@descope/pulumi-descope 0.2.0 → 0.3.2

package/types/input.d.ts

@@ -126,7 +126,7 @@ export interface ProjectApplicationsSamlApplicationManualConfiguration {
     /**
      * Enter the `Certificate` from the SP.
      */
-    certificate: pulumi.Input<string>;
+    certificate?: pulumi.Input<string>;
     /**
      * Enter the `Entity Id` from the SP.
      */
@@ -148,7 +148,11 @@ export interface ProjectAttributesTenant {
      */
     authorization?: pulumi.Input<inputs.ProjectAttributesTenantAuthorization>;
     /**
-     * The name of the attribute.
+     * An optional identifier for the attribute. This value is called `Machine Name` in the Descope console. If a value is not provided then an appropriate one will be created from the value of `name`.
+     */
+    id?: pulumi.Input<string>;
+    /**
+     * The name of the attribute. This value is called `Display Name` in the Descope console.
      */
     name: pulumi.Input<string>;
     /**
@@ -168,7 +172,11 @@ export interface ProjectAttributesTenantAuthorization {
 }
 export interface ProjectAttributesUser {
     /**
-     * The name of the attribute.
+     * An optional identifier for the attribute. This value is called `Machine Name` in the Descope console. If a value is not provided then an appropriate one will be created from the value of `name`.
+     */
+    id?: pulumi.Input<string>;
+    /**
+     * The name of the attribute. This value is called `Display Name` in the Descope console.
      */
     name: pulumi.Input<string>;
     /**
@@ -402,6 +410,10 @@ export interface ProjectAuthenticationOauthCustom {
      * The type of grants (`authorizationCode` or `implicit`) to allow when requesting access tokens from the OAuth provider.
      */
     allowedGrantTypes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The apple key generator object describing how to create a dynamic apple client secret for applications.
+     */
+    appleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthCustomAppleKeyGenerator>;
     /**
      * The URL that users are redirected to for authorization with the OAuth provider.
      */
@@ -452,6 +464,18 @@ export interface ProjectAuthenticationOauthCustom {
      * Whether to merge existing user accounts with new ones created through OAuth authentication.
      */
     mergeUserAccounts?: pulumi.Input<boolean>;
+    /**
+     * The apple key generator object describing how to create a dynamic native apple client secret for mobile apps.
+     */
+    nativeAppleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthCustomNativeAppleKeyGenerator>;
+    /**
+     * The client ID for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientId?: pulumi.Input<string>;
+    /**
+     * The client secret for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientSecret?: pulumi.Input<string>;
     /**
      * Custom prompts or consent screens that users may see during OAuth authentication.
      */
@@ -472,11 +496,43 @@ export interface ProjectAuthenticationOauthCustom {
      * The URL where the application requests an access token from the OAuth provider.
      */
     tokenEndpoint?: pulumi.Input<string>;
+    /**
+     * Use private key JWT (client assertion) instead of client secret.
+     */
+    useClientAssertion?: pulumi.Input<boolean>;
     /**
      * The URL where the application retrieves user information from the OAuth provider.
      */
     userInfoEndpoint?: pulumi.Input<string>;
 }
+export interface ProjectAuthenticationOauthCustomAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
+export interface ProjectAuthenticationOauthCustomNativeAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
 export interface ProjectAuthenticationOauthCustomProviderTokenManagement {
 }
 export interface ProjectAuthenticationOauthSystem {
@@ -522,6 +578,10 @@ export interface ProjectAuthenticationOauthSystemApple {
      * The type of grants (`authorizationCode` or `implicit`) to allow when requesting access tokens from the OAuth provider.
      */
     allowedGrantTypes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The apple key generator object describing how to create a dynamic apple client secret for applications.
+     */
+    appleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemAppleAppleKeyGenerator>;
     /**
      * The URL that users are redirected to for authorization with the OAuth provider.
      */
@@ -572,6 +632,18 @@ export interface ProjectAuthenticationOauthSystemApple {
      * Whether to merge existing user accounts with new ones created through OAuth authentication.
      */
     mergeUserAccounts?: pulumi.Input<boolean>;
+    /**
+     * The apple key generator object describing how to create a dynamic native apple client secret for mobile apps.
+     */
+    nativeAppleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemAppleNativeAppleKeyGenerator>;
+    /**
+     * The client ID for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientId?: pulumi.Input<string>;
+    /**
+     * The client secret for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientSecret?: pulumi.Input<string>;
     /**
      * Custom prompts or consent screens that users may see during OAuth authentication.
      */
@@ -592,11 +664,43 @@ export interface ProjectAuthenticationOauthSystemApple {
      * The URL where the application requests an access token from the OAuth provider.
      */
     tokenEndpoint?: pulumi.Input<string>;
+    /**
+     * Use private key JWT (client assertion) instead of client secret.
+     */
+    useClientAssertion?: pulumi.Input<boolean>;
     /**
      * The URL where the application retrieves user information from the OAuth provider.
      */
     userInfoEndpoint?: pulumi.Input<string>;
 }
+export interface ProjectAuthenticationOauthSystemAppleAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
+export interface ProjectAuthenticationOauthSystemAppleNativeAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
 export interface ProjectAuthenticationOauthSystemAppleProviderTokenManagement {
 }
 export interface ProjectAuthenticationOauthSystemDiscord {
@@ -604,6 +708,10 @@ export interface ProjectAuthenticationOauthSystemDiscord {
      * The type of grants (`authorizationCode` or `implicit`) to allow when requesting access tokens from the OAuth provider.
      */
     allowedGrantTypes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The apple key generator object describing how to create a dynamic apple client secret for applications.
+     */
+    appleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemDiscordAppleKeyGenerator>;
     /**
      * The URL that users are redirected to for authorization with the OAuth provider.
      */
@@ -654,6 +762,18 @@ export interface ProjectAuthenticationOauthSystemDiscord {
      * Whether to merge existing user accounts with new ones created through OAuth authentication.
      */
     mergeUserAccounts?: pulumi.Input<boolean>;
+    /**
+     * The apple key generator object describing how to create a dynamic native apple client secret for mobile apps.
+     */
+    nativeAppleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemDiscordNativeAppleKeyGenerator>;
+    /**
+     * The client ID for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientId?: pulumi.Input<string>;
+    /**
+     * The client secret for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientSecret?: pulumi.Input<string>;
     /**
      * Custom prompts or consent screens that users may see during OAuth authentication.
      */
@@ -674,11 +794,43 @@ export interface ProjectAuthenticationOauthSystemDiscord {
      * The URL where the application requests an access token from the OAuth provider.
      */
     tokenEndpoint?: pulumi.Input<string>;
+    /**
+     * Use private key JWT (client assertion) instead of client secret.
+     */
+    useClientAssertion?: pulumi.Input<boolean>;
     /**
      * The URL where the application retrieves user information from the OAuth provider.
      */
     userInfoEndpoint?: pulumi.Input<string>;
 }
+export interface ProjectAuthenticationOauthSystemDiscordAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
+export interface ProjectAuthenticationOauthSystemDiscordNativeAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
 export interface ProjectAuthenticationOauthSystemDiscordProviderTokenManagement {
 }
 export interface ProjectAuthenticationOauthSystemFacebook {
@@ -686,6 +838,10 @@ export interface ProjectAuthenticationOauthSystemFacebook {
      * The type of grants (`authorizationCode` or `implicit`) to allow when requesting access tokens from the OAuth provider.
      */
     allowedGrantTypes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The apple key generator object describing how to create a dynamic apple client secret for applications.
+     */
+    appleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemFacebookAppleKeyGenerator>;
     /**
      * The URL that users are redirected to for authorization with the OAuth provider.
      */
@@ -736,6 +892,18 @@ export interface ProjectAuthenticationOauthSystemFacebook {
      * Whether to merge existing user accounts with new ones created through OAuth authentication.
      */
     mergeUserAccounts?: pulumi.Input<boolean>;
+    /**
+     * The apple key generator object describing how to create a dynamic native apple client secret for mobile apps.
+     */
+    nativeAppleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemFacebookNativeAppleKeyGenerator>;
+    /**
+     * The client ID for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientId?: pulumi.Input<string>;
+    /**
+     * The client secret for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientSecret?: pulumi.Input<string>;
     /**
      * Custom prompts or consent screens that users may see during OAuth authentication.
      */
@@ -756,11 +924,43 @@ export interface ProjectAuthenticationOauthSystemFacebook {
      * The URL where the application requests an access token from the OAuth provider.
      */
     tokenEndpoint?: pulumi.Input<string>;
+    /**
+     * Use private key JWT (client assertion) instead of client secret.
+     */
+    useClientAssertion?: pulumi.Input<boolean>;
     /**
      * The URL where the application retrieves user information from the OAuth provider.
      */
     userInfoEndpoint?: pulumi.Input<string>;
 }
+export interface ProjectAuthenticationOauthSystemFacebookAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
+export interface ProjectAuthenticationOauthSystemFacebookNativeAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
 export interface ProjectAuthenticationOauthSystemFacebookProviderTokenManagement {
 }
 export interface ProjectAuthenticationOauthSystemGithub {
@@ -768,6 +968,10 @@ export interface ProjectAuthenticationOauthSystemGithub {
      * The type of grants (`authorizationCode` or `implicit`) to allow when requesting access tokens from the OAuth provider.
      */
     allowedGrantTypes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The apple key generator object describing how to create a dynamic apple client secret for applications.
+     */
+    appleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemGithubAppleKeyGenerator>;
     /**
      * The URL that users are redirected to for authorization with the OAuth provider.
      */
@@ -818,6 +1022,18 @@ export interface ProjectAuthenticationOauthSystemGithub {
      * Whether to merge existing user accounts with new ones created through OAuth authentication.
      */
     mergeUserAccounts?: pulumi.Input<boolean>;
+    /**
+     * The apple key generator object describing how to create a dynamic native apple client secret for mobile apps.
+     */
+    nativeAppleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemGithubNativeAppleKeyGenerator>;
+    /**
+     * The client ID for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientId?: pulumi.Input<string>;
+    /**
+     * The client secret for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientSecret?: pulumi.Input<string>;
     /**
      * Custom prompts or consent screens that users may see during OAuth authentication.
      */
@@ -838,11 +1054,43 @@ export interface ProjectAuthenticationOauthSystemGithub {
      * The URL where the application requests an access token from the OAuth provider.
      */
     tokenEndpoint?: pulumi.Input<string>;
+    /**
+     * Use private key JWT (client assertion) instead of client secret.
+     */
+    useClientAssertion?: pulumi.Input<boolean>;
     /**
      * The URL where the application retrieves user information from the OAuth provider.
      */
     userInfoEndpoint?: pulumi.Input<string>;
 }
+export interface ProjectAuthenticationOauthSystemGithubAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
+export interface ProjectAuthenticationOauthSystemGithubNativeAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
 export interface ProjectAuthenticationOauthSystemGithubProviderTokenManagement {
 }
 export interface ProjectAuthenticationOauthSystemGitlab {
@@ -850,6 +1098,10 @@ export interface ProjectAuthenticationOauthSystemGitlab {
      * The type of grants (`authorizationCode` or `implicit`) to allow when requesting access tokens from the OAuth provider.
      */
     allowedGrantTypes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The apple key generator object describing how to create a dynamic apple client secret for applications.
+     */
+    appleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemGitlabAppleKeyGenerator>;
     /**
      * The URL that users are redirected to for authorization with the OAuth provider.
      */
@@ -900,6 +1152,18 @@ export interface ProjectAuthenticationOauthSystemGitlab {
      * Whether to merge existing user accounts with new ones created through OAuth authentication.
      */
     mergeUserAccounts?: pulumi.Input<boolean>;
+    /**
+     * The apple key generator object describing how to create a dynamic native apple client secret for mobile apps.
+     */
+    nativeAppleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemGitlabNativeAppleKeyGenerator>;
+    /**
+     * The client ID for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientId?: pulumi.Input<string>;
+    /**
+     * The client secret for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientSecret?: pulumi.Input<string>;
     /**
      * Custom prompts or consent screens that users may see during OAuth authentication.
      */
@@ -920,11 +1184,43 @@ export interface ProjectAuthenticationOauthSystemGitlab {
      * The URL where the application requests an access token from the OAuth provider.
      */
     tokenEndpoint?: pulumi.Input<string>;
+    /**
+     * Use private key JWT (client assertion) instead of client secret.
+     */
+    useClientAssertion?: pulumi.Input<boolean>;
     /**
      * The URL where the application retrieves user information from the OAuth provider.
      */
     userInfoEndpoint?: pulumi.Input<string>;
 }
+export interface ProjectAuthenticationOauthSystemGitlabAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
+export interface ProjectAuthenticationOauthSystemGitlabNativeAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
 export interface ProjectAuthenticationOauthSystemGitlabProviderTokenManagement {
 }
 export interface ProjectAuthenticationOauthSystemGoogle {
@@ -932,6 +1228,10 @@ export interface ProjectAuthenticationOauthSystemGoogle {
      * The type of grants (`authorizationCode` or `implicit`) to allow when requesting access tokens from the OAuth provider.
      */
     allowedGrantTypes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The apple key generator object describing how to create a dynamic apple client secret for applications.
+     */
+    appleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemGoogleAppleKeyGenerator>;
     /**
      * The URL that users are redirected to for authorization with the OAuth provider.
      */
@@ -982,6 +1282,18 @@ export interface ProjectAuthenticationOauthSystemGoogle {
      * Whether to merge existing user accounts with new ones created through OAuth authentication.
      */
     mergeUserAccounts?: pulumi.Input<boolean>;
+    /**
+     * The apple key generator object describing how to create a dynamic native apple client secret for mobile apps.
+     */
+    nativeAppleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemGoogleNativeAppleKeyGenerator>;
+    /**
+     * The client ID for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientId?: pulumi.Input<string>;
+    /**
+     * The client secret for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientSecret?: pulumi.Input<string>;
     /**
      * Custom prompts or consent screens that users may see during OAuth authentication.
      */
@@ -1002,11 +1314,43 @@ export interface ProjectAuthenticationOauthSystemGoogle {
      * The URL where the application requests an access token from the OAuth provider.
      */
     tokenEndpoint?: pulumi.Input<string>;
+    /**
+     * Use private key JWT (client assertion) instead of client secret.
+     */
+    useClientAssertion?: pulumi.Input<boolean>;
     /**
      * The URL where the application retrieves user information from the OAuth provider.
      */
     userInfoEndpoint?: pulumi.Input<string>;
 }
+export interface ProjectAuthenticationOauthSystemGoogleAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
+export interface ProjectAuthenticationOauthSystemGoogleNativeAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
 export interface ProjectAuthenticationOauthSystemGoogleProviderTokenManagement {
 }
 export interface ProjectAuthenticationOauthSystemLinkedin {
@@ -1014,6 +1358,10 @@ export interface ProjectAuthenticationOauthSystemLinkedin {
      * The type of grants (`authorizationCode` or `implicit`) to allow when requesting access tokens from the OAuth provider.
      */
     allowedGrantTypes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The apple key generator object describing how to create a dynamic apple client secret for applications.
+     */
+    appleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemLinkedinAppleKeyGenerator>;
     /**
      * The URL that users are redirected to for authorization with the OAuth provider.
      */
@@ -1064,6 +1412,18 @@ export interface ProjectAuthenticationOauthSystemLinkedin {
      * Whether to merge existing user accounts with new ones created through OAuth authentication.
      */
     mergeUserAccounts?: pulumi.Input<boolean>;
+    /**
+     * The apple key generator object describing how to create a dynamic native apple client secret for mobile apps.
+     */
+    nativeAppleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemLinkedinNativeAppleKeyGenerator>;
+    /**
+     * The client ID for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientId?: pulumi.Input<string>;
+    /**
+     * The client secret for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientSecret?: pulumi.Input<string>;
     /**
      * Custom prompts or consent screens that users may see during OAuth authentication.
      */
@@ -1084,11 +1444,43 @@ export interface ProjectAuthenticationOauthSystemLinkedin {
      * The URL where the application requests an access token from the OAuth provider.
      */
     tokenEndpoint?: pulumi.Input<string>;
+    /**
+     * Use private key JWT (client assertion) instead of client secret.
+     */
+    useClientAssertion?: pulumi.Input<boolean>;
     /**
      * The URL where the application retrieves user information from the OAuth provider.
      */
     userInfoEndpoint?: pulumi.Input<string>;
 }
+export interface ProjectAuthenticationOauthSystemLinkedinAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
+export interface ProjectAuthenticationOauthSystemLinkedinNativeAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
 export interface ProjectAuthenticationOauthSystemLinkedinProviderTokenManagement {
 }
 export interface ProjectAuthenticationOauthSystemMicrosoft {
@@ -1096,6 +1488,10 @@ export interface ProjectAuthenticationOauthSystemMicrosoft {
      * The type of grants (`authorizationCode` or `implicit`) to allow when requesting access tokens from the OAuth provider.
      */
     allowedGrantTypes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The apple key generator object describing how to create a dynamic apple client secret for applications.
+     */
+    appleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemMicrosoftAppleKeyGenerator>;
     /**
      * The URL that users are redirected to for authorization with the OAuth provider.
      */
@@ -1146,6 +1542,18 @@ export interface ProjectAuthenticationOauthSystemMicrosoft {
      * Whether to merge existing user accounts with new ones created through OAuth authentication.
      */
     mergeUserAccounts?: pulumi.Input<boolean>;
+    /**
+     * The apple key generator object describing how to create a dynamic native apple client secret for mobile apps.
+     */
+    nativeAppleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemMicrosoftNativeAppleKeyGenerator>;
+    /**
+     * The client ID for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientId?: pulumi.Input<string>;
+    /**
+     * The client secret for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientSecret?: pulumi.Input<string>;
     /**
      * Custom prompts or consent screens that users may see during OAuth authentication.
      */
@@ -1166,11 +1574,43 @@ export interface ProjectAuthenticationOauthSystemMicrosoft {
      * The URL where the application requests an access token from the OAuth provider.
      */
     tokenEndpoint?: pulumi.Input<string>;
+    /**
+     * Use private key JWT (client assertion) instead of client secret.
+     */
+    useClientAssertion?: pulumi.Input<boolean>;
     /**
      * The URL where the application retrieves user information from the OAuth provider.
      */
     userInfoEndpoint?: pulumi.Input<string>;
 }
+export interface ProjectAuthenticationOauthSystemMicrosoftAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
+export interface ProjectAuthenticationOauthSystemMicrosoftNativeAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
 export interface ProjectAuthenticationOauthSystemMicrosoftProviderTokenManagement {
 }
 export interface ProjectAuthenticationOauthSystemSlack {
@@ -1178,6 +1618,10 @@ export interface ProjectAuthenticationOauthSystemSlack {
      * The type of grants (`authorizationCode` or `implicit`) to allow when requesting access tokens from the OAuth provider.
      */
     allowedGrantTypes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The apple key generator object describing how to create a dynamic apple client secret for applications.
+     */
+    appleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemSlackAppleKeyGenerator>;
     /**
      * The URL that users are redirected to for authorization with the OAuth provider.
      */
@@ -1228,6 +1672,18 @@ export interface ProjectAuthenticationOauthSystemSlack {
      * Whether to merge existing user accounts with new ones created through OAuth authentication.
      */
     mergeUserAccounts?: pulumi.Input<boolean>;
+    /**
+     * The apple key generator object describing how to create a dynamic native apple client secret for mobile apps.
+     */
+    nativeAppleKeyGenerator?: pulumi.Input<inputs.ProjectAuthenticationOauthSystemSlackNativeAppleKeyGenerator>;
+    /**
+     * The client ID for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientId?: pulumi.Input<string>;
+    /**
+     * The client secret for the OAuth provider, used for Sign in with Apple in mobile apps.
+     */
+    nativeClientSecret?: pulumi.Input<string>;
     /**
      * Custom prompts or consent screens that users may see during OAuth authentication.
      */
@@ -1248,11 +1704,43 @@ export interface ProjectAuthenticationOauthSystemSlack {
      * The URL where the application requests an access token from the OAuth provider.
      */
     tokenEndpoint?: pulumi.Input<string>;
+    /**
+     * Use private key JWT (client assertion) instead of client secret.
+     */
+    useClientAssertion?: pulumi.Input<boolean>;
     /**
      * The URL where the application retrieves user information from the OAuth provider.
      */
     userInfoEndpoint?: pulumi.Input<string>;
 }
+export interface ProjectAuthenticationOauthSystemSlackAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
+export interface ProjectAuthenticationOauthSystemSlackNativeAppleKeyGenerator {
+    /**
+     * The apple generator key id produced by Apple.
+     */
+    keyId: pulumi.Input<string>;
+    /**
+     * The apple generator private key produced by Apple.
+     */
+    privateKey: pulumi.Input<string>;
+    /**
+     * The apple generator team id assigned to the key by Apple.
+     */
+    teamId: pulumi.Input<string>;
+}
 export interface ProjectAuthenticationOauthSystemSlackProviderTokenManagement {
 }
 export interface ProjectAuthenticationOtp {
@@ -1407,6 +1895,10 @@ export interface ProjectAuthenticationPassword {
      * Whether passwords must contain at least one lowercase letter.
      */
     lowercase?: pulumi.Input<boolean>;
+    /**
+     * Prevents information about user accounts from being revealed in error messages, e.g., whether a user already exists.
+     */
+    maskErrors?: pulumi.Input<boolean>;
     /**
      * The minimum length of the password that users are required to use. The maximum length is always `64`.
      */
@@ -1427,6 +1919,18 @@ export interface ProjectAuthenticationPassword {
      * The number of previous passwords whose hashes are kept to prevent users from reusing old passwords.
      */
     reuseAmount?: pulumi.Input<number>;
+    /**
+     * Whether the user account should be temporarily locked after a specified number of failed login attempts.
+     */
+    temporaryLock?: pulumi.Input<boolean>;
+    /**
+     * The number of failed login attempts allowed before an account is temporarily locked.
+     */
+    temporaryLockAttempts?: pulumi.Input<number>;
+    /**
+     * The amount of time before the user can sign in again after the account is temporarily locked.
+     */
+    temporaryLockDuration?: pulumi.Input<string>;
     /**
      * Whether passwords must contain at least one uppercase letter.
      */
@@ -1470,6 +1974,10 @@ export interface ProjectAuthenticationPasswordEmailServiceTemplate {
     usePlainTextBody?: pulumi.Input<boolean>;
 }
 export interface ProjectAuthenticationSso {
+    /**
+     * Whether to allow duplicate SSO domains across tenants.
+     */
+    allowDuplicateDomains?: pulumi.Input<boolean>;
     /**
      * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
@@ -1478,12 +1986,54 @@ export interface ProjectAuthenticationSso {
      * Whether to merge existing user accounts with new ones created through SSO authentication.
      */
     mergeUsers?: pulumi.Input<boolean>;
+    /**
+     * The URL the end user is redirected to after a successful authentication. If one is specified in tenant level settings or SDK/API call, they will override this value.
+     */
+    redirectUrl?: pulumi.Input<string>;
+    /**
+     * Configuration block for the SSO Suite.
+     */
+    ssoSuiteSettings?: pulumi.Input<inputs.ProjectAuthenticationSsoSsoSuiteSettings>;
+}
+export interface ProjectAuthenticationSsoSsoSuiteSettings {
+    /**
+     * Setting this to `true` will allow only verified domains to be used.
+     */
+    forceDomainVerification?: pulumi.Input<boolean>;
+    /**
+     * Setting this to `true` will hide the domains configuration section in the SSO Suite interface.
+     */
+    hideDomains?: pulumi.Input<boolean>;
+    /**
+     * Setting this to `true` will hide the groups mapping configuration section in the SSO Suite interface.
+     */
+    hideGroupsMapping?: pulumi.Input<boolean>;
+    /**
+     * Setting this to `true` will hide the OIDC configuration option.
+     */
+    hideOidc?: pulumi.Input<boolean>;
+    /**
+     * Setting this to `true` will hide the SAML configuration option.
+     */
+    hideSaml?: pulumi.Input<boolean>;
+    /**
+     * Setting this to `true` will hide the SCIM configuration in the SSO Suite interface.
+     */
+    hideScim?: pulumi.Input<boolean>;
+    /**
+     * Specifies the style ID to apply in the SSO Suite. Ensure a style with this ID exists in the console for it to be used.
+     */
+    styleId?: pulumi.Input<string>;
 }
 export interface ProjectAuthenticationTotp {
     /**
      * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
     disabled?: pulumi.Input<boolean>;
+    /**
+     * The template for the service issuer label (issuer) shown in the authenticator app.
+     */
+    serviceLabel?: pulumi.Input<string>;
 }
 export interface ProjectAuthorization {
     /**
@@ -1507,11 +2057,16 @@ export interface ProjectAuthorizationPermission {
     name: pulumi.Input<string>;
 }
 export interface ProjectAuthorizationRole {
+    /**
+     * Whether this role should automatically be assigned to users that are created without any roles.
+     */
+    default?: pulumi.Input<boolean>;
     /**
      * A description for the role.
      */
     description?: pulumi.Input<string>;
     id?: pulumi.Input<string>;
+    key?: pulumi.Input<string>;
     /**
      * A name for the role.
      */
@@ -1520,6 +2075,10 @@ export interface ProjectAuthorizationRole {
      * A list of permissions by name to be included in the role.
      */
     permissions?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Whether this role should not be displayed to tenant admins.
+     */
+    private?: pulumi.Input<boolean>;
 }
 export interface ProjectConnectors {
     /**
@@ -1543,13 +2102,9 @@ export interface ProjectConnectors {
      */
     awsTranslates?: pulumi.Input<pulumi.Input<inputs.ProjectConnectorsAwsTranslate>[]>;
     /**
-     * Add sophisticated identity verification processes to your user journey with the CLEAR Verified connector.
-     */
-    clears?: pulumi.Input<pulumi.Input<inputs.ProjectConnectorsClear>[]>;
-    /**
-     * Utilize threat intelligence to block malicious login attempts or check leaks with the Cybersixgill connector.
+     * Utilize threat intelligence to block malicious login attempts or check leaks with the Bitsight Threat Intelligence connector.
      */
-    cybersixgills?: pulumi.Input<pulumi.Input<inputs.ProjectConnectorsCybersixgill>[]>;
+    bitsights?: pulumi.Input<pulumi.Input<inputs.ProjectConnectorsBitsight>[]>;
     /**
      * Stream authentication audit logs with the Datadog connector.
      */
@@ -1602,6 +2157,10 @@ export interface ProjectConnectors {
      * Send messages using a generic SMS gateway.
      */
     genericSmsGateways?: pulumi.Input<pulumi.Input<inputs.ProjectConnectorsGenericSmsGateway>[]>;
+    /**
+     * Stream logs and audit events with the Google Cloud Logging connector.
+     */
+    googleCloudLoggings?: pulumi.Input<pulumi.Input<inputs.ProjectConnectorsGoogleCloudLogging>[]>;
     /**
      * Localize the language of your login and user journey screens with the Google Cloud Translation connector.
      */
@@ -1866,7 +2425,7 @@ export interface ProjectConnectorsAwsS3 {
     /**
      * The authentication type to use.
      */
-    authType: pulumi.Input<string>;
+    authType?: pulumi.Input<string>;
     /**
      * The AWS S3 bucket. This bucket should already exist for the connector to work.
      */
@@ -1942,32 +2501,13 @@ export interface ProjectConnectorsAwsTranslate {
      */
     sessionToken?: pulumi.Input<string>;
 }
-export interface ProjectConnectorsClear {
-    /**
-     * Your CLEAR API key.
-     */
-    apiKey: pulumi.Input<string>;
+export interface ProjectConnectorsBitsight {
     /**
-     * A description of what your connector is used for.
-     */
-    description?: pulumi.Input<string>;
-    id?: pulumi.Input<string>;
-    /**
-     * A custom name for your connector.
-     */
-    name: pulumi.Input<string>;
-    /**
-     * Your CLEAR project ID.
-     */
-    projectId: pulumi.Input<string>;
-}
-export interface ProjectConnectorsCybersixgill {
-    /**
-     * API Client ID issued when you create the credentials in Cybersixgill.
+     * API Client ID issued when you create the credentials in Bitsight Threat Intelligence.
      */
     clientId: pulumi.Input<string>;
     /**
-     * Client secret issued when you create the credentials in Cybersixgill.
+     * Client secret issued when you create the credentials in Bitsight Threat Intelligence.
      */
     clientSecret: pulumi.Input<string>;
     /**
@@ -2461,6 +3001,47 @@ export interface ProjectConnectorsGenericSmsGatewayAuthenticationBasic {
      */
     username: pulumi.Input<string>;
 }
+export interface ProjectConnectorsGoogleCloudLogging {
+    /**
+     * Whether to enable streaming of audit events.
+     */
+    auditEnabled?: pulumi.Input<boolean>;
+    /**
+     * Specify which events will be sent to the external audit service (including tenant selection).
+     */
+    auditFilters?: pulumi.Input<pulumi.Input<inputs.ProjectConnectorsGoogleCloudLoggingAuditFilter>[]>;
+    /**
+     * A description of what your connector is used for.
+     */
+    description?: pulumi.Input<string>;
+    id?: pulumi.Input<string>;
+    /**
+     * A custom name for your connector.
+     */
+    name: pulumi.Input<string>;
+    /**
+     * A Service Account Key JSON file created from a service account on your Google Cloud project. This file is used to authenticate and authorize the connector to access Google Cloud Logging. The service account this key belongs to must have the appropriate permissions to write logs.
+     */
+    serviceAccountKey: pulumi.Input<string>;
+    /**
+     * Whether to send troubleshooting events.
+     */
+    troubleshootLogEnabled?: pulumi.Input<boolean>;
+}
+export interface ProjectConnectorsGoogleCloudLoggingAuditFilter {
+    /**
+     * The field name to filter on (either 'actions' or 'tenants').
+     */
+    key: pulumi.Input<string>;
+    /**
+     * The filter operation to apply ('includes' or 'excludes').
+     */
+    operator: pulumi.Input<string>;
+    /**
+     * The list of values to match against for the filter.
+     */
+    values: pulumi.Input<pulumi.Input<string>[]>;
+}
 export interface ProjectConnectorsGoogleCloudTranslation {
     /**
      * A description of what your connector is used for.
@@ -2840,6 +3421,14 @@ export interface ProjectConnectorsRecaptchaEnterprise {
      * When configured, the Recaptcha action will return the score without assessing the request. The score ranges between 0 and 1, where 1 is a human interaction and 0 is a bot.
      */
     assessmentScore?: pulumi.Input<number>;
+    /**
+     * Apply a custom url to the reCAPTCHA Enterprise scripts. This is useful when attempting to use reCAPTCHA globally. Defaults to https://www.google.com
+     */
+    baseUrl?: pulumi.Input<string>;
+    /**
+     * The bot threshold is used to determine whether the request is a bot or a human. The score ranges between 0 and 1, where 1 is a human interaction and 0 is a bot. If the score is below this threshold, the request is considered a bot.
+     */
+    botThreshold?: pulumi.Input<number>;
     /**
      * A description of what your connector is used for.
      */
@@ -2970,7 +3559,11 @@ export interface ProjectConnectorsSe {
     /**
      * AWS Access key ID.
      */
-    accessKeyId: pulumi.Input<string>;
+    accessKeyId?: pulumi.Input<string>;
+    /**
+     * The authentication type to use.
+     */
+    authType?: pulumi.Input<string>;
     /**
      * A description of what your connector is used for.
      */
@@ -2979,6 +3572,10 @@ export interface ProjectConnectorsSe {
      * An optional endpoint URL (hostname only or fully qualified URI).
      */
     endpoint?: pulumi.Input<string>;
+    /**
+     * The external ID to use when assuming the role.
+     */
+    externalId?: pulumi.Input<string>;
     id?: pulumi.Input<string>;
     /**
      * A custom name for your connector.
@@ -2988,10 +3585,14 @@ export interface ProjectConnectorsSe {
      * AWS region to send requests to (e.g. `us-west-2`).
      */
     region: pulumi.Input<string>;
+    /**
+     * The Amazon Resource Name (ARN) of the role to assume.
+     */
+    roleArn?: pulumi.Input<string>;
     /**
      * AWS Secret Access Key.
      */
-    secret: pulumi.Input<string>;
+    secret?: pulumi.Input<string>;
     /**
      * The sender details that should be displayed in the email message.
      */
@@ -3183,9 +3784,15 @@ export interface ProjectConnectorsSn {
      */
     name: pulumi.Input<string>;
     /**
-     * An optional phone number from which the text messages are going to be sent. Make sure it is registered properly in your server.
+     * Use the `originationNumber` attribute instead.
+     *
+     * @deprecated The organizationNumber attribute has been renamed, set the originationNumber attribute instead. This attribute will be removed in a future version of the provider.
      */
     organizationNumber?: pulumi.Input<string>;
+    /**
+     * An optional phone number from which the text messages are going to be sent. Make sure it is registered properly in your server.
+     */
+    originationNumber?: pulumi.Input<string>;
     /**
      * AWS region to send requests to (e.g. `us-west-2`).
      */
@@ -3245,6 +3852,20 @@ export interface ProjectConnectorsSumologicAuditFilter {
     values: pulumi.Input<pulumi.Input<string>[]>;
 }
 export interface ProjectConnectorsSupabase {
+    /**
+     * The authentication type to use.
+     */
+    authType?: pulumi.Input<string>;
+    /**
+     * Enable to automatically create users in Supabase when generating tokens. Will only create a new user if one does not already exist. When disabled, only JWT tokens will be generated, WITHOUT user creation.
+     */
+    createUsers?: pulumi.Input<boolean>;
+    /**
+     * A mapping of Descope user fields or JWT claims to Supabase custom claims
+     */
+    customClaimsMapping?: pulumi.Input<{
+        [key: string]: pulumi.Input<string>;
+    }>;
     /**
      * A description of what your connector is used for.
      */
@@ -3258,10 +3879,22 @@ export interface ProjectConnectorsSupabase {
      * A custom name for your connector.
      */
     name: pulumi.Input<string>;
+    /**
+     * The private key in JWK format used to sign the JWT. You can generate a key using tools like `npx supabase gen signing-key --algorithm ES256`. Make sure to use the ES256 algorithm.
+     */
+    privateKey?: pulumi.Input<string>;
+    /**
+     * Your Supabase Project's API base URL, e.g.: https://\n\n.supabase.co.
+     */
+    projectBaseUrl?: pulumi.Input<string>;
+    /**
+     * The service role API key for your Supabase project, required to create users.
+     */
+    serviceRoleApiKey?: pulumi.Input<string>;
     /**
      * The signing secret for your Supabase project.
      */
-    signingSecret: pulumi.Input<string>;
+    signingSecret?: pulumi.Input<string>;
 }
 export interface ProjectConnectorsTelesign {
     /**
@@ -3435,6 +4068,18 @@ export interface ProjectInviteSettings {
      * Whether to include a magic link token in invitation messages.
      */
     addMagiclinkToken?: pulumi.Input<boolean>;
+    /**
+     * Settings related to sending invitation emails.
+     */
+    emailService?: pulumi.Input<inputs.ProjectInviteSettingsEmailService>;
+    /**
+     * Expire the user account if the invitation is not accepted within the expiration time.
+     */
+    expireInvitedUsers?: pulumi.Input<boolean>;
+    /**
+     * The expiry time for the invitation, meant to be used together with `expireInvitedUsers` and/or `addMagiclinkToken`. Use values such as "2 weeks", "4 days", etc. The minimum value is "1 hour".
+     */
+    inviteExpiration?: pulumi.Input<string>;
     /**
      * Custom URL to include in the message sent to invited users.
      */
@@ -3452,6 +4097,43 @@ export interface ProjectInviteSettings {
      */
     sendText?: pulumi.Input<boolean>;
 }
+export interface ProjectInviteSettingsEmailService {
+    /**
+     * The name of the email connector to use for sending emails.
+     */
+    connector: pulumi.Input<string>;
+    /**
+     * A list of email templates for different authentication flows.
+     */
+    templates?: pulumi.Input<pulumi.Input<inputs.ProjectInviteSettingsEmailServiceTemplate>[]>;
+}
+export interface ProjectInviteSettingsEmailServiceTemplate {
+    /**
+     * Whether this email template is currently active and in use.
+     */
+    active?: pulumi.Input<boolean>;
+    /**
+     * HTML content of the email message body, required if `usePlainTextBody` isn't set.
+     */
+    htmlBody?: pulumi.Input<string>;
+    id?: pulumi.Input<string>;
+    /**
+     * Unique name for this email template.
+     */
+    name: pulumi.Input<string>;
+    /**
+     * Plain text version of the email message body, required if `usePlainTextBody` is set to `true`.
+     */
+    plainTextBody?: pulumi.Input<string>;
+    /**
+     * Subject line of the email message.
+     */
+    subject: pulumi.Input<string>;
+    /**
+     * Whether to use the plain text body instead of HTML for the email.
+     */
+    usePlainTextBody?: pulumi.Input<boolean>;
+}
 export interface ProjectJwtTemplates {
     /**
      * A list of `Access Key` type JWT Templates.
@@ -3638,7 +4320,7 @@ export interface ProjectProjectSettingsSessionMigration {
     /**
      * The unique client ID for the vendor.
      */
-    clientId: pulumi.Input<string>;
+    clientId?: pulumi.Input<string>;
     /**
      * The domain value if needed by the vendor.
      */
@@ -3650,11 +4332,11 @@ export interface ProjectProjectSettingsSessionMigration {
     /**
      * A set of attributes from the vendor's user that should be used to match with the Descope user's login ID.
      */
-    loginidMatchedAttributes: pulumi.Input<pulumi.Input<string>[]>;
+    loginidMatchedAttributes?: pulumi.Input<pulumi.Input<string>[]>;
     /**
      * The name of the vendor the sessions are migrated from, in all lowercase.
      */
-    vendor: pulumi.Input<string>;
+    vendor?: pulumi.Input<string>;
 }
 export interface ProjectStyles {
     /**
@@ -3662,3 +4344,9 @@ export interface ProjectStyles {
      */
     data: pulumi.Input<string>;
 }
+export interface ProjectWidgets {
+    /**
+     * The JSON data defining the widget. This will usually be exported as a `.json` file from the Descope console, and set in the `.tf` file using the `data = file("...")` syntax.
+     */
+    data: pulumi.Input<string>;
+}