@distilled.cloud/stackit 0.0.0-stage → 1.0.0-rc.13

package/src/services/service_account.ts

@@ -0,0 +1,1208 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-stackit). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as Redacted from "effect/Redacted";
+import * as API from "@distilled.cloud/core/api";
+import * as C from "@distilled.cloud/core/category";
+import * as T from "../traits.ts";
+import {
+  StackitProtocol,
+  type StackitOpError,
+  type StackitOpContext,
+} from "../protocol.ts";
+import { UnknownStackitError } from "../errors.ts";
+import * as Retry from "../retry.ts";
+
+export type { StackitOpError, StackitOpContext };
+
+export class BadRequest
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<BadRequest>()("BadRequest", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 400 }],
+  ) {}
+
+export class Conflict
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<Conflict>()("Conflict", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withConflictError),
+    [{ status: 409 }],
+  ) {}
+
+export class Forbidden
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<Forbidden>()("Forbidden", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withAuthError),
+    [{ status: 403 }],
+  ) {}
+
+export class NotFound
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<NotFound>()("NotFound", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 404 }],
+  ) {}
+
+export interface CreateFederatedIdentityProviderRequestAssertionsItem {
+  /** Item to compare */
+  item?: string;
+  /** Operator for the comparison */
+  operator?: string;
+  /** Value which the item is compared to */
+  value?: string;
+}
+export const CreateFederatedIdentityProviderRequestAssertionsItem =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      item: S.optional(S.String),
+      operator: S.optional(S.String),
+      value: S.optional(S.String),
+    }),
+  ).annotate({
+    identifier: "CreateFederatedIdentityProviderRequestAssertionsItem",
+  }) as any as S.Schema<CreateFederatedIdentityProviderRequestAssertionsItem>;
+
+/** list of assertions of the federated identity provider */
+export type CreateFederatedIdentityProviderRequestAssertionsList =
+  Array<CreateFederatedIdentityProviderRequestAssertionsItem>;
+export const CreateFederatedIdentityProviderRequestAssertionsList =
+  /*@__PURE__*/ S.Array(
+    CreateFederatedIdentityProviderRequestAssertionsItem,
+  ) as any as S.Schema<CreateFederatedIdentityProviderRequestAssertionsList>;
+
+export interface CreateFederatedIdentityProviderRequest {
+  /** The ID of the project. */
+  projectId: string;
+  /** The email of the service account. */
+  serviceAccountEmail: string;
+  /** list of assertions of the federated identity provider */
+  assertions?: CreateFederatedIdentityProviderRequestAssertionsList;
+  /** Issuer of the federated identity provider. */
+  issuer: string;
+  /** Unique name used as identifier of the federated identity provider. */
+  name: string;
+}
+export const CreateFederatedIdentityProviderRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      projectId: S.String.pipe(T.Label()),
+      serviceAccountEmail: S.String.pipe(T.Label()),
+      assertions: S.optional(
+        CreateFederatedIdentityProviderRequestAssertionsList,
+      ),
+      issuer: S.String,
+      name: S.String,
+    }).pipe(
+      T.Http({
+        method: "POST",
+        uri: "/v2/projects/{projectId}/service-accounts/{serviceAccountEmail}/federations",
+        code: 200,
+        baseUrl: "https://service-account.api.stackit.cloud",
+      }),
+    ),
+).annotate({
+  identifier: "CreateFederatedIdentityProviderRequest",
+}) as any as S.Schema<CreateFederatedIdentityProviderRequest>;
+
+export interface FederatedIdentityProviderAssertionsItem {
+  /** Item to compare */
+  item: string;
+  /** Operator for the comparison */
+  operator: string;
+  /** Value which the item is compared to */
+  value: string;
+}
+export const FederatedIdentityProviderAssertionsItem = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      item: S.String,
+      operator: S.String,
+      value: S.String,
+    }),
+).annotate({
+  identifier: "FederatedIdentityProviderAssertionsItem",
+}) as any as S.Schema<FederatedIdentityProviderAssertionsItem>;
+
+/** list of assertions of the federated identity provider */
+export type FederatedIdentityProviderAssertionsList =
+  Array<FederatedIdentityProviderAssertionsItem>;
+export const FederatedIdentityProviderAssertionsList = /*@__PURE__*/ S.Array(
+  FederatedIdentityProviderAssertionsItem,
+) as any as S.Schema<FederatedIdentityProviderAssertionsList>;
+
+export interface FederatedIdentityProvider {
+  /** list of assertions of the federated identity provider */
+  assertions: FederatedIdentityProviderAssertionsList;
+  /** Creation time of the federated identity provider. */
+  createdAt: string;
+  /** Unique ID of the federated identity provider. */
+  id?: string;
+  /** Issuer of the federated identity provider. */
+  issuer: string;
+  /** Unique name of the federated identity provider. */
+  name: string;
+  /** Last update time of the federated identity provider. */
+  updatedAt: string;
+}
+export const FederatedIdentityProvider = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    assertions: FederatedIdentityProviderAssertionsList,
+    createdAt: S.String,
+    id: S.optional(S.String),
+    issuer: S.String,
+    name: S.String,
+    updatedAt: S.String,
+  }),
+).annotate({
+  identifier: "FederatedIdentityProvider",
+}) as any as S.Schema<FederatedIdentityProvider>;
+
+export interface CreateServiceAccountRequest {
+  /** The ID of the project. */
+  projectId: string;
+  /** The requested name of the service account. The service will generate a unique email from this name. */
+  name: string;
+}
+export const CreateServiceAccountRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    name: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v2/projects/{projectId}/service-accounts",
+      code: 200,
+      baseUrl: "https://service-account.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "CreateServiceAccountRequest",
+}) as any as S.Schema<CreateServiceAccountRequest>;
+
+export interface ServiceAccount2 {
+  /** Unique identifier of the service account in format of an email address generated by the service containing the prefix provided by the user during creation. */
+  email: string;
+  /** Unique ID of the service account. It is also used in the 'sub' field of the service accounts access tokens. */
+  id: string;
+  /** Flag indicating internal service accounts */
+  internal: boolean;
+  /** ID of the related project */
+  projectId: string;
+}
+export const ServiceAccount2 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    email: S.String,
+    id: S.String,
+    internal: S.Boolean,
+    projectId: S.String,
+  }),
+).annotate({
+  identifier: "ServiceAccount2",
+}) as any as S.Schema<ServiceAccount2>;
+
+/** Optional, key algorithm of the generated key-pair. Used only if publicKey attribute is not specified, otherwise the algorithm is derived from the public key. */
+export type CreateServiceAccountKeyRequestAlgorithm = "RSA_2048" | "RSA_4096";
+export const CreateServiceAccountKeyRequestAlgorithm = /*@__PURE__*/ S.String;
+
+export interface CreateServiceAccountKeyRequest {
+  /** The ID of the project. */
+  projectId: string;
+  /** The email of the service account. */
+  serviceAccountEmail: string;
+  /** Optional, key algorithm of the generated key-pair. Used only if publicKey attribute is not specified, otherwise the algorithm is derived from the public key. */
+  algorithm?: CreateServiceAccountKeyRequestAlgorithm | (string & {});
+  /** Optional, public key part of the user generated RSA key-pair wrapped in a [X.509 v3 certificate](https://www.rfc-editor.org/rfc/rfc5280) */
+  publicKey?: string;
+  /** Optional, date of key expiration. When omitted, key is valid until deleted */
+  validUntil?: string;
+}
+export const CreateServiceAccountKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    serviceAccountEmail: S.String.pipe(T.Label()),
+    algorithm: S.optional(CreateServiceAccountKeyRequestAlgorithm),
+    publicKey: S.optional(S.String),
+    validUntil: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v2/projects/{projectId}/service-accounts/{serviceAccountEmail}/keys",
+      code: 200,
+      baseUrl: "https://service-account.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "CreateServiceAccountKeyRequest",
+}) as any as S.Schema<CreateServiceAccountKeyRequest>;
+
+export interface CreateServiceAccountKeyResponseCredentials {
+  /** Audience - service account API URL */
+  aud: string;
+  /** Service account email */
+  iss: string;
+  /** Key id to use */
+  kid: string;
+  /** Private key. Only present, if the service account API was generating the key. Not recoverable later. */
+  privateKey?: string | Redacted.Redacted<string>;
+  /** Service account id */
+  sub: string;
+  /** Endpoint used to obtain access tokens for the service account. */
+  tokenEndpoint?: string;
+}
+export const CreateServiceAccountKeyResponseCredentials =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      aud: S.String,
+      iss: S.String,
+      kid: S.String,
+      privateKey: S.optional(S.String.pipe(T.SensitiveValue({}))),
+      sub: S.String,
+      tokenEndpoint: S.optional(S.String),
+    }),
+  ).annotate({
+    identifier: "CreateServiceAccountKeyResponseCredentials",
+  }) as any as S.Schema<CreateServiceAccountKeyResponseCredentials>;
+
+export type CreateServiceAccountKeyResponseKeyAlgorithm =
+  | "RSA_2048"
+  | "RSA_4096";
+export const CreateServiceAccountKeyResponseKeyAlgorithm =
+  /*@__PURE__*/ S.String;
+
+export type CreateServiceAccountKeyResponseKeyOrigin =
+  | "USER_PROVIDED"
+  | "GENERATED";
+export const CreateServiceAccountKeyResponseKeyOrigin = /*@__PURE__*/ S.String;
+
+export type CreateServiceAccountKeyResponseKeyType =
+  | "USER_MANAGED"
+  | "SYSTEM_MANAGED";
+export const CreateServiceAccountKeyResponseKeyType = /*@__PURE__*/ S.String;
+
+export interface CreateServiceAccountKeyResponse {
+  active: boolean;
+  /** Creation time of the key */
+  createdAt: string;
+  credentials: CreateServiceAccountKeyResponseCredentials;
+  /** Unique ID of the key. */
+  id: string;
+  keyAlgorithm: CreateServiceAccountKeyResponseKeyAlgorithm;
+  keyOrigin: CreateServiceAccountKeyResponseKeyOrigin;
+  keyType: CreateServiceAccountKeyResponseKeyType;
+  /** Public key, that was provider, or was generated by the service account API */
+  publicKey: string;
+  /** If specified, the timestamp until the key is active. May be null */
+  validUntil?: string;
+}
+export const CreateServiceAccountKeyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    active: S.Boolean,
+    createdAt: S.String,
+    credentials: CreateServiceAccountKeyResponseCredentials,
+    id: S.String,
+    keyAlgorithm: CreateServiceAccountKeyResponseKeyAlgorithm,
+    keyOrigin: CreateServiceAccountKeyResponseKeyOrigin,
+    keyType: CreateServiceAccountKeyResponseKeyType,
+    publicKey: S.String,
+    validUntil: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "CreateServiceAccountKeyResponse",
+}) as any as S.Schema<CreateServiceAccountKeyResponse>;
+
+/** Always use URL encoded values. E.g. urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer */
+export type CreateShortLivedAccessTokenRequestGrantType =
+  | "urn:ietf:params:oauth:grant-type:jwt-bearer"
+  | "refresh_token";
+export const CreateShortLivedAccessTokenRequestGrantType =
+  /*@__PURE__*/ S.String;
+
+export interface CreateShortLivedAccessTokenRequest {
+  /** The self signed JWT. Must be given when grant_type is urn:ietf:params:oauth:grant-type:jwt-bearer */
+  assertion?: string;
+  /** Always use URL encoded values. E.g. urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer */
+  grant_type: CreateShortLivedAccessTokenRequestGrantType | (string & {});
+  /** Refresh token provided by a previous call with a self signed token. Must be given when grant_type is refresh_token */
+  refresh_token?: string | Redacted.Redacted<string>;
+}
+export const CreateShortLivedAccessTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    assertion: S.optional(S.String),
+    grant_type: CreateShortLivedAccessTokenRequestGrantType,
+    refresh_token: S.optional(S.String.pipe(T.SensitiveValue({}))),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/token",
+      code: 200,
+      baseUrl: "https://service-account.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "CreateShortLivedAccessTokenRequest",
+}) as any as S.Schema<CreateShortLivedAccessTokenRequest>;
+
+export type CreateShortLivedAccessTokenResponseTokenType = "Bearer";
+export const CreateShortLivedAccessTokenResponseTokenType =
+  /*@__PURE__*/ S.String;
+
+export interface CreateShortLivedAccessTokenResponse {
+  /** The short lived token that can be used for API access */
+  access_token: string | Redacted.Redacted<string>;
+  expires_in: number;
+  /** Refresh token that can be used to request a new access token when it expires (and before refresh token expires). Tokens are rotated. */
+  refresh_token: string | Redacted.Redacted<string>;
+  /** scope field of the self signed token */
+  scope: string;
+  token_type: CreateShortLivedAccessTokenResponseTokenType;
+}
+export const CreateShortLivedAccessTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    access_token: S.String.pipe(T.SensitiveValue({})),
+    expires_in: S.Number,
+    refresh_token: S.String.pipe(T.SensitiveValue({})),
+    scope: S.String,
+    token_type: CreateShortLivedAccessTokenResponseTokenType,
+  }),
+).annotate({
+  identifier: "CreateShortLivedAccessTokenResponse",
+}) as any as S.Schema<CreateShortLivedAccessTokenResponse>;
+
+export interface DeleteServiceAccountRequest {
+  /** The ID of the project. */
+  projectId: string;
+  /** The email of the Service Account. */
+  serviceAccountEmail: string;
+}
+export const DeleteServiceAccountRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    serviceAccountEmail: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/v2/projects/{projectId}/service-accounts/{serviceAccountEmail}",
+      code: 200,
+      baseUrl: "https://service-account.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "DeleteServiceAccountRequest",
+}) as any as S.Schema<DeleteServiceAccountRequest>;
+
+export interface DeleteServiceAccountResponse {}
+export const DeleteServiceAccountResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteServiceAccountResponse",
+}) as any as S.Schema<DeleteServiceAccountResponse>;
+
+export interface DeleteServiceAccountKeyRequest {
+  /** The ID of the project. */
+  projectId: string;
+  /** The email of the service account. */
+  serviceAccountEmail: string;
+  /** ID of the key. */
+  keyId: string;
+}
+export const DeleteServiceAccountKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    serviceAccountEmail: S.String.pipe(T.Label()),
+    keyId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/v2/projects/{projectId}/service-accounts/{serviceAccountEmail}/keys/{keyId}",
+      code: 200,
+      baseUrl: "https://service-account.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "DeleteServiceAccountKeyRequest",
+}) as any as S.Schema<DeleteServiceAccountKeyRequest>;
+
+export interface DeleteServiceAccountKeyResponse {}
+export const DeleteServiceAccountKeyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteServiceAccountKeyResponse",
+}) as any as S.Schema<DeleteServiceAccountKeyResponse>;
+
+export interface DeleteServiceFederatedIdentityProviderRequest {
+  /** The ID of the project. */
+  projectId: string;
+  /** The email of the service account. */
+  serviceAccountEmail: string;
+  /** ID of the Federated Identity Provider. */
+  federationId: string;
+}
+export const DeleteServiceFederatedIdentityProviderRequest =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      projectId: S.String.pipe(T.Label()),
+      serviceAccountEmail: S.String.pipe(T.Label()),
+      federationId: S.String.pipe(T.Label()),
+    }).pipe(
+      T.Http({
+        method: "DELETE",
+        uri: "/v2/projects/{projectId}/service-accounts/{serviceAccountEmail}/federations/{federationId}",
+        code: 200,
+        baseUrl: "https://service-account.api.stackit.cloud",
+      }),
+    ),
+  ).annotate({
+    identifier: "DeleteServiceFederatedIdentityProviderRequest",
+  }) as any as S.Schema<DeleteServiceFederatedIdentityProviderRequest>;
+
+export interface DeleteServiceFederatedIdentityProviderResponse {}
+export const DeleteServiceFederatedIdentityProviderResponse =
+  /*@__PURE__*/ S.suspend(() => S.Struct({})).annotate({
+    identifier: "DeleteServiceFederatedIdentityProviderResponse",
+  }) as any as S.Schema<DeleteServiceFederatedIdentityProviderResponse>;
+
+export interface GetFederatedIdentityProviderRequest {
+  /** The ID of the project. */
+  projectId: string;
+  /** The email of the service account. */
+  serviceAccountEmail: string;
+  /** ID of the Federated Identity Provider. */
+  federationId: string;
+}
+export const GetFederatedIdentityProviderRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    serviceAccountEmail: S.String.pipe(T.Label()),
+    federationId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v2/projects/{projectId}/service-accounts/{serviceAccountEmail}/federations/{federationId}",
+      code: 200,
+      baseUrl: "https://service-account.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "GetFederatedIdentityProviderRequest",
+}) as any as S.Schema<GetFederatedIdentityProviderRequest>;
+
+export interface GetJWKSRequest {
+  /** The email of the service account. */
+  serviceAccountEmail: string;
+}
+export const GetJWKSRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    serviceAccountEmail: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v2/service-accounts/public/jwk/{serviceAccountEmail}",
+      code: 200,
+      baseUrl: "https://service-account.api.stackit.cloud",
+    }),
+  ),
+).annotate({ identifier: "GetJWKSRequest" }) as any as S.Schema<GetJWKSRequest>;
+
+/** JSON Web Key according to https://datatracker.ietf.org/doc/html/rfc7517#section-4 */
+export interface JWK {
+  alg?: string;
+  e: string;
+  kid?: string;
+  ks?: string;
+  n: string;
+  ops?: string;
+  use?: string;
+  x5c?: string;
+  x5t?: string;
+  x5t256?: string;
+  x5u?: string;
+}
+export const JWK = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    alg: S.optional(S.String),
+    e: S.String,
+    kid: S.optional(S.String),
+    ks: S.optional(S.String),
+    n: S.String,
+    ops: S.optional(S.String),
+    use: S.optional(S.String),
+    x5c: S.optional(S.String),
+    x5t: S.optional(S.String),
+    x5t256: S.optional(S.String),
+    x5u: S.optional(S.String),
+  }),
+).annotate({ identifier: "JWK" }) as any as S.Schema<JWK>;
+
+export type JWKSKeysList = Array<JWK>;
+export const JWKSKeysList = /*@__PURE__*/ S.Array(
+  JWK,
+) as any as S.Schema<JWKSKeysList>;
+
+export interface JWKS {
+  keys: JWKSKeysList;
+}
+export const JWKS = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    keys: JWKSKeysList,
+  }),
+).annotate({ identifier: "JWKS" }) as any as S.Schema<JWKS>;
+
+export type GetServiceAccountKeyRequestFormat = "X509_PEM";
+export const GetServiceAccountKeyRequestFormat = /*@__PURE__*/ S.String;
+
+export interface GetServiceAccountKeyRequest {
+  /** The ID of the project. */
+  projectId: string;
+  /** The email of the service account. */
+  serviceAccountEmail: string;
+  /** ID of the key. */
+  keyId: string;
+  /** Requested format for the public key */
+  format?: GetServiceAccountKeyRequestFormat | (string & {});
+}
+export const GetServiceAccountKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    serviceAccountEmail: S.String.pipe(T.Label()),
+    keyId: S.String.pipe(T.Label()),
+    format: S.optional(GetServiceAccountKeyRequestFormat.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v2/projects/{projectId}/service-accounts/{serviceAccountEmail}/keys/{keyId}",
+      code: 200,
+      baseUrl: "https://service-account.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "GetServiceAccountKeyRequest",
+}) as any as S.Schema<GetServiceAccountKeyRequest>;
+
+export interface GetServiceAccountKeyResponseCredentials {
+  /** Audience - service account API URL */
+  aud: string;
+  /** Service account email */
+  iss: string;
+  /** Key id to use */
+  kid: string;
+  /** Service account id */
+  sub: string;
+}
+export const GetServiceAccountKeyResponseCredentials = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      aud: S.String,
+      iss: S.String,
+      kid: S.String,
+      sub: S.String,
+    }),
+).annotate({
+  identifier: "GetServiceAccountKeyResponseCredentials",
+}) as any as S.Schema<GetServiceAccountKeyResponseCredentials>;
+
+export type GetServiceAccountKeyResponseKeyAlgorithm = "RSA_2048" | "RSA_4096";
+export const GetServiceAccountKeyResponseKeyAlgorithm = /*@__PURE__*/ S.String;
+
+export type GetServiceAccountKeyResponseKeyOrigin =
+  | "USER_PROVIDED"
+  | "GENERATED";
+export const GetServiceAccountKeyResponseKeyOrigin = /*@__PURE__*/ S.String;
+
+export type GetServiceAccountKeyResponseKeyType =
+  | "USER_MANAGED"
+  | "SYSTEM_MANAGED";
+export const GetServiceAccountKeyResponseKeyType = /*@__PURE__*/ S.String;
+
+export interface GetServiceAccountKeyResponse {
+  active: boolean;
+  /** Creation time of the key */
+  createdAt: string;
+  credentials: GetServiceAccountKeyResponseCredentials;
+  /** Unique ID of the key. */
+  id: string;
+  keyAlgorithm: GetServiceAccountKeyResponseKeyAlgorithm;
+  keyOrigin: GetServiceAccountKeyResponseKeyOrigin;
+  keyType: GetServiceAccountKeyResponseKeyType;
+  /** Public key, in the requested format */
+  publicKey?: string;
+  /** If specified, the timestamp until the key is active. May be null */
+  validUntil?: string;
+}
+export const GetServiceAccountKeyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    active: S.Boolean,
+    createdAt: S.String,
+    credentials: GetServiceAccountKeyResponseCredentials,
+    id: S.String,
+    keyAlgorithm: GetServiceAccountKeyResponseKeyAlgorithm,
+    keyOrigin: GetServiceAccountKeyResponseKeyOrigin,
+    keyType: GetServiceAccountKeyResponseKeyType,
+    publicKey: S.optional(S.String),
+    validUntil: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "GetServiceAccountKeyResponse",
+}) as any as S.Schema<GetServiceAccountKeyResponse>;
+
+export interface ListFederatedIdentityProvidersRequest {
+  /** The ID of the project. */
+  projectId: string;
+  /** The email of the service account. */
+  serviceAccountEmail: string;
+}
+export const ListFederatedIdentityProvidersRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      projectId: S.String.pipe(T.Label()),
+      serviceAccountEmail: S.String.pipe(T.Label()),
+    }).pipe(
+      T.Http({
+        method: "GET",
+        uri: "/v2/projects/{projectId}/service-accounts/{serviceAccountEmail}/federations",
+        code: 200,
+        baseUrl: "https://service-account.api.stackit.cloud",
+      }),
+    ),
+).annotate({
+  identifier: "ListFederatedIdentityProvidersRequest",
+}) as any as S.Schema<ListFederatedIdentityProvidersRequest>;
+
+export type FederatedListFederatedIdentityProvidersResponseResourcesList =
+  Array<FederatedIdentityProvider>;
+export const FederatedListFederatedIdentityProvidersResponseResourcesList =
+  /*@__PURE__*/ S.Array(
+    FederatedIdentityProvider,
+  ) as any as S.Schema<FederatedListFederatedIdentityProvidersResponseResourcesList>;
+
+export interface FederatedListFederatedIdentityProvidersResponse {
+  itemsPerPage: number;
+  resources: FederatedListFederatedIdentityProvidersResponseResourcesList;
+  startIndex: number;
+  totalResults: number;
+}
+export const FederatedListFederatedIdentityProvidersResponse =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      itemsPerPage: S.Number,
+      resources: FederatedListFederatedIdentityProvidersResponseResourcesList,
+      startIndex: S.Number,
+      totalResults: S.Number,
+    }),
+  ).annotate({
+    identifier: "FederatedListFederatedIdentityProvidersResponse",
+  }) as any as S.Schema<FederatedListFederatedIdentityProvidersResponse>;
+
+export interface ListServiceAccountKeysRequest {
+  /** The ID of the project. */
+  projectId: string;
+  /** The email of the service account. */
+  serviceAccountEmail: string;
+}
+export const ListServiceAccountKeysRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    serviceAccountEmail: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v2/projects/{projectId}/service-accounts/{serviceAccountEmail}/keys",
+      code: 200,
+      baseUrl: "https://service-account.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "ListServiceAccountKeysRequest",
+}) as any as S.Schema<ListServiceAccountKeysRequest>;
+
+export type ServiceAccountKeyListResponseKeyAlgorithm = "RSA_2048" | "RSA_4096";
+export const ServiceAccountKeyListResponseKeyAlgorithm = /*@__PURE__*/ S.String;
+
+export type ServiceAccountKeyListResponseKeyOrigin =
+  | "USER_PROVIDED"
+  | "GENERATED";
+export const ServiceAccountKeyListResponseKeyOrigin = /*@__PURE__*/ S.String;
+
+export type ServiceAccountKeyListResponseKeyType =
+  | "USER_MANAGED"
+  | "SYSTEM_MANAGED";
+export const ServiceAccountKeyListResponseKeyType = /*@__PURE__*/ S.String;
+
+export interface ServiceAccountKeyListResponse {
+  active: boolean;
+  /** Creation time of the key */
+  createdAt: string;
+  /** Unique ID of the key. */
+  id: string;
+  keyAlgorithm: ServiceAccountKeyListResponseKeyAlgorithm;
+  keyOrigin: ServiceAccountKeyListResponseKeyOrigin;
+  keyType: ServiceAccountKeyListResponseKeyType;
+  /** If specified, the timestamp until the key is active. May be null */
+  validUntil?: string;
+}
+export const ServiceAccountKeyListResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    active: S.Boolean,
+    createdAt: S.String,
+    id: S.String,
+    keyAlgorithm: ServiceAccountKeyListResponseKeyAlgorithm,
+    keyOrigin: ServiceAccountKeyListResponseKeyOrigin,
+    keyType: ServiceAccountKeyListResponseKeyType,
+    validUntil: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "ServiceAccountKeyListResponse",
+}) as any as S.Schema<ServiceAccountKeyListResponse>;
+
+export type ListServiceAccountKeysResponseItemsList =
+  Array<ServiceAccountKeyListResponse>;
+export const ListServiceAccountKeysResponseItemsList = /*@__PURE__*/ S.Array(
+  ServiceAccountKeyListResponse,
+) as any as S.Schema<ListServiceAccountKeysResponseItemsList>;
+
+export interface ListServiceAccountKeysResponse {
+  items: ListServiceAccountKeysResponseItemsList;
+}
+export const ListServiceAccountKeysResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    items: ListServiceAccountKeysResponseItemsList,
+  }),
+).annotate({
+  identifier: "ListServiceAccountKeysResponse",
+}) as any as S.Schema<ListServiceAccountKeysResponse>;
+
+export interface ListServiceAccountsRequest {
+  /** The ID of the project. */
+  projectId: string;
+}
+export const ListServiceAccountsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v2/projects/{projectId}/service-accounts",
+      code: 200,
+      baseUrl: "https://service-account.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "ListServiceAccountsRequest",
+}) as any as S.Schema<ListServiceAccountsRequest>;
+
+export type ListServiceAccountsResponseItemsList = Array<ServiceAccount2>;
+export const ListServiceAccountsResponseItemsList = /*@__PURE__*/ S.Array(
+  ServiceAccount2,
+) as any as S.Schema<ListServiceAccountsResponseItemsList>;
+
+export interface ListServiceAccountsResponse {
+  items: ListServiceAccountsResponseItemsList;
+}
+export const ListServiceAccountsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    items: ListServiceAccountsResponseItemsList,
+  }),
+).annotate({
+  identifier: "ListServiceAccountsResponse",
+}) as any as S.Schema<ListServiceAccountsResponse>;
+
+export type PartialUpdateServiceAccountFederatedIdentityProviderRequestAssertionsItem =
+  CreateFederatedIdentityProviderRequestAssertionsItem;
+export const PartialUpdateServiceAccountFederatedIdentityProviderRequestAssertionsItem =
+  CreateFederatedIdentityProviderRequestAssertionsItem;
+
+/** list of assertions of the federated identity provider */
+export type PartialUpdateServiceAccountFederatedIdentityProviderRequestAssertionsList =
+  Array<CreateFederatedIdentityProviderRequestAssertionsItem>;
+export const PartialUpdateServiceAccountFederatedIdentityProviderRequestAssertionsList =
+  /*@__PURE__*/ S.Array(
+    CreateFederatedIdentityProviderRequestAssertionsItem,
+  ) as any as S.Schema<PartialUpdateServiceAccountFederatedIdentityProviderRequestAssertionsList>;
+
+export interface PartialUpdateServiceAccountFederatedIdentityProviderRequest {
+  /** The ID of the project. */
+  projectId: string;
+  /** The email of the service account. */
+  serviceAccountEmail: string;
+  /** ID of the Federated Identity Provider. */
+  federationId: string;
+  /** list of assertions of the federated identity provider */
+  assertions?: PartialUpdateServiceAccountFederatedIdentityProviderRequestAssertionsList;
+  /** Issuer of the federated identity provider. */
+  issuer: string;
+  /** Unique name used as identifier of the federated identity provider. */
+  name: string;
+}
+export const PartialUpdateServiceAccountFederatedIdentityProviderRequest =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      projectId: S.String.pipe(T.Label()),
+      serviceAccountEmail: S.String.pipe(T.Label()),
+      federationId: S.String.pipe(T.Label()),
+      assertions: S.optional(
+        PartialUpdateServiceAccountFederatedIdentityProviderRequestAssertionsList,
+      ),
+      issuer: S.String,
+      name: S.String,
+    }).pipe(
+      T.Http({
+        method: "PATCH",
+        uri: "/v2/projects/{projectId}/service-accounts/{serviceAccountEmail}/federations/{federationId}",
+        code: 200,
+        baseUrl: "https://service-account.api.stackit.cloud",
+      }),
+    ),
+  ).annotate({
+    identifier: "PartialUpdateServiceAccountFederatedIdentityProviderRequest",
+  }) as any as S.Schema<PartialUpdateServiceAccountFederatedIdentityProviderRequest>;
+
+export interface PartialUpdateServiceAccountKeyRequest {
+  /** The ID of the project. */
+  projectId: string;
+  /** The email of the service account. */
+  serviceAccountEmail: string;
+  /** ID of the key. */
+  keyId: string;
+  /** Active keys are valid, while inactive keys are temporarily deactivated. */
+  active?: boolean;
+  /** Optional, date of key expiration. To disable, set time to "9999-01-01T01:01:01Z" */
+  validUntil?: string;
+}
+export const PartialUpdateServiceAccountKeyRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      projectId: S.String.pipe(T.Label()),
+      serviceAccountEmail: S.String.pipe(T.Label()),
+      keyId: S.String.pipe(T.Label()),
+      active: S.optional(S.Boolean),
+      validUntil: S.optional(S.String),
+    }).pipe(
+      T.Http({
+        method: "PATCH",
+        uri: "/v2/projects/{projectId}/service-accounts/{serviceAccountEmail}/keys/{keyId}",
+        code: 200,
+        baseUrl: "https://service-account.api.stackit.cloud",
+      }),
+    ),
+).annotate({
+  identifier: "PartialUpdateServiceAccountKeyRequest",
+}) as any as S.Schema<PartialUpdateServiceAccountKeyRequest>;
+
+export type PartialUpdateServiceAccountKeyResponseKeyAlgorithm =
+  | "RSA_2048"
+  | "RSA_4096";
+export const PartialUpdateServiceAccountKeyResponseKeyAlgorithm =
+  /*@__PURE__*/ S.String;
+
+export type PartialUpdateServiceAccountKeyResponseKeyOrigin =
+  | "USER_PROVIDED"
+  | "GENERATED";
+export const PartialUpdateServiceAccountKeyResponseKeyOrigin =
+  /*@__PURE__*/ S.String;
+
+export type PartialUpdateServiceAccountKeyResponseKeyType =
+  | "USER_MANAGED"
+  | "SYSTEM_MANAGED";
+export const PartialUpdateServiceAccountKeyResponseKeyType =
+  /*@__PURE__*/ S.String;
+
+export interface PartialUpdateServiceAccountKeyResponse {
+  active: boolean;
+  /** Creation time of the key */
+  createdAt: string;
+  /** Unique ID of the key. */
+  id: string;
+  keyAlgorithm: PartialUpdateServiceAccountKeyResponseKeyAlgorithm;
+  keyOrigin: PartialUpdateServiceAccountKeyResponseKeyOrigin;
+  keyType: PartialUpdateServiceAccountKeyResponseKeyType;
+  /** If specified, the timestamp until the key is active. May be null */
+  validUntil?: string;
+}
+export const PartialUpdateServiceAccountKeyResponse = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      active: S.Boolean,
+      createdAt: S.String,
+      id: S.String,
+      keyAlgorithm: PartialUpdateServiceAccountKeyResponseKeyAlgorithm,
+      keyOrigin: PartialUpdateServiceAccountKeyResponseKeyOrigin,
+      keyType: PartialUpdateServiceAccountKeyResponseKeyType,
+      validUntil: S.optional(S.String),
+    }),
+).annotate({
+  identifier: "PartialUpdateServiceAccountKeyResponse",
+}) as any as S.Schema<PartialUpdateServiceAccountKeyResponse>;
+
+export type CreateFederatedIdentityProviderError =
+  | BadRequest
+  | Forbidden
+  | Conflict
+  | StackitOpError;
+/** Create a new Federated Identity Provider Federate the service account with an identity provider. */
+export const createFederatedIdentityProvider: API.OperationMethod<
+  CreateFederatedIdentityProviderRequest,
+  FederatedIdentityProvider,
+  CreateFederatedIdentityProviderError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateFederatedIdentityProviderRequest,
+  output: FederatedIdentityProvider,
+  errors: [BadRequest, Forbidden, Conflict, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateServiceAccountError =
+  | BadRequest
+  | Forbidden
+  | Conflict
+  | StackitOpError;
+/** Create a new Service Account Create a new Service Account in a project. The service account only resides in the project, and initially has no roles or permissions on any resources. After creation, the service account can be assigned to this project, other projects in the parent organization or to the parent organization. */
+export const createServiceAccount: API.OperationMethod<
+  CreateServiceAccountRequest,
+  ServiceAccount2,
+  CreateServiceAccountError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateServiceAccountRequest,
+  output: ServiceAccount2,
+  errors: [BadRequest, Forbidden, Conflict, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateServiceAccountKeyError =
+  | BadRequest
+  | Forbidden
+  | Conflict
+  | StackitOpError;
+/** Create a new Service Account key Create a new key to the service account. You can generate an RSA keypair, and post the PUBLIC part of the keypair, or leave empty, then the service will generate a pair. Maximum of 10 key can be added. A new key cannot be created using the same service account (authenticated using the short lived token of another key of the same service account). */
+export const createServiceAccountKey: API.OperationMethod<
+  CreateServiceAccountKeyRequest,
+  CreateServiceAccountKeyResponse,
+  CreateServiceAccountKeyError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateServiceAccountKeyRequest,
+  output: CreateServiceAccountKeyResponse,
+  errors: [BadRequest, Forbidden, Conflict, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateShortLivedAccessTokenError =
+  | BadRequest
+  | Forbidden
+  | StackitOpError;
+/** Request short lived API access token (OAUTH2). Request a short lived API access token with OAUTH2. Compatible with [Using JWTs as Authorization Grants](https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1) You can request a token with a self signed token, or with a refresh token. */
+export const createShortLivedAccessToken: API.OperationMethod<
+  CreateShortLivedAccessTokenRequest,
+  CreateShortLivedAccessTokenResponse,
+  CreateShortLivedAccessTokenError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateShortLivedAccessTokenRequest,
+  output: CreateShortLivedAccessTokenResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteServiceAccountError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | StackitOpError;
+/** Delete Service Account Delete a Service Account. */
+export const deleteServiceAccount: API.OperationMethod<
+  DeleteServiceAccountRequest,
+  DeleteServiceAccountResponse,
+  DeleteServiceAccountError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteServiceAccountRequest,
+  output: DeleteServiceAccountResponse,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteServiceAccountKeyError =
+  | BadRequest
+  | Forbidden
+  | StackitOpError;
+/** Delete a service account key Delete a key */
+export const deleteServiceAccountKey: API.OperationMethod<
+  DeleteServiceAccountKeyRequest,
+  DeleteServiceAccountKeyResponse,
+  DeleteServiceAccountKeyError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteServiceAccountKeyRequest,
+  output: DeleteServiceAccountKeyResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteServiceFederatedIdentityProviderError =
+  | BadRequest
+  | Forbidden
+  | StackitOpError;
+/** Delete a service account Federated Identity Provider Delete a Federated Identity Provider */
+export const deleteServiceFederatedIdentityProvider: API.OperationMethod<
+  DeleteServiceFederatedIdentityProviderRequest,
+  DeleteServiceFederatedIdentityProviderResponse,
+  DeleteServiceFederatedIdentityProviderError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteServiceFederatedIdentityProviderRequest,
+  output: DeleteServiceFederatedIdentityProviderResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetFederatedIdentityProviderError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | StackitOpError;
+/** Get a service account Federated Identity Provider Get a Federated Identity Provider of the service account by its ID. */
+export const getFederatedIdentityProvider: API.OperationMethod<
+  GetFederatedIdentityProviderRequest,
+  FederatedIdentityProvider,
+  GetFederatedIdentityProviderError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetFederatedIdentityProviderRequest,
+  output: FederatedIdentityProvider,
+  errors: [BadRequest, Forbidden, NotFound, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetJWKSError = StackitOpError;
+/** Get JSON Web Key set of the service account Get JSON Web Key set of the service account */
+export const getJWKS: API.OperationMethod<
+  GetJWKSRequest,
+  JWKS,
+  GetJWKSError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetJWKSRequest,
+  output: JWKS,
+  errors: [UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetServiceAccountKeyError = BadRequest | Forbidden | StackitOpError;
+/** Get service account key details Get key details */
+export const getServiceAccountKey: API.OperationMethod<
+  GetServiceAccountKeyRequest,
+  GetServiceAccountKeyResponse,
+  GetServiceAccountKeyError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetServiceAccountKeyRequest,
+  output: GetServiceAccountKeyResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListFederatedIdentityProvidersError =
+  | BadRequest
+  | Forbidden
+  | StackitOpError;
+/** List all federated identity providers List all the identity providers the service account is federated with. */
+export const listFederatedIdentityProviders: API.OperationMethod<
+  ListFederatedIdentityProvidersRequest,
+  FederatedListFederatedIdentityProvidersResponse,
+  ListFederatedIdentityProvidersError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListFederatedIdentityProvidersRequest,
+  output: FederatedListFederatedIdentityProvidersResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListServiceAccountKeysError =
+  | BadRequest
+  | Forbidden
+  | StackitOpError;
+/** List all keys that belong to the service account List all keys that belong to the service account */
+export const listServiceAccountKeys: API.OperationMethod<
+  ListServiceAccountKeysRequest,
+  ListServiceAccountKeysResponse,
+  ListServiceAccountKeysError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListServiceAccountKeysRequest,
+  output: ListServiceAccountKeysResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListServiceAccountsError = BadRequest | Forbidden | StackitOpError;
+/** List all Service Accounts List all Service Account resources in a project. Returns the service account resources, not the service accounts that has access to the project. */
+export const listServiceAccounts: API.OperationMethod<
+  ListServiceAccountsRequest,
+  ListServiceAccountsResponse,
+  ListServiceAccountsError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListServiceAccountsRequest,
+  output: ListServiceAccountsResponse,
+  errors: [BadRequest, Forbidden, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PartialUpdateServiceAccountFederatedIdentityProviderError =
+  | BadRequest
+  | Forbidden
+  | Conflict
+  | StackitOpError;
+/** Update Service Account Federated Identity Provider Update a Federated Identity Provider. */
+export const partialUpdateServiceAccountFederatedIdentityProvider: API.OperationMethod<
+  PartialUpdateServiceAccountFederatedIdentityProviderRequest,
+  FederatedIdentityProvider,
+  PartialUpdateServiceAccountFederatedIdentityProviderError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PartialUpdateServiceAccountFederatedIdentityProviderRequest,
+  output: FederatedIdentityProvider,
+  errors: [BadRequest, Forbidden, Conflict, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PartialUpdateServiceAccountKeyError =
+  | BadRequest
+  | Forbidden
+  | Conflict
+  | StackitOpError;
+/** Update Service Account key Update a key. You can activate or deactivate a key, or set/delete validUntil. The key cannot be updated using the same service account (authenticated using the short lived token of the key). */
+export const partialUpdateServiceAccountKey: API.OperationMethod<
+  PartialUpdateServiceAccountKeyRequest,
+  PartialUpdateServiceAccountKeyResponse,
+  PartialUpdateServiceAccountKeyError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PartialUpdateServiceAccountKeyRequest,
+  output: PartialUpdateServiceAccountKeyResponse,
+  errors: [BadRequest, Forbidden, Conflict, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));