@cube-dev/platform-client 0.19.0 → 0.20.0

package/dist/schema.d.ts

@@ -427,7 +427,7 @@ export interface paths {
          *
          *     Pass `filters`, `timeGrains` and `memberSwitchers` to render the board with specific control values, exactly as a scheduled notification does; omit them to render its saved defaults.
          *
-         *     Pass `layout: print` with `format: pdf` for the paginated A4 document the dashboard's "Print version" menu item produces — one column, every table row, the filter state as a summary line — instead of the default `screenshot` of the board. `print` with `format: png` returns `400`.
+         *     Pass `layout: print` with `format: pdf` for the paginated A4 document the dashboard's "Download print version" menu item produces — one column, every table row, the filter state as a summary line — instead of the default `screenshot` of the board. `print` with `format: png` returns `400`.
          *
          *     By default the dashboard renders under the calling user's own security context, so the file shows what that user would see. Requires **manage** access to the dashboard's workbook — the same permission the console's own "Download as PNG / PDF" actions require, because a whole-dashboard render is a bulk data export.
          *
@@ -1100,6 +1100,84 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/deployments/{deploymentId}/ossie-conversions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start an Apache Ossie conversion
+         * @description Converts between a Cube data model and an [Apache Ossie (Open Semantic Interchange)](https://github.com/apache/ossie) model, and returns polling URLs immediately. An export converts the YAML data model of the deployment's latest successful build, or uploaded YAML files, to one Ossie model; an import converts an uploaded Ossie model to Cube data model files. Neither changes the deployment. Only static YAML model files are converted; JavaScript models and Jinja-templated files are skipped. Uploads are limited to 512 files of at most 2 MiB each and 20 MiB in total. Requests and results are kept for at most one day. Requires `SchemaRead` or `SchemaUpdate` access. This is currently in preview — reach out to the Cube support team to activate it for your account.
+         */
+        post: operations["OssieConversionPublicController.startConversion"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/deployments/{deploymentId}/ossie-conversions/{conversionId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get an Apache Ossie conversion status */
+        get: operations["OssieConversionPublicController.conversionStatus"];
+        put?: never;
+        post?: never;
+        /** Cancel an Apache Ossie conversion */
+        delete: operations["OssieConversionPublicController.cancelConversion"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/deployments/{deploymentId}/ossie-conversions/{conversionId}/files": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the files of an Apache Ossie conversion
+         * @description Returns `ossie.yaml` for an export, or the generated Cube data model files for an import; empty when the conversion failed. Returns 409 while the conversion is still running or if it ended without a result.
+         */
+        get: operations["OssieConversionPublicController.conversionFiles"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/deployments/{deploymentId}/ossie-conversions/{conversionId}/result": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get an Apache Ossie conversion result
+         * @description Returns the outcome, counts, issues and converter versions of a completed conversion. Returns 409 while the conversion is still running or if it ended without a result. Read the converted files from `/files`.
+         */
+        get: operations["OssieConversionPublicController.conversionResult"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/deployments/{deploymentId}/pods": {
         parameters: {
             query?: never;
@@ -1329,7 +1407,7 @@ export interface paths {
          *
          *     `source` is **create-only**: it is recorded when the report is first created and ignored on subsequent updates (it describes where the report originated, not its current definition).
          *
-         *     Access: updating requires **edit** access to the existing report; creating requires the same access as `POST /reports`.
+         *     Access: updating requires **edit** access to the existing report; moving it to a different parent requires **manage** access to the report and **edit** access to the destination. Creating requires the same access as `POST /reports`.
          */
         put: operations["ReportsPublicController.upsertReportByPublicId"];
         post?: never;
@@ -1356,7 +1434,7 @@ export interface paths {
          *
          *     The id you assign must be one you chose (any distinct 12-character `[0-9A-Za-z]` id). The auto-generated placeholder id shown for a report that has no stable id yet cannot be assigned — it is not unique — and is rejected with `400`.
          *
-         *     Requires **edit** access to the report.
+         *     Requires **edit** access to the report. Moving it to a different parent requires **manage** access to the report and **edit** access to the destination.
          */
         put: operations["ReportsPublicController.updateReport"];
         post?: never;
@@ -1794,7 +1872,7 @@ export interface paths {
          *
          *     If a workbook with this slug exists in the deployment, it is updated: only the fields you send are changed, and `meta` is merged into the existing metadata (a `meta.dashboardDraft` is validated like everywhere else). Otherwise a new workbook is created with this slug. The slug is normalized (trimmed, lowercased) before matching. Re-applying the same request is a no-op.
          *
-         *     Access: updating requires **edit** access to the workbook holding the slug (requests that include `folderId` require **manage** access, plus **edit** access to the destination folder); creating requires the same access as `POST /workbooks` (AI BI User role or higher).
+         *     Access: updating requires **edit** access to the workbook holding the slug (requests that include `folderId` require **manage** access, plus **edit** access to the destination folder); creating requires the same access as `POST /workbooks` (AI BI User role or higher, plus **edit** access to a supplied destination folder).
          *
          *     Whether this request creates or updates is decided — and access-checked — before it is applied. If another writer changes that in between (creates or deletes the workbook holding this slug), the request is rejected with `409` and `code: "upsert_branch_changed"` rather than applied under the wrong permission check. This is **transient: retry the request**. It only happens when two writers target the same slug concurrently — for example two pipeline runs applying the same bundle at once, where one creates the workbook and the other must then retry into the update path.
          *
@@ -2075,7 +2153,7 @@ export interface paths {
          *     Supported query parameters:
          *     - `folderId` — list the contents of this folder (omit for the root).
          *     - `types` — restrict the results to one or more item types (`FOLDER`, `WORKBOOK`, `REPORT`). Repeat the parameter to pass several.
-         *     - `search` — case-insensitive substring match on item names; searches across all folders, not just the current level.
+         *     - `search` — case-insensitive substring match on item names; searches across all folders, not just the current level. A workbook also matches when a report inside it does, so a search finds a dashboard by the name of a chart on it. Use this to find an item by name instead of walking folders.
          *     - `orderByField` / `orderByDirection` — sort the non-folder items (e.g. by `name`, `updated_at`, `created_at`, or `viewer_last_viewed_at`).
          *     - `first` / `after` — cursor-based pagination.
          *
@@ -2164,19 +2242,7 @@ export interface paths {
         put?: never;
         /**
          * Move a workspace item
-         * @description Move any workspace item — a workbook, report, or folder — into a folder, in one unified endpoint. Returns the moved item.
-         *
-         *     Request body:
-         *     - `type` — the item type: `WORKBOOK`, `REPORT`, or `FOLDER`.
-         *     - `id` — the id of the item to move.
-         *     - `folderId` — the destination folder id, or `null` to move the item to the workspace root. For a folder, this becomes its new parent.
-         *
-         *     Access requirements depend on the item type and mirror the per-type rules:
-         *     - **Workbook** — manage access to the workbook, plus edit access to the destination folder when moving into one.
-         *     - **Report** — edit access to the report (with the report-manage permission).
-         *     - **Folder** — manage access to the folder being moved, plus manage or edit access to the destination parent folder.
-         *
-         *     Moving a folder into one of its own descendants, or exceeding the maximum folder depth, is rejected with `400`. Returns `404` if the item does not exist or belongs to a different deployment.
+         * @description Move a workbook, report, or folder to folderId (null for root). Source and destination permissions are checked, and a report's destination must be in the route deployment.
          */
         post: operations["WorkspacePublicController.moveWorkspaceObject"];
         delete?: never;
@@ -3089,6 +3155,160 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/roles/": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List custom roles
+         * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
+         *
+         *     Lists the tenant's custom roles, newest first, cursor-paginated via `first`/`after`. Cube's built-in roles are not included — they are not tenant data.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
+         */
+        get: operations["RolesPublicController.getRoles"];
+        put?: never;
+        /**
+         * Create a custom role
+         * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
+         *
+         *     Creates a role and returns it with the `id` to assign it by. Role names are unique, so recreating one that already exists answers `409`.
+         *
+         *     To scope the role to specific deployments, send a `Deployment` policy whose `resources` are the deployment ids as strings. A role usually also needs a `Global` policy naming the holder's license tier — `AIBIView`, `AIBIExplore` or `AIBIDevelop` — which is what the console calls the role's Base Role. Pick a tier that covers the deployment actions you grant: the console forces Developer (`AIBIDevelop`) for every deployment action except `DeploymentRead`, `DeploymentAgentRead`, `DownloadData` and `ChatHistoryRead`, so a lower tier here produces a role its role builder would not have let you save:
+         *
+         *     ```json
+         *     {
+         *       "name": "team-analytics",
+         *       "policies": [
+         *         {
+         *           "resourceType": "Global",
+         *           "actions": ["AIBIDevelop"],
+         *           "resources": ["All"]
+         *         },
+         *         {
+         *           "resourceType": "Deployment",
+         *           "actions": ["DeploymentRead", "SchemaRead", "SqlRunnerRead"],
+         *           "resources": ["1734"]
+         *         }
+         *       ]
+         *     }
+         *     ```
+         *
+         *     The tier is **not** required and is **not** derived from the deployment actions: a role sent without one is accepted and simply confers no tier, so a user holding only that role gets the deployment grants and still cannot use the product. That is deliberate — a user holds the union of their roles, so a role that only adds a deployment scope beside another role carrying the tier is valid — but it means nothing warns you. Omit the `Global` policy only when some other role supplies the tier. Note the console does require one on every role it writes, so a role created here without a tier shows an unset Base Role when opened in the role builder.
+         *
+         *     Use `["All"]` as `resources` to cover every deployment, and `"All"` as the single action for full access to the deployments in scope. A policy is rejected when it grants no action, when it names no resource, or when a `Deployment` resource is not a deployment id — pass the numeric id returned by POST /build/api/v1/deployments, not a slug or a name. Ids are checked for shape, not existence, so an id whose deployment was since deleted is kept and simply grants nothing.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
+         */
+        post: operations["RolesPublicController.createRole"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/roles/{roleId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a custom role
+         * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
+         *
+         *     Returns one custom role by id, with its policies.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
+         */
+        get: operations["RolesPublicController.getRole"];
+        /**
+         * Update a custom role
+         * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
+         *
+         *     Updates the fields present in the body and leaves the rest alone. Sending `policies` replaces the role's policies outright, so read the role first if you mean to add one rather than start over. Renaming to a name another role already holds answers `409`. Built-in roles cannot be updated.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
+         */
+        put: operations["RolesPublicController.updateRole"];
+        post?: never;
+        /**
+         * Delete a custom role
+         * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
+         *
+         *     Deletes the role and every assignment of it, from users and from groups. Built-in roles cannot be deleted.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
+         */
+        delete: operations["RolesPublicController.deleteRole"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/roles/{roleId}/users": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the users holding a role
+         * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
+         *
+         *     Lists every user holding the role, directly or through a group, newest first, cursor-paginated via `first`/`after`. Accepts built-in role ids. Each user carries every role they hold, so a combination such as "holds Explorer but not my custom role" is one pass over these pages. Deactivated users are included.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
+         */
+        get: operations["RolesPublicController.getRoleHolders"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/roles/{roleId}/users/{userId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Assign a role to a user
+         * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
+         *
+         *     Gives the user everything the role grants. Idempotent — assigning a role the user already holds changes nothing. Returns `404` if either the user or the role is unknown.
+         *
+         *     Unlike the other endpoints here, this one is not limited to your custom roles: it also accepts the id of a built-in role, and assigning one grants everything that role confers. **Cube's Admin role is the exception and cannot be granted this way** — it is not among the built-in roles this endpoint resolves, so its id returns `404`. No call to this endpoint can make a user an account-wide administrator.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
+         */
+        put: operations["RolesPublicController.assignRoleToUser"];
+        post?: never;
+        /**
+         * Remove a role from a user
+         * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
+         *
+         *     Takes the role away from the user. Idempotent — removing a role the user does not hold changes nothing. Returns `404` if the user is unknown.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
+         */
+        delete: operations["RolesPublicController.removeRoleFromUser"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/spec": {
         parameters: {
             query?: never;
@@ -3351,6 +3571,8 @@ export interface paths {
          *     - A tenant must always keep at least one active, direct admin, so the action that would remove the last one fails with `403` while the rest of the batch still applies.
          *
          *     Reapplying an action a user is already in (deactivating a deactivated user) succeeds as a no-op.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
          */
         post: operations["UsersAdminPublicController.bulkUserAction"];
         delete?: never;
@@ -3408,7 +3630,7 @@ export interface paths {
         head?: never;
         /**
          * Update my settings
-         * @description Merge a partial patch into the authenticated user's own settings. Omitted fields are left as they are; `sheets` merges field-by-field, and an explicit `null` clears it.
+         * @description Merge a partial patch into the authenticated user's own settings. Omitted fields are left as they are; `sheets` and `memory` merge field-by-field, and an explicit `null` clears one.
          */
         patch: operations["UsersPublicController.updateMySettings"];
         trace?: never;
@@ -3431,6 +3653,30 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/users/{id}/roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List a user's roles
+         * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
+         *
+         *     Every role the user holds, built-in and custom, whether assigned directly or through a group. Only a direct assignment can be removed with `DELETE /api/v1/roles/{roleId}/users/{userId}`.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
+         */
+        get: operations["UsersAdminPublicController.getUserRoles"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/build/api/v1/deployments/": {
         parameters: {
             query?: never;
@@ -3744,6 +3990,7 @@ export interface components {
             graphqlToken?: string | null;
             hasAgentAccess?: any | null;
             mcpToken?: string | null;
+            memoryGenerationEnabled?: boolean | null;
             resolvedTimezone?: string | null;
             scheduledTaskPolicies?: components["schemas"]["ChatThreadPolicy"][] | null;
             timezoneSettings?: components["schemas"]["TimezoneSettings"] | null;
@@ -3770,6 +4017,7 @@ export interface components {
             createdAt: string;
             dedicatedAiEngineerRegion?: string | null;
             deploymentId?: number | null;
+            displayName?: string | null;
             embeddingLlm?: components["schemas"]["AgentLlm"] | null;
             embeddingUrl?: string | null;
             id: number;
@@ -4244,7 +4492,7 @@ export interface components {
             timezone?: string | null;
         };
         /** @enum {string} */
-        CreateNotificationInputNotificationFormat: "png" | "pdf";
+        CreateNotificationInputNotificationFormat: "png" | "pdf" | "pdf_print";
         /** @enum {string} */
         CreateNotificationInputScheduleType: "HOURLY" | "DAILY" | "WEEKLY" | "MONTHLY" | "CUSTOM";
         CreateOAuthIntegrationInput: {
@@ -4319,6 +4567,8 @@ export interface components {
         CreateScheduledTaskInput: {
             /** @description The agent that runs the task. Omit for the deployment default. */
             agentId?: number | null;
+            /** @description Notify only when: on each fire the measure is read once, before the agent runs, and the agent runs only when the condition starts to hold, with the crossing facts at the top of its thread; it runs again only after the condition has stopped holding. A `change` or `anomaly` rule needs `timeDimension` and `granularity`. The creator gets an inbox row only with `notificationEnabled: true`. Omit to run the agent on every fire. */
+            condition?: components["schemas"]["ScheduledTaskCondition"] | null;
             /** @description Standard 5-field cron (minute hour day-of-month month day-of-week), e.g. `0 9 * * 1-5` for 9:00 on weekdays. A task runs at most once an hour, so the minute field is a single number. Null or omitted makes the task Manual: it runs only when started with `POST /scheduled-tasks/{taskId}/run`. */
             cronExpression?: string | null;
             description?: string | null;
@@ -4551,17 +4801,17 @@ export interface components {
             endInclusive?: any | null;
             /** @description Dimension path, e.g. "Orders.status" */
             member: string;
-            /** @description Filter operator (defaults to "equals") */
+            /** @description Filter operator (defaults to "equals"; with an empty value, omitting it clears the control instead) */
             operator?: components["schemas"]["DashboardFilterInputOperator"] | null;
             /** @description For between filters: whether the start bound is inclusive */
             startInclusive?: any | null;
-            /** @description Filter value. Omit for is_null / is_not_null / is_empty / is_not_empty; provide a 2-element [start, end] array for between. */
+            /** @description Filter value. Omit for is_null / is_not_null / is_empty / is_not_empty; provide a 2-element [start, end] array for between. An empty array or empty string with no operator renders the filter cleared; with an operator, the filter keeps that operator. */
             value?: (string | number | boolean | unknown[]) | null;
         };
         /** @enum {string} */
-        DashboardFilterInputOperator: "equals" | "not_equals" | "greater_than" | "greater_than_or_equal" | "less_than" | "less_than_or_equal" | "contains" | "not_contains" | "starts_with" | "not_starts_with" | "ends_with" | "not_ends_with" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "between" | "custom";
+        DashboardFilterInputOperator: "equals" | "not_equals" | "greater_than" | "greater_than_or_equal" | "less_than" | "less_than_or_equal" | "contains" | "not_contains" | "starts_with" | "not_starts_with" | "ends_with" | "not_ends_with" | "in_month" | "not_in_month" | "in_quarter" | "not_in_quarter" | "in_year" | "not_in_year" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "between" | "custom";
         /** @enum {string} */
-        DashboardFilterOperator: "equals" | "not_equals" | "greater_than" | "greater_than_or_equal" | "less_than" | "less_than_or_equal" | "contains" | "not_contains" | "starts_with" | "not_starts_with" | "ends_with" | "not_ends_with" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "between" | "custom";
+        DashboardFilterOperator: "equals" | "not_equals" | "greater_than" | "greater_than_or_equal" | "less_than" | "less_than_or_equal" | "contains" | "not_contains" | "starts_with" | "not_starts_with" | "ends_with" | "not_ends_with" | "in_month" | "not_in_month" | "in_quarter" | "not_in_quarter" | "in_year" | "not_in_year" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "between" | "custom";
         DashboardLayout: {
             breakpoints?: components["schemas"]["DashboardBreakpoints"] | null;
             cols?: components["schemas"]["DashboardBreakpointCols"] | null;
@@ -4618,7 +4868,7 @@ export interface components {
             member: string;
         };
         DashboardTimeGrainInput: {
-            /** @description Granularity, e.g. "day", "week", "month" */
+            /** @description Granularity, e.g. "day", "week", "month". An empty string renders the control cleared. */
             grain: string;
             /** @description Time dimension path, e.g. "Orders.created_at" */
             member: string;
@@ -5470,11 +5720,21 @@ export interface components {
             pageInfo?: components["schemas"]["PageInfo"] | null;
         };
         EvaluationResultResponse: {
+            /** @description The agent's text answer, which may be truncated. */
+            agentResponse?: string | null;
+            /** @description The SQL the agent ran to answer the question. */
+            agentSql?: string | null;
+            /** @description The grader's explanation of the verdict: why the question failed or errored, a note for a result that needs review, or the AI check's rationale. */
+            analysis?: string | null;
             createdAt: string;
             evaluationId: number;
+            /** @description The ground-truth SQL the agent result was compared against. */
+            groundTruthSql?: string | null;
             id: number;
             questionTextSnapshot: string;
             score?: number | null;
+            /** @description Short categories for a non-passing verdict, such as "Row count mismatch" or "Query error". Empty when the question passed. */
+            scoreReasons: string[];
             updatedAt: string;
             /** @description Question outcome: pass, fail, review, skipped, or error. */
             verdict?: string | null;
@@ -5739,6 +5999,9 @@ export interface components {
             locale: string;
             value: string;
         };
+        MemoryUserSettingsInput: {
+            generateFromChats?: boolean | null;
+        };
         MergeIntoParentBranchRequest: {
             branchId?: number;
             branchName?: string;
@@ -5875,6 +6138,122 @@ export interface components {
         };
         /** @enum {string} */
         OidcTokenConfigDTOSubjectType: "deployment" | "user";
+        OssieConversionCounts: {
+            /** @description Cube cubes. */
+            cubes: number;
+            /** @description Ossie datasets. */
+            datasets: number;
+            /** @description Ossie dataset fields. */
+            fields: number;
+            /** @description Cube data model files. */
+            files: number;
+            issues: components["schemas"]["OssieConversionIssueCounts"];
+            /** @description Ossie metrics. */
+            metrics: number;
+            /** @description Ossie relationships. */
+            relationships: number;
+            /** @description Cube views. */
+            views: number;
+        };
+        OssieConversionFile: {
+            content: string;
+            /** @description For an export, `ossie.yaml`. For an import, the path of the generated file within the data model project. */
+            path: string;
+        };
+        OssieConversionFilesListResponse: {
+            /** @description The converted files, empty when the conversion failed. */
+            items: components["schemas"]["OssieConversionFile"][];
+            pageInfo: components["schemas"]["PageInfo"];
+        };
+        OssieConversionInput: {
+            /** @description Import only. The dataset the generated view is rooted at, for an Ossie model whose relationships do not determine one. */
+            baseCube?: string | null;
+            /** @description Import only. The warehouse dialect whose expressions are preferred where the Ossie model has several; ANSI_SQL is always the fallback. Defaults to the dialect of the deployment's default data source, or ANSI_SQL. */
+            dialect?: components["schemas"]["OssieConversionInputDialect"] | null;
+            /** @description 'export' converts a Cube data model to an Ossie model; 'import' converts an Ossie model to Cube data model files. */
+            direction: components["schemas"]["OssieConversionInputDirection"];
+            /** @description Export with source 'files' only. Relative `.yml`/`.yaml` paths mapped to their contents, such as a local checkout of the data model. Other files are not accepted. */
+            files?: {
+                [key: string]: string;
+            } | null;
+            /** @description Import only. The Ossie YAML document to convert. */
+            ossieYaml?: string | null;
+            /** @description Export only. 'deployment' (the default) converts the YAML data model of the deployment's latest successful build; 'files' converts the `files` sent with the request. */
+            source?: components["schemas"]["OssieConversionInputSource"] | null;
+            /** @description Export only. Refuse a metric whose value join fan-out could change, instead of converting it with a warning. Defaults to false for a whole-model export and true for a view export. */
+            strictFanout?: boolean | null;
+            /** @description Export only. Convert just this view's public members instead of the whole model. */
+            view?: string | null;
+        };
+        /** @enum {string} */
+        OssieConversionInputDialect: "ANSI_SQL" | "SNOWFLAKE" | "DATABRICKS" | "BIGQUERY";
+        /** @enum {string} */
+        OssieConversionInputDirection: "export" | "import";
+        /** @enum {string} */
+        OssieConversionInputSource: "deployment" | "files";
+        OssieConversionIssue: {
+            /** @description The converter issue type, such as DROPPED_MEASURE or CONVERSION_FAILED. */
+            code: string;
+            /** @description The model element the issue is about. */
+            element?: string | null;
+            message: string;
+            /** @description ERROR fails the conversion. WARNING marks something dropped or changed. INFO marks something kept in another form. */
+            severity: components["schemas"]["OssieConversionIssueSeverity"];
+        };
+        OssieConversionIssueCounts: {
+            error: number;
+            info: number;
+            warning: number;
+        };
+        /** @enum {string} */
+        OssieConversionIssueSeverity: "ERROR" | "WARNING" | "INFO";
+        OssieConversionResultResponse: {
+            completedAt: string;
+            conversionId: string;
+            counts: components["schemas"]["OssieConversionCounts"];
+            deploymentId: number;
+            direction: components["schemas"]["OssieConversionResultResponseDirection"];
+            durationMs: number;
+            issues: components["schemas"]["OssieConversionIssue"][];
+            /** @description 'failed' exactly when an issue has severity ERROR. */
+            outcome: components["schemas"]["OssieConversionResultResponseOutcome"];
+            runtime: components["schemas"]["OssieConversionRuntime"];
+            /** @description SHA-256 of the converted input. */
+            sourceSha256: string;
+        };
+        /** @enum {string} */
+        OssieConversionResultResponseDirection: "export" | "import";
+        /** @enum {string} */
+        OssieConversionResultResponseOutcome: "success" | "failed";
+        OssieConversionRuntime: {
+            cubeConverterVersion: string;
+            /** @description The apache/ossie commit the converter was built from. */
+            ossieCommit: string;
+            ossieCoreVersion: string;
+        };
+        OssieConversionStartResponse: {
+            conversionId: string;
+            resultUrl: string;
+            status: components["schemas"]["OssieConversionStartResponseStatus"];
+            statusUrl: string;
+        };
+        /** @enum {string} */
+        OssieConversionStartResponseStatus: "QUEUED";
+        OssieConversionStatusResponse: {
+            conversionId: string;
+            deploymentId: number;
+            direction: components["schemas"]["OssieConversionStatusResponseDirection"];
+            /** @description Why the job ended without a result. */
+            error?: string | null;
+            startedAt: string;
+            /** @description One of QUEUED, RUNNING, COMPLETED, FAILED or CANCELLED. COMPLETED means a result is available, even when the conversion itself failed; read its outcome. FAILED means the job ended without a result. */
+            status: components["schemas"]["OssieConversionStatusResponseStatus"];
+            updatedAt: string;
+        };
+        /** @enum {string} */
+        OssieConversionStatusResponseDirection: "export" | "import";
+        /** @enum {string} */
+        OssieConversionStatusResponseStatus: "QUEUED" | "RUNNING" | "COMPLETED" | "FAILED" | "CANCELLED";
         PageInfo: {
             endCursor?: string | null;
             hasNextPage: boolean;
@@ -6468,11 +6847,49 @@ export interface components {
             /** @description The session id returned by `POST /api/v1/embed/generate-session`. Works whether or not the session has already been exchanged for a token. */
             sessionId: string;
         };
+        Role: {
+            description?: string | null;
+            id: number;
+            name: string;
+            policies: components["schemas"]["Policy"][];
+        };
+        RoleCreateBody: {
+            description?: string | null;
+            /** @description Unique role name. Cannot be one of the built-in role names, which are rejected with `400`: `Admin`, `Developer`, `AIBIDeveloper`, `D3User`, `AIBIUser`, `AIBIViewer`, `Guest`, `EmbedUser`. (The console additionally refuses `None` and `All` in its own role builder; those are accepted here.) */
+            name: string;
+            /** @description What the role grants. Scope a policy to specific deployments by setting `resourceType` to `Deployment` and listing the deployment ids — as returned by POST /build/api/v1/deployments — in `resources`, or `["All"]` for every deployment. An empty `policies` list is accepted and creates a role that grants nothing yet; an individual policy with no actions, or none naming a resource, is rejected. */
+            policies: components["schemas"]["Policy"][];
+        };
+        RoleHolder: {
+            email: string;
+            firstName?: string | null;
+            id: number;
+            /** @description Set by the user's own Admin flag or by a group granting Admin. */
+            isAdmin: boolean;
+            isDeactivated: boolean;
+            roles: components["schemas"]["UserRoleAssignmentResponse"][];
+        };
+        RoleHoldersListResponse: {
+            items: components["schemas"]["RoleHolder"][];
+            pageInfo: components["schemas"]["PageInfo"];
+        };
+        RoleUpdateBody: {
+            /** @description Omit to leave the description unchanged; `null` clears it. */
+            description?: string | null;
+            /** @description Omit to leave the name unchanged. `null` is rejected. */
+            name?: string;
+            /** @description Replaces the role's policies outright when present — there is no per-policy merge. Omit it to leave them unchanged, or send `[]` to remove them all. `null` is rejected, so a partly-filled client object cannot strip a role's grants by accident. */
+            policies?: components["schemas"]["Policy"][];
+        };
         RoleWithAccess: {
             actions: ("All" | "DeploymentsManage" | "DeploymentCreate" | "DeploymentRead" | "DeploymentUpdate" | "DeploymentDelete" | "SecretsManage" | "DownloadData" | "PlaygroundRead" | "SchemaRead" | "SchemaUpdate" | "SchemaUpdateDevBranches" | "APMRead" | "ChatHistoryRead" | "PreAggregationRead" | "PreAggregationBuild" | "AlertsCreate" | "AlertsRead" | "AlertsUpdate" | "AlertsDelete" | "AuditLogManage" | "BillingRead" | "SqlRunnerRead" | "DataAssetsRead" | "DataAssetsManage" | "CubeNetworkConnect" | "ReportRead" | "ReportEdit" | "ReportManage" | "WorkbookManage" | "WorkbookRead" | "WorkbookEdit" | "ChatThreadRead" | "AgentManage" | "AgentRead" | "AgentSpaceManage" | "AgentAdmin" | "DeploymentAgentRead" | "ScheduledTasksCreate" | "ScheduledTaskRead" | "OAuthIntegrationsManage" | "OAuthIntegrationsIssueTokens" | "McpToolsManage" | "AIBIDevelop" | "AIBIExplore" | "AIBIView" | "ChartPalettesManage" | "DashboardThemesManage" | "AIBIDeveloper" | "AIBIUser" | "AIBIViewer" | "EmbedDeploymentRead" | "EmbedDashboardRead" | "FolderRead" | "FolderEdit" | "FolderManage")[];
             id: number;
             name: string;
         };
+        RolesListResponse: {
+            items: components["schemas"]["Role"][];
+            pageInfo: components["schemas"]["PageInfo"];
+        };
         RunScheduledTaskResponse: {
             /** @description The chat thread this run writes to. */
             chatThreadUuid: string;
@@ -6499,6 +6916,61 @@ export interface components {
         SaveDatabricksMetricViewIntegrationInputDeletionPolicy: "retain" | "delete-managed";
         /** @enum {string} */
         SaveDatabricksMetricViewIntegrationInputSelectionMode: "all" | "selected" | "pattern";
+        ScheduledTaskCondition: {
+            granularity?: components["schemas"]["ScheduledTaskConditionGranularity"] | null;
+            /** @description Changes whenever the condition does. Read-only. */
+            id?: string | null;
+            /** @description Full measure name, e.g. `orders.revenue`. */
+            measure: string;
+            measureTitle?: string | null;
+            rule: components["schemas"]["ScheduledTaskConditionRule"];
+            /** @description Full time dimension name, e.g. `orders.created_at`. */
+            timeDimension?: string | null;
+            timeDimensionTitle?: string | null;
+        };
+        ScheduledTaskConditionBand: {
+            high: number;
+            low: number;
+            median: number;
+        };
+        /** @enum {string} */
+        ScheduledTaskConditionGranularity: "day" | "week" | "month" | "quarter" | "year";
+        ScheduledTaskConditionRule: {
+            /** @description For `change`: increases, decreases, or changes either way. */
+            direction?: components["schemas"]["ScheduledTaskConditionRuleDirection"] | null;
+            /** @description For `threshold`: above, below or equal to. */
+            operator?: components["schemas"]["ScheduledTaskConditionRuleOperator"] | null;
+            /** @description For `change`: the percentage, greater than 0, e.g. `5` for 5 %. */
+            percent?: number | null;
+            /** @description `threshold`: the last complete period (or the total, with no time dimension) is above, below or equal to `value`. `change`: the last complete period moved by at least `percent` % from the one before it. `anomaly`: the last complete period lies outside median ± 3·MAD of the at least 8 complete periods before it. */
+            type: components["schemas"]["ScheduledTaskConditionRuleType"];
+            /** @description For `threshold`: the number compared with. */
+            value?: number | null;
+        };
+        /** @enum {string} */
+        ScheduledTaskConditionRuleDirection: "up" | "down" | "either";
+        /** @enum {string} */
+        ScheduledTaskConditionRuleOperator: "gt" | "lt" | "eq";
+        /** @enum {string} */
+        ScheduledTaskConditionRuleType: "threshold" | "change" | "anomaly";
+        ScheduledTaskLastConditionCheck: {
+            /** @description When the check ran (ISO 8601). */
+            at: string;
+            band?: components["schemas"]["ScheduledTaskConditionBand"] | null;
+            changePercent?: number | null;
+            conditionId: string;
+            notifiedAt?: string | null;
+            /** @description Start of the period read, `YYYY-MM-DD`. */
+            period?: string | null;
+            previous?: number | null;
+            previousPeriod?: string | null;
+            reason?: string | null;
+            /** @description `held-notified` ran the agent; `held-already-notified` was still holding since an earlier notification; `cannot-evaluate` carries a `reason` code; an `error` carries its text in `reason` to the task's creator only, as do the figures the check read. */
+            status: components["schemas"]["ScheduledTaskLastConditionCheckStatus"];
+            value?: number | null;
+        };
+        /** @enum {string} */
+        ScheduledTaskLastConditionCheckStatus: "not-held" | "held-notified" | "held-already-notified" | "cannot-evaluate" | "error";
         ScheduledTaskListResponse: {
             items: components["schemas"]["ScheduledTaskResponse"][];
             pageInfo: components["schemas"]["PageInfo"];
@@ -6506,6 +6978,8 @@ export interface components {
         ScheduledTaskResponse: {
             /** @description The agent that runs the task; null runs the deployment default. */
             agentId?: number | null;
+            /** @description Notify only when: on each fire the measure is read once, before the agent runs, and the agent runs only when the condition starts to hold, with the crossing facts at the top of its thread; it runs again only after the condition has stopped holding. A `change` or `anomaly` rule needs `timeDimension` and `granularity`. The creator gets an inbox row only with `notificationEnabled: true`. Null runs the agent on every fire. */
+            condition?: components["schemas"]["ScheduledTaskCondition"] | null;
             /** @description Standard 5-field cron (minute hour day-of-month month day-of-week), e.g. `0 9 * * 1-5` for 9:00 on weekdays. Null when the task is Manual: it runs only when started with `POST /scheduled-tasks/{taskId}/run`. */
             cronExpression?: string | null;
             deploymentId: number;
@@ -6513,6 +6987,8 @@ export interface components {
             id: number;
             /** @description False while the schedule is paused. */
             isEnabled: boolean;
+            /** @description The latest condition check; null before the first one. */
+            lastConditionCheck?: components["schemas"]["ScheduledTaskLastConditionCheck"] | null;
             name: string;
             /** @description When the schedule next fires (ISO 8601, UTC); null for a Manual or paused task. */
             nextRunAt?: string | null;
@@ -6618,7 +7094,7 @@ export interface components {
             /** @description Output format: `png` or `pdf`. */
             format: components["schemas"]["StartDashboardExportInputFormat"];
             /**
-             * @description How the dashboard is laid out. `screenshot` (the default) renders the board as it looks on screen. `print` renders the paginated A4 document the dashboard's 'Print version' menu item produces: one column, every table row, and the filter state as a summary line instead of filter controls. `print` is available for `format: 'pdf'` only.
+             * @description How the dashboard is laid out. `screenshot` (the default) renders the board as it looks on screen. `print` renders the paginated A4 document the dashboard's 'Download print version' menu item produces: one column, every table row, and the filter state as a summary line instead of filter controls. `print` is available for `format: 'pdf'` only.
              * @default screenshot
              */
             layout?: components["schemas"]["StartDashboardExportInputLayout"] | null;
@@ -6664,6 +7140,10 @@ export interface components {
             branchName: string;
             /** @description Path of one eval-question YAML file to run, relative to the agents directory. Omit to run the complete eval set. */
             questionFile?: string | null;
+            /** @description Security context to evaluate under, merged over the caller's own. Applies to the ground-truth queries, and to the agent's queries when the run's agent is defined in the deployment's agent config; the default `auto` agent queries under the caller's own context. Requires deployment edit access; a `cubeCloud` key requires an admin. */
+            securityContext?: {
+                [key: string]: any;
+            } | null;
         };
         StartReportDeliveryRunResponse: {
             /** @description Id of the run, which writes the sheet in the background; poll it for the outcome. */
@@ -6830,7 +7310,7 @@ export interface components {
             timezone?: string | null;
         };
         /** @enum {string} */
-        UpdateNotificationInputNotificationFormat: "png" | "pdf";
+        UpdateNotificationInputNotificationFormat: "png" | "pdf" | "pdf_print";
         /** @enum {string} */
         UpdateNotificationInputScheduleType: "HOURLY" | "DAILY" | "WEEKLY" | "MONTHLY" | "CUSTOM";
         UpdateOAuthIntegrationInput: {
@@ -6928,6 +7408,8 @@ export interface components {
         UpdateScheduledTaskInput: {
             /** @description The agent that runs the task. Omit to leave unchanged; null resets it to the deployment default. */
             agentId?: number | null;
+            /** @description Notify only when: on each fire the measure is read once, before the agent runs, and the agent runs only when the condition starts to hold, with the crossing facts at the top of its thread; it runs again only after the condition has stopped holding. A `change` or `anomaly` rule needs `timeDimension` and `granularity`. The creator gets an inbox row only with `notificationEnabled: true`. Omit to leave unchanged; null removes it. A changed condition starts its breach state fresh. */
+            condition?: components["schemas"]["ScheduledTaskCondition"] | null;
             /** @description New standard 5-field cron, at most hourly (the minute field is a single number). Omit it to keep the current schedule; send null to make the task Manual. */
             cronExpression?: string | null;
             /** @description Omit to leave unchanged. Send null to clear the description. */
@@ -7114,6 +7596,22 @@ export interface components {
             updatedAt: string;
             userId: number;
         };
+        UserRoleAssignmentResponse: {
+            builtIn: boolean;
+            description?: string | null;
+            /** @description Assigned to the user directly — the assignment `DELETE /api/v1/roles/{roleId}/users/{userId}` removes. */
+            direct: boolean;
+            /** @description Groups that grant the role. Removing it from the user does not touch these; change the group instead. */
+            groupIds: number[];
+            /** @description Role id. Built-in roles have fixed negative ids. */
+            id: number;
+            name: string;
+        };
+        UserRolesResponse: {
+            /** @description Set by the user's own Admin flag or by a group granting Admin. */
+            isAdmin: boolean;
+            roles: components["schemas"]["UserRoleAssignmentResponse"][];
+        };
         UserSettingsInput: {
             alternatingRowColors?: boolean | null;
             defaultDeploymentId?: number | null;
@@ -7123,6 +7621,7 @@ export interface components {
              */
             lastSeenChangelogId?: number | null;
             locale?: string | null;
+            memory?: components["schemas"]["MemoryUserSettingsInput"] | null;
             sheets?: components["schemas"]["SheetsUserSettingsInput"] | null;
             theme?: string | null;
             timezone?: string | null;
@@ -9256,9 +9755,134 @@ export interface operations {
             };
         };
     };
-    "DeploymentsPublicController.pods": {
+    "OssieConversionPublicController.startConversion": {
         parameters: {
-            query?: {
+            query?: never;
+            header?: never;
+            path: {
+                deploymentId: number;
+            };
+            cookie?: never;
+        };
+        /** @description OssieConversionInput */
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["OssieConversionInput"];
+            };
+        };
+        responses: {
+            202: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["OssieConversionStartResponse"];
+                };
+            };
+        };
+    };
+    "OssieConversionPublicController.conversionStatus": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                deploymentId: number;
+                conversionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["OssieConversionStatusResponse"];
+                };
+            };
+        };
+    };
+    "OssieConversionPublicController.cancelConversion": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                deploymentId: number;
+                conversionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful response */
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": any;
+                };
+            };
+            /** @description Cancelled, or already finished. */
+            204: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+        };
+    };
+    "OssieConversionPublicController.conversionFiles": {
+        parameters: {
+            query?: {
+                after?: string | null;
+                first?: number | null;
+            };
+            header?: never;
+            path: {
+                deploymentId: number;
+                conversionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["OssieConversionFilesListResponse"];
+                };
+            };
+        };
+    };
+    "OssieConversionPublicController.conversionResult": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                deploymentId: number;
+                conversionId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["OssieConversionResultResponse"];
+                };
+            };
+        };
+    };
+    "DeploymentsPublicController.pods": {
+        parameters: {
+            query?: {
                 after?: string | null;
                 first?: number | null;
             };
@@ -12298,6 +12922,282 @@ export interface operations {
             };
         };
     };
+    "RolesPublicController.getRoles": {
+        parameters: {
+            query?: {
+                after?: string | null;
+                first?: number | null;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["RolesListResponse"];
+                };
+            };
+        };
+    };
+    "RolesPublicController.createRole": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** @description RoleCreateBody */
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["RoleCreateBody"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["Role"];
+                };
+            };
+            /** @description The name is one of the built-in role names, or a policy grants no action, names no resource, or scopes a `Deployment` to something that is not a deployment id. */
+            400: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+            /** @description A role with that name already exists. */
+            409: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+        };
+    };
+    "RolesPublicController.getRole": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                roleId: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["Role"];
+                };
+            };
+            /** @description No custom role has that id. */
+            404: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+        };
+    };
+    "RolesPublicController.updateRole": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                roleId: number;
+            };
+            cookie?: never;
+        };
+        /** @description RoleUpdateBody */
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["RoleUpdateBody"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["Role"];
+                };
+            };
+            /** @description `name` or `policies` was `null`, the new name is one of the built-in role names, or a policy is not a valid one. */
+            400: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+            /** @description No custom role has that id. */
+            404: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+            /** @description A role with that name already exists. */
+            409: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+        };
+    };
+    "RolesPublicController.deleteRole": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                roleId: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful response */
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": any;
+                };
+            };
+            /** @description Role deleted. */
+            204: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+            /** @description No custom role has that id. */
+            404: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+        };
+    };
+    "RolesPublicController.getRoleHolders": {
+        parameters: {
+            query?: {
+                after?: string | null;
+                first?: number | null;
+            };
+            header?: never;
+            path: {
+                roleId: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["RoleHoldersListResponse"];
+                };
+            };
+            /** @description No role has that id. Cube's Admin role answers `404` too. */
+            404: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+        };
+    };
+    "RolesPublicController.assignRoleToUser": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                roleId: number;
+                userId: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful response */
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": any;
+                };
+            };
+            /** @description Role assigned, or already held. */
+            204: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+            /** @description The user or the role is unknown. Cube's Admin role is not resolvable here, so its id answers `404` as well. */
+            404: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+        };
+    };
+    "RolesPublicController.removeRoleFromUser": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                roleId: number;
+                userId: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful response */
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": any;
+                };
+            };
+            /** @description Role removed, or was not held. */
+            204: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+            /** @description The user is unknown. */
+            404: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+        };
+    };
     "OpenApiSpecPublicController.getSpec": {
         parameters: {
             query?: never;
@@ -12813,6 +13713,34 @@ export interface operations {
             };
         };
     };
+    "UsersAdminPublicController.getUserRoles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["UserRolesResponse"];
+                };
+            };
+            /** @description The user is unknown. */
+            404: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+        };
+    };
     "DeploymentsBuildPublicController.createDeployment": {
         parameters: {
             query?: never;