@descope/pulumi-descope 0.3.2 → 0.3.13

package/types/output.d.ts

@@ -1,4 +1,186 @@
 import * as outputs from "../types/output";
+export interface AccessKeyTenant {
+    /**
+     * The roles the access key will be granted within the tenant.
+     */
+    roles: string[];
+    /**
+     * The ID of the tenant to associate with the access key.
+     */
+    tenantId: string;
+}
+export interface DescoperRbac {
+    /**
+     * Whether this descoper has company-wide admin access. When set to `true`, the descoper cannot have `tagRoles` or `projectRoles`.
+     */
+    isCompanyAdmin: boolean;
+    /**
+     * A list of roles that are granted to the descoper for specific projects by their project ID.
+     */
+    projectRoles: outputs.DescoperRbacProjectRole[];
+    /**
+     * A list of roles that are granted to the descoper for all projects that have a specific tag.
+     */
+    tagRoles: outputs.DescoperRbacTagRole[];
+}
+export interface DescoperRbacProjectRole {
+    /**
+     * The project IDs this role grant applies to.
+     */
+    projectIds: string[];
+    /**
+     * The roles the descoper will be granted in the applicable projects. Must be one of: `admin`, `developer`, `support`, `auditor`.
+     */
+    role: string;
+}
+export interface DescoperRbacTagRole {
+    /**
+     * The role the descoper will be granted in the applicable projects. Must be one of: `admin`, `developer`, `support`, `auditor`.
+     */
+    role: string;
+    /**
+     * The project tags this role assignment applies to.
+     */
+    tags: string[];
+}
+export interface InboundAppAttributesScope {
+    /**
+     * A description for the scope.
+     */
+    description: string;
+    /**
+     * A name for the scope.
+     */
+    name: string;
+    /**
+     * Whether this scope is optional. When `false`, the scope is mandatory and must be granted during authorization. When `true`, the user may choose to withhold it.
+     */
+    optional: boolean;
+    /**
+     * The identifiers of the relevant permission, attribute or connection scopes.
+     */
+    values: string[];
+}
+export interface InboundAppConnectionsScope {
+    /**
+     * A description for the scope.
+     */
+    description: string;
+    /**
+     * A name for the scope.
+     */
+    name: string;
+    /**
+     * Whether this scope is optional. When `false`, the scope is mandatory and must be granted during authorization. When `true`, the user may choose to withhold it.
+     */
+    optional: boolean;
+    /**
+     * The identifiers of the relevant permission, attribute or connection scopes.
+     */
+    values: string[];
+}
+export interface InboundAppPermissionsScope {
+    /**
+     * A description for the scope.
+     */
+    description: string;
+    /**
+     * A name for the scope.
+     */
+    name: string;
+    /**
+     * Whether this scope is optional. When `false`, the scope is mandatory and must be granted during authorization. When `true`, the user may choose to withhold it.
+     */
+    optional: boolean;
+    /**
+     * The identifiers of the relevant permission, attribute or connection scopes.
+     */
+    values: string[];
+}
+export interface InboundAppSessionSettings {
+    /**
+     * Whether to override the project's session settings.
+     */
+    enabled: boolean;
+    /**
+     * The expiration duration for access key session tokens. Must be between 3 minutes and one month.
+     */
+    keySessionTokenExpiration: string;
+    /**
+     * The ID of the JWT template to use for access key JWTs issued to this inbound app.
+     */
+    keyTemplateId: string;
+    /**
+     * The expiration duration for refresh tokens issued to this inbound app.
+     */
+    refreshTokenExpiration: string;
+    /**
+     * The expiration duration for session tokens issued to this inbound app.
+     */
+    sessionTokenExpiration: string;
+    /**
+     * The ID of the JWT template to use for user JWTs issued to this inbound app.
+     */
+    userTemplateId: string;
+}
+export interface ManagementKeyRebac {
+    /**
+     * A list of company-level role names that are granted to the management key. This attribute is mutually exclusive with `tagRoles` and `projectRoles`.
+     */
+    companyRoles: string[];
+    /**
+     * A list of project-level role names that are granted to the management key for specific projects by their project ID.
+     */
+    projectRoles: outputs.ManagementKeyRebacProjectRole[];
+    /**
+     * A list of project-level role names that are granted to the management key for all projects that have a specific tag.
+     */
+    tagRoles: outputs.ManagementKeyRebacTagRole[];
+}
+export interface ManagementKeyRebacProjectRole {
+    /**
+     * The project IDs this role grant applies to.
+     */
+    projectIds: string[];
+    /**
+     * The roles the management key will be granted in the applicable projects.
+     */
+    roles: string[];
+}
+export interface ManagementKeyRebacTagRole {
+    /**
+     * The roles the management key will be granted in the applicable projects.
+     */
+    roles: string[];
+    /**
+     * The project tags this role grant applies to.
+     */
+    tags: string[];
+}
+export interface ProjectAdminPortal {
+    /**
+     * Whether the Admin Portal is enabled
+     */
+    enabled: boolean;
+    /**
+     * The style id to use
+     */
+    styleId: string;
+    /**
+     * The widgets to show in the Admin Portal
+     */
+    widgets: outputs.ProjectAdminPortalWidget[];
+}
+export interface ProjectAdminPortalWidget {
+    /**
+     * The type of the Widget
+     */
+    type: string;
+    /**
+     * The unique identifier of the Widget
+     */
+    widgetId: string;
+}
 export interface ProjectApplications {
     /**
      * Applications using OpenID Connect (OIDC) for authentication.
@@ -8,16 +190,52 @@ export interface ProjectApplications {
      * Applications using SAML for authentication.
      */
     samlApplications: outputs.ProjectApplicationsSamlApplication[];
+    /**
+     * Applications using WS-Federation for authentication.
+     */
+    wsfedApplications: outputs.ProjectApplicationsWsfedApplication[];
 }
 export interface ProjectApplicationsOidcApplication {
+    /**
+     * A list of approved redirect URLs for this application (supports `*` wildcards). When set, redirect URIs are validated against this per-app list; when empty, validation falls back to the project's approved/trusted domains.
+     */
+    approvedRedirectUrls: string[];
+    /**
+     * Disables the `authorizationCode` grant type for this application.
+     */
+    authorizationCodeDisabled: boolean;
     /**
      * A list of supported claims. e.g. `sub`, `email`, `exp`.
      */
     claims: string[];
+    /**
+     * Disables the `clientCredentials` grant type for this application.
+     */
+    clientCredentialsDisabled: boolean;
+    /**
+     * A dedicated OIDC `clientId` to import for this application. When omitted, the `clientId` is computed by the server; when set, it must be unique within the project. Can only be set when the application is created, and attempting to change it on an existing application will fail.
+     */
+    clientId: string;
+    /**
+     * A dedicated OIDC `clientSecret` to import for this application, applied on creation only. When omitted, a secret is generated server-side. The value is sensitive and is not returned on subsequent reads.
+     */
+    clientSecret: string;
+    /**
+     * OAuth client confidentiality. One of `""` (default — legacy access-key authentication), `"confidential"` (a dedicated client secret is generated for the app), or `"public"`.
+     */
+    clientType: string;
+    /**
+     * Controls the default `aud` claim of tokens issued for this application. One of `"projectId"` (the project ID only), `"clientId"` (the dedicated client ID only), or `""` (default — both). Only applies to modern apps that set a `clientType`; legacy apps always use the project ID, so the empty default leaves their behavior unchanged.
+     */
+    defaultAudience: string;
     /**
      * A description for the OIDC application.
      */
     description: string;
+    /**
+     * Disables the `urn:ietf:params:oauth:grant-type:device_code` grant type for this application.
+     */
+    deviceCodeDisabled: boolean;
     /**
      * Whether the application should be enabled or disabled.
      */
@@ -26,10 +244,18 @@ export interface ProjectApplicationsOidcApplication {
      * This configuration overrides the default behavior of the SSO application and forces the user to authenticate via the Descope flow, regardless of the SP's request.
      */
     forceAuthentication: boolean;
+    /**
+     * When enabled, the authorization code flow requires PKCE in addition to the normal client authentication. A confidential client must then present both its client secret and a valid PKCE `codeVerifier`. Public clients always use PKCE regardless of this setting.
+     */
+    forcePkce: boolean;
     /**
      * An optional identifier for the OIDC application.
      */
     id: string;
+    /**
+     * Disables the `urn:ietf:params:oauth:grant-type:jwt-bearer` grant type for this application.
+     */
+    jwtBearerDisabled: boolean;
     /**
      * The Flow Hosting URL. Read more about using this parameter with custom domain [here](https://docs.descope.com/sso-integrations/applications/saml-apps).
      */
@@ -42,6 +268,24 @@ export interface ProjectApplicationsOidcApplication {
      * A name for the OIDC application.
      */
     name: string;
+    permissions: outputs.ProjectApplicationsOidcApplicationPermission[];
+    /**
+     * Disables the `refreshToken` grant type for this application.
+     */
+    refreshTokenDisabled: boolean;
+    roles: outputs.ProjectApplicationsOidcApplicationRole[];
+}
+export interface ProjectApplicationsOidcApplicationPermission {
+    description: string;
+    id: string;
+    name: string;
+}
+export interface ProjectApplicationsOidcApplicationRole {
+    description: string;
+    id: string;
+    name: string;
+    permissions: string[];
+    roleMappings: string[];
 }
 export interface ProjectApplicationsSamlApplication {
     /**
@@ -56,6 +300,10 @@ export interface ProjectApplicationsSamlApplication {
      * The default relay state. When using IdP-initiated authentication, this value may be used as a URL to a resource in the Service Provider.
      */
     defaultRelayState: string;
+    /**
+     * The signature algorithm used to sign SAML responses. Choose one of `""` (default, SHA-1) or `"sha256"` (SHA-256). Only applies to IdP-initiated flows — SP-initiated flows use the algorithm specified in the SP's SAML request.
+     */
+    defaultSignatureAlgorithm: string;
     /**
      * A description for the SAML application.
      */
@@ -92,6 +340,8 @@ export interface ProjectApplicationsSamlApplication {
      * A name for the SAML application.
      */
     name: string;
+    permissions: outputs.ProjectApplicationsSamlApplicationPermission[];
+    roles: outputs.ProjectApplicationsSamlApplicationRole[];
     /**
      * The subject name id format. Choose one of "", "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified", "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent", "urn:oasis:names:tc:SAML:2.0:nameid-format:transient". Read more about this configuration [here](https://docs.descope.com/sso-integrations/applications/saml-apps).
      */
@@ -131,16 +381,178 @@ export interface ProjectApplicationsSamlApplicationManualConfiguration {
      */
     entityId: string;
 }
+export interface ProjectApplicationsSamlApplicationPermission {
+    description: string;
+    id: string;
+    name: string;
+}
+export interface ProjectApplicationsSamlApplicationRole {
+    description: string;
+    id: string;
+    name: string;
+    permissions: string[];
+    roleMappings: string[];
+}
+export interface ProjectApplicationsWsfedApplication {
+    /**
+     * A list of attribute mappings from Descope user attributes to WS-Fed assertion attributes.
+     */
+    attributeMappings: outputs.ProjectApplicationsWsfedApplicationAttributeMapping[];
+    /**
+     * A description for the WS-Fed application.
+     */
+    description: string;
+    /**
+     * Whether the application should be enabled or disabled.
+     */
+    disabled: boolean;
+    /**
+     * The URL to redirect to when an error occurs.
+     */
+    errorRedirectUrl: string;
+    /**
+     * This configuration overrides the default behavior of the SSO application and forces the user to authenticate via the Descope flow, regardless of the SP's request.
+     */
+    forceAuthentication: boolean;
+    /**
+     * A list of group mappings from Descope roles to WS-Fed groups.
+     */
+    groupsMappings: outputs.ProjectApplicationsWsfedApplicationGroupsMapping[];
+    /**
+     * An optional identifier for the WS-Fed application.
+     */
+    id: string;
+    /**
+     * The Flow Hosting URL.
+     */
+    loginPageUrl: string;
+    /**
+     * A logo for the WS-Fed application. Should be a hosted image URL.
+     */
+    logo: string;
+    /**
+     * The URL to redirect to after logout.
+     */
+    logoutRedirectUrl: string;
+    /**
+     * A name for the WS-Fed application.
+     */
+    name: string;
+    permissions: outputs.ProjectApplicationsWsfedApplicationPermission[];
+    /**
+     * The WS-Fed realm identifier for the application.
+     */
+    realm: string;
+    /**
+     * Additional allowed `wreply` callback URLs beyond `replyUrl`. Each entry may include the `*` wildcard. When the RP supplies a `wreply` parameter, it must match either the default `replyUrl` or one of these patterns.
+     */
+    replyAllowedCallbackUrls: string[];
+    /**
+     * The default reply URL where WS-Fed responses are sent. Used for IdP-initiated flows and when no `wreply` is supplied by the RP.
+     */
+    replyUrl: string;
+    roles: outputs.ProjectApplicationsWsfedApplicationRole[];
+}
+export interface ProjectApplicationsWsfedApplicationAttributeMapping {
+    /**
+     * The name of the attribute.
+     */
+    name: string;
+    /**
+     * The value of the attribute.
+     */
+    value: string;
+}
+export interface ProjectApplicationsWsfedApplicationGroupsMapping {
+    /**
+     * The filter type for the groups mapping.
+     */
+    filterType: string;
+    /**
+     * The name of the groups mapping.
+     */
+    name: string;
+    /**
+     * The `RoleGroupMapping` object. A list of roles mapped to this group.
+     */
+    roles: outputs.ProjectApplicationsWsfedApplicationGroupsMappingRole[];
+    /**
+     * The type of the groups mapping.
+     */
+    type: string;
+    /**
+     * The value of the groups mapping.
+     */
+    value: string;
+}
+export interface ProjectApplicationsWsfedApplicationGroupsMappingRole {
+    /**
+     * The identifier of the role.
+     */
+    id: string;
+    /**
+     * The name of the role.
+     */
+    name: string;
+}
+export interface ProjectApplicationsWsfedApplicationPermission {
+    description: string;
+    id: string;
+    name: string;
+}
+export interface ProjectApplicationsWsfedApplicationRole {
+    description: string;
+    id: string;
+    name: string;
+    permissions: string[];
+    roleMappings: string[];
+}
 export interface ProjectAttributes {
     /**
-     * A list of `TenantAttribute`. Read the description below.
+     * A list of custom attributes for storing additional details about each access key in the project.
+     */
+    accessKeys: outputs.ProjectAttributesAccessKey[];
+    /**
+     * A list of custom attributes for storing additional details about each tenant in the project.
      */
     tenants: outputs.ProjectAttributesTenant[];
     /**
-     * A list of `UserAttribute`. Read the description below.
+     * A list of custom attributes for storing additional details about each user in the project.
      */
     users: outputs.ProjectAttributesUser[];
 }
+export interface ProjectAttributesAccessKey {
+    /**
+     * An optional identifier for the attribute. This value is called `Machine Name` in the Descope console. If a value is not provided then an appropriate one will be created from the value of `name`.
+     */
+    id: string;
+    /**
+     * The name of the attribute. This value is called `Display Name` in the Descope console.
+     */
+    name: string;
+    /**
+     * When the attribute type is "multiselect". A list of options to choose from.
+     */
+    selectOptions: string[];
+    /**
+     * The type of the attribute. Choose one of "string", "number", "boolean", "singleselect", "multiselect", "date".
+     */
+    type: string;
+    /**
+     * Determines the permissions access key are required to have to access this attribute in the access key management widget.
+     */
+    widgetAuthorization: outputs.ProjectAttributesAccessKeyWidgetAuthorization;
+}
+export interface ProjectAttributesAccessKeyWidgetAuthorization {
+    /**
+     * The permissions users are required to have to edit this attribute in the access key management widget.
+     */
+    editPermissions: string[];
+    /**
+     * The permissions users are required to have to view this attribute in the access key management widget.
+     */
+    viewPermissions: string[];
+}
 export interface ProjectAttributesTenant {
     /**
      * Determines the required permissions for this tenant.
@@ -440,7 +852,11 @@ export interface ProjectAuthenticationOauthCustom {
      */
     description: string;
     /**
-     * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
+     * By default the user attribute mapping configuration is used to update the user's attributes automatically during sign in. Disable this if you want this to happen only during user creation.
+     */
+    disableJitUpdates: boolean;
+    /**
+     * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
     disabled: boolean;
     /**
@@ -607,6 +1023,10 @@ export interface ProjectAuthenticationOauthSystemApple {
      * A brief description of the OAuth provider.
      */
     description: string;
+    /**
+     * By default the user attribute mapping configuration is used to update the user's attributes automatically during sign in. Disable this if you want this to happen only during user creation.
+     */
+    disableJitUpdates: boolean;
     /**
      * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
@@ -737,6 +1157,10 @@ export interface ProjectAuthenticationOauthSystemDiscord {
      * A brief description of the OAuth provider.
      */
     description: string;
+    /**
+     * By default the user attribute mapping configuration is used to update the user's attributes automatically during sign in. Disable this if you want this to happen only during user creation.
+     */
+    disableJitUpdates: boolean;
     /**
      * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
@@ -867,6 +1291,10 @@ export interface ProjectAuthenticationOauthSystemFacebook {
      * A brief description of the OAuth provider.
      */
     description: string;
+    /**
+     * By default the user attribute mapping configuration is used to update the user's attributes automatically during sign in. Disable this if you want this to happen only during user creation.
+     */
+    disableJitUpdates: boolean;
     /**
      * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
@@ -997,6 +1425,10 @@ export interface ProjectAuthenticationOauthSystemGithub {
      * A brief description of the OAuth provider.
      */
     description: string;
+    /**
+     * By default the user attribute mapping configuration is used to update the user's attributes automatically during sign in. Disable this if you want this to happen only during user creation.
+     */
+    disableJitUpdates: boolean;
     /**
      * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
@@ -1127,6 +1559,10 @@ export interface ProjectAuthenticationOauthSystemGitlab {
      * A brief description of the OAuth provider.
      */
     description: string;
+    /**
+     * By default the user attribute mapping configuration is used to update the user's attributes automatically during sign in. Disable this if you want this to happen only during user creation.
+     */
+    disableJitUpdates: boolean;
     /**
      * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
@@ -1257,6 +1693,10 @@ export interface ProjectAuthenticationOauthSystemGoogle {
      * A brief description of the OAuth provider.
      */
     description: string;
+    /**
+     * By default the user attribute mapping configuration is used to update the user's attributes automatically during sign in. Disable this if you want this to happen only during user creation.
+     */
+    disableJitUpdates: boolean;
     /**
      * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
@@ -1387,6 +1827,10 @@ export interface ProjectAuthenticationOauthSystemLinkedin {
      * A brief description of the OAuth provider.
      */
     description: string;
+    /**
+     * By default the user attribute mapping configuration is used to update the user's attributes automatically during sign in. Disable this if you want this to happen only during user creation.
+     */
+    disableJitUpdates: boolean;
     /**
      * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
@@ -1517,6 +1961,10 @@ export interface ProjectAuthenticationOauthSystemMicrosoft {
      * A brief description of the OAuth provider.
      */
     description: string;
+    /**
+     * By default the user attribute mapping configuration is used to update the user's attributes automatically during sign in. Disable this if you want this to happen only during user creation.
+     */
+    disableJitUpdates: boolean;
     /**
      * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
@@ -1647,6 +2095,10 @@ export interface ProjectAuthenticationOauthSystemSlack {
      * A brief description of the OAuth provider.
      */
     description: string;
+    /**
+     * By default the user attribute mapping configuration is used to update the user's attributes automatically during sign in. Disable this if you want this to happen only during user creation.
+     */
+    disableJitUpdates: boolean;
     /**
      * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
@@ -1856,24 +2308,48 @@ export interface ProjectAuthenticationOtpVoiceServiceTemplate {
     name: string;
 }
 export interface ProjectAuthenticationPasskeys {
+    /**
+     * A list of SHA-256 APK key hash fingerprints (colon-separated hex, e.g. `AB:CD:EF:...`) that are allowed as passkey origins for Android apps. When set, only Android apps with a matching fingerprint will be permitted to use passkey authentication.
+     */
+    androidFingerprints: string[];
     /**
      * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
     disabled: boolean;
+    /**
+     * The human-friendly name shown to users when they create or use a passkey. Some password managers display this name, while others display the top level domain instead. When left empty, the project name is used.
+     */
+    displayName: string;
     /**
      * Passkeys will be usable in the following domain and all its subdomains.
      */
     topLevelDomain: string;
 }
 export interface ProjectAuthenticationPassword {
+    /**
+     * Whether passwords must contain at least one letter, either uppercase or lowercase.
+     */
+    anyLetter: boolean;
     /**
      * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
     disabled: boolean;
+    /**
+     * Whether to reject passwords that match the user's email address or its local-part (the segment before `@`), case-insensitively. The check is skipped if the user's email is not known at validation time.
+     */
+    disallowEmailMatch: boolean;
+    /**
+     * Reject passwords containing any of these characters. Each character in the string is treated as a forbidden literal (e.g., `"'"` to reject single and double quotes).
+     */
+    disallowedCharacters: string;
     /**
      * Settings related to sending password reset emails as part of the password feature.
      */
     emailService: outputs.ProjectAuthenticationPasswordEmailService;
+    /**
+     * Use zxcvbn to calculate the strength of a given password and enforce a minimum level of strength.
+     */
+    enforceStrength: string;
     /**
      * Whether users are required to change their password periodically.
      */
@@ -1977,10 +2453,38 @@ export interface ProjectAuthenticationSso {
      * Whether to allow duplicate SSO domains across tenants.
      */
     allowDuplicateDomains: boolean;
+    /**
+     * Whether to allow overriding user's roles with SSO related roles.
+     */
+    allowOverrideRoles: boolean;
+    /**
+     * Whether to block SSO login if the user's email domain doesn't match the configured SSO domains.
+     */
+    blockIfEmailDomainMismatch: boolean;
     /**
      * Setting this to `true` will disallow using this authentication method directly via API and SDK calls. Note that this does not affect authentication flows that are configured to use this authentication method.
      */
     disabled: boolean;
+    /**
+     * Settings related to sending SSO invite emails as part of the SSO feature.
+     */
+    emailService: outputs.ProjectAuthenticationSsoEmailService;
+    /**
+     * Whether to enable groups priority.
+     */
+    groupsPriority: boolean;
+    /**
+     * Mapping to attributes not specified in `mandatoryUserAttributes` is not allowed.
+     */
+    limitMappingToMandatoryAttributes: boolean;
+    /**
+     * Define the required Descope attributes that must be populated when receiving SSO information.
+     */
+    mandatoryUserAttributes: outputs.ProjectAuthenticationSsoMandatoryUserAttribute[];
+    /**
+     * Whether to mark the user's email as unverified when logging in via SSO.
+     */
+    markEmailAsUnverified: boolean;
     /**
      * Whether to merge existing user accounts with new ones created through SSO authentication.
      */
@@ -1989,11 +2493,66 @@ export interface ProjectAuthenticationSso {
      * The URL the end user is redirected to after a successful authentication. If one is specified in tenant level settings or SDK/API call, they will override this value.
      */
     redirectUrl: string;
+    /**
+     * When configuring SSO the groups attribute name must be specified.
+     */
+    requireGroupsAttributeName: boolean;
+    /**
+     * When configuring SSO an SSO domain must be specified.
+     */
+    requireSsoDomains: boolean;
     /**
      * Configuration block for the SSO Suite.
      */
     ssoSuiteSettings: outputs.ProjectAuthenticationSsoSsoSuiteSettings;
 }
+export interface ProjectAuthenticationSsoEmailService {
+    /**
+     * The name of the email connector to use for sending emails.
+     */
+    connector: string;
+    /**
+     * A list of email templates for different authentication flows.
+     */
+    templates: outputs.ProjectAuthenticationSsoEmailServiceTemplate[];
+}
+export interface ProjectAuthenticationSsoEmailServiceTemplate {
+    /**
+     * Whether this email template is currently active and in use.
+     */
+    active: boolean;
+    /**
+     * HTML content of the email message body, required if `usePlainTextBody` isn't set.
+     */
+    htmlBody: string;
+    id: string;
+    /**
+     * Unique name for this email template.
+     */
+    name: string;
+    /**
+     * Plain text version of the email message body, required if `usePlainTextBody` is set to `true`.
+     */
+    plainTextBody: string;
+    /**
+     * Subject line of the email message.
+     */
+    subject: string;
+    /**
+     * Whether to use the plain text body instead of HTML for the email.
+     */
+    usePlainTextBody: boolean;
+}
+export interface ProjectAuthenticationSsoMandatoryUserAttribute {
+    /**
+     * Whether the attribute is a custom attribute defined in addition to the default Descope user attributes.
+     */
+    custom: boolean;
+    /**
+     * The identifier for the attribute. This value is called `Machine Name` in the Descope console.
+     */
+    id: string;
+}
 export interface ProjectAuthenticationSsoSsoSuiteSettings {
     /**
      * Setting this to `true` will allow only verified domains to be used.
@@ -2007,6 +2566,10 @@ export interface ProjectAuthenticationSsoSsoSuiteSettings {
      * Setting this to `true` will hide the groups mapping configuration section in the SSO Suite interface.
      */
     hideGroupsMapping: boolean;
+    /**
+     * Whether to hide the JIT provisioning guide section in the SSO Suite hosted UI.
+     */
+    hideJitGuide: boolean;
     /**
      * Setting this to `true` will hide the OIDC configuration option.
      */
@@ -2019,10 +2582,18 @@ export interface ProjectAuthenticationSsoSsoSuiteSettings {
      * Setting this to `true` will hide the SCIM configuration in the SSO Suite interface.
      */
     hideScim: boolean;
+    /**
+     * Whether to display the help/support contact link in the SSO Suite UI.
+     */
+    showHelpContact: boolean;
     /**
      * Specifies the style ID to apply in the SSO Suite. Ensure a style with this ID exists in the console for it to be used.
      */
     styleId: string;
+    /**
+     * Email address shown to end-users in the SSO Suite UI as a support contact.
+     */
+    supportEmail: string;
 }
 export interface ProjectAuthenticationTotp {
     /**
@@ -2035,6 +2606,10 @@ export interface ProjectAuthenticationTotp {
     serviceLabel: string;
 }
 export interface ProjectAuthorization {
+    /**
+     * The project's FGA schema, configured in the [Descope console](https://app.descope.com/authorization/fga) under the FGA tab. Use the code view to get the schema text and paste it as the value for this attribute.
+     */
+    fga: string;
     /**
      * A list of `Permission` objects.
      */
@@ -2084,10 +2659,18 @@ export interface ProjectConnectors {
      * Utilize IP threat intelligence to block malicious login attempts with the AbuseIPDB connector.
      */
     abuseipdbs: outputs.ProjectConnectorsAbuseipdb[];
+    /**
+     * Streamline identity verification and fraud monitoring with the Alloy connector.
+     */
+    alloys: outputs.ProjectConnectorsAlloy[];
     /**
      * Track user activity and traits at any point in your user journey with the Amplitude connector.
      */
     amplitudes: outputs.ProjectConnectorsAmplitude[];
+    /**
+     * Use the Arkose connector to integrate with Arkose's bot and fraud detection.
+     */
+    arkoses: outputs.ProjectConnectorsArkose[];
     /**
      * Send audit events to a custom webhook.
      */
@@ -2096,6 +2679,10 @@ export interface ProjectConnectors {
      * Stream authentication audit logs with the Amazon S3 connector.
      */
     awsS3s: outputs.ProjectConnectorsAwsS3[];
+    /**
+     * Validate email addresses using the AWS SES Email Validation API to check syntax, DNS records, mailbox existence, and deliverability.
+     */
+    awsSesEmailValidations: outputs.ProjectConnectorsAwsSesEmailValidation[];
     /**
      * Localize the language of your login and user journey screens with the Amazon Translate connector.
      */
@@ -2104,6 +2691,18 @@ export interface ProjectConnectors {
      * Utilize threat intelligence to block malicious login attempts or check leaks with the Bitsight Threat Intelligence connector.
      */
     bitsights: outputs.ProjectConnectorsBitsight[];
+    /**
+     * Send audit events and troubleshooting logs to Coralogix.
+     */
+    coralogixes: outputs.ProjectConnectorsCoralogix[];
+    /**
+     * Stream audit events and troubleshooting logs to Cribl Stream via the HTTP/S Bulk API. Requires an HTTP source configured in your Cribl deployment. See Cribl's HTTP/S source setup guide: https://docs.cribl.io/stream/sources-https/
+     */
+    cribls: outputs.ProjectConnectorsCribl[];
+    /**
+     * Connect to Darwinium API for fraud detection and device intelligence.
+     */
+    darwinia: outputs.ProjectConnectorsDarwinium[];
     /**
      * Stream authentication audit logs with the Datadog connector.
      */
@@ -2168,6 +2767,14 @@ export interface ProjectConnectors {
      * Get address autocompletions from Place Autocomplete Data API.
      */
     googleMapsPlaces: outputs.ProjectConnectorsGoogleMapsPlace[];
+    /**
+     * Send audit events and troubleshooting logs to groundcover.
+     */
+    groundcovers: outputs.ProjectConnectorsGroundcover[];
+    /**
+     * hCaptcha can help protect your applications from bots, spam, and other forms of automated abuse.
+     */
+    hcaptchas: outputs.ProjectConnectorsHcaptcha[];
     /**
      * Check if passwords have been previously exposed in data breaches with the Have I Been Pwned connector.
      */
@@ -2188,10 +2795,18 @@ export interface ProjectConnectors {
      * Orchestrate customer identity information from your Descope user journey with the Intercom connector.
      */
     intercoms: outputs.ProjectConnectorsIntercom[];
+    /**
+     * Use this connector to authenticate users against an LDAP directory server with support for both password and mTLS authentication.
+     */
+    ldaps: outputs.ProjectConnectorsLdap[];
     /**
      * Localize the language of your login and user journey screens with the Lokalise connector.
      */
     lokalises: outputs.ProjectConnectorsLokalise[];
+    /**
+     * Stream authentication audit logs and troubleshoot logs to Mixpanel.
+     */
+    mixpanels: outputs.ProjectConnectorsMixpanel[];
     /**
      * Track and send user event data (e.g. page views, purchases, etc.) across connected tools using the mParticle connector.
      */
@@ -2200,6 +2815,22 @@ export interface ProjectConnectors {
      * Stream authentication audit logs with the New Relic connector.
      */
     newrelics: outputs.ProjectConnectorsNewrelic[];
+    /**
+     * Send audit events and troubleshooting logs to an OpenTelemetry-compatible endpoint using OTLP over HTTP or gRPC.
+     */
+    opentelemetries: outputs.ProjectConnectorsOpentelemetry[];
+    /**
+     * Stream authentication audit logs with the Pendo connector.
+     */
+    pendos: outputs.ProjectConnectorsPendo[];
+    /**
+     * Authenticate against PingDirectory.
+     */
+    pingDirectories: outputs.ProjectConnectorsPingDirectory[];
+    /**
+     * Send emails using Postmark
+     */
+    postmarks: outputs.ProjectConnectorsPostmark[];
     /**
      * Get address autocompletions from Radar Autocomplete API.
      */
@@ -2208,6 +2839,10 @@ export interface ProjectConnectors {
      * Mitigate fraud using advanced risk analysis and add adaptive MFA with the reCAPTCHA Enterprise connector.
      */
     recaptchaEnterprises: outputs.ProjectConnectorsRecaptchaEnterprise[];
+    /**
+     * Use the reCAPTCHA v2 "I'm not a robot" checkbox widget with your flows.
+     */
+    recaptchaV2s: outputs.ProjectConnectorsRecaptchaV2[];
     /**
      * Prevent bot attacks on your login pages with the reCAPTCHA v3 connector.
      */
@@ -2216,6 +2851,10 @@ export interface ProjectConnectors {
      * Add image recognition capabilities for identity verification and fraud prevention with the Amazon Rekognition connector.
      */
     rekognitions: outputs.ProjectConnectorsRekognition[];
+    /**
+     * Query the FCC Reassigned Numbers Database (RND) to validate whether telephone numbers have been permanently disconnected (reassigned) since a specific date. Helps obtain Safe Harbor from TCPA liability by checking the most recent database update.
+     */
+    rndReassigneds: outputs.ProjectConnectorsRndReassigned[];
     /**
      * Send transactional messages with the Salesforce Marketing Cloud connector.
      */
@@ -2228,6 +2867,10 @@ export interface ProjectConnectors {
      * Evaluate customer risk using Sardine
      */
     sardines: outputs.ProjectConnectorsSardine[];
+    /**
+     * Provision and de-provision users to an external SCIM v2 endpoint as part of your Descope user journey.
+     */
+    scims: outputs.ProjectConnectorsScim[];
     /**
      * Orchestrate customer identity traits and signals from your Descope user journey with the Segment connector.
      */
@@ -2252,10 +2895,22 @@ export interface ProjectConnectors {
      * Simple Mail Transfer Protocol (SMTP) server for sending emails.
      */
     smtps: outputs.ProjectConnectorsSmtp[];
+    /**
+     * Stream authentication audit logs to your Snowflake data warehouse with the Snowflake connector.
+     */
+    snowflakes: outputs.ProjectConnectorsSnowflake[];
     /**
      * Amazon Simple Notification Service (SNS) for sending SMS messages through AWS.
      */
     sns: outputs.ProjectConnectorsSn[];
+    /**
+     * Stream logs and audit events with the Splunk HTTP Event Collector (HEC).
+     */
+    splunks: outputs.ProjectConnectorsSplunk[];
+    /**
+     * SQL connector for relational databases including PostgreSQL, MySQL, MariaDB, Microsoft SQL Server (MSSQL), Oracle, CockroachDB, and Amazon Redshift.
+     */
+    sqls: outputs.ProjectConnectorsSql[];
     /**
      * Stream logs and audit events with the Sumo Logic connector.
      */
@@ -2284,6 +2939,14 @@ export interface ProjectConnectors {
      * Twilio Verify is an OTP service that can be used via text messages, instant messaging platforms, voice and e-mail. Choose this connector only if you are a Twilio Verify customer.
      */
     twilioVerifies: outputs.ProjectConnectorsTwilioVerify[];
+    /**
+     * SIM-based authentication and approval using Unibeam's OnSim technology for passwordless authentication and transaction approval.
+     */
+    unibeams: outputs.ProjectConnectorsUnibeam[];
+    /**
+     * Email validation with ZeroBounce
+     */
+    zerobounces: outputs.ProjectConnectorsZerobounce[];
 }
 export interface ProjectConnectorsAbuseipdb {
     /**
@@ -2300,6 +2963,29 @@ export interface ProjectConnectorsAbuseipdb {
      */
     name: string;
 }
+export interface ProjectConnectorsAlloy {
+    /**
+     * The Alloy API secret.
+     */
+    apiSecret: string;
+    /**
+     * The Alloy API token.
+     */
+    apiToken: string;
+    /**
+     * The base URL for the Alloy API, e.g.: https://sandbox.alloy.co/v1, https://api.alloy.co/v1.
+     */
+    baseUrl: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    id: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+}
 export interface ProjectConnectorsAmplitude {
     /**
      * The Amplitude API Key generated for the Descope service.
@@ -2323,6 +3009,33 @@ export interface ProjectConnectorsAmplitude {
      */
     serverZone: string;
 }
+export interface ProjectConnectorsArkose {
+    /**
+     * A custom base URL to use when loading the Arkose Labs client script. If not provided, the default value of `https://client-api.arkoselabs.com/v2` will be used.
+     */
+    clientBaseUrl: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    id: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * The private key that can be copied from the Keys screen in the Arkose Labs portal.
+     */
+    privateKey: string;
+    /**
+     * The public key that's shown in the Keys screen in the Arkose Labs portal.
+     */
+    publicKey: string;
+    /**
+     * A custom base URL to use when verifying the session token using the Arkose Labs Verify API. If not provided, the default value of `https://verify-api.arkoselabs.com/api/v4` will be used.
+     */
+    verifyBaseUrl: string;
+}
 export interface ProjectConnectorsAuditWebhook {
     /**
      * Specify which events will be sent to the external audit service (including tenant selection).
@@ -2438,6 +3151,10 @@ export interface ProjectConnectorsAwsS3 {
      */
     externalId: string;
     id: string;
+    /**
+     * Whether to mask personally identifiable information in the logs.
+     */
+    maskPii: boolean;
     /**
      * A custom name for your connector.
      */
@@ -2473,6 +3190,45 @@ export interface ProjectConnectorsAwsS3AuditFilter {
      */
     values: string[];
 }
+export interface ProjectConnectorsAwsSesEmailValidation {
+    /**
+     * AWS access key ID.
+     */
+    accessKeyId: string;
+    /**
+     * The authentication type to use.
+     */
+    authType: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    /**
+     * The external ID to use when assuming the role.
+     */
+    externalId: string;
+    id: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * The AWS region to which this client will send requests. (e.g. us-east-1.)
+     */
+    region: string;
+    /**
+     * The Amazon Resource Name (ARN) of the role to assume.
+     */
+    roleArn: string;
+    /**
+     * AWS secret access key.
+     */
+    secretAccessKey: string;
+    /**
+     * (Optional) A security or session token to use with these credentials. Usually present for temporary credentials.
+     */
+    sessionToken: string;
+}
 export interface ProjectConnectorsAwsTranslate {
     /**
      * AWS access key ID.
@@ -2519,11 +3275,7 @@ export interface ProjectConnectorsBitsight {
      */
     name: string;
 }
-export interface ProjectConnectorsDatadog {
-    /**
-     * The unique Datadog organization key.
-     */
-    apiKey: string;
+export interface ProjectConnectorsCoralogix {
     /**
      * Whether to enable streaming of audit events.
      */
@@ -2531,26 +3283,34 @@ export interface ProjectConnectorsDatadog {
     /**
      * Specify which events will be sent to the external audit service (including tenant selection).
      */
-    auditFilters: outputs.ProjectConnectorsDatadogAuditFilter[];
+    auditFilters: outputs.ProjectConnectorsCoralogixAuditFilter[];
+    /**
+     * Bearer token issued by Coralogix as Send-Your-Data API key
+     */
+    bearerToken: string;
     /**
      * A description of what your connector is used for.
      */
     description: string;
+    /**
+     * The ingress OpenTelemetry endpoint URL.
+     */
+    endpoint: string;
     id: string;
     /**
-     * A custom name for your connector.
+     * Whether to mask personally identifiable information in the logs.
      */
-    name: string;
+    maskPii: boolean;
     /**
-     * The Datadog site to send logs to. Default is `datadoghq.com`. European, free tier and other customers should set their site accordingly.
+     * A custom name for your connector.
      */
-    site: string;
+    name: string;
     /**
      * Whether to send troubleshooting events.
      */
     troubleshootLogEnabled: boolean;
 }
-export interface ProjectConnectorsDatadogAuditFilter {
+export interface ProjectConnectorsCoralogixAuditFilter {
     /**
      * The field name to filter on (either 'actions' or 'tenants').
      */
@@ -2564,11 +3324,172 @@ export interface ProjectConnectorsDatadogAuditFilter {
      */
     values: string[];
 }
-export interface ProjectConnectorsDevrevGrow {
+export interface ProjectConnectorsCribl {
     /**
-     * Authentication to DevRev APIs requires a personal access token (PAT).
+     * Whether to enable streaming of audit events.
      */
-    apiKey: string;
+    auditEnabled: boolean;
+    /**
+     * Specify which events will be sent to the external audit service (including tenant selection).
+     */
+    auditFilters: outputs.ProjectConnectorsCriblAuditFilter[];
+    /**
+     * A shared secret token for authenticating with the Cribl HTTP source. This token is defined on the source and is strongly recommended for security reasons.
+     */
+    authToken: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    /**
+     * The base URL of your Cribl Stream HTTP source. For Cribl Cloud, the default http source looks something like https://\n\n.main.\n\n.cribl.cloud:10080. You can also define a custom source (find this in your Cribl Cloud portal under Data Sources). For self-hosted deployments, use https://\n\n:10080 or however you have it configured.
+     */
+    endpoint: string;
+    id: string;
+    /**
+     * Whether to mask personally identifiable information in the logs.
+     */
+    maskPii: boolean;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * An optional source identifier for events in Cribl (defaults to 'descope').
+     */
+    source: string;
+    /**
+     * Whether to send troubleshooting events.
+     */
+    troubleshootLogEnabled: boolean;
+}
+export interface ProjectConnectorsCriblAuditFilter {
+    /**
+     * The field name to filter on (either 'actions' or 'tenants').
+     */
+    key: string;
+    /**
+     * The filter operation to apply ('includes' or 'excludes').
+     */
+    operator: string;
+    /**
+     * The list of values to match against for the filter.
+     */
+    values: string[];
+}
+export interface ProjectConnectorsDarwinium {
+    /**
+     * The default result to return if no result is available.
+     */
+    defaultResult: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    id: string;
+    /**
+     * The name of the Darwinium journey to use for profiling.
+     */
+    journeyName: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * The name of the Darwinium Native Mobile API to use.
+     */
+    nativeApiName: string;
+    /**
+     * The key name for the native profiling blob sent via the client parameter. If not provided, the default key of 'nativeProfilingBlob' will be used.
+     */
+    nativeBlobKeyName: string;
+    /**
+     * The name of the Darwinium node.
+     */
+    nodeName: string;
+    /**
+     * The passphrase for the PEM certificate, if applicable.
+     */
+    passphrase: string;
+    /**
+     * The PEM certificate for client authentication.
+     */
+    pemCertificate: string;
+    /**
+     * The private key for client authentication.
+     */
+    privateKey: string;
+    /**
+     * The custom URL where the Darwinium Tags script is hosted. If not provided, the default Darwinium script URL will be used.
+     */
+    profilingTagsScriptUrl: string;
+    /**
+     * The name of the Darwinium Web API to use.
+     */
+    webApiName: string;
+}
+export interface ProjectConnectorsDatadog {
+    /**
+     * The unique Datadog organization key.
+     */
+    apiKey: string;
+    /**
+     * Whether to enable streaming of audit events.
+     */
+    auditEnabled: boolean;
+    /**
+     * Specify which events will be sent to the external audit service (including tenant selection).
+     */
+    auditFilters: outputs.ProjectConnectorsDatadogAuditFilter[];
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    id: string;
+    /**
+     * Whether to mask personally identifiable information in the logs.
+     */
+    maskPii: boolean;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * The Datadog site to send logs to. Default is `datadoghq.com`. European, free tier and other customers should set their site accordingly.
+     */
+    site: string;
+    /**
+     * An optional custom source to use for log entries sent to Datadog. This can be used to differentiate between environments (e.g. `production`, `staging`). If left empty, the default Descope source will be used.
+     */
+    source: string;
+    /**
+     * An optional comma-separated list of tags to append to all log entries sent to Datadog (e.g. `env:production,team:auth`). These are added in addition to any default tags. If left empty, only the default Descope tags will be used.
+     */
+    tags: string;
+    /**
+     * Whether to send troubleshooting events.
+     */
+    troubleshootLogEnabled: boolean;
+}
+export interface ProjectConnectorsDatadogAuditFilter {
+    /**
+     * The field name to filter on (either 'actions' or 'tenants').
+     */
+    key: string;
+    /**
+     * The filter operation to apply ('includes' or 'excludes').
+     */
+    operator: string;
+    /**
+     * The list of values to match against for the filter.
+     */
+    values: string[];
+}
+export interface ProjectConnectorsDevrevGrow {
+    /**
+     * Authentication to DevRev APIs requires a personal access token (PAT).
+     */
+    apiKey: string;
     /**
      * A description of what your connector is used for.
      */
@@ -3087,6 +4008,86 @@ export interface ProjectConnectorsGoogleMapsPlace {
      */
     region: string;
 }
+export interface ProjectConnectorsGroundcover {
+    /**
+     * Whether to enable streaming of audit events.
+     */
+    auditEnabled: boolean;
+    /**
+     * Specify which events will be sent to the external audit service (including tenant selection).
+     */
+    auditFilters: outputs.ProjectConnectorsGroundcoverAuditFilter[];
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    /**
+     * The gRPC OTLP backend endpoint URL. Found in the groundcover console under Settings → Ingestion Keys → Backend Endpoints.
+     */
+    endpoint: string;
+    id: string;
+    /**
+     * Third Party ingestion key for authenticating with groundcover. Create one in the groundcover console under Settings → Ingestion Keys (type: thirdParty).
+     */
+    ingestionKey: string;
+    /**
+     * Whether to mask personally identifiable information in the logs.
+     */
+    maskPii: boolean;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * Whether to send troubleshooting events.
+     */
+    troubleshootLogEnabled: boolean;
+}
+export interface ProjectConnectorsGroundcoverAuditFilter {
+    /**
+     * The field name to filter on (either 'actions' or 'tenants').
+     */
+    key: string;
+    /**
+     * The filter operation to apply ('includes' or 'excludes').
+     */
+    operator: string;
+    /**
+     * The list of values to match against for the filter.
+     */
+    values: string[];
+}
+export interface ProjectConnectorsHcaptcha {
+    /**
+     * When configured, the hCaptcha action will return the score without assessing the request. The score ranges between 0 and 1, where 1 is a human interaction and 0 is a bot.
+     */
+    assessmentScore: number;
+    /**
+     * The bot threshold is used to determine whether the request is a bot or a human. The score ranges between 0 and 1, where 1 is a human interaction and 0 is a bot. If the score is below this threshold, the request is considered a bot.
+     */
+    botThreshold: number;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    id: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * Override the default assessment model. Note: Overriding assessment is intended for automated testing and should not be utilized in production environments.
+     */
+    overrideAssessment: boolean;
+    /**
+     * The secret key authorizes communication between Descope backend and the hCaptcha server to verify the user's response.
+     */
+    secretKey: string;
+    /**
+     * The site key is used to invoke hCaptcha service on your site or mobile application.
+     */
+    siteKey: string;
+}
 export interface ProjectConnectorsHibp {
     /**
      * A description of what your connector is used for.
@@ -3103,6 +4104,34 @@ export interface ProjectConnectorsHttp {
      * Authentication Information
      */
     authentication: outputs.ProjectConnectorsHttpAuthentication;
+    /**
+     * The unique AWS access key ID.
+     */
+    awsAccessKeyId: string;
+    /**
+     * Apply AWS signature version 4 authentication to the request.
+     */
+    awsAuthType: string;
+    /**
+     * The external ID to use when assuming the role.
+     */
+    awsExternalId: string;
+    /**
+     * The AWS region, e.g. `us-east-1`.
+     */
+    awsRegion: string;
+    /**
+     * The Amazon Resource Name (ARN) of the role to assume.
+     */
+    awsRoleArn: string;
+    /**
+     * The secret AWS access key.
+     */
+    awsSecretAccessKey: string;
+    /**
+     * The AWS service to target, e.g. `lambda`, `execute-api`, `s3`, etc.
+     */
+    awsService: string;
     /**
      * The base URL to fetch
      */
@@ -3123,7 +4152,7 @@ export interface ProjectConnectorsHttp {
     hmacSecret: string;
     id: string;
     /**
-     * The connector response context will also include the headers. The context will have a "body" attribute and a "headers" attribute. See more details in the help guide
+     * The connector response context will also include the headers and status code. The context will have a "body" attribute, a "headers" attribute, and a "statusCode" attribute. See more details in the help guide
      */
     includeHeadersInContext: boolean;
     /**
@@ -3134,6 +4163,26 @@ export interface ProjectConnectorsHttp {
      * A custom name for your connector.
      */
     name: string;
+    /**
+     * HTTP message components to include in the signature (e.g., @method, @target-uri, @authority, content-type, content-digest). Leave empty to use defaults: @method, @target-uri, @authority
+     */
+    rfc9421Components: string;
+    /**
+     * Identifier for the signing key. This will be included in the signature metadata to help the recipient identify which key was used for verification
+     */
+    rfc9421KeyId: string;
+    /**
+     * Provide a private key in PEM format or an HMAC secret. Algorithms such as ECDSA P-256/P-384, Ed25519, and RSA are supported. You can paste the key with or without newlines; both formats are accepted.
+     */
+    rfc9421PrivateKey: string;
+    /**
+     * How long the signature is valid for, in seconds. Default is 300 seconds (5 minutes). The signature includes automatic replay protection via a randomly generated nonce
+     */
+    rfc9421SignatureTtl: number;
+    /**
+     * Enable RFC 9421 HTTP Message Signatures for cryptographically signing requests. Supports multiple algorithms including ECDSA, Ed25519, RSA, and HMAC
+     */
+    rfc9421SigningEnabled: boolean;
     /**
      * Whether the connector should send all requests from specific static IPs.
      */
@@ -3238,6 +4287,49 @@ export interface ProjectConnectorsIntercom {
      */
     token: string;
 }
+export interface ProjectConnectorsLdap {
+    /**
+     * The Distinguished Name to bind with for searching.
+     */
+    bindDn: string;
+    /**
+     * The password for the bind DN.
+     */
+    bindPassword: string;
+    /**
+     * The Certificate Authority certificate in PEM format for validating the server certificate.
+     */
+    caCertificate: string;
+    /**
+     * The client certificate in PEM format for mTLS authentication.
+     */
+    clientCertificate: string;
+    /**
+     * The client private key in PEM format for mTLS authentication.
+     */
+    clientKey: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    id: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * Reject connections to LDAP servers with invalid certificates.
+     */
+    rejectUnauthorized: boolean;
+    /**
+     * The LDAP server URL (e.g., ldap://localhost:389 or ldaps://localhost:636 for SSL/TLS).
+     */
+    serverUrl: string;
+    /**
+     * Enable mutual TLS authentication for LDAP connection.
+     */
+    useMtls: boolean;
+}
 export interface ProjectConnectorsLokalise {
     /**
      * Lokalise API token.
@@ -3269,32 +4361,101 @@ export interface ProjectConnectorsLokalise {
      */
     translationProvider: string;
 }
-export interface ProjectConnectorsMparticle {
+export interface ProjectConnectorsMixpanel {
     /**
-     * The mParticle Server to Server Key generated for the Descope service.
-     */
-    apiKey: string;
-    /**
-     * The mParticle Server to Server Secret generated for the Descope service.
+     * The Mixpanel API secret key used for authenticating API requests.
      */
     apiSecret: string;
     /**
-     * The base URL of the mParticle API, when using a custom domain in mParticle. default value is https://s2s.mparticle.com/
+     * Whether to enable streaming of audit events.
      */
-    baseUrl: string;
+    auditEnabled: boolean;
     /**
-     * The default environment of which connector send data to, either “production” or “development“. default value: production. This field can be overridden per event (see at flows).
+     * Specify which events will be sent to the external audit service (including tenant selection).
      */
-    defaultEnvironment: string;
+    auditFilters: outputs.ProjectConnectorsMixpanelAuditFilter[];
     /**
      * A description of what your connector is used for.
      */
     description: string;
-    id: string;
     /**
-     * A custom name for your connector.
+     * Indicates if your Mixpanel project data is stored in the EU region.
      */
-    name: string;
+    euResidency: boolean;
+    id: string;
+    /**
+     * Specify a custom prefix for all log fields. The default prefix is `descope.`.
+     */
+    logsPrefix: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * Enable this option to use a custom prefix for log fields.
+     */
+    overrideLogsPrefix: boolean;
+    /**
+     * The unique identifier for your Mixpanel project.
+     */
+    projectId: string;
+    /**
+     * The unique Mixpanel project token used to identify the project where data will be sent.
+     */
+    projectToken: string;
+    /**
+     * The Mixpanel service account secret used for integration.
+     */
+    serviceAccountSecret: string;
+    /**
+     * The Mixpanel service account username used for integration.
+     */
+    serviceAccountUsername: string;
+    /**
+     * Whether to send troubleshooting events.
+     */
+    troubleshootLogEnabled: boolean;
+}
+export interface ProjectConnectorsMixpanelAuditFilter {
+    /**
+     * The field name to filter on (either 'actions' or 'tenants').
+     */
+    key: string;
+    /**
+     * The filter operation to apply ('includes' or 'excludes').
+     */
+    operator: string;
+    /**
+     * The list of values to match against for the filter.
+     */
+    values: string[];
+}
+export interface ProjectConnectorsMparticle {
+    /**
+     * The mParticle Server to Server Key generated for the Descope service.
+     */
+    apiKey: string;
+    /**
+     * The mParticle Server to Server Secret generated for the Descope service.
+     */
+    apiSecret: string;
+    /**
+     * The base URL of the mParticle API, when using a custom domain in mParticle. default value is https://s2s.mparticle.com/
+     */
+    baseUrl: string;
+    /**
+     * The default environment of which connector send data to, either “production” or “development“. default value: production. This field can be overridden per event (see at flows).
+     */
+    defaultEnvironment: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    id: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
     /**
      * Whether the connector should send all requests from specific static IPs.
      */
@@ -3353,6 +4514,190 @@ export interface ProjectConnectorsNewrelicAuditFilter {
      */
     values: string[];
 }
+export interface ProjectConnectorsOpentelemetry {
+    /**
+     * Whether to enable streaming of audit events.
+     */
+    auditEnabled: boolean;
+    /**
+     * Specify which events will be sent to the external audit service (including tenant selection).
+     */
+    auditFilters: outputs.ProjectConnectorsOpentelemetryAuditFilter[];
+    /**
+     * Authentication Information
+     */
+    authentication: outputs.ProjectConnectorsOpentelemetryAuthentication;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    /**
+     * The OTLP endpoint URL.
+     */
+    endpoint: string;
+    /**
+     * The headers to send with the request
+     */
+    headers: {
+        [key: string]: string;
+    };
+    id: string;
+    /**
+     * Will ignore certificate errors raised by the client
+     */
+    insecure: boolean;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * Protocol to use for OTLP: http or grpc.
+     */
+    protocol: string;
+    /**
+     * Whether to send troubleshooting events.
+     */
+    troubleshootLogEnabled: boolean;
+}
+export interface ProjectConnectorsOpentelemetryAuditFilter {
+    /**
+     * The field name to filter on (either 'actions' or 'tenants').
+     */
+    key: string;
+    /**
+     * The filter operation to apply ('includes' or 'excludes').
+     */
+    operator: string;
+    /**
+     * The list of values to match against for the filter.
+     */
+    values: string[];
+}
+export interface ProjectConnectorsOpentelemetryAuthentication {
+    /**
+     * API key authentication configuration.
+     */
+    apiKey: outputs.ProjectConnectorsOpentelemetryAuthenticationApiKey;
+    /**
+     * Basic authentication credentials (username and password).
+     */
+    basic: outputs.ProjectConnectorsOpentelemetryAuthenticationBasic;
+    /**
+     * Bearer token for HTTP authentication.
+     */
+    bearerToken: string;
+}
+export interface ProjectConnectorsOpentelemetryAuthenticationApiKey {
+    /**
+     * The API key.
+     */
+    key: string;
+    /**
+     * The API secret.
+     */
+    token: string;
+}
+export interface ProjectConnectorsOpentelemetryAuthenticationBasic {
+    /**
+     * Password for basic HTTP authentication.
+     */
+    password: string;
+    /**
+     * Username for basic HTTP authentication.
+     */
+    username: string;
+}
+export interface ProjectConnectorsPendo {
+    /**
+     * Whether to enable streaming of audit events.
+     */
+    auditEnabled: boolean;
+    /**
+     * Specify which events will be sent to the external audit service (including tenant selection).
+     */
+    auditFilters: outputs.ProjectConnectorsPendoAuditFilter[];
+    /**
+     * The Pendo regional domain to send logs to. Default is the US region, `https://data.pendo.io`. Customers in other regions must set this accordingly.
+     */
+    baseUrl: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    id: string;
+    /**
+     * The secret Pendo integration key Descope should use.
+     */
+    integrationKey: string;
+    /**
+     * Whether to mask personally identifiable information in the logs.
+     */
+    maskPii: boolean;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * Whether to send troubleshooting events.
+     */
+    troubleshootLogEnabled: boolean;
+}
+export interface ProjectConnectorsPendoAuditFilter {
+    /**
+     * The field name to filter on (either 'actions' or 'tenants').
+     */
+    key: string;
+    /**
+     * The filter operation to apply ('includes' or 'excludes').
+     */
+    operator: string;
+    /**
+     * The list of values to match against for the filter.
+     */
+    values: string[];
+}
+export interface ProjectConnectorsPingDirectory {
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    /**
+     * PingDirectory's REST API host.
+     */
+    host: string;
+    id: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * PingDirectory's REST API port.
+     */
+    port: number;
+}
+export interface ProjectConnectorsPostmark {
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    /**
+     * The email address that will appear in the 'From' field of the sent email
+     */
+    emailFrom: string;
+    id: string;
+    /**
+     * The ID of the message stream to use for the email
+     */
+    messageStreamId: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * The API token for authenticating with the Postmark server
+     */
+    serverApiToken: string;
+}
 export interface ProjectConnectorsRadar {
     /**
      * The address types to return.
@@ -3412,6 +4757,10 @@ export interface ProjectConnectorsRecaptcha {
     siteKey: string;
 }
 export interface ProjectConnectorsRecaptchaEnterprise {
+    /**
+     * The user-initiated action for this assessment.
+     */
+    action: string;
     /**
      * API key associated with the current project.
      */
@@ -3421,7 +4770,7 @@ export interface ProjectConnectorsRecaptchaEnterprise {
      */
     assessmentScore: number;
     /**
-     * Apply a custom url to the reCAPTCHA Enterprise scripts. This is useful when attempting to use reCAPTCHA globally. Defaults to https://www.google.com
+     * The base URL used to load the reCAPTCHA Enterprise scripts. Select recaptcha.net when google.com is unavailable in your users' region. Restricting this to the official Google domains prevents loading scripts from untrusted hosts.
      */
     baseUrl: string;
     /**
@@ -3450,6 +4799,37 @@ export interface ProjectConnectorsRecaptchaEnterprise {
      */
     siteKey: string;
 }
+export interface ProjectConnectorsRecaptchaV2 {
+    /**
+     * When override is enabled, return this score instead of calling Google.
+     */
+    assessmentScore: number;
+    /**
+     * For v2 verification, success maps to risk score 1 and failure to 0. Bot is detected when risk score is below this threshold (default 0.5).
+     */
+    botThreshold: number;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    id: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * Override the default assessment model. Intended for automated testing only.
+     */
+    overrideAssessment: boolean;
+    /**
+     * The secret key used to verify the user's response with Google siteverify.
+     */
+    secretKey: string;
+    /**
+     * The reCAPTCHA v2 site key from the Google reCAPTCHA admin console (checkbox / "I'm not a robot" type).
+     */
+    siteKey: string;
+}
 export interface ProjectConnectorsRekognition {
     /**
      * The AWS access key ID
@@ -3473,6 +4853,25 @@ export interface ProjectConnectorsRekognition {
      */
     secretAccessKey: string;
 }
+export interface ProjectConnectorsRndReassigned {
+    /**
+     * Your RND company ID (e.g., C038612852). Retrieve this from your RND account under Account → Company → Company ID.
+     */
+    companyId: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    id: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * Your RND refresh token for authentication. Retrieve this from your RND account under Account → API Credentials.
+     */
+    refreshToken: string;
+}
 export interface ProjectConnectorsSalesforce {
     /**
      * The Salesforce API base URL.
@@ -3498,61 +4897,136 @@ export interface ProjectConnectorsSalesforce {
     /**
      * REST API Version.
      */
-    version: string;
-}
-export interface ProjectConnectorsSalesforceMarketingCloud {
+    version: string;
+}
+export interface ProjectConnectorsSalesforceMarketingCloud {
+    /**
+     * Account identifier, or MID, of the target business unit.
+     */
+    accountId: string;
+    /**
+     * Client ID issued when you create the API integration in Installed Packages.
+     */
+    clientId: string;
+    /**
+     * Client secret issued when you create the API integration in Installed Packages.
+     */
+    clientSecret: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    id: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * Space-separated list of data-access permissions for your connector.
+     */
+    scope: string;
+    /**
+     * The Salesforce Marketing Cloud endpoint subdomain.
+     */
+    subdomain: string;
+}
+export interface ProjectConnectorsSardine {
+    /**
+     * The base URL for the Sardine API, e.g.: https://api.sandbox.sardine.ai, https://api.sardine.ai, https://api.eu.sardine.ai.
+     */
+    baseUrl: string;
+    /**
+     * The Sardine Client ID.
+     */
+    clientId: string;
+    /**
+     * The Sardine Client Secret.
+     */
+    clientSecret: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    id: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+}
+export interface ProjectConnectorsScim {
+    /**
+     * Authentication credentials used when sending requests to the SCIM endpoint.
+     */
+    authentication: outputs.ProjectConnectorsScimAuthentication;
+    /**
+     * The base URL of the SCIM v2 endpoint that user provisioning events will be sent to.
+     */
+    baseUrl: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
     /**
-     * Account identifier, or MID, of the target business unit.
+     * Whether to disable this SCIM connector. When disabled, provisioning events will not be sent to the configured endpoint.
      */
-    accountId: string;
+    disabled: boolean;
     /**
-     * Client ID issued when you create the API integration in Installed Packages.
+     * The ID of the federated SSO application this SCIM connector is associated with.
      */
-    clientId: string;
+    federatedAppId: string;
     /**
-     * Client secret issued when you create the API integration in Installed Packages.
+     * Custom HTTP headers to send with each provisioning request.
      */
-    clientSecret: string;
+    headers: {
+        [key: string]: string;
+    };
     /**
-     * A description of what your connector is used for.
+     * HMAC is a method for message signing with a symmetrical key. This secret will be used to sign the base64 encoded payload, and the resulting signature will be sent in the `x-descope-webhook-s256` header. The receiving service should use this secret to verify the integrity and authenticity of the payload by checking the provided signature.
      */
-    description: string;
+    hmacSecret: string;
     id: string;
+    /**
+     * Will ignore certificate errors raised by the client.
+     */
+    insecure: boolean;
     /**
      * A custom name for your connector.
      */
     name: string;
+}
+export interface ProjectConnectorsScimAuthentication {
     /**
-     * Space-separated list of data-access permissions for your connector.
+     * API key authentication configuration.
      */
-    scope: string;
+    apiKey: outputs.ProjectConnectorsScimAuthenticationApiKey;
     /**
-     * The Salesforce Marketing Cloud endpoint subdomain.
+     * Basic authentication credentials (username and password).
      */
-    subdomain: string;
-}
-export interface ProjectConnectorsSardine {
+    basic: outputs.ProjectConnectorsScimAuthenticationBasic;
     /**
-     * The base URL for the Sardine API, e.g.: https://api.sandbox.sardine.ai, https://api.sardine.ai, https://api.eu.sardine.ai.
+     * Bearer token for HTTP authentication.
      */
-    baseUrl: string;
+    bearerToken: string;
+}
+export interface ProjectConnectorsScimAuthenticationApiKey {
     /**
-     * The Sardine Client ID.
+     * The API key.
      */
-    clientId: string;
+    key: string;
     /**
-     * The Sardine Client Secret.
+     * The API secret.
      */
-    clientSecret: string;
+    token: string;
+}
+export interface ProjectConnectorsScimAuthenticationBasic {
     /**
-     * A description of what your connector is used for.
+     * Password for basic HTTP authentication.
      */
-    description: string;
-    id: string;
+    password: string;
     /**
-     * A custom name for your connector.
+     * Username for basic HTTP authentication.
      */
-    name: string;
+    username: string;
 }
 export interface ProjectConnectorsSe {
     /**
@@ -3809,6 +5283,163 @@ export interface ProjectConnectorsSn {
      */
     templateId: string;
 }
+export interface ProjectConnectorsSnowflake {
+    /**
+     * A Snowflake Programmatic Access Token (PAT). The token's user must have CREATE DATABASE privileges.
+     */
+    apiKey: string;
+    /**
+     * Whether to enable streaming of audit events.
+     */
+    auditEnabled: boolean;
+    /**
+     * Specify which events will be sent to the external audit service (including tenant selection).
+     */
+    auditFilters: outputs.ProjectConnectorsSnowflakeAuditFilter[];
+    /**
+     * The table to write audit events to. Defaults to `DESCOPE_AUDIT_LOGS`.
+     */
+    auditTable: string;
+    /**
+     * The Snowflake database to use. Defaults to `DESCOPE_EXPORT_DB`.
+     */
+    database: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    id: string;
+    /**
+     * Whether to mask personally identifiable information in the logs.
+     */
+    maskPii: boolean;
+    /**
+     * The minimum time between writes to Snowflake, in minutes. When set, events are accumulated and written in a single batch at most once per interval, which lets the warehouse auto-suspend between writes and reduces cost. Set to 0 (or leave empty) to write events according to the default Descope cycle.
+     */
+    minFlushIntervalMinutes: number;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * The schema within the database. Defaults to `PUBLIC`.
+     */
+    schema: string;
+    /**
+     * Your Snowflake account URL, e.g. `https://<org>-<account>.snowflakecomputing.com`.
+     */
+    site: string;
+    /**
+     * Whether to send troubleshooting events.
+     */
+    troubleshootLogEnabled: boolean;
+    /**
+     * The Snowflake warehouse to use. Defaults to `COMPUTE_WH`.
+     */
+    warehouse: string;
+}
+export interface ProjectConnectorsSnowflakeAuditFilter {
+    /**
+     * The field name to filter on (either 'actions' or 'tenants').
+     */
+    key: string;
+    /**
+     * The filter operation to apply ('includes' or 'excludes').
+     */
+    operator: string;
+    /**
+     * The list of values to match against for the filter.
+     */
+    values: string[];
+}
+export interface ProjectConnectorsSplunk {
+    /**
+     * Whether to enable streaming of audit events.
+     */
+    auditEnabled: boolean;
+    /**
+     * Specify which events will be sent to the external audit service (including tenant selection).
+     */
+    auditFilters: outputs.ProjectConnectorsSplunkAuditFilter[];
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    /**
+     * An HTTP Event Collector token configured on your Splunk project.
+     */
+    hecToken: string;
+    /**
+     * The URL to be used accessing your Splunk system, including the appropriate port
+     */
+    hecUrl: string;
+    id: string;
+    /**
+     * An optional index to use for all sent events
+     */
+    index: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * Whether to send troubleshooting events.
+     */
+    troubleshootLogEnabled: boolean;
+}
+export interface ProjectConnectorsSplunkAuditFilter {
+    /**
+     * The field name to filter on (either 'actions' or 'tenants').
+     */
+    key: string;
+    /**
+     * The filter operation to apply ('includes' or 'excludes').
+     */
+    operator: string;
+    /**
+     * The list of values to match against for the filter.
+     */
+    values: string[];
+}
+export interface ProjectConnectorsSql {
+    /**
+     * The database name.
+     */
+    databaseName: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    /**
+     * The database engine type.
+     */
+    engineName: string;
+    /**
+     * The database host.
+     */
+    host: string;
+    id: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * The database password.
+     */
+    password: string;
+    /**
+     * The database port. If not specified, the default port for the selected engine will be used.
+     */
+    port: number;
+    /**
+     * The Oracle service name (required for Oracle only).
+     */
+    serviceName: string;
+    /**
+     * The database username.
+     */
+    username: string;
+}
 export interface ProjectConnectorsSumologic {
     /**
      * Whether to enable streaming of audit events.
@@ -4056,6 +5687,60 @@ export interface ProjectConnectorsTwilioVerifyAuthentication {
      */
     authToken: string;
 }
+export interface ProjectConnectorsUnibeam {
+    /**
+     * Unibeam API base URL.
+     */
+    baseUrl: string;
+    /**
+     * OAuth2 client ID for authentication.
+     */
+    clientId: string;
+    /**
+     * OAuth2 client secret for authentication.
+     */
+    clientSecret: string;
+    /**
+     * Your Unibeam customer ID.
+     */
+    customerId: string;
+    /**
+     * Default message to display when no message is provided in the command.
+     */
+    defaultMessage: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    /**
+     * HMAC secret supplied by Unibeam for securing communications.
+     */
+    hmacSecret: string;
+    id: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+}
+export interface ProjectConnectorsZerobounce {
+    /**
+     * The ZeroBounce API key.
+     */
+    apiKey: string;
+    /**
+     * A description of what your connector is used for.
+     */
+    description: string;
+    id: string;
+    /**
+     * A custom name for your connector.
+     */
+    name: string;
+    /**
+     * ZeroBounce platform region.
+     */
+    region: string;
+}
 export interface ProjectFlows {
     /**
      * The JSON data defining the authentication flow configuration, including metadata, screens, contents, and references.
@@ -4144,6 +5829,10 @@ export interface ProjectJwtTemplates {
     userTemplates: outputs.ProjectJwtTemplatesUserTemplate[];
 }
 export interface ProjectJwtTemplatesAccessKeyTemplate {
+    /**
+     * When enabled, a unique JWT ID (jti) claim will be added to the token for tracking and preventing replay attacks.
+     */
+    addJtiClaim: boolean;
     /**
      * The authorization claims format - `default`, `tenantOnly` or `none`. Read more about schema types [here](https://docs.descope.com/project-settings/jwt-templates).
      */
@@ -4168,17 +5857,29 @@ export interface ProjectJwtTemplatesAccessKeyTemplate {
      * Whether to enforce that the JWT issuer matches the project configuration.
      */
     enforceIssuer: boolean;
+    /**
+     * When enabled, permissions will not be included in the JWT token.
+     */
+    excludePermissionClaim: boolean;
     id: string;
     /**
      * Name of the JWT Template.
      */
     name: string;
+    /**
+     * Switching on will allow you to add a custom subject claim to the JWT. A default new `dsub` claim will be added with the user ID.
+     */
+    overrideSubjectClaim: boolean;
     /**
      * The JSON template defining the structure and claims of the JWT token. This is expected to be a valid JSON object given as a `string` value.
      */
     template: string;
 }
 export interface ProjectJwtTemplatesUserTemplate {
+    /**
+     * When enabled, a unique JWT ID (jti) claim will be added to the token for tracking and preventing replay attacks.
+     */
+    addJtiClaim: boolean;
     /**
      * The authorization claims format - `default`, `tenantOnly` or `none`. Read more about schema types [here](https://docs.descope.com/project-settings/jwt-templates).
      */
@@ -4203,16 +5904,43 @@ export interface ProjectJwtTemplatesUserTemplate {
      * Whether to enforce that the JWT issuer matches the project configuration.
      */
     enforceIssuer: boolean;
+    /**
+     * When enabled, permissions will not be included in the JWT token.
+     */
+    excludePermissionClaim: boolean;
     id: string;
     /**
      * Name of the JWT Template.
      */
     name: string;
+    /**
+     * Switching on will allow you to add a custom subject claim to the JWT. A default new `dsub` claim will be added with the user ID.
+     */
+    overrideSubjectClaim: boolean;
     /**
      * The JSON template defining the structure and claims of the JWT token. This is expected to be a valid JSON object given as a `string` value.
      */
     template: string;
 }
+export interface ProjectList {
+    /**
+     * The JSON data for the list. The format depends on the `type`: - For `"texts"` and `"ips"` types: Must be a JSON array of strings (e.g., `["item1", "item2"]`) - For `"ips"` type: Each string must be a valid IP address or CIDR range - For `"json"` type: Must be a JSON object (e.g., `{"key": "value"}`)
+     */
+    data: string;
+    /**
+     * An optional description for the list. Defaults to an empty string if not provided.
+     */
+    description: string;
+    id: string;
+    /**
+     * The name of the list. Maximum length is 100 characters.
+     */
+    name: string;
+    /**
+     * The type of list. Must be one of: - `"texts"` - A list of text strings - `"ips"` - A list of IP addresses or CIDR ranges - `"json"` - A JSON object
+     */
+    type: string;
+}
 export interface ProjectProjectSettings {
     /**
      * Name of the access key JWT Template.
@@ -4290,6 +6018,10 @@ export interface ProjectProjectSettings {
      * The expiry time for the step up token, after which it will not be valid and the user will automatically go back to the session token.
      */
     stepUpTokenExpiration: string;
+    /**
+     * When enabled, users are completely isolated per tenant. The same login ID in Tenant A and Tenant B will be treated as separate identities with isolated credentials, sessions, and MFA state.
+     */
+    tenantUserIsolation: boolean;
     /**
      * Define a regular expression so that whenever a user is created with a matching login ID it will automatically be marked as a test user.
      */
@@ -4312,6 +6044,10 @@ export interface ProjectProjectSettings {
     userJwtTemplate: string;
 }
 export interface ProjectProjectSettingsSessionMigration {
+    /**
+     * An API token for the vendor, required when `vendor` is set to `okta`.
+     */
+    apiToken: string;
     /**
      * The audience value if needed by the vendor.
      */
@@ -4332,11 +6068,29 @@ export interface ProjectProjectSettingsSessionMigration {
      * A set of attributes from the vendor's user that should be used to match with the Descope user's login ID.
      */
     loginidMatchedAttributes: string[];
+    /**
+     * A list of attribute mappings from the external vendor's user to Descope user attributes.
+     */
+    userMappings: outputs.ProjectProjectSettingsSessionMigrationUserMapping[];
+    /**
+     * The type of user synchronization to perform. Valid values are `matchOnly` (match existing users only) and `jit` (just-in-time provisioning).
+     */
+    userSyncType: string;
     /**
      * The name of the vendor the sessions are migrated from, in all lowercase.
      */
     vendor: string;
 }
+export interface ProjectProjectSettingsSessionMigrationUserMapping {
+    /**
+     * The Descope user attribute to map the external key to.
+     */
+    descopeKey: string;
+    /**
+     * The attribute key in the external vendor's user object.
+     */
+    externalKey: string;
+}
 export interface ProjectStyles {
     /**
      * The JSON data defining the visual styling and theme configuration used for authentication, widgets, etc.
@@ -4349,3 +6103,4 @@ export interface ProjectWidgets {
      */
     data: string;
 }
+//# sourceMappingURL=output.d.ts.map