@dfns/sdk 0.8.21 → 0.8.24

package/generated/auth/types.d.ts

@@ -1,132 +1,217 @@
 export type ActivateCredentialBody = {
+    /** UUID of the credential to activate. */
     credentialUuid: string;
 };
 export type ActivateCredentialResponse = {
+    /** Human-readable success message. */
     message: string;
 };
 export type ActivateCredentialRequest = {
     body: ActivateCredentialBody;
 };
 export type ActivatePersonalAccessTokenParams = {
+    /** Token id. */
     tokenId: string;
 };
 export type ActivatePersonalAccessTokenResponse = {
+    /** The access token. Only returned at creation time. */
     accessToken?: string | undefined;
     dateCreated: string;
+    /** ID of the credential associated with the access token. */
     credId: string;
+    /** Whether the access token is active. */
     isActive: boolean;
     /** Access token kind. */
     kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+    /** User id. */
     linkedUserId: string;
+    /** ID of the application the access token is linked to. */
     linkedAppId: string;
+    /** Human-readable name of the access token. */
     name: string;
+    /** Organization id. */
     orgId: string;
+    /** Permissions (roles) assigned to the access token. */
     permissionAssignments: {
+        /** Human-readable name of the permission (role). */
         permissionName: string;
+        /** ID of the permission (also referred to as "role" in the dashboard). */
         permissionId: string;
+        /** ID of the permission assignment. */
         assignmentId: string;
+        /** List of API operations granted by this permission. */
         operations?: string[] | undefined;
     }[];
+    /** Public key associated with the access token. */
     publicKey: string;
+    /** Token id. */
     tokenId: string;
 };
 export type ActivatePersonalAccessTokenRequest = ActivatePersonalAccessTokenParams;
 export type ActivateServiceAccountParams = {
+    /** ID of the service account. */
     serviceAccountId: string;
 };
 export type ActivateServiceAccountResponse = {
     userInfo: {
+        /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
         username: string;
+        /** Display name of the user. */
         name: string;
         /** User id. */
         userId: string;
         /** User kind. */
-        kind: "DfnsStaff" | "AccountUser" | "CustomerEmployee" | "EndUser";
+        kind: "DfnsStaff" | "TenantUser" | "CustomerEmployee" | "EndUser";
+        /** UUID of the user's primary credential. */
         credentialUuid: string;
-        orgId: string;
+        /** Organization id. */
+        orgId?: string | undefined;
+        /** Tenant id. */
+        tenantId?: string | undefined;
+        /** @deprecated - Flat list of API operations the user has access to. */
         permissions?: string[] | undefined;
+        /** Whether the user is active. */
         isActive: boolean;
+        /** Whether the user is a service account. */
         isServiceAccount: boolean;
+        /** Whether the user has completed registration. */
         isRegistered: boolean;
+        /** Permissions (roles) assigned to the user. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
     };
     accessTokens: {
+        /** The access token. Only returned at creation time. */
         accessToken?: string | undefined;
         dateCreated: string;
+        /** ID of the credential associated with the access token. */
         credId: string;
+        /** Whether the access token is active. */
         isActive: boolean;
         /** Access token kind. */
         kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+        /** User id. */
         linkedUserId: string;
+        /** ID of the application the access token is linked to. */
         linkedAppId: string;
+        /** Human-readable name of the access token. */
         name: string;
+        /** Organization id. */
         orgId: string;
+        /** Permissions (roles) assigned to the access token. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
+        /** Public key associated with the access token. */
         publicKey: string;
+        /** Token id. */
         tokenId: string;
     }[];
 };
 export type ActivateServiceAccountRequest = ActivateServiceAccountParams;
 export type ActivateUserParams = {
+    /** User id. */
     userId: string;
 };
 export type ActivateUserResponse = {
+    /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
     username: string;
+    /** Display name of the user. */
     name: string;
     /** User id. */
     userId: string;
     /** User kind. */
-    kind: "DfnsStaff" | "AccountUser" | "CustomerEmployee" | "EndUser";
+    kind: "DfnsStaff" | "TenantUser" | "CustomerEmployee" | "EndUser";
+    /** UUID of the user's primary credential. */
     credentialUuid: string;
-    orgId: string;
+    /** Organization id. */
+    orgId?: string | undefined;
+    /** Tenant id. */
+    tenantId?: string | undefined;
+    /** @deprecated - Flat list of API operations the user has access to. */
     permissions?: string[] | undefined;
+    /** Whether the user is active. */
     isActive: boolean;
+    /** Whether the user is a service account. */
     isServiceAccount: boolean;
+    /** Whether the user has completed registration. */
     isRegistered: boolean;
+    /** Whether the user must authenticate via SSO. */
     isSSORequired: boolean;
+    /** Permissions (roles) assigned to the user. */
     permissionAssignments: {
+        /** Human-readable name of the permission (role). */
         permissionName: string;
+        /** ID of the permission (also referred to as "role" in the dashboard). */
         permissionId: string;
+        /** ID of the permission assignment. */
         assignmentId: string;
+        /** List of API operations granted by this permission. */
         operations?: string[] | undefined;
     }[];
 };
 export type ActivateUserRequest = ActivateUserParams;
+export type ArchiveCredentialParams = {
+    credentialUuid: string;
+};
+export type ArchiveCredentialResponse = {};
+export type ArchiveCredentialRequest = ArchiveCredentialParams;
 export type ArchivePersonalAccessTokenParams = {
+    /** Token id. */
     tokenId: string;
 };
 export type ArchivePersonalAccessTokenResponse = {
+    /** The access token. Only returned at creation time. */
     accessToken?: string | undefined;
     dateCreated: string;
+    /** ID of the credential associated with the access token. */
     credId: string;
+    /** Whether the access token is active. */
     isActive: boolean;
     /** Access token kind. */
     kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+    /** User id. */
     linkedUserId: string;
+    /** ID of the application the access token is linked to. */
     linkedAppId: string;
+    /** Human-readable name of the access token. */
     name: string;
+    /** Organization id. */
     orgId: string;
+    /** Permissions (roles) assigned to the access token. */
     permissionAssignments: {
+        /** Human-readable name of the permission (role). */
         permissionName: string;
+        /** ID of the permission (also referred to as "role" in the dashboard). */
         permissionId: string;
+        /** ID of the permission assignment. */
         assignmentId: string;
+        /** List of API operations granted by this permission. */
         operations?: string[] | undefined;
     }[];
+    /** Public key associated with the access token. */
     publicKey: string;
+    /** Token id. */
     tokenId: string;
 };
 export type ArchivePersonalAccessTokenRequest = ArchivePersonalAccessTokenParams;
 export type ArchiveServiceAccountParams = {
+    /** ID of the service account. */
     serviceAccountId: string;
 };
 export type ArchiveServiceAccountQuery = {
@@ -135,43 +220,72 @@ export type ArchiveServiceAccountQuery = {
 };
 export type ArchiveServiceAccountResponse = {
     userInfo: {
+        /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
         username: string;
+        /** Display name of the user. */
         name: string;
         /** User id. */
         userId: string;
         /** User kind. */
-        kind: "DfnsStaff" | "AccountUser" | "CustomerEmployee" | "EndUser";
+        kind: "DfnsStaff" | "TenantUser" | "CustomerEmployee" | "EndUser";
+        /** UUID of the user's primary credential. */
         credentialUuid: string;
-        orgId: string;
+        /** Organization id. */
+        orgId?: string | undefined;
+        /** Tenant id. */
+        tenantId?: string | undefined;
+        /** @deprecated - Flat list of API operations the user has access to. */
         permissions?: string[] | undefined;
+        /** Whether the user is active. */
         isActive: boolean;
+        /** Whether the user is a service account. */
         isServiceAccount: boolean;
+        /** Whether the user has completed registration. */
         isRegistered: boolean;
+        /** Permissions (roles) assigned to the user. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
     };
     accessTokens: {
+        /** The access token. Only returned at creation time. */
         accessToken?: string | undefined;
         dateCreated: string;
+        /** ID of the credential associated with the access token. */
         credId: string;
+        /** Whether the access token is active. */
         isActive: boolean;
         /** Access token kind. */
         kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+        /** User id. */
         linkedUserId: string;
+        /** ID of the application the access token is linked to. */
         linkedAppId: string;
+        /** Human-readable name of the access token. */
         name: string;
+        /** Organization id. */
         orgId: string;
+        /** Permissions (roles) assigned to the access token. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
+        /** Public key associated with the access token. */
         publicKey: string;
+        /** Token id. */
         tokenId: string;
     }[];
 };
@@ -179,26 +293,43 @@ export type ArchiveServiceAccountRequest = ArchiveServiceAccountParams & {
     query?: ArchiveServiceAccountQuery;
 };
 export type ArchiveUserParams = {
+    /** User id. */
     userId: string;
 };
 export type ArchiveUserResponse = {
+    /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
     username: string;
+    /** Display name of the user. */
     name: string;
     /** User id. */
     userId: string;
     /** User kind. */
-    kind: "DfnsStaff" | "AccountUser" | "CustomerEmployee" | "EndUser";
+    kind: "DfnsStaff" | "TenantUser" | "CustomerEmployee" | "EndUser";
+    /** UUID of the user's primary credential. */
     credentialUuid: string;
-    orgId: string;
+    /** Organization id. */
+    orgId?: string | undefined;
+    /** Tenant id. */
+    tenantId?: string | undefined;
+    /** @deprecated - Flat list of API operations the user has access to. */
     permissions?: string[] | undefined;
+    /** Whether the user is active. */
     isActive: boolean;
+    /** Whether the user is a service account. */
     isServiceAccount: boolean;
+    /** Whether the user has completed registration. */
     isRegistered: boolean;
+    /** Whether the user must authenticate via SSO. */
     isSSORequired: boolean;
+    /** Permissions (roles) assigned to the user. */
     permissionAssignments: {
+        /** Human-readable name of the permission (role). */
         permissionName: string;
+        /** ID of the permission (also referred to as "role" in the dashboard). */
         permissionId: string;
+        /** ID of the permission assignment. */
         assignmentId: string;
+        /** List of API operations granted by this permission. */
         operations?: string[] | undefined;
     }[];
 };
@@ -206,84 +337,129 @@ export type ArchiveUserRequest = ArchiveUserParams;
 export type CreateCredentialBody = {
     credentialKind: "Fido2";
     credentialInfo: {
+        /** Base64url-encoded id of the credential returned by the user's WebAuthn client. */
         credId: string;
+        /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object returned by the user's WebAuthn client. */
         clientData: string;
+        /** Base64url-encoded attestation data returned by the user's WebAuthn client. */
         attestationData: string;
     };
+    /** Human-readable name of the credential. */
     credentialName: string;
+    /** Challenge identifier returned by the create credential challenge endpoint. */
     challengeIdentifier: string;
 } | {
     credentialKind: "Key";
     credentialInfo: {
+        /** Base64url-encoded id of the credential. */
         credId: string;
+        /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
         clientData: string;
+        /** Base64url-encoded public key. */
         attestationData: string;
     };
+    /** Human-readable name of the credential. */
     credentialName: string;
+    /** Challenge identifier returned by the create credential challenge endpoint. */
     challengeIdentifier: string;
 } | {
     credentialKind: "PasswordProtectedKey";
     credentialInfo: {
+        /** Base64url-encoded id of the credential. */
         credId: string;
+        /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
         clientData: string;
+        /** Base64url-encoded public key. */
         attestationData: string;
     };
+    /** User-encrypted private key. Dfns does not have the password to decrypt it. */
     encryptedPrivateKey: string;
+    /** Human-readable name of the credential. */
     credentialName: string;
+    /** Challenge identifier returned by the create credential challenge endpoint. */
     challengeIdentifier: string;
 } | {
     credentialKind: "RecoveryKey";
     credentialInfo: {
+        /** Base64url-encoded id of the recovery credential. */
         credId: string;
+        /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
         clientData: string;
+        /** Base64url-encoded public key. */
         attestationData: string;
     };
+    /** User-encrypted private key for the recovery credential. */
     encryptedPrivateKey?: string | undefined;
+    /** Human-readable name of the credential. */
     credentialName: string;
+    /** Challenge identifier returned by the create credential challenge endpoint. */
     challengeIdentifier: string;
 } | {
     credentialKind: "Password";
     credentialInfo: {
+        /** User password. */
         password: string;
     };
+    /** Human-readable name of the credential. */
     credentialName: string;
+    /** Challenge identifier returned by the create credential challenge endpoint. */
     challengeIdentifier: string;
 } | {
     credentialKind: "Totp";
     credentialInfo: {
+        /** TOTP one-time code. */
         otpCode: string;
     };
+    /** Human-readable name of the credential. */
     credentialName: string;
+    /** Challenge identifier returned by the create credential challenge endpoint. */
     challengeIdentifier: string;
 };
 export type CreateCredentialResponse = {
     kind: "Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey";
+    /** Credential ID from the WebAuthn authenticator (base64url). */
     credentialId: string;
+    /** Dfns-internal UUID of the credential. */
     credentialUuid: string;
     dateCreated: string;
+    /** Whether the credential is active. */
     isActive: boolean;
+    /** Human-readable name of the credential. */
     name: string;
+    /** Public key of the credential. */
     publicKey: string;
+    /** Relying party identifier associated with the credential. */
     relyingPartyId: string;
+    /** Origin where the credential was created. */
     origin: string;
 };
 export type CreateCredentialRequest = {
     body: CreateCredentialBody;
 };
+export type CreateUserCredentialBody = CreateCredentialBody;
+export type CreateUserCredentialResponse = CreateCredentialResponse;
+export type CreateUserCredentialRequest = CreateCredentialRequest;
 export type CreateCredentialChallengeBody = {
     kind: "Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey";
 };
 export type CreateCredentialChallengeResponse = {
     kind: "Fido2";
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** Challenge identifier to be used in the subsequent create credential request. */
     challengeIdentifier: string;
+    /** Challenge value to be signed by the credential. */
     challenge: string;
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
     authenticatorSelection: {
@@ -319,14 +495,21 @@ export type CreateCredentialChallengeResponse = {
 } | {
     kind: "Key";
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** Challenge identifier to be used in the subsequent create credential request. */
     challengeIdentifier: string;
+    /** Challenge value to be signed by the credential. */
     challenge: string;
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
     /** Identifies the information needed to verify the user's signing certificate; can be one of the following:
@@ -345,14 +528,21 @@ export type CreateCredentialChallengeResponse = {
 } | {
     kind: "PasswordProtectedKey";
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** Challenge identifier to be used in the subsequent create credential request. */
     challengeIdentifier: string;
+    /** Challenge value to be signed by the credential. */
     challenge: string;
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
     /** Identifies the information needed to verify the user's signing certificate; can be one of the following:
@@ -371,14 +561,21 @@ export type CreateCredentialChallengeResponse = {
 } | {
     kind: "RecoveryKey";
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** Challenge identifier to be used in the subsequent create credential request. */
     challengeIdentifier: string;
+    /** Challenge value to be signed by the credential. */
     challenge: string;
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
     /** Identifies the information needed to verify the user's signing certificate; can be one of the following:
@@ -397,13 +594,19 @@ export type CreateCredentialChallengeResponse = {
 } | {
     kind: "Password";
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** Challenge identifier to be used in the subsequent create credential request. */
     challengeIdentifier: string;
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
     /** @deprecated use challengeIdentifier instead */
@@ -411,15 +614,22 @@ export type CreateCredentialChallengeResponse = {
 } | {
     kind: "Totp";
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** Challenge identifier to be used in the subsequent create credential request. */
     challengeIdentifier: string;
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
+    /** Provisioning URL for the TOTP authenticator. */
     otpUrl: string;
     /** @deprecated use challengeIdentifier instead */
     temporaryAuthenticationToken: string;
@@ -427,21 +637,32 @@ export type CreateCredentialChallengeResponse = {
 export type CreateCredentialChallengeRequest = {
     body: CreateCredentialChallengeBody;
 };
+export type CreateUserCredentialChallengeBody = CreateCredentialChallengeBody;
+export type CreateUserCredentialChallengeResponse = CreateCredentialChallengeResponse;
+export type CreateUserCredentialChallengeRequest = CreateCredentialChallengeRequest;
 export type CreateCredentialChallengeWithCodeBody = {
     credentialKind: "Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey";
+    /** One-time code obtained from the create credential code endpoint. */
     code: string;
 };
 export type CreateCredentialChallengeWithCodeResponse = {
     kind: "Fido2";
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** Challenge identifier to be used in the subsequent create credential request. */
     challengeIdentifier: string;
+    /** Challenge value to be signed by the credential. */
     challenge: string;
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
     authenticatorSelection: {
@@ -477,14 +698,21 @@ export type CreateCredentialChallengeWithCodeResponse = {
 } | {
     kind: "Key";
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** Challenge identifier to be used in the subsequent create credential request. */
     challengeIdentifier: string;
+    /** Challenge value to be signed by the credential. */
     challenge: string;
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
     /** Identifies the information needed to verify the user's signing certificate; can be one of the following:
@@ -503,14 +731,21 @@ export type CreateCredentialChallengeWithCodeResponse = {
 } | {
     kind: "PasswordProtectedKey";
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** Challenge identifier to be used in the subsequent create credential request. */
     challengeIdentifier: string;
+    /** Challenge value to be signed by the credential. */
     challenge: string;
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
     /** Identifies the information needed to verify the user's signing certificate; can be one of the following:
@@ -529,14 +764,21 @@ export type CreateCredentialChallengeWithCodeResponse = {
 } | {
     kind: "RecoveryKey";
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** Challenge identifier to be used in the subsequent create credential request. */
     challengeIdentifier: string;
+    /** Challenge value to be signed by the credential. */
     challenge: string;
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
     /** Identifies the information needed to verify the user's signing certificate; can be one of the following:
@@ -555,13 +797,19 @@ export type CreateCredentialChallengeWithCodeResponse = {
 } | {
     kind: "Password";
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** Challenge identifier to be used in the subsequent create credential request. */
     challengeIdentifier: string;
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
     /** @deprecated use challengeIdentifier instead */
@@ -569,15 +817,22 @@ export type CreateCredentialChallengeWithCodeResponse = {
 } | {
     kind: "Totp";
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** Challenge identifier to be used in the subsequent create credential request. */
     challengeIdentifier: string;
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
+    /** Provisioning URL for the TOTP authenticator. */
     otpUrl: string;
     /** @deprecated use challengeIdentifier instead */
     temporaryAuthenticationToken: string;
@@ -590,7 +845,9 @@ export type CreateCredentialCodeBody = {
     expiration: string | number;
 };
 export type CreateCredentialCodeResponse = {
+    /** One-time code that can be used to create a new credential. */
     code: string;
+    /** Code expiration, as an ISO-8601 datetime string or a unix timestamp. */
     expiration: string;
 };
 export type CreateCredentialCodeRequest = {
@@ -599,88 +856,136 @@ export type CreateCredentialCodeRequest = {
 export type CreateCredentialWithCodeBody = {
     credentialKind: "Fido2";
     credentialInfo: {
+        /** Base64url-encoded id of the credential returned by the user's WebAuthn client. */
         credId: string;
+        /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object returned by the user's WebAuthn client. */
         clientData: string;
+        /** Base64url-encoded attestation data returned by the user's WebAuthn client. */
         attestationData: string;
     };
+    /** Human-readable name of the credential. */
     credentialName: string;
+    /** Challenge identifier returned by the create credential challenge endpoint. */
     challengeIdentifier: string;
 } | {
     credentialKind: "Key";
     credentialInfo: {
+        /** Base64url-encoded id of the credential. */
         credId: string;
+        /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
         clientData: string;
+        /** Base64url-encoded public key. */
         attestationData: string;
     };
+    /** Human-readable name of the credential. */
     credentialName: string;
+    /** Challenge identifier returned by the create credential challenge endpoint. */
     challengeIdentifier: string;
 } | {
     credentialKind: "PasswordProtectedKey";
     credentialInfo: {
+        /** Base64url-encoded id of the credential. */
         credId: string;
+        /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
         clientData: string;
+        /** Base64url-encoded public key. */
         attestationData: string;
     };
+    /** User-encrypted private key. Dfns does not have the password to decrypt it. */
     encryptedPrivateKey: string;
+    /** Human-readable name of the credential. */
     credentialName: string;
+    /** Challenge identifier returned by the create credential challenge endpoint. */
     challengeIdentifier: string;
 } | {
     credentialKind: "RecoveryKey";
     credentialInfo: {
+        /** Base64url-encoded id of the recovery credential. */
         credId: string;
+        /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
         clientData: string;
+        /** Base64url-encoded public key. */
         attestationData: string;
     };
+    /** User-encrypted private key for the recovery credential. */
     encryptedPrivateKey?: string | undefined;
+    /** Human-readable name of the credential. */
     credentialName: string;
+    /** Challenge identifier returned by the create credential challenge endpoint. */
     challengeIdentifier: string;
 } | {
     credentialKind: "Password";
     credentialInfo: {
+        /** User password. */
         password: string;
     };
+    /** Human-readable name of the credential. */
     credentialName: string;
+    /** Challenge identifier returned by the create credential challenge endpoint. */
     challengeIdentifier: string;
 } | {
     credentialKind: "Totp";
     credentialInfo: {
+        /** TOTP one-time code. */
         otpCode: string;
     };
+    /** Human-readable name of the credential. */
     credentialName: string;
+    /** Challenge identifier returned by the create credential challenge endpoint. */
     challengeIdentifier: string;
 };
 export type CreateCredentialWithCodeResponse = {
     kind: "Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey";
+    /** Credential ID from the WebAuthn authenticator (base64url). */
     credentialId: string;
+    /** Dfns-internal UUID of the credential. */
     credentialUuid: string;
     dateCreated: string;
+    /** Whether the credential is active. */
     isActive: boolean;
+    /** Human-readable name of the credential. */
     name: string;
+    /** Public key of the credential. */
     publicKey: string;
+    /** Relying party identifier associated with the credential. */
     relyingPartyId: string;
+    /** Origin where the credential was created. */
     origin: string;
 };
 export type CreateCredentialWithCodeRequest = {
     body: CreateCredentialWithCodeBody;
 };
 export type CreateDelegatedRecoveryChallengeBody = {
+    /** Username/identifier of the user to recover. */
     username: string;
+    /** Identifier of the recovery credential to use. */
     credentialId: string;
 };
 export type CreateDelegatedRecoveryChallengeResponse = {
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** JWT used to identify the registration session when calling Complete User Registration. */
     temporaryAuthenticationToken: string;
+    /** Challenge to be signed by the credential being registered. */
     challenge: string;
+    /** Deprecated. Should not be used. */
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
+    /** Credential kinds that can be used to register the user. */
     supportedCredentialKinds: {
+        /** Credential kinds accepted as first factor. */
         firstFactor: ("Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey")[];
+        /** Credential kinds accepted as second factor. */
         secondFactor: ("Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey")[];
     };
     authenticatorSelection: {
@@ -701,44 +1006,66 @@ export type CreateDelegatedRecoveryChallengeResponse = {
     * enterprise: indicates the attestation data should include information to uniquely identify the user's device
      */
     attestation: "none" | "indirect" | "direct" | "enterprise";
+    /** Public key credential parameters supported for the registration. */
     pubKeyCredParams: {
         type: "public-key";
         alg: number;
     }[];
+    /** Credentials to exclude from the registration (already registered for the user). */
     excludeCredentials: {
         /** Is always `public-key`. */
         type: "public-key";
         /** ID that identifies the credential. */
         id: string;
     }[];
+    /** URL to provision a TOTP credential, when applicable. */
     otpUrl: string;
     allowedRecoveryCredentials: {
+        /** Identifier of the recovery credential. */
         id: string;
+        /** Encrypted recovery key associated with this credential. */
         encryptedRecoveryKey: string;
     }[];
 };
 export type CreateDelegatedRecoveryChallengeRequest = {
     body: CreateDelegatedRecoveryChallengeBody;
 };
+export type CreateDelegatedUserRecoveryBody = CreateDelegatedRecoveryChallengeBody;
+export type CreateDelegatedUserRecoveryResponse = CreateDelegatedRecoveryChallengeResponse;
+export type CreateDelegatedUserRecoveryRequest = CreateDelegatedRecoveryChallengeRequest;
 export type CreateDelegatedRegistrationChallengeBody = {
+    /** Username/identifier (any unique string accepted, e.g. your internal user ID or email). */
     email: string;
+    /** Must be `EndUser`. */
     kind: "EndUser";
+    /** Optional external identifier for the user, used for cross-referencing with your own systems. */
     externalId?: string | undefined;
 };
 export type CreateDelegatedRegistrationChallengeResponse = {
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** JWT used to identify the registration session when calling Complete User Registration. */
     temporaryAuthenticationToken: string;
+    /** Challenge to be signed by the credential being registered. */
     challenge: string;
+    /** Deprecated. Should not be used. */
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
+    /** Credential kinds that can be used to register the user. */
     supportedCredentialKinds: {
+        /** Credential kinds accepted as first factor. */
         firstFactor: ("Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey")[];
+        /** Credential kinds accepted as second factor. */
         secondFactor: ("Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey")[];
     };
     authenticatorSelection: {
@@ -759,24 +1086,35 @@ export type CreateDelegatedRegistrationChallengeResponse = {
     * enterprise: indicates the attestation data should include information to uniquely identify the user's device
      */
     attestation: "none" | "indirect" | "direct" | "enterprise";
+    /** Public key credential parameters supported for the registration. */
     pubKeyCredParams: {
         type: "public-key";
         alg: number;
     }[];
+    /** Credentials to exclude from the registration (already registered for the user). */
     excludeCredentials: {
         /** Is always `public-key`. */
         type: "public-key";
         /** ID that identifies the credential. */
         id: string;
     }[];
+    /** URL to provision a TOTP credential, when applicable. */
     otpUrl: string;
 };
 export type CreateDelegatedRegistrationChallengeRequest = {
     body: CreateDelegatedRegistrationChallengeBody;
 };
+export type CreateDelegatedUserRegistrationBody = CreateDelegatedRegistrationChallengeBody;
+export type CreateDelegatedUserRegistrationResponse = CreateDelegatedRegistrationChallengeResponse;
+export type CreateDelegatedUserRegistrationRequest = CreateDelegatedRegistrationChallengeRequest;
 export type CreateLoginChallengeBody = {
+    /** Username/identifier of the user. Optional when the user has at least one discoverable WebAuthn credential. */
     username?: string | undefined;
-    orgId: string;
+    /** Organization id. */
+    orgId?: string | undefined;
+    /** Tenant id. */
+    tenantId?: string | undefined;
+    /** One-time login code, required when the user has a credential of kind `PasswordProtectedKey`. */
     loginCode?: string | undefined;
 };
 export type CreateLoginChallengeResponse = {
@@ -786,7 +1124,9 @@ export type CreateLoginChallengeResponse = {
     challengeIdentifier: string;
     /** Deprecated. Should not be used. */
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
     /** Identifies the kind of credentials that can be used to sign the user action. */
@@ -844,29 +1184,48 @@ export type CreateLoginChallengeRequest = {
     body: CreateLoginChallengeBody;
 };
 export type CreatePersonalAccessTokenBody = {
+    /** Human-readable name of the Personal Access Token. */
     name: string;
     publicKey: string;
+    /** ID of the permission (also referred to as "role" in the dashboard). */
     permissionId?: string | undefined;
+    /** Value that can be used to correlate the entity with an external system. */
     externalId?: string | undefined;
+    /** Number of days the token will be valid for. */
     daysValid?: number | undefined;
+    /** Number of seconds the token will be valid for. */
     secondsValid?: number | undefined;
 };
 export type CreatePersonalAccessTokenResponse = {
+    /** The access token. Only returned at creation time. */
     accessToken: string;
     dateCreated: string;
+    /** ID of the credential associated with the access token. */
     credId: string;
+    /** Whether the access token is active. */
     isActive: boolean;
     kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+    /** User id. */
     linkedUserId: string;
+    /** ID of the application the access token is linked to. */
     linkedAppId: string;
+    /** Human-readable name of the access token. */
     name: string;
+    /** Organization id. */
     orgId: string;
+    /** Public key associated with the access token. */
     publicKey: string;
+    /** Token id. */
     tokenId: string;
+    /** Permissions (roles) assigned to the access token. */
     permissionAssignments: {
+        /** Human-readable name of the permission (role). */
         permissionName: string;
+        /** ID of the permission (also referred to as "role" in the dashboard). */
         permissionId: string;
+        /** ID of the permission assignment. */
         assignmentId: string;
+        /** List of API operations granted by this permission. */
         operations?: string[] | undefined;
     }[];
 };
@@ -874,25 +1233,42 @@ export type CreatePersonalAccessTokenRequest = {
     body: CreatePersonalAccessTokenBody;
 };
 export type CreateRecoveryChallengeBody = {
+    /** Username/identifier of the user to recover. */
     username: string;
+    /** Recovery verification code sent to the user by email. */
     verificationCode: string;
-    orgId: string;
+    /** Organization id. */
+    orgId?: string | undefined;
+    /** Tenant id. */
+    tenantId?: string | undefined;
+    /** Identifier of the recovery credential to use. */
     credentialId: string;
 };
 export type CreateRecoveryChallengeResponse = {
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** JWT used to identify the registration session when calling Complete User Registration. */
     temporaryAuthenticationToken: string;
+    /** Challenge to be signed by the credential being registered. */
     challenge: string;
+    /** Deprecated. Should not be used. */
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
+    /** Credential kinds that can be used to register the user. */
     supportedCredentialKinds: {
+        /** Credential kinds accepted as first factor. */
         firstFactor: ("Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey")[];
+        /** Credential kinds accepted as second factor. */
         secondFactor: ("Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey")[];
     };
     authenticatorSelection: {
@@ -913,19 +1289,24 @@ export type CreateRecoveryChallengeResponse = {
     * enterprise: indicates the attestation data should include information to uniquely identify the user's device
      */
     attestation: "none" | "indirect" | "direct" | "enterprise";
+    /** Public key credential parameters supported for the registration. */
     pubKeyCredParams: {
         type: "public-key";
         alg: number;
     }[];
+    /** Credentials to exclude from the registration (already registered for the user). */
     excludeCredentials: {
         /** Is always `public-key`. */
         type: "public-key";
         /** ID that identifies the credential. */
         id: string;
     }[];
+    /** URL to provision a TOTP credential, when applicable. */
     otpUrl: string;
     allowedRecoveryCredentials: {
+        /** Identifier of the recovery credential. */
         id: string;
+        /** Encrypted recovery key associated with this credential. */
         encryptedRecoveryKey: string;
     }[];
 };
@@ -933,24 +1314,40 @@ export type CreateRecoveryChallengeRequest = {
     body: CreateRecoveryChallengeBody;
 };
 export type CreateRegistrationChallengeBody = {
-    orgId: string;
+    /** Organization id. */
+    orgId?: string | undefined;
+    /** Tenant id. */
+    tenantId?: string | undefined;
+    /** Username/identifier of the user being registered (any unique string accepted, e.g. email). */
     username: string;
+    /** One-time registration code sent to the user by email. */
     registrationCode: string;
 };
 export type CreateRegistrationChallengeResponse = {
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** JWT used to identify the registration session when calling Complete User Registration. */
     temporaryAuthenticationToken: string;
+    /** Challenge to be signed by the credential being registered. */
     challenge: string;
+    /** Deprecated. Should not be used. */
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
+    /** Credential kinds that can be used to register the user. */
     supportedCredentialKinds: {
+        /** Credential kinds accepted as first factor. */
         firstFactor: ("Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey")[];
+        /** Credential kinds accepted as second factor. */
         secondFactor: ("Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey")[];
     };
     authenticatorSelection: {
@@ -971,67 +1368,103 @@ export type CreateRegistrationChallengeResponse = {
     * enterprise: indicates the attestation data should include information to uniquely identify the user's device
      */
     attestation: "none" | "indirect" | "direct" | "enterprise";
+    /** Public key credential parameters supported for the registration. */
     pubKeyCredParams: {
         type: "public-key";
         alg: number;
     }[];
+    /** Credentials to exclude from the registration (already registered for the user). */
     excludeCredentials: {
         /** Is always `public-key`. */
         type: "public-key";
         /** ID that identifies the credential. */
         id: string;
     }[];
+    /** URL to provision a TOTP credential, when applicable. */
     otpUrl: string;
 };
 export type CreateRegistrationChallengeRequest = {
     body: CreateRegistrationChallengeBody;
 };
 export type CreateServiceAccountBody = {
+    /** Human-readable name of the Service Account. */
     name: string;
     publicKey: string;
+    /** ID of the permission (also referred to as "role" in the dashboard). */
     permissionId?: string | undefined;
+    /** Value that can be used to correlate the entity with an external system. */
     externalId?: string | undefined;
+    /** Number of days the service account will be valid for. */
     daysValid?: number | undefined;
 };
 export type CreateServiceAccountResponse = {
     userInfo: {
+        /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
         username: string;
+        /** Display name of the user. */
         name: string;
         /** User id. */
         userId: string;
         /** User kind. */
-        kind: "DfnsStaff" | "AccountUser" | "CustomerEmployee" | "EndUser";
+        kind: "DfnsStaff" | "TenantUser" | "CustomerEmployee" | "EndUser";
+        /** UUID of the user's primary credential. */
         credentialUuid: string;
-        orgId: string;
+        /** Organization id. */
+        orgId?: string | undefined;
+        /** Tenant id. */
+        tenantId?: string | undefined;
+        /** @deprecated - Flat list of API operations the user has access to. */
         permissions?: string[] | undefined;
+        /** Whether the user is active. */
         isActive: boolean;
+        /** Whether the user is a service account. */
         isServiceAccount: boolean;
+        /** Whether the user has completed registration. */
         isRegistered: boolean;
+        /** Permissions (roles) assigned to the user. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
     };
     accessTokens: {
+        /** The access token. Only returned at creation time. */
         accessToken?: string | undefined;
         dateCreated: string;
+        /** ID of the credential associated with the access token. */
         credId: string;
+        /** Whether the access token is active. */
         isActive: boolean;
         /** Access token kind. */
         kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+        /** User id. */
         linkedUserId: string;
+        /** ID of the application the access token is linked to. */
         linkedAppId: string;
+        /** Human-readable name of the access token. */
         name: string;
+        /** Organization id. */
         orgId: string;
+        /** Permissions (roles) assigned to the access token. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
+        /** Public key associated with the access token. */
         publicKey: string;
+        /** Token id. */
         tokenId: string;
     }[];
 };
@@ -1039,24 +1472,38 @@ export type CreateServiceAccountRequest = {
     body: CreateServiceAccountBody;
 };
 export type CreateSocialRegistrationChallengeBody = {
+    /** Organization id. */
     orgId?: string | undefined;
+    /** Social login provider used to issue the JWT. */
     socialLoginProviderKind: "Oidc";
+    /** JWT id token issued by the social login provider. */
     idToken: string;
 };
 export type CreateSocialRegistrationChallengeResponse = {
     user: {
+        /** Base64url-encoded user handle (WebAuthn user.id). */
         id: string;
+        /** Display name of the user. */
         displayName: string;
+        /** Username of the user. */
         name: string;
     };
+    /** JWT used to identify the registration session when calling Complete User Registration. */
     temporaryAuthenticationToken: string;
+    /** Challenge to be signed by the credential being registered. */
     challenge: string;
+    /** Deprecated. Should not be used. */
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
+    /** Credential kinds that can be used to register the user. */
     supportedCredentialKinds: {
+        /** Credential kinds accepted as first factor. */
         firstFactor: ("Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey")[];
+        /** Credential kinds accepted as second factor. */
         secondFactor: ("Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey")[];
     };
     authenticatorSelection: {
@@ -1077,16 +1524,19 @@ export type CreateSocialRegistrationChallengeResponse = {
     * enterprise: indicates the attestation data should include information to uniquely identify the user's device
      */
     attestation: "none" | "indirect" | "direct" | "enterprise";
+    /** Public key credential parameters supported for the registration. */
     pubKeyCredParams: {
         type: "public-key";
         alg: number;
     }[];
+    /** Credentials to exclude from the registration (already registered for the user). */
     excludeCredentials: {
         /** Is always `public-key`. */
         type: "public-key";
         /** ID that identifies the credential. */
         id: string;
     }[];
+    /** URL to provision a TOTP credential, when applicable. */
     otpUrl: string;
 };
 export type CreateSocialRegistrationChallengeRequest = {
@@ -1098,6 +1548,7 @@ export type CreateUserBody = {
     /** The kind of user being created.
           In this endpoint it can only be "`CustomerEmployee`" (creating an "`EndUser`" is done through the [Delegated Registration](https://docs.dfns.co/api-reference/auth/registration-flows#delegated-users-registration-flow) endpoint) */
     kind: "CustomerEmployee" | "DfnsStaff";
+    /** Optional public key in PEM format associated with the user. */
     publicKey?: string | undefined;
     /** Value that can be used to correlate the entity with an external system. */
     externalId?: string | undefined;
@@ -1105,23 +1556,39 @@ export type CreateUserBody = {
     isSSORequired?: boolean | undefined;
 };
 export type CreateUserResponse = {
+    /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
     username: string;
+    /** Display name of the user. */
     name: string;
     /** User id. */
     userId: string;
     /** User kind. */
-    kind: "DfnsStaff" | "AccountUser" | "CustomerEmployee" | "EndUser";
+    kind: "DfnsStaff" | "TenantUser" | "CustomerEmployee" | "EndUser";
+    /** UUID of the user's primary credential. */
     credentialUuid: string;
-    orgId: string;
+    /** Organization id. */
+    orgId?: string | undefined;
+    /** Tenant id. */
+    tenantId?: string | undefined;
+    /** @deprecated - Flat list of API operations the user has access to. */
     permissions?: string[] | undefined;
+    /** Whether the user is active. */
     isActive: boolean;
+    /** Whether the user is a service account. */
     isServiceAccount: boolean;
+    /** Whether the user has completed registration. */
     isRegistered: boolean;
+    /** Whether the user must authenticate via SSO. */
     isSSORequired: boolean;
+    /** Permissions (roles) assigned to the user. */
     permissionAssignments: {
+        /** Human-readable name of the permission (role). */
         permissionName: string;
+        /** ID of the permission (also referred to as "role" in the dashboard). */
         permissionId: string;
+        /** ID of the permission assignment. */
         assignmentId: string;
+        /** List of API operations granted by this permission. */
         operations?: string[] | undefined;
     }[];
 };
@@ -1145,7 +1612,9 @@ export type CreateUserActionChallengeResponse = {
     challengeIdentifier: string;
     /** Deprecated. Should not be used. */
     rp?: {
+        /** ID of the WebAuthn relying party (typically a domain name). */
         id: string;
+        /** Human-readable name of the relying party. */
         name: string;
     } | undefined;
     /** Identifies the kind of credentials that can be used to sign the user action. */
@@ -1202,6 +1671,9 @@ export type CreateUserActionChallengeResponse = {
 export type CreateUserActionChallengeRequest = {
     body: CreateUserActionChallengeBody;
 };
+export type CreateUserActionSignatureChallengeBody = CreateUserActionChallengeBody;
+export type CreateUserActionSignatureChallengeResponse = CreateUserActionChallengeResponse;
+export type CreateUserActionSignatureChallengeRequest = CreateUserActionChallengeRequest;
 export type CreateUserActionSignatureBody = {
     /** Temporary authentication token returned by the Create Challenge endpoint. */
     challengeIdentifier: string;
@@ -1248,6 +1720,7 @@ export type CreateUserActionSignatureBody = {
         };
     } | {
         kind: "Password";
+        /** User password. */
         password: string;
     };
     /** Second factor credential used to authenticate a user. */
@@ -1293,45 +1766,64 @@ export type CreateUserActionSignatureBody = {
         };
     } | {
         kind: "Totp";
+        /** TOTP one-time code. */
         otpCode: string;
     }) | undefined;
 };
 export type CreateUserActionSignatureResponse = {
+    /** Signing token to use to verify the user intended to perform the action. */
     userAction: string;
 };
 export type CreateUserActionSignatureRequest = {
     body: CreateUserActionSignatureBody;
 };
 export type DeactivateCredentialBody = {
+    /** UUID of the credential to deactivate. */
     credentialUuid: string;
 };
 export type DeactivateCredentialResponse = {
+    /** Human-readable success message. */
     message: string;
 };
 export type DeactivateCredentialRequest = {
     body: DeactivateCredentialBody;
 };
 export type DeactivatePersonalAccessTokenParams = {
+    /** Token id. */
     tokenId: string;
 };
 export type DeactivatePersonalAccessTokenResponse = {
+    /** The access token. Only returned at creation time. */
     accessToken?: string | undefined;
     dateCreated: string;
+    /** ID of the credential associated with the access token. */
     credId: string;
+    /** Whether the access token is active. */
     isActive: boolean;
     /** Access token kind. */
     kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+    /** User id. */
     linkedUserId: string;
+    /** ID of the application the access token is linked to. */
     linkedAppId: string;
+    /** Human-readable name of the access token. */
     name: string;
+    /** Organization id. */
     orgId: string;
+    /** Permissions (roles) assigned to the access token. */
     permissionAssignments: {
+        /** Human-readable name of the permission (role). */
         permissionName: string;
+        /** ID of the permission (also referred to as "role" in the dashboard). */
         permissionId: string;
+        /** ID of the permission assignment. */
         assignmentId: string;
+        /** List of API operations granted by this permission. */
         operations?: string[] | undefined;
     }[];
+    /** Public key associated with the access token. */
     publicKey: string;
+    /** Token id. */
     tokenId: string;
 };
 export type DeactivatePersonalAccessTokenRequest = DeactivatePersonalAccessTokenParams;
@@ -1340,47 +1832,77 @@ export type DeactivateServiceAccountBody = {
     force?: boolean;
 };
 export type DeactivateServiceAccountParams = {
+    /** ID of the service account. */
     serviceAccountId: string;
 };
 export type DeactivateServiceAccountResponse = {
     userInfo: {
+        /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
         username: string;
+        /** Display name of the user. */
         name: string;
         /** User id. */
         userId: string;
         /** User kind. */
-        kind: "DfnsStaff" | "AccountUser" | "CustomerEmployee" | "EndUser";
+        kind: "DfnsStaff" | "TenantUser" | "CustomerEmployee" | "EndUser";
+        /** UUID of the user's primary credential. */
         credentialUuid: string;
-        orgId: string;
+        /** Organization id. */
+        orgId?: string | undefined;
+        /** Tenant id. */
+        tenantId?: string | undefined;
+        /** @deprecated - Flat list of API operations the user has access to. */
         permissions?: string[] | undefined;
+        /** Whether the user is active. */
         isActive: boolean;
+        /** Whether the user is a service account. */
         isServiceAccount: boolean;
+        /** Whether the user has completed registration. */
         isRegistered: boolean;
+        /** Permissions (roles) assigned to the user. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
     };
     accessTokens: {
+        /** The access token. Only returned at creation time. */
         accessToken?: string | undefined;
         dateCreated: string;
+        /** ID of the credential associated with the access token. */
         credId: string;
+        /** Whether the access token is active. */
         isActive: boolean;
         /** Access token kind. */
         kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+        /** User id. */
         linkedUserId: string;
+        /** ID of the application the access token is linked to. */
         linkedAppId: string;
+        /** Human-readable name of the access token. */
         name: string;
+        /** Organization id. */
         orgId: string;
+        /** Permissions (roles) assigned to the access token. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
+        /** Public key associated with the access token. */
         publicKey: string;
+        /** Token id. */
         tokenId: string;
     }[];
 };
@@ -1388,74 +1910,133 @@ export type DeactivateServiceAccountRequest = DeactivateServiceAccountParams & {
     body: DeactivateServiceAccountBody;
 };
 export type DeactivateUserParams = {
+    /** User id. */
     userId: string;
 };
 export type DeactivateUserResponse = {
+    /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
     username: string;
+    /** Display name of the user. */
     name: string;
     /** User id. */
     userId: string;
     /** User kind. */
-    kind: "DfnsStaff" | "AccountUser" | "CustomerEmployee" | "EndUser";
+    kind: "DfnsStaff" | "TenantUser" | "CustomerEmployee" | "EndUser";
+    /** UUID of the user's primary credential. */
     credentialUuid: string;
-    orgId: string;
+    /** Organization id. */
+    orgId?: string | undefined;
+    /** Tenant id. */
+    tenantId?: string | undefined;
+    /** @deprecated - Flat list of API operations the user has access to. */
     permissions?: string[] | undefined;
+    /** Whether the user is active. */
     isActive: boolean;
+    /** Whether the user is a service account. */
     isServiceAccount: boolean;
+    /** Whether the user has completed registration. */
     isRegistered: boolean;
+    /** Whether the user must authenticate via SSO. */
     isSSORequired: boolean;
+    /** Permissions (roles) assigned to the user. */
     permissionAssignments: {
+        /** Human-readable name of the permission (role). */
         permissionName: string;
+        /** ID of the permission (also referred to as "role" in the dashboard). */
         permissionId: string;
+        /** ID of the permission assignment. */
         assignmentId: string;
+        /** List of API operations granted by this permission. */
         operations?: string[] | undefined;
     }[];
 };
 export type DeactivateUserRequest = DeactivateUserParams;
 export type DelegatedLoginBody = {
+    /** Username/identifier of the user to log in. */
     username: string;
 };
 export type DelegatedLoginResponse = {
+    /** Authentication token issued to the user. */
     token: string;
 };
 export type DelegatedLoginRequest = {
     body: DelegatedLoginBody;
 };
+export type CreateDelegatedUserLoginBody = DelegatedLoginBody;
+export type CreateDelegatedUserLoginResponse = DelegatedLoginResponse;
+export type CreateDelegatedUserLoginRequest = DelegatedLoginRequest;
+export type ExchangeAccessTokenBody = {
+    /** ID of the Organisation or Tenant for which you wish to obtain an access token. */
+    target: string;
+};
+export type ExchangeAccessTokenResponse = {
+    token: string;
+};
+export type ExchangeAccessTokenRequest = {
+    body: ExchangeAccessTokenBody;
+};
 export type GetApplicationParams = {
+    /** ID of the application (deprecated). */
     appId: string;
 };
 export type GetApplicationResponse = {
+    /** ID of the application (deprecated). */
     appId: string;
     kind: "ServerSideApplication" | "ClientSideApplication";
+    /** Organization id. */
     orgId: string;
+    /** Expected relying party ID for webauthn (deprecated). */
     expectedRpId?: string | undefined;
+    /** Human-readable name of the application. */
     name: string;
+    /** Whether the application is active. */
     isActive: boolean;
+    /** Expected origin for webauthn (deprecated). */
     expectedOrigin?: string | undefined;
+    /** Permissions (roles) assigned to the application. */
     permissionAssignments: {
+        /** Human-readable name of the permission (role). */
         permissionName: string;
+        /** ID of the permission (also referred to as "role" in the dashboard). */
         permissionId: string;
+        /** ID of the permission assignment. */
         assignmentId: string;
+        /** List of API operations granted by this permission. */
         operations?: string[] | undefined;
     }[];
+    /** Access tokens associated with the application. */
     accessTokens: {
+        /** The access token. Only returned at creation time. */
         accessToken?: string | undefined;
         dateCreated: string;
+        /** ID of the credential associated with the access token. */
         credId: string;
+        /** Whether the access token is active. */
         isActive: boolean;
         /** Access token kind. */
         kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+        /** User id. */
         linkedUserId: string;
+        /** ID of the application the access token is linked to. */
         linkedAppId: string;
+        /** Human-readable name of the access token. */
         name: string;
+        /** Organization id. */
         orgId: string;
+        /** Permissions (roles) assigned to the access token. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
+        /** Public key associated with the access token. */
         publicKey: string;
+        /** Token id. */
         tokenId: string;
     }[];
 };
@@ -1497,133 +2078,232 @@ export type GetAuditLogResponse = {
 };
 export type GetAuditLogRequest = GetAuditLogParams;
 export type GetPersonalAccessTokenParams = {
+    /** Token id. */
     tokenId: string;
 };
 export type GetPersonalAccessTokenResponse = {
+    /** The access token. Only returned at creation time. */
     accessToken?: string | undefined;
     dateCreated: string;
+    /** ID of the credential associated with the access token. */
     credId: string;
+    /** Whether the access token is active. */
     isActive: boolean;
     /** Access token kind. */
     kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+    /** User id. */
     linkedUserId: string;
+    /** ID of the application the access token is linked to. */
     linkedAppId: string;
+    /** Human-readable name of the access token. */
     name: string;
+    /** Organization id. */
     orgId: string;
+    /** Permissions (roles) assigned to the access token. */
     permissionAssignments: {
+        /** Human-readable name of the permission (role). */
         permissionName: string;
+        /** ID of the permission (also referred to as "role" in the dashboard). */
         permissionId: string;
+        /** ID of the permission assignment. */
         assignmentId: string;
+        /** List of API operations granted by this permission. */
         operations?: string[] | undefined;
     }[];
+    /** Public key associated with the access token. */
     publicKey: string;
+    /** Token id. */
     tokenId: string;
 };
 export type GetPersonalAccessTokenRequest = GetPersonalAccessTokenParams;
 export type GetServiceAccountParams = {
+    /** ID of the service account. */
     serviceAccountId: string;
 };
 export type GetServiceAccountResponse = {
     userInfo: {
+        /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
         username: string;
+        /** Display name of the user. */
         name: string;
         /** User id. */
         userId: string;
         /** User kind. */
-        kind: "DfnsStaff" | "AccountUser" | "CustomerEmployee" | "EndUser";
+        kind: "DfnsStaff" | "TenantUser" | "CustomerEmployee" | "EndUser";
+        /** UUID of the user's primary credential. */
         credentialUuid: string;
-        orgId: string;
+        /** Organization id. */
+        orgId?: string | undefined;
+        /** Tenant id. */
+        tenantId?: string | undefined;
+        /** @deprecated - Flat list of API operations the user has access to. */
         permissions?: string[] | undefined;
+        /** Whether the user is active. */
         isActive: boolean;
+        /** Whether the user is a service account. */
         isServiceAccount: boolean;
+        /** Whether the user has completed registration. */
         isRegistered: boolean;
+        /** Permissions (roles) assigned to the user. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
     };
     accessTokens: {
+        /** The access token. Only returned at creation time. */
         accessToken?: string | undefined;
         dateCreated: string;
+        /** ID of the credential associated with the access token. */
         credId: string;
+        /** Whether the access token is active. */
         isActive: boolean;
         /** Access token kind. */
         kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+        /** User id. */
         linkedUserId: string;
+        /** ID of the application the access token is linked to. */
         linkedAppId: string;
+        /** Human-readable name of the access token. */
         name: string;
+        /** Organization id. */
         orgId: string;
+        /** Permissions (roles) assigned to the access token. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
+        /** Public key associated with the access token. */
         publicKey: string;
+        /** Token id. */
         tokenId: string;
     }[];
 };
 export type GetServiceAccountRequest = GetServiceAccountParams;
 export type GetUserParams = {
+    /** User id. */
     userId: string;
 };
 export type GetUserResponse = {
+    /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
     username: string;
+    /** Display name of the user. */
     name: string;
     /** User id. */
     userId: string;
     /** User kind. */
-    kind: "DfnsStaff" | "AccountUser" | "CustomerEmployee" | "EndUser";
+    kind: "DfnsStaff" | "TenantUser" | "CustomerEmployee" | "EndUser";
+    /** UUID of the user's primary credential. */
     credentialUuid: string;
-    orgId: string;
+    /** Organization id. */
+    orgId?: string | undefined;
+    /** Tenant id. */
+    tenantId?: string | undefined;
+    /** @deprecated - Flat list of API operations the user has access to. */
     permissions?: string[] | undefined;
+    /** Whether the user is active. */
     isActive: boolean;
+    /** Whether the user is a service account. */
     isServiceAccount: boolean;
+    /** Whether the user has completed registration. */
     isRegistered: boolean;
+    /** Whether the user must authenticate via SSO. */
     isSSORequired: boolean;
+    /** Permissions (roles) assigned to the user. */
     permissionAssignments: {
+        /** Human-readable name of the permission (role). */
         permissionName: string;
+        /** ID of the permission (also referred to as "role" in the dashboard). */
         permissionId: string;
+        /** ID of the permission assignment. */
         assignmentId: string;
+        /** List of API operations granted by this permission. */
         operations?: string[] | undefined;
     }[];
 };
 export type GetUserRequest = GetUserParams;
+export type InviteTenantUserBody = {
+    /** Email address of the existing Tenant User. */
+    email: string;
+    /** The kind of user being invited. It can only be "`TenantUser`" */
+    kind: "TenantUser";
+};
+export type InviteTenantUserResponse = {};
+export type InviteTenantUserRequest = {
+    body: InviteTenantUserBody;
+};
 export type ListApplicationsResponse = {
+    /** Current page items. */
     items: {
+        /** ID of the application (deprecated). */
         appId: string;
         kind: "ServerSideApplication" | "ClientSideApplication";
+        /** Organization id. */
         orgId: string;
+        /** Expected relying party ID for webauthn (deprecated). */
         expectedRpId?: string | undefined;
+        /** Human-readable name of the application. */
         name: string;
+        /** Whether the application is active. */
         isActive: boolean;
+        /** Expected origin for webauthn (deprecated). */
         expectedOrigin?: string | undefined;
+        /** Permissions (roles) assigned to the application. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
+        /** Access tokens associated with the application. */
         accessTokens: {
+            /** The access token. Only returned at creation time. */
             accessToken?: string | undefined;
             dateCreated: string;
+            /** ID of the credential associated with the access token. */
             credId: string;
+            /** Whether the access token is active. */
             isActive: boolean;
             /** Access token kind. */
             kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+            /** User id. */
             linkedUserId: string;
+            /** ID of the application the access token is linked to. */
             linkedAppId: string;
+            /** Human-readable name of the access token. */
             name: string;
+            /** Organization id. */
             orgId: string;
+            /** Permissions (roles) assigned to the access token. */
             permissionAssignments: {
+                /** Human-readable name of the permission (role). */
                 permissionName: string;
+                /** ID of the permission (also referred to as "role" in the dashboard). */
                 permissionId: string;
+                /** ID of the permission assignment. */
                 assignmentId: string;
+                /** List of API operations granted by this permission. */
                 operations?: string[] | undefined;
             }[];
+            /** Public key associated with the access token. */
             publicKey: string;
+            /** Token id. */
             tokenId: string;
         }[];
     }[];
@@ -1639,111 +2319,186 @@ export type ListAuditLogsRequest = {
     query?: ListAuditLogsQuery;
 };
 export type ListCredentialsResponse = {
+    /** Current page items. */
     items: {
         kind: "Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey";
+        /** Credential ID from the WebAuthn authenticator (base64url). */
         credentialId: string;
+        /** Dfns-internal UUID of the credential. */
         credentialUuid: string;
         dateCreated: string;
+        /** Whether the credential is active. */
         isActive: boolean;
+        /** Human-readable name of the credential. */
         name: string;
+        /** Public key of the credential. */
         publicKey: string;
+        /** Relying party identifier associated with the credential. */
         relyingPartyId: string;
+        /** Origin where the credential was created. */
         origin: string;
     }[];
 };
+export type ListUserCredentialsResponse = ListCredentialsResponse;
 export type ListPersonalAccessTokensResponse = {
+    /** Current page items. */
     items: {
+        /** The access token. Only returned at creation time. */
         accessToken?: string | undefined;
         dateCreated: string;
+        /** ID of the credential associated with the access token. */
         credId: string;
+        /** Whether the access token is active. */
         isActive: boolean;
         /** Access token kind. */
         kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+        /** User id. */
         linkedUserId: string;
+        /** ID of the application the access token is linked to. */
         linkedAppId: string;
+        /** Human-readable name of the access token. */
         name: string;
+        /** Organization id. */
         orgId: string;
+        /** Permissions (roles) assigned to the access token. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
+        /** Public key associated with the access token. */
         publicKey: string;
+        /** Token id. */
         tokenId: string;
     }[];
 };
 export type ListServiceAccountsResponse = {
+    /** Current page items. */
     items: {
         userInfo: {
+            /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
             username: string;
+            /** Display name of the user. */
             name: string;
             /** User id. */
             userId: string;
             /** User kind. */
-            kind: "DfnsStaff" | "AccountUser" | "CustomerEmployee" | "EndUser";
+            kind: "DfnsStaff" | "TenantUser" | "CustomerEmployee" | "EndUser";
+            /** UUID of the user's primary credential. */
             credentialUuid: string;
-            orgId: string;
+            /** Organization id. */
+            orgId?: string | undefined;
+            /** Tenant id. */
+            tenantId?: string | undefined;
+            /** @deprecated - Flat list of API operations the user has access to. */
             permissions?: string[] | undefined;
+            /** Whether the user is active. */
             isActive: boolean;
+            /** Whether the user is a service account. */
             isServiceAccount: boolean;
+            /** Whether the user has completed registration. */
             isRegistered: boolean;
+            /** Permissions (roles) assigned to the user. */
             permissionAssignments: {
+                /** Human-readable name of the permission (role). */
                 permissionName: string;
+                /** ID of the permission (also referred to as "role" in the dashboard). */
                 permissionId: string;
+                /** ID of the permission assignment. */
                 assignmentId: string;
+                /** List of API operations granted by this permission. */
                 operations?: string[] | undefined;
             }[];
         };
         accessTokens: {
+            /** The access token. Only returned at creation time. */
             accessToken?: string | undefined;
             dateCreated: string;
+            /** ID of the credential associated with the access token. */
             credId: string;
+            /** Whether the access token is active. */
             isActive: boolean;
             /** Access token kind. */
             kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+            /** User id. */
             linkedUserId: string;
+            /** ID of the application the access token is linked to. */
             linkedAppId: string;
+            /** Human-readable name of the access token. */
             name: string;
+            /** Organization id. */
             orgId: string;
+            /** Permissions (roles) assigned to the access token. */
             permissionAssignments: {
+                /** Human-readable name of the permission (role). */
                 permissionName: string;
+                /** ID of the permission (also referred to as "role" in the dashboard). */
                 permissionId: string;
+                /** ID of the permission assignment. */
                 assignmentId: string;
+                /** List of API operations granted by this permission. */
                 operations?: string[] | undefined;
             }[];
+            /** Public key associated with the access token. */
             publicKey: string;
+            /** Token id. */
             tokenId: string;
         }[];
     }[];
 };
 export type ListUsersQuery = {
+    /** Maximum number of items to return. */
     limit?: number | undefined;
+    /** Opaque token used to retrieve the next page. Returned as `nextPageToken` from the previous request. */
     paginationToken?: string | undefined;
+    /** Filter users by kind. */
     kind?: ("CustomerEmployee" | "EndUser") | undefined;
 };
 export type ListUsersResponse = {
+    /** Current page items. */
     items: {
+        /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
         username: string;
+        /** Display name of the user. */
         name: string;
         /** User id. */
         userId: string;
         /** User kind. */
-        kind: "DfnsStaff" | "AccountUser" | "CustomerEmployee" | "EndUser";
+        kind: "DfnsStaff" | "TenantUser" | "CustomerEmployee" | "EndUser";
+        /** UUID of the user's primary credential. */
         credentialUuid: string;
-        orgId: string;
+        /** Organization id. */
+        orgId?: string | undefined;
+        /** Tenant id. */
+        tenantId?: string | undefined;
+        /** @deprecated - Flat list of API operations the user has access to. */
         permissions?: string[] | undefined;
+        /** Whether the user is active. */
         isActive: boolean;
+        /** Whether the user is a service account. */
         isServiceAccount: boolean;
+        /** Whether the user has completed registration. */
         isRegistered: boolean;
+        /** Whether the user must authenticate via SSO. */
         isSSORequired: boolean;
+        /** Permissions (roles) assigned to the user. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
     }[];
+    /** token to use as `paginationToken` to request the next page. */
     nextPageToken?: string | undefined;
 };
 export type ListUsersRequest = {
@@ -1795,6 +2550,7 @@ export type LoginBody = {
         };
     } | {
         kind: "Password";
+        /** User password. */
         password: string;
     };
     /** Second factor credential used to authenticate a user. */
@@ -1840,12 +2596,15 @@ export type LoginBody = {
         };
     } | {
         kind: "Totp";
+        /** TOTP one-time code. */
         otpCode: string;
     }) | undefined;
 };
 export type LoginResponse = {
+    /** Authentication token issued to the user. */
     token: string;
 } | {
+    /** Identifier of the SSO client to use to complete the login flow. */
     ssoClientId: string;
 };
 export type LoginRequest = {
@@ -1855,6 +2614,7 @@ export type LogoutBody = {
     allSessions?: boolean | undefined;
 } | undefined;
 export type LogoutResponse = {
+    /** Human-readable success message. */
     message: string;
 };
 export type LogoutRequest = {
@@ -1878,288 +2638,424 @@ export type RecoverBody = {
         firstFactorCredential: {
             credentialKind: "Fido2";
             credentialInfo: {
+                /** Base64url-encoded id of the credential returned by the user's WebAuthn client. */
                 credId: string;
+                /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object returned by the user's WebAuthn client. */
                 clientData: string;
+                /** Base64url-encoded attestation data returned by the user's WebAuthn client. */
                 attestationData: string;
             };
+            /** Human-readable name to assign to the credential. */
             credentialName?: string | undefined;
         } | {
             credentialKind: "Key";
             credentialInfo: {
+                /** Base64url-encoded id of the credential. */
                 credId: string;
+                /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
                 clientData: string;
+                /** Base64url-encoded public key. */
                 attestationData: string;
             };
+            /** Human-readable name to assign to the credential. */
             credentialName?: string | undefined;
         } | {
             credentialKind: "Password";
             credentialInfo: {
+                /** User password. */
                 password: string;
             };
+            /** Human-readable name to assign to the credential. */
             credentialName?: string | undefined;
         } | {
             credentialKind: "PasswordProtectedKey";
             credentialInfo: {
+                /** Base64url-encoded id of the credential. */
                 credId: string;
+                /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
                 clientData: string;
+                /** Base64url-encoded public key. */
                 attestationData: string;
             };
+            /** User-encrypted private key. Dfns does not have the password to decrypt it. */
             encryptedPrivateKey: string;
+            /** Human-readable name to assign to the credential. */
             credentialName?: string | undefined;
         };
         secondFactorCredential?: ({
             credentialKind: "Fido2";
             credentialInfo: {
+                /** Base64url-encoded id of the credential returned by the user's WebAuthn client. */
                 credId: string;
+                /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object returned by the user's WebAuthn client. */
                 clientData: string;
+                /** Base64url-encoded attestation data returned by the user's WebAuthn client. */
                 attestationData: string;
             };
+            /** Human-readable name to assign to the credential. */
             credentialName?: string | undefined;
         } | {
             credentialKind: "Key";
             credentialInfo: {
+                /** Base64url-encoded id of the credential. */
                 credId: string;
+                /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
                 clientData: string;
+                /** Base64url-encoded public key. */
                 attestationData: string;
             };
+            /** Human-readable name to assign to the credential. */
             credentialName?: string | undefined;
         } | {
             credentialKind: "Totp";
             credentialInfo: {
+                /** TOTP one-time code. */
                 otpCode: string;
             };
+            /** Human-readable name to assign to the credential. */
             credentialName?: string | undefined;
         } | {
             credentialKind: "PasswordProtectedKey";
             credentialInfo: {
+                /** Base64url-encoded id of the credential. */
                 credId: string;
+                /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
                 clientData: string;
+                /** Base64url-encoded public key. */
                 attestationData: string;
             };
+            /** User-encrypted private key. Dfns does not have the password to decrypt it. */
             encryptedPrivateKey: string;
+            /** Human-readable name to assign to the credential. */
             credentialName?: string | undefined;
         }) | undefined;
         /** Register a recovery key. See [Account Recovery](https://docs.dfns.co/api-reference/auth/account-recovery) for more details. */
         recoveryCredential?: {
             credentialKind: "RecoveryKey";
             credentialInfo: {
+                /** Base64url-encoded id of the recovery credential. */
                 credId: string;
+                /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
                 clientData: string;
+                /** Base64url-encoded public key. */
                 attestationData: string;
             };
+            /** User-encrypted private key for the recovery credential. */
             encryptedPrivateKey?: string | undefined;
+            /** Human-readable name to assign to the credential. */
             credentialName?: string | undefined;
         } | undefined;
     };
 };
 export type RecoverResponse = {
     credential: {
+        /** UUID of the credential that was registered. */
         uuid: string;
+        /** Kind of credential that was registered. */
         kind: "Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey";
+        /** Human-readable name of the credential. */
         name: string;
     };
     user: {
+        /** User id. */
         id: string;
+        /** Username/identifier of the user. */
         username: string;
-        orgId: string;
+        /** Organization id. */
+        orgId?: string | undefined;
+        /** Tenant id. */
+        tenantId?: string | undefined;
     };
 };
 export type RecoverRequest = {
     body: RecoverBody;
 };
+export type CreateUserRecoveryBody = RecoverBody;
+export type CreateUserRecoveryResponse = RecoverResponse;
+export type CreateUserRecoveryRequest = RecoverRequest;
 export type RegisterBody = {
     firstFactorCredential: {
         credentialKind: "Fido2";
         credentialInfo: {
+            /** Base64url-encoded id of the credential returned by the user's WebAuthn client. */
             credId: string;
+            /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object returned by the user's WebAuthn client. */
             clientData: string;
+            /** Base64url-encoded attestation data returned by the user's WebAuthn client. */
             attestationData: string;
         };
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     } | {
         credentialKind: "Key";
         credentialInfo: {
+            /** Base64url-encoded id of the credential. */
             credId: string;
+            /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
             clientData: string;
+            /** Base64url-encoded public key. */
             attestationData: string;
         };
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     } | {
         credentialKind: "Password";
         credentialInfo: {
+            /** User password. */
             password: string;
         };
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     } | {
         credentialKind: "PasswordProtectedKey";
         credentialInfo: {
+            /** Base64url-encoded id of the credential. */
             credId: string;
+            /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
             clientData: string;
+            /** Base64url-encoded public key. */
             attestationData: string;
         };
+        /** User-encrypted private key. Dfns does not have the password to decrypt it. */
         encryptedPrivateKey: string;
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     };
     secondFactorCredential?: ({
         credentialKind: "Fido2";
         credentialInfo: {
+            /** Base64url-encoded id of the credential returned by the user's WebAuthn client. */
             credId: string;
+            /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object returned by the user's WebAuthn client. */
             clientData: string;
+            /** Base64url-encoded attestation data returned by the user's WebAuthn client. */
             attestationData: string;
         };
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     } | {
         credentialKind: "Key";
         credentialInfo: {
+            /** Base64url-encoded id of the credential. */
             credId: string;
+            /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
             clientData: string;
+            /** Base64url-encoded public key. */
             attestationData: string;
         };
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     } | {
         credentialKind: "Totp";
         credentialInfo: {
+            /** TOTP one-time code. */
             otpCode: string;
         };
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     } | {
         credentialKind: "PasswordProtectedKey";
         credentialInfo: {
+            /** Base64url-encoded id of the credential. */
             credId: string;
+            /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
             clientData: string;
+            /** Base64url-encoded public key. */
             attestationData: string;
         };
+        /** User-encrypted private key. Dfns does not have the password to decrypt it. */
         encryptedPrivateKey: string;
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     }) | undefined;
     /** Register a recovery key. See [Account Recovery](https://docs.dfns.co/api-reference/auth/account-recovery) for more details. */
     recoveryCredential?: {
         credentialKind: "RecoveryKey";
         credentialInfo: {
+            /** Base64url-encoded id of the recovery credential. */
             credId: string;
+            /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
             clientData: string;
+            /** Base64url-encoded public key. */
             attestationData: string;
         };
+        /** User-encrypted private key for the recovery credential. */
         encryptedPrivateKey?: string | undefined;
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     } | undefined;
 };
 export type RegisterResponse = {
     credential: {
+        /** UUID of the credential that was registered. */
         uuid: string;
+        /** Kind of credential that was registered. */
         kind: "Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey";
+        /** Human-readable name of the credential. */
         name: string;
     };
     user: {
+        /** User id. */
         id: string;
+        /** Username/identifier of the user. */
         username: string;
-        orgId: string;
+        /** Organization id. */
+        orgId?: string | undefined;
+        /** Tenant id. */
+        tenantId?: string | undefined;
     };
 };
 export type RegisterRequest = {
     body: RegisterBody;
 };
+export type CreateUserRegistrationBody = RegisterBody;
+export type CreateUserRegistrationResponse = RegisterResponse;
+export type CreateUserRegistrationRequest = RegisterRequest;
 export type RegisterEndUserBody = {
     firstFactorCredential: {
         credentialKind: "Fido2";
         credentialInfo: {
+            /** Base64url-encoded id of the credential returned by the user's WebAuthn client. */
             credId: string;
+            /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object returned by the user's WebAuthn client. */
             clientData: string;
+            /** Base64url-encoded attestation data returned by the user's WebAuthn client. */
             attestationData: string;
         };
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     } | {
         credentialKind: "Key";
         credentialInfo: {
+            /** Base64url-encoded id of the credential. */
             credId: string;
+            /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
             clientData: string;
+            /** Base64url-encoded public key. */
             attestationData: string;
         };
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     } | {
         credentialKind: "Password";
         credentialInfo: {
+            /** User password. */
             password: string;
         };
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     } | {
         credentialKind: "PasswordProtectedKey";
         credentialInfo: {
+            /** Base64url-encoded id of the credential. */
             credId: string;
+            /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
             clientData: string;
+            /** Base64url-encoded public key. */
             attestationData: string;
         };
+        /** User-encrypted private key. Dfns does not have the password to decrypt it. */
         encryptedPrivateKey: string;
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     };
     secondFactorCredential?: ({
         credentialKind: "Fido2";
         credentialInfo: {
+            /** Base64url-encoded id of the credential returned by the user's WebAuthn client. */
             credId: string;
+            /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object returned by the user's WebAuthn client. */
             clientData: string;
+            /** Base64url-encoded attestation data returned by the user's WebAuthn client. */
             attestationData: string;
         };
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     } | {
         credentialKind: "Key";
         credentialInfo: {
+            /** Base64url-encoded id of the credential. */
             credId: string;
+            /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
             clientData: string;
+            /** Base64url-encoded public key. */
             attestationData: string;
         };
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     } | {
         credentialKind: "Totp";
         credentialInfo: {
+            /** TOTP one-time code. */
             otpCode: string;
         };
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     } | {
         credentialKind: "PasswordProtectedKey";
         credentialInfo: {
+            /** Base64url-encoded id of the credential. */
             credId: string;
+            /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
             clientData: string;
+            /** Base64url-encoded public key. */
             attestationData: string;
         };
+        /** User-encrypted private key. Dfns does not have the password to decrypt it. */
         encryptedPrivateKey: string;
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     }) | undefined;
     /** Register a recovery key. See [Account Recovery](https://docs.dfns.co/api-reference/auth/account-recovery) for more details. */
     recoveryCredential?: {
         credentialKind: "RecoveryKey";
         credentialInfo: {
+            /** Base64url-encoded id of the recovery credential. */
             credId: string;
+            /** Base64url-encoded, stringified JSON [client data](https://docs.dfns.co/api-reference/auth/credentials-data#client-data) object. */
             clientData: string;
+            /** Base64url-encoded public key. */
             attestationData: string;
         };
+        /** User-encrypted private key for the recovery credential. */
         encryptedPrivateKey?: string | undefined;
+        /** Human-readable name to assign to the credential. */
         credentialName?: string | undefined;
     } | undefined;
     wallets: {
-        network: ("Algorand" | "AlgorandTestnet" | "Aptos" | "AptosTestnet" | "ArbitrumOne" | "ArbitrumGoerli" | "ArbitrumSepolia" | "ArcTestnet" | "Areum" | "AvalancheC" | "AvalancheCFuji" | "Adi" | "AdiTestnet" | "AdiTestnetAb" | "BabylonGenesis" | "BabylonTestnet5" | "Base" | "BaseGoerli" | "BaseSepolia" | "Berachain" | "BerachainBArtio" | "BerachainBepolia" | "BesuTestnet" | "Bitcoin" | "BitcoinSignet" | "BitcoinTestnet3" | "BitcoinTestnet4" | "BitcoinCash" | "BitcoinCashTestnet" | "Bob" | "BobSepolia" | "Bsc" | "BscTestnet" | "Canton" | "CantonDevnet" | "CantonTestnet" | "Cardano" | "CardanoPreprod" | "Concordium" | "ConcordiumTestnet" | "Celo" | "CeloAlfajores" | "Codex" | "CodexSepolia" | "CosmosHub4" | "CosmosIcsTestnet" | "Dogecoin" | "DogecoinTestnet" | "Ethereum" | "EthereumClassic" | "EthereumClassicMordor" | "EthereumGoerli" | "EthereumSepolia" | "EthereumHolesky" | "EthereumHoodi" | "FantomOpera" | "FantomTestnet" | "FlareC" | "FlareCCoston2" | "FlowEvm" | "FlowEvmTestnet" | "Hedera" | "HederaTestnet" | "Ink" | "InkSepolia" | "InternetComputer" | "Ion" | "IonTestnet" | "Iota" | "IotaTestnet" | "IotaZodianet" | "Kaspa" | "KaspaTestnet11" | "Kusama" | "KusamaAssetHub" | "Litecoin" | "LitecoinTestnet" | "Near" | "NearTestnet" | "Optimism" | "OptimismGoerli" | "OptimismSepolia" | "Origyn" | "Plasma" | "PlasmaTestnet" | "Plume" | "PlumeSepolia" | "Paseo" | "PaseoAssetHub" | "Polkadot" | "PolkadotAssetHub" | "Polygon" | "PolygonAmoy" | "PolygonMumbai" | "Polymesh" | "PolymeshTestnet" | "Race" | "RaceSepolia" | "SeiAtlantic2" | "SeiPacific1" | "Solana" | "SolanaDevnet" | "Sonic" | "SonicTestnet" | "Starknet" | "StarknetSepolia" | "Stellar" | "StellarTestnet" | "Sui" | "SuiTestnet" | "Tezos" | "TezosGhostnet" | "TezosShadownet" | "Tempo" | "TempoAndantino" | "TempoModerato" | "Tsc" | "TscTestnet1" | "Ton" | "TonTestnet" | "Tron" | "TronNile" | "Westend" | "WestendAssetHub" | "Xdc" | "XdcApothem" | "XLayer" | "XLayerSepolia" | "XrpLedger" | "XrpLedgerTestnet") | ("KeyECDSA" | "KeyEdDSA" | "KeyECDSAStark");
+        network: ("Algorand" | "AlgorandTestnet" | "Aptos" | "AptosTestnet" | "ArbitrumOne" | "ArbitrumGoerli" | "ArbitrumSepolia" | "ArcTestnet" | "Areum" | "AvalancheC" | "AvalancheCFuji" | "Adi" | "AdiTestnet" | "AdiTestnetAb" | "BabylonGenesis" | "BabylonTestnet5" | "Base" | "BaseGoerli" | "BaseSepolia" | "Berachain" | "BerachainBArtio" | "BerachainBepolia" | "BesuTestnet" | "BesuTestnet2" | "Bitcoin" | "BitcoinSignet" | "BitcoinTestnet3" | "BitcoinTestnet4" | "BitcoinCash" | "BitcoinCashTestnet" | "Bob" | "BobSepolia" | "Bsc" | "BscTestnet" | "Canton" | "CantonDevnet" | "CantonTestnet" | "Cardano" | "CardanoPreprod" | "Concordium" | "ConcordiumTestnet" | "Celo" | "CeloAlfajores" | "Codex" | "CodexSepolia" | "CosmosHub4" | "CosmosIcsTestnet" | "Dogecoin" | "DogecoinTestnet" | "Ethereum" | "EthereumClassic" | "EthereumClassicMordor" | "EthereumGoerli" | "EthereumSepolia" | "EthereumHolesky" | "EthereumHoodi" | "FantomOpera" | "FantomTestnet" | "FlareC" | "FlareCCoston2" | "FlowEvm" | "FlowEvmTestnet" | "IconTestnet" | "Hedera" | "HederaTestnet" | "Ink" | "InkSepolia" | "InternetComputer" | "Ion" | "IonTestnet" | "Iota" | "IotaTestnet" | "IotaZodianet" | "Kaspa" | "KaspaTestnet11" | "Kusama" | "KusamaAssetHub" | "Litecoin" | "LitecoinTestnet" | "Movement" | "MovementTestnet" | "Near" | "NearTestnet" | "Optimism" | "OptimismGoerli" | "OptimismSepolia" | "Origyn" | "Plasma" | "PlasmaTestnet" | "Plume" | "PlumeSepolia" | "Paseo" | "PaseoAssetHub" | "Polkadot" | "PolkadotAssetHub" | "Polygon" | "PolygonAmoy" | "PolygonMumbai" | "Polymesh" | "PolymeshTestnet" | "Race" | "RaceSepolia" | "Rayls" | "RaylsTestnet" | "Robinhood" | "RobinhoodSepolia" | "SeiAtlantic2" | "SeiPacific1" | "Solana" | "SolanaDevnet" | "Sonic" | "SonicTestnet" | "Starknet" | "StarknetSepolia" | "Stellar" | "StellarTestnet" | "Sui" | "SuiTestnet" | "Tezos" | "TezosGhostnet" | "TezosShadownet" | "Tempo" | "TempoAndantino" | "TempoModerato" | "Tsc" | "TscTestnet1" | "Ton" | "TonTestnet" | "Tron" | "TronNile" | "Westend" | "WestendAssetHub" | "Xdc" | "XdcApothem" | "XLayer" | "XLayerSepolia" | "XrpLedger" | "XrpLedgerTestnet") | ("KeyECDSA" | "KeyEdDSA" | "KeyECDSAStark");
         /** Wallet nickname. */
         name?: string | undefined;
     }[];
 };
 export type RegisterEndUserResponse = {
     credential: {
+        /** UUID of the credential that was registered. */
         uuid: string;
+        /** Kind of credential that was registered. */
         kind: "Fido2" | "Key" | "Password" | "Totp" | "RecoveryKey" | "PasswordProtectedKey";
+        /** Human-readable name of the credential. */
         name: string;
     };
     user: {
+        /** User id. */
         id: string;
+        /** Username/identifier of the user. */
         username: string;
-        orgId: string;
+        /** Organization id. */
+        orgId?: string | undefined;
+        /** Tenant id. */
+        tenantId?: string | undefined;
     };
     authentication: {
+        /** Authentication token issued to the user. */
         token: string;
     };
     wallets: {
         /** ID of the wallet. */
         id: string;
         /** Network this wallet is bound to. */
-        network: ("Algorand" | "AlgorandTestnet" | "Aptos" | "AptosTestnet" | "ArbitrumOne" | "ArbitrumGoerli" | "ArbitrumSepolia" | "ArcTestnet" | "Areum" | "AvalancheC" | "AvalancheCFuji" | "Adi" | "AdiTestnet" | "AdiTestnetAb" | "BabylonGenesis" | "BabylonTestnet5" | "Base" | "BaseGoerli" | "BaseSepolia" | "Berachain" | "BerachainBArtio" | "BerachainBepolia" | "BesuTestnet" | "Bitcoin" | "BitcoinSignet" | "BitcoinTestnet3" | "BitcoinTestnet4" | "BitcoinCash" | "BitcoinCashTestnet" | "Bob" | "BobSepolia" | "Bsc" | "BscTestnet" | "Canton" | "CantonDevnet" | "CantonTestnet" | "Cardano" | "CardanoPreprod" | "Concordium" | "ConcordiumTestnet" | "Celo" | "CeloAlfajores" | "Codex" | "CodexSepolia" | "CosmosHub4" | "CosmosIcsTestnet" | "Dogecoin" | "DogecoinTestnet" | "Ethereum" | "EthereumClassic" | "EthereumClassicMordor" | "EthereumGoerli" | "EthereumSepolia" | "EthereumHolesky" | "EthereumHoodi" | "FantomOpera" | "FantomTestnet" | "FlareC" | "FlareCCoston2" | "FlowEvm" | "FlowEvmTestnet" | "Hedera" | "HederaTestnet" | "Ink" | "InkSepolia" | "InternetComputer" | "Ion" | "IonTestnet" | "Iota" | "IotaTestnet" | "IotaZodianet" | "Kaspa" | "KaspaTestnet11" | "Kusama" | "KusamaAssetHub" | "Litecoin" | "LitecoinTestnet" | "Near" | "NearTestnet" | "Optimism" | "OptimismGoerli" | "OptimismSepolia" | "Origyn" | "Plasma" | "PlasmaTestnet" | "Plume" | "PlumeSepolia" | "Paseo" | "PaseoAssetHub" | "Polkadot" | "PolkadotAssetHub" | "Polygon" | "PolygonAmoy" | "PolygonMumbai" | "Polymesh" | "PolymeshTestnet" | "Race" | "RaceSepolia" | "SeiAtlantic2" | "SeiPacific1" | "Solana" | "SolanaDevnet" | "Sonic" | "SonicTestnet" | "Starknet" | "StarknetSepolia" | "Stellar" | "StellarTestnet" | "Sui" | "SuiTestnet" | "Tezos" | "TezosGhostnet" | "TezosShadownet" | "Tempo" | "TempoAndantino" | "TempoModerato" | "Tsc" | "TscTestnet1" | "Ton" | "TonTestnet" | "Tron" | "TronNile" | "Westend" | "WestendAssetHub" | "Xdc" | "XdcApothem" | "XLayer" | "XLayerSepolia" | "XrpLedger" | "XrpLedgerTestnet") | ("KeyECDSA" | "KeyEdDSA" | "KeyECDSAStark");
+        network: ("Algorand" | "AlgorandTestnet" | "Aptos" | "AptosTestnet" | "ArbitrumOne" | "ArbitrumGoerli" | "ArbitrumSepolia" | "ArcTestnet" | "Areum" | "AvalancheC" | "AvalancheCFuji" | "Adi" | "AdiTestnet" | "AdiTestnetAb" | "BabylonGenesis" | "BabylonTestnet5" | "Base" | "BaseGoerli" | "BaseSepolia" | "Berachain" | "BerachainBArtio" | "BerachainBepolia" | "BesuTestnet" | "BesuTestnet2" | "Bitcoin" | "BitcoinSignet" | "BitcoinTestnet3" | "BitcoinTestnet4" | "BitcoinCash" | "BitcoinCashTestnet" | "Bob" | "BobSepolia" | "Bsc" | "BscTestnet" | "Canton" | "CantonDevnet" | "CantonTestnet" | "Cardano" | "CardanoPreprod" | "Concordium" | "ConcordiumTestnet" | "Celo" | "CeloAlfajores" | "Codex" | "CodexSepolia" | "CosmosHub4" | "CosmosIcsTestnet" | "Dogecoin" | "DogecoinTestnet" | "Ethereum" | "EthereumClassic" | "EthereumClassicMordor" | "EthereumGoerli" | "EthereumSepolia" | "EthereumHolesky" | "EthereumHoodi" | "FantomOpera" | "FantomTestnet" | "FlareC" | "FlareCCoston2" | "FlowEvm" | "FlowEvmTestnet" | "IconTestnet" | "Hedera" | "HederaTestnet" | "Ink" | "InkSepolia" | "InternetComputer" | "Ion" | "IonTestnet" | "Iota" | "IotaTestnet" | "IotaZodianet" | "Kaspa" | "KaspaTestnet11" | "Kusama" | "KusamaAssetHub" | "Litecoin" | "LitecoinTestnet" | "Movement" | "MovementTestnet" | "Near" | "NearTestnet" | "Optimism" | "OptimismGoerli" | "OptimismSepolia" | "Origyn" | "Plasma" | "PlasmaTestnet" | "Plume" | "PlumeSepolia" | "Paseo" | "PaseoAssetHub" | "Polkadot" | "PolkadotAssetHub" | "Polygon" | "PolygonAmoy" | "PolygonMumbai" | "Polymesh" | "PolymeshTestnet" | "Race" | "RaceSepolia" | "Rayls" | "RaylsTestnet" | "Robinhood" | "RobinhoodSepolia" | "SeiAtlantic2" | "SeiPacific1" | "Solana" | "SolanaDevnet" | "Sonic" | "SonicTestnet" | "Starknet" | "StarknetSepolia" | "Stellar" | "StellarTestnet" | "Sui" | "SuiTestnet" | "Tezos" | "TezosGhostnet" | "TezosShadownet" | "Tempo" | "TempoAndantino" | "TempoModerato" | "Tsc" | "TscTestnet1" | "Ton" | "TonTestnet" | "Tron" | "TronNile" | "Westend" | "WestendAssetHub" | "Xdc" | "XdcApothem" | "XLayer" | "XLayerSepolia" | "XrpLedger" | "XrpLedgerTestnet") | ("KeyECDSA" | "KeyEdDSA" | "KeyECDSAStark");
         /** Wallet address on its corresponding network. */
         address?: string | undefined;
         /** Details about the key underlying the wallet. */
@@ -2197,41 +3093,60 @@ export type RegisterEndUserRequest = {
     body: RegisterEndUserBody;
 };
 export type ResendRegistrationCodeBody = {
+    /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
     username: string;
-    orgId: string;
+    /** Organization id. */
+    orgId?: string | undefined;
+    /** Tenant id. */
+    tenantId?: string | undefined;
 };
 export type ResendRegistrationCodeResponse = {
+    /** Human-readable success message. */
     message: string;
 };
 export type ResendRegistrationCodeRequest = {
     body: ResendRegistrationCodeBody;
 };
 export type SendLoginCodeBody = {
+    /** Username/identifier of the user to send the login code to. */
     username: string;
-    orgId: string;
+    /** Organization id. */
+    orgId?: string | undefined;
+    /** Tenant id. */
+    tenantId?: string | undefined;
 };
 export type SendLoginCodeResponse = {
+    /** Human-readable success message. */
     message: string;
 };
 export type SendLoginCodeRequest = {
     body: SendLoginCodeBody;
 };
 export type SendRecoveryCodeBody = {
+    /** Username/identifier of the user to send the recovery code to. */
     username: string;
-    orgId: string;
+    /** Organization id. */
+    orgId?: string | undefined;
+    /** Tenant id. */
+    tenantId?: string | undefined;
 };
 export type SendRecoveryCodeResponse = {
+    /** Human-readable success message. */
     message: string;
 };
 export type SendRecoveryCodeRequest = {
     body: SendRecoveryCodeBody;
 };
 export type SocialLoginBody = {
+    /** Organization id. */
     orgId?: string | undefined;
+    /** Social login provider used to issue the JWT. */
     socialLoginProviderKind: "Oidc";
+    /** JWT id token issued by the social login provider. */
     idToken: string;
 };
 export type SocialLoginResponse = {
+    /** Authentication token issued to the user. */
     token: string;
 };
 export type SocialLoginRequest = {
@@ -2244,6 +3159,7 @@ export type SsoLoginBody = {
     state: string;
 };
 export type SsoLoginResponse = {
+    /** Authentication token issued to the user. */
     token: string;
 };
 export type SsoLoginRequest = {
@@ -2265,81 +3181,130 @@ export type SsoLoginInitRequest = {
     body: SsoLoginInitBody;
 };
 export type UpdatePersonalAccessTokenBody = {
+    /** Updated human-readable name of the Personal Access Token. */
     name?: string | undefined;
+    /** Value that can be used to correlate the entity with an external system. */
     externalId?: string | undefined;
 };
 export type UpdatePersonalAccessTokenParams = {
+    /** Token id. */
     tokenId: string;
 };
 export type UpdatePersonalAccessTokenResponse = {
+    /** The access token. Only returned at creation time. */
     accessToken?: string | undefined;
     dateCreated: string;
+    /** ID of the credential associated with the access token. */
     credId: string;
+    /** Whether the access token is active. */
     isActive: boolean;
     /** Access token kind. */
     kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+    /** User id. */
     linkedUserId: string;
+    /** ID of the application the access token is linked to. */
     linkedAppId: string;
+    /** Human-readable name of the access token. */
     name: string;
+    /** Organization id. */
     orgId: string;
+    /** Permissions (roles) assigned to the access token. */
     permissionAssignments: {
+        /** Human-readable name of the permission (role). */
         permissionName: string;
+        /** ID of the permission (also referred to as "role" in the dashboard). */
         permissionId: string;
+        /** ID of the permission assignment. */
         assignmentId: string;
+        /** List of API operations granted by this permission. */
         operations?: string[] | undefined;
     }[];
+    /** Public key associated with the access token. */
     publicKey: string;
+    /** Token id. */
     tokenId: string;
 };
 export type UpdatePersonalAccessTokenRequest = UpdatePersonalAccessTokenParams & {
     body: UpdatePersonalAccessTokenBody;
 };
 export type UpdateServiceAccountBody = {
+    /** Updated human-readable name of the Service Account. */
     name?: string | undefined;
+    /** Value that can be used to correlate the entity with an external system. */
     externalId?: string | undefined;
 };
 export type UpdateServiceAccountParams = {
+    /** ID of the service account. */
     serviceAccountId: string;
 };
 export type UpdateServiceAccountResponse = {
     userInfo: {
+        /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
         username: string;
+        /** Display name of the user. */
         name: string;
         /** User id. */
         userId: string;
         /** User kind. */
-        kind: "DfnsStaff" | "AccountUser" | "CustomerEmployee" | "EndUser";
+        kind: "DfnsStaff" | "TenantUser" | "CustomerEmployee" | "EndUser";
+        /** UUID of the user's primary credential. */
         credentialUuid: string;
-        orgId: string;
+        /** Organization id. */
+        orgId?: string | undefined;
+        /** Tenant id. */
+        tenantId?: string | undefined;
+        /** @deprecated - Flat list of API operations the user has access to. */
         permissions?: string[] | undefined;
+        /** Whether the user is active. */
         isActive: boolean;
+        /** Whether the user is a service account. */
         isServiceAccount: boolean;
+        /** Whether the user has completed registration. */
         isRegistered: boolean;
+        /** Permissions (roles) assigned to the user. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
     };
     accessTokens: {
+        /** The access token. Only returned at creation time. */
         accessToken?: string | undefined;
         dateCreated: string;
+        /** ID of the credential associated with the access token. */
         credId: string;
+        /** Whether the access token is active. */
         isActive: boolean;
         /** Access token kind. */
         kind: "Pat" | "ServiceAccount" | "Token" | "Code" | "Recovery" | "Temp" | "Application";
+        /** User id. */
         linkedUserId: string;
+        /** ID of the application the access token is linked to. */
         linkedAppId: string;
+        /** Human-readable name of the access token. */
         name: string;
+        /** Organization id. */
         orgId: string;
+        /** Permissions (roles) assigned to the access token. */
         permissionAssignments: {
+            /** Human-readable name of the permission (role). */
             permissionName: string;
+            /** ID of the permission (also referred to as "role" in the dashboard). */
             permissionId: string;
+            /** ID of the permission assignment. */
             assignmentId: string;
+            /** List of API operations granted by this permission. */
             operations?: string[] | undefined;
         }[];
+        /** Public key associated with the access token. */
         publicKey: string;
+        /** Token id. */
         tokenId: string;
     }[];
 };
@@ -2350,26 +3315,43 @@ export type UpdateUserBody = {
     isSSORequired: boolean;
 };
 export type UpdateUserParams = {
+    /** User id. */
     userId: string;
 };
 export type UpdateUserResponse = {
+    /** Username/identifier of the user (any unique string accepted, e.g. your internal user ID or email). */
     username: string;
+    /** Display name of the user. */
     name: string;
     /** User id. */
     userId: string;
     /** User kind. */
-    kind: "DfnsStaff" | "AccountUser" | "CustomerEmployee" | "EndUser";
+    kind: "DfnsStaff" | "TenantUser" | "CustomerEmployee" | "EndUser";
+    /** UUID of the user's primary credential. */
     credentialUuid: string;
-    orgId: string;
+    /** Organization id. */
+    orgId?: string | undefined;
+    /** Tenant id. */
+    tenantId?: string | undefined;
+    /** @deprecated - Flat list of API operations the user has access to. */
     permissions?: string[] | undefined;
+    /** Whether the user is active. */
     isActive: boolean;
+    /** Whether the user is a service account. */
     isServiceAccount: boolean;
+    /** Whether the user has completed registration. */
     isRegistered: boolean;
+    /** Whether the user must authenticate via SSO. */
     isSSORequired: boolean;
+    /** Permissions (roles) assigned to the user. */
     permissionAssignments: {
+        /** Human-readable name of the permission (role). */
         permissionName: string;
+        /** ID of the permission (also referred to as "role" in the dashboard). */
         permissionId: string;
+        /** ID of the permission assignment. */
         assignmentId: string;
+        /** List of API operations granted by this permission. */
         operations?: string[] | undefined;
     }[];
 };