characters. No composition rules — NIST SP 800-63B aligned. A HaveIBeenPwned breach check runs server-side. The effective policy is published on `GET /v1/identity/auth/config`, so a client can state the rules before submit rather than after. Omit to create a passwordless identity (sign-in via SSO/social or forgot-password reset). */
+            /** @description Initial password. 8-64 characters. No composition rules — NIST SP 800-63B aligned. A HaveIBeenPwned breach check runs server-side. The effective policy is published on `GET /v1/identity/auth/config`, so a client can state the rules before submit rather than after. Omit to create a passwordless identity (sign-in via SSO or a password reset). */
             password?: string;
             external_id?: string;
             metadata?: Record<string, unknown>;
+            /** @description Role for an initial assignment — required if node_id is provided */
             role_id?: string;
+            /** @description Node for an initial assignment — required if role_id is provided */
             node_id?: string;
         };
         BulkCreateIdentitiesDto: {
@@ -2588,13 +2643,9 @@ interface components {
             /** Format: date-time */
             updated_at: string;
         };
-        MessageResponseDto: {
-            message: string;
-        };
         UpdateIdentityDto: {
             first_name?: string;
             last_name?: string;
-            is_active?: boolean;
             metadata?: Record<string, unknown> | null;
         };
         SetIdentityPasswordDto: {
@@ -2653,7 +2704,7 @@ interface components {
             email_verified: boolean;
             /** Format: date-time */
             email_verified_at?: string | null;
-            /** @description Whether the identity has a usable password. False for passwordless (SSO/social/code-only) identities. */
+            /** @description Whether the identity has a usable password. False for passwordless (SSO or email-code-only) identities. */
             password_set: boolean;
             /** @description True while the identity is in an active failed-login lockout window. */
             locked: boolean;
@@ -2706,10 +2757,6 @@ interface components {
             name: string;
             role_id?: string | null;
             node_id?: string | null;
-            /** @description Environment the invite targets, or null for a directory-only (account-tier) invite created with the Environment field left empty. */
-            environment_id?: string | null;
-            /** @description Display name of the target Environment, or null for a directory-only invite. */
-            environment_name?: string | null;
             has_initial_assignment: boolean;
             /** @enum {string} */
             status: "pending" | "accepted" | "revoked" | "expired";
@@ -2741,10 +2788,6 @@ interface components {
             name: string;
             role_id?: string | null;
             node_id?: string | null;
-            /** @description Environment the invite targets, or null for a directory-only (account-tier) invite created with the Environment field left empty. */
-            environment_id?: string | null;
-            /** @description Display name of the target Environment, or null for a directory-only invite. */
-            environment_name?: string | null;
             has_initial_assignment: boolean;
             /** @enum {string} */
             status: "pending" | "accepted" | "revoked" | "expired";
@@ -3106,6 +3149,8 @@ interface components {
             /** @enum {string} */
             type: "saml" | "oidc";
             status: string;
+            /** @description The organization that set the connection up from the organization portal, or null. A connection owned by this organization cannot be unbound from it. */
+            owner_organization_node_id?: string | null;
         };
         OrganizationSsoRoleSummaryDto: {
             id: string;
@@ -3228,7 +3273,11 @@ interface components {
             type: "saml" | "oidc";
             name: string;
             /** @enum {string} */
-            status: "configuring" | "active" | "disabled" | "failed";
+            status: "configuring" | "active" | "disabled";
+            /** @description The organization that owns the connection, when its administrator set it up from the organization portal; null for a connection the developer created. An owned connection cannot be moved to another organization or Environment, and its administrators are emailed when the developer changes its provider settings, disables or deletes it. */
+            owner_organization_node_id?: string | null;
+            /** @description True when an organization's administrator set the connection up from the organization portal. */
+            owned_by_organization: boolean;
             /** @description The HTTPS address the identity provider's SAML metadata was last imported from. `null` when the metadata was pasted as a document or never imported. */
             saml_metadata_url?: string | null;
             /** @description The last test sign-in run against the connection. Cleared when its provider settings change, since a test no longer proves them. */
@@ -3253,11 +3302,6 @@ interface components {
             /** Format: date-time */
             last_login_at?: string | null;
             /** Format: date-time */
-            last_login_failure_at?: string | null;
-            consecutive_failures: number;
-            /** Format: date-time */
-            auto_disabled_at?: string | null;
-            /** Format: date-time */
             created_at: string;
             /** Format: date-time */
             updated_at: string;
@@ -3311,6 +3355,7 @@ interface components {
             saml_name_id_format?: string;
             /** @description Force the IdP to re-authenticate the user on every login (SAML ForceAuthn / OIDC max_age=0). Prevents silent reuse of a stale IdP session on shared devices. */
             force_authn?: boolean;
+            /** @description The identity provider's OIDC discovery document. Canopy's servers fetch it, so it must be an `https` address on a public host; private, loopback and link-local addresses are refused. */
             oidc_discovery_url?: string;
             oidc_client_id?: string;
             /** @description OIDC client secret (plaintext in; encrypted at rest). */
@@ -3336,6 +3381,7 @@ interface components {
             saml_name_id_format?: string;
             /** @description Force the IdP to re-authenticate the user on every login (SAML ForceAuthn / OIDC max_age=0). Prevents silent reuse of a stale IdP session on shared devices. */
             force_authn?: boolean;
+            /** @description The identity provider's OIDC discovery document. Canopy's servers fetch it, so it must be an `https` address on a public host; private, loopback and link-local addresses are refused. */
             oidc_discovery_url?: string;
             oidc_client_id?: string;
             /** @description OIDC client secret (plaintext in; encrypted at rest). */
@@ -3491,9 +3537,12 @@ interface components {
             name?: string;
             /** @description Updated role description */
             description?: string | null;
-            /** @description Whether the role is active */
+            /** @description Whether the role is active. An inactive role is hidden from pickers, cannot be newly assigned, and grants nothing to its current holders until it is reactivated; their assignments are kept. */
             is_active?: boolean;
         };
+        MessageResponseDto: {
+            message: string;
+        };
         SetRolePermissionsDto: {
             permission_keys: string[];
         };
@@ -3736,7 +3785,7 @@ interface components {
             /** @description Allowed node types (e.g. ['region', 'district', 'team']). Order is informational, not structural — parent/child rules are governed by `allowed_children`. Names starting with `canopy:` are reserved; with organizations enabled the list starts with `canopy:organization`. */
             node_types: string[];
             /**
-             * @description Map from node type to allowed child node types. Empty array means leaf-only.
+             * @description Map from node type to allowed child node types. An empty array makes that type a leaf: nothing may be created or moved beneath it. A type the map does not mention accepts any child.
              * @example {
              *       "region": [
              *         "district"
@@ -3795,7 +3844,7 @@ interface components {
         UpdateEnvironmentBrandingDto: {
             /** @description The product name hosted pages and the organization admin portal show: in the browser tab title, beside the logo when `logo_kind` is `icon`, as a full logo's alt text, and in place of a logo when none is set. Null clears it, and the pages then show no name. */
             product_name?: string | null;
-            /** @description Absolute https URL of the logo shown at the top of hosted pages and the portal. Null clears it. */
+            /** @description Absolute https URL of the logo shown at the top of hosted pages, the portal and emails to the Environment's users. Emails show it only when the image is a PNG, JPEG or GIF, which every email client displays; with any other format they show the product name. Null clears it. */
             logo_url?: string | null;
             /**
              * @description What the logo image is. `full`: a complete logo that already carries the product name, shown alone. `icon`: a square mark, shown at icon size with the product name beside it. Null returns to `full`.
@@ -3896,6 +3945,90 @@ interface components {
             description?: string | null;
             is_active?: boolean;
         };
+        OAuthClientCreatedResponseDto: {
+            id: string;
+            client_id: string;
+            name: string;
+            redirect_uris: string[];
+            /** @description Where this client may send someone after RP-initiated logout, matched exactly. */
+            post_logout_redirect_uris: string[];
+            grant_types: string[];
+            scopes: string[];
+            /** @description Where Canopy delivers a logout token when a session ends. Null means the client is told nothing. */
+            backchannel_logout_uri?: string | null;
+            invite_redirect_url?: string | null;
+            /** @description The route in the client's application that starts a sign-in (OpenID Connect `initiate_login_uri`), offered as **Sign in** on hosted pages that end with nothing to return to. */
+            initiate_login_uri?: string | null;
+            is_active: boolean;
+            /** Format: date-time */
+            created_at: string;
+            /**
+             * @description The issuer this client's tokens name, which a relying party configures: `https://<custom auth domain>` while the Environment has an active one, else the platform's. Its discovery document is at `<issuer>/.well-known/openid-configuration`.
+             * @example https://auth.yourapp.com
+             */
+            issuer: string;
+            /** @description Client secret — shown only once */
+            client_secret: string;
+        };
+        CreateOAuthClientDto: {
+            name: string;
+            redirect_uris: string[];
+            /** @description Where this client may send someone after RP-initiated logout. Matched exactly, and separate from `redirect_uris`: receiving an authorization code and being a landing page after sign-out are different kinds of trust. */
+            post_logout_redirect_uris?: string[];
+            scopes?: string[];
+            /** @description Where Canopy delivers a signed logout token, server to server, when a session this client issued tokens for ends. Omit it and the client is told nothing. */
+            backchannel_logout_uri?: string;
+            invite_redirect_url?: string;
+            /** @description The route in your application that starts a sign-in (OpenID Connect `initiate_login_uri`): it should send the person to Canopy's `/oauth/authorize`. Canopy's hosted pages that end with nothing to return to, such as an accepted invitation or a verified email, offer it as **Sign in**. Absolute `http` or `https` URL. */
+            initiate_login_uri?: string;
+        };
+        OAuthClientResponseDto: {
+            id: string;
+            client_id: string;
+            name: string;
+            redirect_uris: string[];
+            /** @description Where this client may send someone after RP-initiated logout, matched exactly. */
+            post_logout_redirect_uris: string[];
+            grant_types: string[];
+            scopes: string[];
+            /** @description Where Canopy delivers a logout token when a session ends. Null means the client is told nothing. */
+            backchannel_logout_uri?: string | null;
+            invite_redirect_url?: string | null;
+            /** @description The route in the client's application that starts a sign-in (OpenID Connect `initiate_login_uri`), offered as **Sign in** on hosted pages that end with nothing to return to. */
+            initiate_login_uri?: string | null;
+            is_active: boolean;
+            /** Format: date-time */
+            created_at: string;
+            /**
+             * @description The issuer this client's tokens name, which a relying party configures: `https://<custom auth domain>` while the Environment has an active one, else the platform's. Its discovery document is at `<issuer>/.well-known/openid-configuration`.
+             * @example https://auth.yourapp.com
+             */
+            issuer: string;
+        };
+        ActiveSummaryDto: {
+            /** @description Active items in the environment */
+            active_count: number;
+            /** @description Inactive items in the environment */
+            inactive_count: number;
+        };
+        UpdateOAuthClientDto: {
+            name?: string;
+            redirect_uris?: string[];
+            /** @description Where this client may send someone after RP-initiated logout. Matched exactly. An empty array removes every destination, which leaves logout working with nowhere to return to. */
+            post_logout_redirect_uris?: string[];
+            scopes?: string[];
+            is_active?: boolean;
+            /** @description Where Canopy delivers a signed logout token when a session this client issued tokens for ends. `null` stops the notifications. */
+            backchannel_logout_uri?: string | null;
+            invite_redirect_url?: string | null;
+            /** @description The route in your application that starts a sign-in (OpenID Connect `initiate_login_uri`): it should send the person to Canopy's `/oauth/authorize`. Canopy's hosted pages that end with nothing to return to, such as an accepted invitation or a verified email, offer it as **Sign in**. Absolute `http` or `https` URL; `null` clears it. */
+            initiate_login_uri?: string | null;
+        };
+        OAuthClientSecretRotatedResponseDto: {
+            client_id: string;
+            /** @description New client secret — shown only once */
+            client_secret: string;
+        };
         ApiKeyCreatedResponseDto: {
             id: string;
             name: string;
@@ -3925,7 +4058,7 @@ interface components {
              */
             access_mode: "scoped" | "full_access";
             /** @description Permission scopes this key is authorized for, each one the platform offers (`GET .../api-keys/scopes`). Required and must be non-empty when `access_mode` is `scoped`. Must be omitted when `access_mode` is `full_access`. */
-            scopes?: ("hierarchy.view" | "hierarchy.manage" | "rbac.view_roles" | "rbac.manage_roles" | "rbac.view_assignments" | "rbac.manage_assignments" | "permissions.evaluate" | "identity.view" | "identity.manage" | "api_key.view" | "api_key.manage" | "webhook.view" | "webhook.manage")[];
+            scopes?: ("hierarchy.view" | "hierarchy.manage" | "rbac.view_roles" | "rbac.manage_roles" | "rbac.view_assignments" | "rbac.manage_assignments" | "permissions.evaluate" | "identity.view" | "identity.manage" | "api_key.view" | "api_key.manage" | "webhook.view" | "webhook.manage" | "oauth_client.view" | "oauth_client.manage")[];
             /** @description Expiration date (ISO 8601). Omit for no expiration. */
             expires_at?: string;
         };
@@ -3985,6 +4118,11 @@ interface components {
              * @example GET
              */
             method: string;
+            /**
+             * @description The request's correlation id, the same value as the `X-Correlation-Id` response header. Quote it to support: it finds this exact request in Canopy's logs and error reports.
+             * @example 6d7f2c8e-2f0b-4d0f-9b0e-2b0b2b0b2b0b
+             */
+            correlation_id: string | null;
             /**
              * @description Field-level validation messages, present only on 400 responses from request-body validation.
              * @example [
@@ -6687,6 +6825,27 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description The `Idempotency-Key` was already used by this caller for a request with a different method, path or body. A replay must repeat the original request exactly; a new request takes a new key. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 422,
+                     *         "code": null,
+                     *         "message": "The `Idempotency-Key` was already used by this caller for a request with a different method, path or body. A replay must repeat the original request exactly; a new request takes a new key.",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/identities/bulk-create",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     ApiIdentitiesController_getIdentity: {
@@ -7121,7 +7280,7 @@ interface operations {
             };
         };
     };
-    ApiIdentitiesController_activateIdentity: {
+    ApiIdentitiesController_setIdentityPassword: {
         parameters: {
             query?: never;
             header?: never;
@@ -7130,20 +7289,20 @@ interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SetIdentityPasswordDto"];
+            };
+        };
         responses: {
-            /** @description Identity activated */
-            200: {
+            /** @description Password set. The identity's existing sessions are revoked and any active failed-login lockout is cleared; the new password takes effect on next sign-in. Intended for backend/admin tooling (e.g. migrating users off a legacy store). */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": {
-                        data: components["schemas"]["MessageResponseDto"];
-                    };
-                };
+                content?: never;
             };
-            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            /** @description The request failed validation, or the password appears in a known data breach (HaveIBeenPwned check); or the request sent both an `X-API-Key` and an `Authorization` header */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -7154,9 +7313,9 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 400,
                      *         "code": null,
-                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "message": "The request failed validation, or the password appears in a known data breach (HaveIBeenPwned check); or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities/{id}/activate",
+                     *         "path": "/api/v1/identities/{id}/password",
                      *         "method": "POST"
                      *       }
                      *     }
@@ -7219,7 +7378,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "Identity not found",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities/{id}/activate",
+                     *         "path": "/api/v1/identities/{id}/password",
                      *         "method": "POST"
                      *       }
                      *     }
@@ -7229,7 +7388,7 @@ interface operations {
             };
         };
     };
-    ApiIdentitiesController_deactivateIdentity: {
+    ApiIdentitiesController_forceResetIdentityPassword: {
         parameters: {
             query?: never;
             header?: never;
@@ -7240,16 +7399,12 @@ interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Identity deactivated */
-            200: {
+            /** @description A password-reset email is sent so the identity can choose a new password. The current password and existing sessions stay valid until the reset link is used (completing the reset then rotates the password and revokes sessions). For an immediate hard cut, use the revoke-sessions endpoint; to rotate the password outright, use set-password. */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": {
-                        data: components["schemas"]["MessageResponseDto"];
-                    };
-                };
+                content?: never;
             };
             /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
             400: {
@@ -7264,7 +7419,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities/{id}/deactivate",
+                     *         "path": "/api/v1/identities/{id}/password/reset",
                      *         "method": "POST"
                      *       }
                      *     }
@@ -7327,7 +7482,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "Identity not found",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities/{id}/deactivate",
+                     *         "path": "/api/v1/identities/{id}/password/reset",
                      *         "method": "POST"
                      *       }
                      *     }
@@ -7337,7 +7492,7 @@ interface operations {
             };
         };
     };
-    ApiIdentitiesController_setIdentityPassword: {
+    ApiIdentitiesController_listIdentitySessions: {
         parameters: {
             query?: never;
             header?: never;
@@ -7346,20 +7501,20 @@ interface operations {
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["SetIdentityPasswordDto"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Password set. The identity's existing sessions are revoked and any active failed-login lockout is cleared; the new password takes effect on next sign-in. Intended for backend/admin tooling (e.g. migrating users off a legacy store). */
-            204: {
+            /** @description Every session the identity holds that is neither revoked nor expired, newest first: the session's current refresh token id (what the per-session revoke takes), when it was signed in and when it expires, the browser's address and user agent, and the organization it is acting in. */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["IdentitySessionResponseDto"][];
+                    };
+                };
             };
-            /** @description The request failed validation, or the password appears in a known data breach (HaveIBeenPwned check); or the request sent both an `X-API-Key` and an `Authorization` header */
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -7370,10 +7525,10 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 400,
                      *         "code": null,
-                     *         "message": "The request failed validation, or the password appears in a known data breach (HaveIBeenPwned check); or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities/{id}/password",
-                     *         "method": "POST"
+                     *         "path": "/api/v1/identities/{id}/sessions",
+                     *         "method": "GET"
                      *       }
                      *     }
                      */
@@ -7435,8 +7590,8 @@ interface operations {
                      *         "code": null,
                      *         "message": "Identity not found",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities/{id}/password",
-                     *         "method": "POST"
+                     *         "path": "/api/v1/identities/{id}/sessions",
+                     *         "method": "GET"
                      *       }
                      *     }
                      */
@@ -7445,18 +7600,19 @@ interface operations {
             };
         };
     };
-    ApiIdentitiesController_forceResetIdentityPassword: {
+    ApiIdentitiesController_revokeIdentitySession: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 id: string;
+                sessionId: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description A password-reset email is sent so the identity can choose a new password. The current password and existing sessions stay valid until the reset link is used (completing the reset then rotates the password and revokes sessions). For an immediate hard cut, use the revoke-sessions endpoint; to rotate the password outright, use set-password. */
+            /** @description The session's refresh token is revoked, so its next refresh returns 401 while the identity's other sessions carry on. In-flight access tokens keep working until their short TTL expires. */
             204: {
                 headers: {
                     [name: string]: unknown;
@@ -7476,8 +7632,8 @@ interface operations {
                      *         "code": null,
                      *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities/{id}/password/reset",
-                     *         "method": "POST"
+                     *         "path": "/api/v1/identities/{id}/sessions/{sessionId}",
+                     *         "method": "DELETE"
                      *       }
                      *     }
                      */
@@ -7526,7 +7682,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Identity not found */
+            /** @description The identity is not found, or the session does not belong to it or is already revoked */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -7537,10 +7693,10 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 404,
                      *         "code": null,
-                     *         "message": "Identity not found",
+                     *         "message": "The identity is not found, or the session does not belong to it or is already revoked",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities/{id}/password/reset",
-                     *         "method": "POST"
+                     *         "path": "/api/v1/identities/{id}/sessions/{sessionId}",
+                     *         "method": "DELETE"
                      *       }
                      *     }
                      */
@@ -7549,7 +7705,7 @@ interface operations {
             };
         };
     };
-    ApiIdentitiesController_listIdentitySessions: {
+    ApiIdentitiesController_revokeIdentitySessions: {
         parameters: {
             query?: never;
             header?: never;
@@ -7560,16 +7716,12 @@ interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Every session the identity holds that is neither revoked nor expired, newest first: the session's current refresh token id (what the per-session revoke takes), when it was signed in and when it expires, the browser's address and user agent, and the organization it is acting in. */
-            200: {
+            /** @description Every active refresh token for the identity is revoked, so the next refresh on any device returns 401 and the user must sign in again. In-flight access tokens keep working until their short TTL expires. Use as a security-event response (e.g. suspected compromise) from backend tooling. */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": {
-                        items: components["schemas"]["IdentitySessionResponseDto"][];
-                    };
-                };
+                content?: never;
             };
             /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
             400: {
@@ -7584,217 +7736,8 @@ interface operations {
                      *         "code": null,
                      *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities/{id}/sessions",
-                     *         "method": "GET"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description Invalid or expired token */
-            401: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 401,
-                     *         "code": null,
-                     *         "message": "Invalid or expired token",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities",
-                     *         "method": "GET"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
-            403: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 403,
-                     *         "code": null,
-                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities",
-                     *         "method": "GET"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description Identity not found */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 404,
-                     *         "code": null,
-                     *         "message": "Identity not found",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities/{id}/sessions",
-                     *         "method": "GET"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-        };
-    };
-    ApiIdentitiesController_revokeIdentitySession: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                id: string;
-                sessionId: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description The session's refresh token is revoked, so its next refresh returns 401 while the identity's other sessions carry on. In-flight access tokens keep working until their short TTL expires. */
-            204: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
-            400: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 400,
-                     *         "code": null,
-                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities/{id}/sessions/{sessionId}",
-                     *         "method": "DELETE"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description Invalid or expired token */
-            401: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 401,
-                     *         "code": null,
-                     *         "message": "Invalid or expired token",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities",
-                     *         "method": "GET"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
-            403: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 403,
-                     *         "code": null,
-                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities",
-                     *         "method": "GET"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description The identity is not found, or the session does not belong to it or is already revoked */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 404,
-                     *         "code": null,
-                     *         "message": "The identity is not found, or the session does not belong to it or is already revoked",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities/{id}/sessions/{sessionId}",
-                     *         "method": "DELETE"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-        };
-    };
-    ApiIdentitiesController_revokeIdentitySessions: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                id: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Every active refresh token for the identity is revoked, so the next refresh on any device returns 401 and the user must sign in again. In-flight access tokens keep working until their short TTL expires. Use as a security-event response (e.g. suspected compromise) from backend tooling. */
-            204: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
-            400: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 400,
-                     *         "code": null,
-                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/identities/{id}/sessions/revoke",
-                     *         "method": "POST"
+                     *         "path": "/api/v1/identities/{id}/sessions/revoke",
+                     *         "method": "POST"
                      *       }
                      *     }
                      */
@@ -8635,14 +8578,12 @@ interface operations {
                 take?: number;
                 /** @description Search term */
                 q?: string;
-                /** @description Column to sort by. Allowed values depend on the endpoint. */
-                sort_by?: string;
+                /** @description Column to sort by. Defaults to `created`, newest first. */
+                sort_by?: "name" | "email" | "created";
                 /** @description Sort direction */
                 order?: "asc" | "desc";
                 /** @description Filter by invite status */
                 status?: "pending" | "accepted" | "revoked" | "expired";
-                /** @description Filter by target Environment. Pass the literal `none` to return only directory-only invites (environment_id is null). */
-                environment_id?: string;
             };
             header?: never;
             path?: never;
@@ -9065,6 +9006,27 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description The `Idempotency-Key` was already used by this caller for a request with a different method, path or body. A replay must repeat the original request exactly; a new request takes a new key. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 422,
+                     *         "code": null,
+                     *         "message": "The `Idempotency-Key` was already used by this caller for a request with a different method, path or body. A replay must repeat the original request exactly; a new request takes a new key.",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/identity-invites/bulk-create",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     ApiIdentityInvitesController_resendInvite: {
@@ -12641,6 +12603,27 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description The organization set this connection up itself; it stays bound. Disable or delete the connection instead. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "The organization set this connection up itself; it stays bound. Disable or delete the connection instead.",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/sso-connections/{connectionId}",
+                     *         "method": "DELETE"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     ApiOrganizationsController_listMembers: {
@@ -15800,7 +15783,7 @@ interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description The organization's own provisioning events, newest first */
+            /** @description The organization's own directory events (provisioning, group mapping, and changes to its connection, tokens and allowed roles), newest first */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -20010,7 +19993,7 @@ interface operations {
             };
         };
     };
-    ApiApiKeysController_list: {
+    ApiOAuthClientsController_list: {
         parameters: {
             query?: {
                 /** @description Page number (1-based) */
@@ -20037,7 +20020,7 @@ interface operations {
                 };
                 content: {
                     "application/json": {
-                        items: components["schemas"]["ApiKeyResponseDto"][];
+                        items: components["schemas"]["OAuthClientResponseDto"][];
                         pagination: components["schemas"]["PageMetaDto"];
                     };
                 };
@@ -20055,7 +20038,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/api-keys",
+                     *         "path": "/api/v1/oauth-clients",
                      *         "method": "GET"
                      *       }
                      *     }
@@ -20076,7 +20059,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "Invalid or expired token",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/api-keys",
+                     *         "path": "/api/v1/oauth-clients",
                      *         "method": "GET"
                      *       }
                      *     }
@@ -20097,7 +20080,7 @@ interface operations {
                      *         "code": null,
                      *         "message": "The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/api-keys",
+                     *         "path": "/api/v1/oauth-clients",
                      *         "method": "GET"
                      *       }
                      *     }
@@ -20107,7 +20090,7 @@ interface operations {
             };
         };
     };
-    ApiApiKeysController_create: {
+    ApiOAuthClientsController_create: {
         parameters: {
             query?: never;
             header?: never;
@@ -20116,18 +20099,744 @@ interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["CreateApiKeyDto"];
+                "application/json": components["schemas"]["CreateOAuthClientDto"];
             };
         };
         responses: {
-            /** @description API key created — key value is only shown once */
+            /** @description Client created — client_secret is only shown once */
             201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        data: components["schemas"]["ApiKeyCreatedResponseDto"];
+                        data: components["schemas"]["OAuthClientCreatedResponseDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range, `backchannel_logout_uri` names an address Canopy's servers will not call, or `initiate_login_uri` is malformed or not `https` (loopback hosts excepted); or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range, `backchannel_logout_uri` names an address Canopy's servers will not call, or `initiate_login_uri` is malformed or not `https` (loopback hosts excepted); or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The `Idempotency-Key` was already used by this caller for a request with a different method, path or body. A replay must repeat the original request exactly; a new request takes a new key. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 422,
+                     *         "code": null,
+                     *         "message": "The `Idempotency-Key` was already used by this caller for a request with a different method, path or body. A replay must repeat the original request exactly; a new request takes a new key.",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOAuthClientsController_summary: {
+        parameters: {
+            query?: {
+                q?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OAuth client active/inactive summary returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["ActiveSummaryDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients/summary",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOAuthClientsController_get: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OAuth client returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["OAuthClientResponseDto"];
+                    };
+                };
+            };
+            /** @description The request sent both an `X-API-Key` and an `Authorization` header; send one */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request sent both an `X-API-Key` and an `Authorization` header; send one",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients/{id}",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No OAuth client with that id exists in this Environment */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "No OAuth client with that id exists in this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients/{id}",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOAuthClientsController_remove: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OAuth client deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The request sent both an `X-API-Key` and an `Authorization` header; send one */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request sent both an `X-API-Key` and an `Authorization` header; send one",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients/{id}",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No OAuth client with that id exists in this Environment */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "No OAuth client with that id exists in this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients/{id}",
+                     *         "method": "DELETE"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOAuthClientsController_update: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateOAuthClientDto"];
+            };
+        };
+        responses: {
+            /** @description OAuth client updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["OAuthClientResponseDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range, `backchannel_logout_uri` names an address Canopy's servers will not call, or `initiate_login_uri` is malformed or not `https` (loopback hosts excepted); or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range, `backchannel_logout_uri` names an address Canopy's servers will not call, or `initiate_login_uri` is malformed or not `https` (loopback hosts excepted); or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients/{id}",
+                     *         "method": "PATCH"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No OAuth client with that id exists in this Environment */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "No OAuth client with that id exists in this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients/{id}",
+                     *         "method": "PATCH"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOAuthClientsController_rotateSecret: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OAuth client secret rotated — the new secret is only shown once */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["OAuthClientSecretRotatedResponseDto"];
+                    };
+                };
+            };
+            /** @description The request sent both an `X-API-Key` and an `Authorization` header; send one */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request sent both an `X-API-Key` and an `Authorization` header; send one",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients/{id}",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No OAuth client with that id exists in this Environment */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "No OAuth client with that id exists in this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/oauth-clients/{id}/rotate-secret",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiApiKeysController_list: {
+        parameters: {
+            query?: {
+                /** @description Page number (1-based) */
+                page?: number;
+                /** @description Items per page (1-100, default 20) */
+                take?: number;
+                /** @description Search term */
+                q?: string;
+                /** @description Column to sort by. Allowed values depend on the endpoint. */
+                sort_by?: string;
+                /** @description Sort direction */
+                order?: "asc" | "desc";
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Paginated list */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["ApiKeyResponseDto"][];
+                        pagination: components["schemas"]["PageMetaDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/api-keys",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/api-keys",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/api-keys",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiApiKeysController_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateApiKeyDto"];
+            };
+        };
+        responses: {
+            /** @description API key created — key value is only shown once */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["ApiKeyCreatedResponseDto"];
                     };
                 };
             };
@@ -20215,6 +20924,27 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description The `Idempotency-Key` was already used by this caller for a request with a different method, path or body. A replay must repeat the original request exactly; a new request takes a new key. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 422,
+                     *         "code": null,
+                     *         "message": "The `Idempotency-Key` was already used by this caller for a request with a different method, path or body. A replay must repeat the original request exactly; a new request takes a new key.",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/api-keys",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
             /** @description More than 20 create requests in a minute from this caller (`x-canopy-rate-limit`); retry after the window */
             429: {
                 headers: {
@@ -20694,14 +21424,14 @@ declare class Identities {
     get(id: string): Promise<ResponseBody<"ApiIdentitiesController_getIdentity">>;
     create(input: RequestBody<"ApiIdentitiesController_createIdentity">): Promise<ResponseBody<"ApiIdentitiesController_createIdentity">>;
     update(id: string, input: RequestBody<"ApiIdentitiesController_updateIdentity">): Promise<ResponseBody<"ApiIdentitiesController_updateIdentity">>;
-    delete(id: string): Promise<void>;
     /**
-     * Deactivation is the reversible counterpart to `delete` — sessions are
-     * revoked and sign-in refused, but the identity and its assignments survive.
-     * Prefer it for offboarding you may need to undo.
+     * Takes the identity out of this key's Environment: its membership here is
+     * deactivated and its role assignments here are dropped. The identity and
+     * its access to other Environments are untouched. Deactivating an identity
+     * everywhere is an Account-level action, not available to an
+     * Environment-scoped key.
      */
-    deactivate(id: string): Promise<ResponseBody<"ApiIdentitiesController_deactivateIdentity">>;
-    activate(id: string): Promise<ResponseBody<"ApiIdentitiesController_activateIdentity">>;
+    delete(id: string): Promise<void>;
     /**
      * Every role this identity holds, and where — across all pages.
      *
@@ -20739,7 +21469,7 @@ declare class Identities {
      * Ends every session the identity holds, so the next refresh on any device
      * fails and the person signs in again. Access tokens already issued keep
      * working until their short lifetime runs out. For a suspected compromise;
-     * `deactivate` also refuses the next sign-in.
+     * `delete` also takes the identity out of this Environment.
      */
     revokeSessions(id: string): Promise<void>;
 }
@@ -20991,6 +21721,12 @@ declare class Canopy {
     constructor(options: CanopyClientOptions);
 }
 
+/**
+ * The longest a held answer may be kept: five minutes. `ttlMs` is the delay
+ * between an access change and it taking effect, and Canopy promises that
+ * delay is short, so a longer value is refused rather than honoured.
+ */
+declare const MAX_TTL_MS = 300000;
 interface LocalAuthorizerOptions {
     /**
      * How long grant roots and the hierarchy are reused, in milliseconds.
@@ -21007,6 +21743,10 @@ interface LocalAuthorizerOptions {
      * for a caller who cannot accept a stale allow at all — it costs a round trip
      * per request, which is what this class exists to avoid, so reach for it
      * knowingly rather than as a default.
+     *
+     * **At most {@link MAX_TTL_MS} (five minutes).** A longer value, a negative
+     * one or a non-number throws when the authorizer is created, rather than
+     * quietly stretching how long a revoked user keeps access.
      */
     ttlMs?: number;
     /**
@@ -21082,7 +21822,9 @@ declare class LocalAuthorizer {
      * With no argument, everything goes: grants and the hierarchy tree. Not
      * needed in normal operation, where entries expire on their own; useful in
      * tests and after a change whose reach you cannot name (a role's
-     * permissions edited, a node moved).
+     * permissions edited, a role deactivated or reactivated, a node moved). A
+     * deactivated role grants nothing to anyone holding it, so until the cache
+     * is cleared or expires, its holders keep being allowed locally.
      *
      * Multi-instance honesty: an invalidation reaches THIS process only. A
      * webhook lands on one instance behind a load balancer; the others serve
@@ -21251,11 +21993,22 @@ declare function isCanopyTokenError(error: unknown): error is CanopyTokenError;
 
 interface TokenVerifierOptions {
     /**
-     * The issuer whose tokens are accepted, matched against `iss` exactly.
-     * Defaults to Canopy's hosted issuer; set it for a self-hosted instance.
+     * The Environment whose tokens are accepted. Every Environment is its own
+     * issuer with its own signing keys, at
+     * `https://auth.canopy-io.com/environments/<id>`, so on hosted Canopy this is
+     * all verification needs. A token from any other Environment fails.
+     *
+     * Set exactly one of `environmentId` and `issuer`; the constructor throws
+     * with neither or both.
+     */
+    environmentId?: string;
+    /**
+     * The issuer whose tokens are accepted, matched against `iss` exactly. Set it
+     * instead of `environmentId` on a custom auth domain (`https://auth.acme.com`)
+     * or a self-hosted instance (`<origin>/environments/<id>`).
      *
-     * Safe to default because it fails closed: pointed at the wrong issuer, a
-     * token is rejected rather than accepted.
+     * Pointed at the wrong issuer, verification fails closed: a token is
+     * rejected, never mistakenly accepted.
      */
     issuer?: string;
     /**
@@ -21479,4 +22232,4 @@ type WebhookEventData<Name extends WebhookEventName> = WebhookEvent<Name>["data"
  */
 declare function isWebhookEvent<Name extends WebhookEventName>(delivery: WebhookDelivery, name: Name): delivery is WebhookEvent<Name>;
 
-export { type AssignmentItem, Assignments, type CallOptions, Canopy, CanopyAuthorizerError, CanopyClient, type CanopyClientOptions, CanopyConnectionError, CanopyError, type CanopyErrorBody, type CanopyOrgContext, type CanopyTokenClaims, CanopyTokenError, type Collection, type ConcurrencyOptions, type ConditionalResult, type CursorPagination, Identities, type IdentityAssignmentItem, type IdentityItem, type IdentitySessionItem, type LocalAuthorizationQuery, LocalAuthorizer, type LocalAuthorizerOptions, type LocalAuthorizerStats, type OffsetPagination, type OperationId, type OrganizationInviteItem, type OrganizationItem, type OrganizationMemberItem, Organizations, type PageFetcher, type PageParams, type PaginateOptions, type Pagination, Paginator, type PartialSuccess, type PermissionItem, Permissions, type QueryParams, type RequestBody, type RequestOptions, type ResponseBody, type RoleItem, Roles, type Schema, TokenVerifier, type TokenVerifierOptions, type WebhookDelivery, type WebhookEvent, type WebhookEventData, type WebhookEventName, type components, isCanopyAuthorizerError, isCanopyConnectionError, isCanopyError, isCanopyTokenError, isCursorPagination, isWebhookEvent, type operations, orgContext, paginate, type paths, withConcurrency };
+export { type AssignmentItem, Assignments, type CallOptions, Canopy, CanopyAuthorizerError, CanopyClient, type CanopyClientOptions, CanopyConnectionError, CanopyError, type CanopyErrorBody, type CanopyOrgContext, type CanopyTokenClaims, CanopyTokenError, type Collection, type ConcurrencyOptions, type ConditionalResult, type CursorPagination, Identities, type IdentityAssignmentItem, type IdentityItem, type IdentitySessionItem, type LocalAuthorizationQuery, LocalAuthorizer, type LocalAuthorizerOptions, type LocalAuthorizerStats, MAX_TTL_MS, type OffsetPagination, type OperationId, type OrganizationInviteItem, type OrganizationItem, type OrganizationMemberItem, Organizations, type PageFetcher, type PageParams, type PaginateOptions, type Pagination, Paginator, type PartialSuccess, type PermissionItem, Permissions, type QueryParams, type RequestBody, type RequestOptions, type ResponseBody, type RoleItem, Roles, type Schema, TokenVerifier, type TokenVerifierOptions, type WebhookDelivery, type WebhookEvent, type WebhookEventData, type WebhookEventName, type components, isCanopyAuthorizerError, isCanopyConnectionError, isCanopyError, isCanopyTokenError, isCursorPagination, isWebhookEvent, type operations, orgContext, paginate, type paths, withConcurrency };