@descope/pulumi-descope 0.3.13 → 0.3.16

package/types/output.d.ts

@@ -204,6 +204,10 @@ export interface ProjectApplicationsOidcApplication {
      * Disables the `authorizationCode` grant type for this application.
      */
     authorizationCodeDisabled: boolean;
+    /**
+     * The URL that Descope notifies with a logout token when the user's session ends, as per the [OIDC Back-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html) specification. Leave empty to disable back-channel logout notifications for this application.
+     */
+    backchannelLogoutUrl: string;
     /**
      * A list of supported claims. e.g. `sub`, `email`, `exp`.
      */
@@ -225,7 +229,11 @@ export interface ProjectApplicationsOidcApplication {
      */
     clientType: string;
     /**
-     * Controls the default `aud` claim of tokens issued for this application. One of `"projectId"` (the project ID only), `"clientId"` (the dedicated client ID only), or `""` (default — both). Only applies to modern apps that set a `clientType`; legacy apps always use the project ID, so the empty default leaves their behavior unchanged.
+     * A custom login page URL to redirect users to on IdP-initiated login flows, instead of the default login page.
+     */
+    customIdpInitiatedLoginPageUrl: string;
+    /**
+     * Controls the default `aud` claim of tokens issued for this application. One of `"projectId"` (the project ID only), `"clientId"` (the dedicated client ID only), `"appId"` (the application ID only), `"empty"` (no `aud` claim at all), or `""` (default — both the project ID and the client ID). Only applies to modern apps that set a `clientType`; legacy apps always use the project ID, so the empty default leaves their behavior unchanged.
      */
     defaultAudience: string;
     /**
@@ -274,6 +282,10 @@ export interface ProjectApplicationsOidcApplication {
      */
     refreshTokenDisabled: boolean;
     roles: outputs.ProjectApplicationsOidcApplicationRole[];
+    /**
+     * Controls the audience values appended to the issued token's `aud` claim for trusted sibling applications. One of `"projectId"`, `"clientId"`, `"appId"`, `"empty"` (add none), or `""` (default — both the project ID and the client ID). Independent of `defaultAudience`.
+     */
+    trustedAppsAudience: string;
 }
 export interface ProjectApplicationsOidcApplicationPermission {
     description: string;
@@ -2562,6 +2574,10 @@ export interface ProjectAuthenticationSsoSsoSuiteSettings {
      * Setting this to `true` will hide the domains configuration section in the SSO Suite interface.
      */
     hideDomains: boolean;
+    /**
+     * Setting this to `true` will hide the FGA mapping configuration section in the SSO Suite interface.
+     */
+    hideFgaMapping: boolean;
     /**
      * Setting this to `true` will hide the groups mapping configuration section in the SSO Suite interface.
      */
@@ -2574,6 +2590,10 @@ export interface ProjectAuthenticationSsoSsoSuiteSettings {
      * Setting this to `true` will hide the OIDC configuration option.
      */
     hideOidc: boolean;
+    /**
+     * Setting this to `true` will hide the role mapping configuration section in the SSO Suite interface.
+     */
+    hideRoleMapping: boolean;
     /**
      * Setting this to `true` will hide the SAML configuration option.
      */
@@ -2640,6 +2660,9 @@ export interface ProjectAuthorizationRole {
      */
     description: string;
     id: string;
+    /**
+     * A persistent value that identifies a role uniquely across plan changes and configuration updates. It is used exclusively by the Terraform provider during planning, to ensure that user roles are maintained consistently even when role names or other details are changed. Once the `key` is set it should never be changed, otherwise the role will be removed and a new one will be created instead.
+     */
     key: string;
     /**
      * A name for the role.
@@ -3053,6 +3076,10 @@ export interface ProjectConnectorsAuditWebhook {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     /**
      * The headers to send with the request
      */
@@ -3100,6 +3127,10 @@ export interface ProjectConnectorsAuditWebhookAuthentication {
      * Bearer token for HTTP authentication.
      */
     bearerToken: string;
+    /**
+     * OAuth 2.0 client credentials configuration used to fetch an access token before making requests.
+     */
+    oauth2ClientCredentials: outputs.ProjectConnectorsAuditWebhookAuthenticationOauth2ClientCredentials;
 }
 export interface ProjectConnectorsAuditWebhookAuthenticationApiKey {
     /**
@@ -3121,6 +3152,34 @@ export interface ProjectConnectorsAuditWebhookAuthenticationBasic {
      */
     username: string;
 }
+export interface ProjectConnectorsAuditWebhookAuthenticationOauth2ClientCredentials {
+    /**
+     * How the client credentials are sent to the token endpoint. Either `header` to send them in the `Authorization` header, or `body` to send them in the request body.
+     */
+    authStyle: string;
+    /**
+     * The token endpoint URL used to request an access token.
+     */
+    authUrl: string;
+    /**
+     * The OAuth 2.0 client ID used to authenticate against the token endpoint.
+     */
+    clientId: string;
+    /**
+     * The OAuth 2.0 client secret used to authenticate against the token endpoint.
+     */
+    clientSecret: string;
+    /**
+     * A space-separated list of OAuth scopes to request when fetching the access token.
+     */
+    scopes: string;
+    /**
+     * Additional headers to include in the token request sent to the token endpoint.
+     */
+    tokenRequestHeaders: {
+        [key: string]: string;
+    };
+}
 export interface ProjectConnectorsAwsS3 {
     /**
      * The unique AWS access key ID.
@@ -3146,6 +3205,10 @@ export interface ProjectConnectorsAwsS3 {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     /**
      * The external ID to use when assuming the role.
      */
@@ -3203,6 +3266,10 @@ export interface ProjectConnectorsAwsSesEmailValidation {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     /**
      * The external ID to use when assuming the role.
      */
@@ -3238,6 +3305,10 @@ export interface ProjectConnectorsAwsTranslate {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     id: string;
     /**
      * A custom name for your connector.
@@ -3445,6 +3516,10 @@ export interface ProjectConnectorsDatadog {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     id: string;
     /**
      * Whether to mask personally identifiable information in the logs.
@@ -3654,6 +3729,10 @@ export interface ProjectConnectorsExternalTokenHttpAuthentication {
      * Bearer token for HTTP authentication.
      */
     bearerToken: string;
+    /**
+     * OAuth 2.0 client credentials configuration used to fetch an access token before making requests.
+     */
+    oauth2ClientCredentials: outputs.ProjectConnectorsExternalTokenHttpAuthenticationOauth2ClientCredentials;
 }
 export interface ProjectConnectorsExternalTokenHttpAuthenticationApiKey {
     /**
@@ -3675,6 +3754,34 @@ export interface ProjectConnectorsExternalTokenHttpAuthenticationBasic {
      */
     username: string;
 }
+export interface ProjectConnectorsExternalTokenHttpAuthenticationOauth2ClientCredentials {
+    /**
+     * How the client credentials are sent to the token endpoint. Either `header` to send them in the `Authorization` header, or `body` to send them in the request body.
+     */
+    authStyle: string;
+    /**
+     * The token endpoint URL used to request an access token.
+     */
+    authUrl: string;
+    /**
+     * The OAuth 2.0 client ID used to authenticate against the token endpoint.
+     */
+    clientId: string;
+    /**
+     * The OAuth 2.0 client secret used to authenticate against the token endpoint.
+     */
+    clientSecret: string;
+    /**
+     * A space-separated list of OAuth scopes to request when fetching the access token.
+     */
+    scopes: string;
+    /**
+     * Additional headers to include in the token request sent to the token endpoint.
+     */
+    tokenRequestHeaders: {
+        [key: string]: string;
+    };
+}
 export interface ProjectConnectorsFingerprint {
     /**
      * The Cloudflare integration Endpoint URL.
@@ -3726,6 +3833,10 @@ export interface ProjectConnectorsFirebaseAdmin {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     id: string;
     /**
      * A custom name for your connector.
@@ -3825,6 +3936,10 @@ export interface ProjectConnectorsGenericEmailGatewayAuthentication {
      * Bearer token for HTTP authentication.
      */
     bearerToken: string;
+    /**
+     * OAuth 2.0 client credentials configuration used to fetch an access token before making requests.
+     */
+    oauth2ClientCredentials: outputs.ProjectConnectorsGenericEmailGatewayAuthenticationOauth2ClientCredentials;
 }
 export interface ProjectConnectorsGenericEmailGatewayAuthenticationApiKey {
     /**
@@ -3846,6 +3961,34 @@ export interface ProjectConnectorsGenericEmailGatewayAuthenticationBasic {
      */
     username: string;
 }
+export interface ProjectConnectorsGenericEmailGatewayAuthenticationOauth2ClientCredentials {
+    /**
+     * How the client credentials are sent to the token endpoint. Either `header` to send them in the `Authorization` header, or `body` to send them in the request body.
+     */
+    authStyle: string;
+    /**
+     * The token endpoint URL used to request an access token.
+     */
+    authUrl: string;
+    /**
+     * The OAuth 2.0 client ID used to authenticate against the token endpoint.
+     */
+    clientId: string;
+    /**
+     * The OAuth 2.0 client secret used to authenticate against the token endpoint.
+     */
+    clientSecret: string;
+    /**
+     * A space-separated list of OAuth scopes to request when fetching the access token.
+     */
+    scopes: string;
+    /**
+     * Additional headers to include in the token request sent to the token endpoint.
+     */
+    tokenRequestHeaders: {
+        [key: string]: string;
+    };
+}
 export interface ProjectConnectorsGenericSmsGateway {
     /**
      * Authentication Information
@@ -3900,6 +4043,10 @@ export interface ProjectConnectorsGenericSmsGatewayAuthentication {
      * Bearer token for HTTP authentication.
      */
     bearerToken: string;
+    /**
+     * OAuth 2.0 client credentials configuration used to fetch an access token before making requests.
+     */
+    oauth2ClientCredentials: outputs.ProjectConnectorsGenericSmsGatewayAuthenticationOauth2ClientCredentials;
 }
 export interface ProjectConnectorsGenericSmsGatewayAuthenticationApiKey {
     /**
@@ -3921,6 +4068,34 @@ export interface ProjectConnectorsGenericSmsGatewayAuthenticationBasic {
      */
     username: string;
 }
+export interface ProjectConnectorsGenericSmsGatewayAuthenticationOauth2ClientCredentials {
+    /**
+     * How the client credentials are sent to the token endpoint. Either `header` to send them in the `Authorization` header, or `body` to send them in the request body.
+     */
+    authStyle: string;
+    /**
+     * The token endpoint URL used to request an access token.
+     */
+    authUrl: string;
+    /**
+     * The OAuth 2.0 client ID used to authenticate against the token endpoint.
+     */
+    clientId: string;
+    /**
+     * The OAuth 2.0 client secret used to authenticate against the token endpoint.
+     */
+    clientSecret: string;
+    /**
+     * A space-separated list of OAuth scopes to request when fetching the access token.
+     */
+    scopes: string;
+    /**
+     * Additional headers to include in the token request sent to the token endpoint.
+     */
+    tokenRequestHeaders: {
+        [key: string]: string;
+    };
+}
 export interface ProjectConnectorsGoogleCloudLogging {
     /**
      * Whether to enable streaming of audit events.
@@ -3934,6 +4109,10 @@ export interface ProjectConnectorsGoogleCloudLogging {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     id: string;
     /**
      * A custom name for your connector.
@@ -3967,6 +4146,10 @@ export interface ProjectConnectorsGoogleCloudTranslation {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     id: string;
     /**
      * A custom name for your connector.
@@ -4093,6 +4276,10 @@ export interface ProjectConnectorsHibp {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     id: string;
     /**
      * A custom name for your connector.
@@ -4140,6 +4327,10 @@ export interface ProjectConnectorsHttp {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     /**
      * The headers to send with the request
      */
@@ -4201,6 +4392,10 @@ export interface ProjectConnectorsHttpAuthentication {
      * Bearer token for HTTP authentication.
      */
     bearerToken: string;
+    /**
+     * OAuth 2.0 client credentials configuration used to fetch an access token before making requests.
+     */
+    oauth2ClientCredentials: outputs.ProjectConnectorsHttpAuthenticationOauth2ClientCredentials;
 }
 export interface ProjectConnectorsHttpAuthenticationApiKey {
     /**
@@ -4222,6 +4417,34 @@ export interface ProjectConnectorsHttpAuthenticationBasic {
      */
     username: string;
 }
+export interface ProjectConnectorsHttpAuthenticationOauth2ClientCredentials {
+    /**
+     * How the client credentials are sent to the token endpoint. Either `header` to send them in the `Authorization` header, or `body` to send them in the request body.
+     */
+    authStyle: string;
+    /**
+     * The token endpoint URL used to request an access token.
+     */
+    authUrl: string;
+    /**
+     * The OAuth 2.0 client ID used to authenticate against the token endpoint.
+     */
+    clientId: string;
+    /**
+     * The OAuth 2.0 client secret used to authenticate against the token endpoint.
+     */
+    clientSecret: string;
+    /**
+     * A space-separated list of OAuth scopes to request when fetching the access token.
+     */
+    scopes: string;
+    /**
+     * Additional headers to include in the token request sent to the token endpoint.
+     */
+    tokenRequestHeaders: {
+        [key: string]: string;
+    };
+}
 export interface ProjectConnectorsHubspot {
     /**
      * The HubSpot private API access token generated for the Descope service.
@@ -4586,6 +4809,10 @@ export interface ProjectConnectorsOpentelemetryAuthentication {
      * Bearer token for HTTP authentication.
      */
     bearerToken: string;
+    /**
+     * OAuth 2.0 client credentials configuration used to fetch an access token before making requests.
+     */
+    oauth2ClientCredentials: outputs.ProjectConnectorsOpentelemetryAuthenticationOauth2ClientCredentials;
 }
 export interface ProjectConnectorsOpentelemetryAuthenticationApiKey {
     /**
@@ -4607,6 +4834,34 @@ export interface ProjectConnectorsOpentelemetryAuthenticationBasic {
      */
     username: string;
 }
+export interface ProjectConnectorsOpentelemetryAuthenticationOauth2ClientCredentials {
+    /**
+     * How the client credentials are sent to the token endpoint. Either `header` to send them in the `Authorization` header, or `body` to send them in the request body.
+     */
+    authStyle: string;
+    /**
+     * The token endpoint URL used to request an access token.
+     */
+    authUrl: string;
+    /**
+     * The OAuth 2.0 client ID used to authenticate against the token endpoint.
+     */
+    clientId: string;
+    /**
+     * The OAuth 2.0 client secret used to authenticate against the token endpoint.
+     */
+    clientSecret: string;
+    /**
+     * A space-separated list of OAuth scopes to request when fetching the access token.
+     */
+    scopes: string;
+    /**
+     * Additional headers to include in the token request sent to the token endpoint.
+     */
+    tokenRequestHeaders: {
+        [key: string]: string;
+    };
+}
 export interface ProjectConnectorsPendo {
     /**
      * Whether to enable streaming of audit events.
@@ -4661,6 +4916,10 @@ export interface ProjectConnectorsPingDirectory {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     /**
      * PingDirectory's REST API host.
      */
@@ -4781,6 +5040,10 @@ export interface ProjectConnectorsRecaptchaEnterprise {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     id: string;
     /**
      * A custom name for your connector.
@@ -4843,6 +5106,10 @@ export interface ProjectConnectorsRekognition {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     id: string;
     /**
      * A custom name for your connector.
@@ -4889,6 +5156,10 @@ export interface ProjectConnectorsSalesforce {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     id: string;
     /**
      * A custom name for your connector.
@@ -4916,6 +5187,10 @@ export interface ProjectConnectorsSalesforceMarketingCloud {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     id: string;
     /**
      * A custom name for your connector.
@@ -5007,6 +5282,10 @@ export interface ProjectConnectorsScimAuthentication {
      * Bearer token for HTTP authentication.
      */
     bearerToken: string;
+    /**
+     * OAuth 2.0 client credentials configuration used to fetch an access token before making requests.
+     */
+    oauth2ClientCredentials: outputs.ProjectConnectorsScimAuthenticationOauth2ClientCredentials;
 }
 export interface ProjectConnectorsScimAuthenticationApiKey {
     /**
@@ -5028,6 +5307,34 @@ export interface ProjectConnectorsScimAuthenticationBasic {
      */
     username: string;
 }
+export interface ProjectConnectorsScimAuthenticationOauth2ClientCredentials {
+    /**
+     * How the client credentials are sent to the token endpoint. Either `header` to send them in the `Authorization` header, or `body` to send them in the request body.
+     */
+    authStyle: string;
+    /**
+     * The token endpoint URL used to request an access token.
+     */
+    authUrl: string;
+    /**
+     * The OAuth 2.0 client ID used to authenticate against the token endpoint.
+     */
+    clientId: string;
+    /**
+     * The OAuth 2.0 client secret used to authenticate against the token endpoint.
+     */
+    clientSecret: string;
+    /**
+     * A space-separated list of OAuth scopes to request when fetching the access token.
+     */
+    scopes: string;
+    /**
+     * Additional headers to include in the token request sent to the token endpoint.
+     */
+    tokenRequestHeaders: {
+        [key: string]: string;
+    };
+}
 export interface ProjectConnectorsSe {
     /**
      * AWS Access key ID.
@@ -5140,6 +5447,10 @@ export interface ProjectConnectorsSlack {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     id: string;
     /**
      * A custom name for your connector.
@@ -5239,6 +5550,10 @@ export interface ProjectConnectorsSn {
      * AWS Access key ID.
      */
     accessKeyId: string;
+    /**
+     * The authentication type to use.
+     */
+    authType: string;
     /**
      * A description of what your connector is used for.
      */
@@ -5251,6 +5566,10 @@ export interface ProjectConnectorsSn {
      * The entity ID or principal entity (PE) ID for sending text messages to recipients in India.
      */
     entityId: string;
+    /**
+     * The external ID to use when assuming the role.
+     */
+    externalId: string;
     id: string;
     /**
      * A custom name for your connector.
@@ -5270,6 +5589,10 @@ export interface ProjectConnectorsSn {
      * AWS region to send requests to (e.g. `us-west-2`).
      */
     region: string;
+    /**
+     * The Amazon Resource Name (ARN) of the role to assume.
+     */
+    roleArn: string;
     /**
      * AWS Secret Access Key.
      */
@@ -5308,6 +5631,10 @@ export interface ProjectConnectorsSnowflake {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     id: string;
     /**
      * Whether to mask personally identifiable information in the logs.
@@ -5365,6 +5692,10 @@ export interface ProjectConnectorsSplunk {
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ID of the Descope Engine that runs this connector's actions inside your private network. Leave empty to run the connector in the Descope backend.
+     */
+    engineId: string;
     /**
      * An HTTP Event Collector token configured on your Splunk project.
      */
@@ -5950,6 +6281,10 @@ export interface ProjectProjectSettings {
      * The expiry time for access key session tokens. Use values such as "10 minutes", "4 hours", etc. The value needs to be at least 3 minutes and can't be longer than 4 weeks.
      */
     accessKeySessionTokenExpiration: string;
+    /**
+     * When enabled, Descope-hosted flows can be displayed within an iframe on your website. This modifies the security headers that typically prevent the page from being embedded.
+     */
+    allowAuthHostingIframeEmbedding: boolean;
     /**
      * The URL which your application resides on.
      */