@djangocfg/api 2.1.441 → 2.1.442

package/src/_api/generated/sdk.gen.ts

@@ -1,8 +1,8 @@
 // This file is auto-generated by @hey-api/openapi-ts
 
-import { type Client, formDataBodySerializer, type Options as Options2, type RequestResult, type TDataShape } from './client';
+import { type Client, type ClientMeta, formDataBodySerializer, type Options as Options2, type RequestResult, type TDataShape } from './client';
 import { client } from './client.gen';
-import type { CfgAccountsApiKeyRegenerateCreateData, CfgAccountsApiKeyRegenerateCreateErrors, CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRetrieveData, CfgAccountsApiKeyRetrieveErrors, CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyTestCreateData, CfgAccountsApiKeyTestCreateResponses, CfgAccountsOauthConnectionsListData, CfgAccountsOauthConnectionsListResponses, CfgAccountsOauthDisconnectCreateData, CfgAccountsOauthDisconnectCreateErrors, CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthGithubAuthorizeCreateData, CfgAccountsOauthGithubAuthorizeCreateErrors, CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubCallbackCreateData, CfgAccountsOauthGithubCallbackCreateErrors, CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthProvidersRetrieveData, CfgAccountsOauthProvidersRetrieveResponses, CfgAccountsOtpRequestCreateData, CfgAccountsOtpRequestCreateErrors, CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpVerifyCreateData, CfgAccountsOtpVerifyCreateErrors, CfgAccountsOtpVerifyCreateResponses, CfgAccountsProfileAvatarCreateData, CfgAccountsProfileAvatarCreateErrors, CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileDeleteCreateData, CfgAccountsProfileDeleteCreateErrors, CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfilePartialPartialUpdateData, CfgAccountsProfilePartialPartialUpdateErrors, CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialUpdateData, CfgAccountsProfilePartialUpdateErrors, CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfileRetrieveData, CfgAccountsProfileRetrieveErrors, CfgAccountsProfileRetrieveResponses, CfgAccountsProfileUpdatePartialUpdateData, CfgAccountsProfileUpdatePartialUpdateErrors, CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdateUpdateData, CfgAccountsProfileUpdateUpdateErrors, CfgAccountsProfileUpdateUpdateResponses, CfgAccountsTokenRefreshCreateData, CfgAccountsTokenRefreshCreateResponses, CfgCentrifugoAuthTokenRetrieveData, CfgCentrifugoAuthTokenRetrieveErrors, CfgCentrifugoAuthTokenRetrieveResponses, CfgTotpBackupCodesRegenerateCreateData, CfgTotpBackupCodesRegenerateCreateErrors, CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRetrieveData, CfgTotpBackupCodesRetrieveResponses, CfgTotpDevicesDestroyData, CfgTotpDevicesDestroyResponses, CfgTotpDevicesRetrieveData, CfgTotpDevicesRetrieveResponses, CfgTotpDisableCreateData, CfgTotpDisableCreateErrors, CfgTotpDisableCreateResponses, CfgTotpSetupConfirmCreateData, CfgTotpSetupConfirmCreateErrors, CfgTotpSetupConfirmCreateResponses, CfgTotpSetupCreateData, CfgTotpSetupCreateErrors, CfgTotpSetupCreateResponses, CfgTotpVerifyBackupCreateData, CfgTotpVerifyBackupCreateErrors, CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyCreateData, CfgTotpVerifyCreateErrors, CfgTotpVerifyCreateResponses } from './types.gen';
+import type { CfgAccountsApiKeyRegenerateCreateData, CfgAccountsApiKeyRegenerateCreateErrors, CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRetrieveData, CfgAccountsApiKeyRetrieveErrors, CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRevealCreateData, CfgAccountsApiKeyRevealCreateErrors, CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyTestCreateData, CfgAccountsApiKeyTestCreateResponses, CfgAccountsOauthConnectionsListData, CfgAccountsOauthConnectionsListResponses, CfgAccountsOauthDisconnectCreateData, CfgAccountsOauthDisconnectCreateErrors, CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthGithubAuthorizeCreateData, CfgAccountsOauthGithubAuthorizeCreateErrors, CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubCallbackCreateData, CfgAccountsOauthGithubCallbackCreateErrors, CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthProvidersRetrieveData, CfgAccountsOauthProvidersRetrieveResponses, CfgAccountsOtpRequestCreateData, CfgAccountsOtpRequestCreateErrors, CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpVerifyCreateData, CfgAccountsOtpVerifyCreateErrors, CfgAccountsOtpVerifyCreateResponses, CfgAccountsProfileAvatarCreateData, CfgAccountsProfileAvatarCreateErrors, CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileDeleteCreateData, CfgAccountsProfileDeleteCreateErrors, CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfilePartialPartialUpdateData, CfgAccountsProfilePartialPartialUpdateErrors, CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialUpdateData, CfgAccountsProfilePartialUpdateErrors, CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfileRetrieveData, CfgAccountsProfileRetrieveErrors, CfgAccountsProfileRetrieveResponses, CfgAccountsProfileUpdatePartialUpdateData, CfgAccountsProfileUpdatePartialUpdateErrors, CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdateUpdateData, CfgAccountsProfileUpdateUpdateErrors, CfgAccountsProfileUpdateUpdateResponses, CfgAccountsTokenRefreshCreateData, CfgAccountsTokenRefreshCreateResponses, CfgCentrifugoAuthTokenRetrieveData, CfgCentrifugoAuthTokenRetrieveErrors, CfgCentrifugoAuthTokenRetrieveResponses, CfgTotpBackupCodesRegenerateCreateData, CfgTotpBackupCodesRegenerateCreateErrors, CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRetrieveData, CfgTotpBackupCodesRetrieveResponses, CfgTotpDevicesDestroyData, CfgTotpDevicesDestroyResponses, CfgTotpDevicesRetrieveData, CfgTotpDevicesRetrieveResponses, CfgTotpDisableCreateData, CfgTotpDisableCreateErrors, CfgTotpDisableCreateResponses, CfgTotpSetupConfirmCreateData, CfgTotpSetupConfirmCreateErrors, CfgTotpSetupConfirmCreateResponses, CfgTotpSetupCreateData, CfgTotpSetupCreateErrors, CfgTotpSetupCreateResponses, CfgTotpVerifyBackupCreateData, CfgTotpVerifyBackupCreateErrors, CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyCreateData, CfgTotpVerifyCreateErrors, CfgTotpVerifyCreateResponses } from './types.gen';
 
 export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {
     /**
@@ -15,7 +15,7 @@ export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends
      * You can pass arbitrary values through the `meta` object. This can be
      * used to access values that aren't defined as part of the SDK function.
      */
-    meta?: Record<string, unknown>;
+    meta?: keyof ClientMeta extends never ? Record<string, unknown> : ClientMeta;
 };
 
 export class CfgAccountsApiKey {
@@ -27,11 +27,7 @@ export class CfgAccountsApiKey {
     public static cfgAccountsApiKeyRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsApiKeyRetrieveData, ThrowOnError>): RequestResult<CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRetrieveErrors, ThrowOnError> {
         return (options?.client ?? client).get<CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRetrieveErrors, ThrowOnError>({
             security: [
-                {
-                    key: 'jwtAuth',
-                    scheme: 'bearer',
-                    type: 'http'
-                },
+                { scheme: 'bearer', type: 'http' },
                 {
                     in: 'cookie',
                     name: 'sessionid',
@@ -52,11 +48,32 @@ export class CfgAccountsApiKey {
     public static cfgAccountsApiKeyRegenerateCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsApiKeyRegenerateCreateData, ThrowOnError>): RequestResult<CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRegenerateCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRegenerateCreateErrors, ThrowOnError>({
             security: [
+                { scheme: 'bearer', type: 'http' },
                 {
-                    key: 'jwtAuth',
-                    scheme: 'bearer',
-                    type: 'http'
+                    in: 'cookie',
+                    name: 'sessionid',
+                    type: 'apiKey'
                 },
+                { name: 'X-API-Key', type: 'apiKey' }
+            ],
+            url: '/cfg/accounts/api-key/regenerate/',
+            ...options,
+            headers: {
+                'Content-Type': 'application/json',
+                ...options.headers
+            }
+        });
+    }
+    
+    /**
+     * Reveal API key
+     *
+     * Return the current full API key WITHOUT rotating it. The same durable value every one of the user's agents uses — for the signed-in user to copy and paste into agent onboarding. Default GET stays masked; this is the explicit reveal action.
+     */
+    public static cfgAccountsApiKeyRevealCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsApiKeyRevealCreateData, ThrowOnError>): RequestResult<CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyRevealCreateErrors, ThrowOnError> {
+        return (options.client ?? client).post<CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyRevealCreateErrors, ThrowOnError>({
+            security: [
+                { scheme: 'bearer', type: 'http' },
                 {
                     in: 'cookie',
                     name: 'sessionid',
@@ -64,7 +81,7 @@ export class CfgAccountsApiKey {
                 },
                 { name: 'X-API-Key', type: 'apiKey' }
             ],
-            url: '/cfg/accounts/api-key/regenerate/',
+            url: '/cfg/accounts/api-key/reveal/',
             ...options,
             headers: {
                 'Content-Type': 'application/json',
@@ -81,11 +98,7 @@ export class CfgAccountsApiKey {
     public static cfgAccountsApiKeyTestCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsApiKeyTestCreateData, ThrowOnError>): RequestResult<CfgAccountsApiKeyTestCreateResponses, unknown, ThrowOnError> {
         return (options.client ?? client).post<CfgAccountsApiKeyTestCreateResponses, unknown, ThrowOnError>({
             security: [
-                {
-                    key: 'jwtAuth',
-                    scheme: 'bearer',
-                    type: 'http'
-                },
+                { scheme: 'bearer', type: 'http' },
                 {
                     in: 'cookie',
                     name: 'sessionid',
@@ -111,11 +124,7 @@ export class CfgAccountsOauth {
      */
     public static cfgAccountsOauthConnectionsList<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthConnectionsListData, ThrowOnError>): RequestResult<CfgAccountsOauthConnectionsListResponses, unknown, ThrowOnError> {
         return (options?.client ?? client).get<CfgAccountsOauthConnectionsListResponses, unknown, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/accounts/oauth/connections/',
             ...options
         });
@@ -128,11 +137,7 @@ export class CfgAccountsOauth {
      */
     public static cfgAccountsOauthDisconnectCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOauthDisconnectCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthDisconnectCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthDisconnectCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/accounts/oauth/disconnect/',
             ...options,
             headers: {
@@ -190,11 +195,7 @@ export class CfgAccounts {
      */
     public static cfgAccountsOtpRequestCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOtpRequestCreateData, ThrowOnError>): RequestResult<CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpRequestCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpRequestCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/accounts/otp/request/',
             ...options,
             headers: {
@@ -216,11 +217,7 @@ export class CfgAccounts {
      */
     public static cfgAccountsOtpVerifyCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOtpVerifyCreateData, ThrowOnError>): RequestResult<CfgAccountsOtpVerifyCreateResponses, CfgAccountsOtpVerifyCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgAccountsOtpVerifyCreateResponses, CfgAccountsOtpVerifyCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/accounts/otp/verify/',
             ...options,
             headers: {
@@ -239,11 +236,7 @@ export class CfgAccountsProfile {
      */
     public static cfgAccountsProfileRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileRetrieveData, ThrowOnError>): RequestResult<CfgAccountsProfileRetrieveResponses, CfgAccountsProfileRetrieveErrors, ThrowOnError> {
         return (options?.client ?? client).get<CfgAccountsProfileRetrieveResponses, CfgAccountsProfileRetrieveErrors, ThrowOnError>({
-            security: [{
-                    key: 'jwtAuth',
-                    scheme: 'bearer',
-                    type: 'http'
-                }, {
+            security: [{ scheme: 'bearer', type: 'http' }, {
                     in: 'cookie',
                     name: 'sessionid',
                     type: 'apiKey'
@@ -261,11 +254,7 @@ export class CfgAccountsProfile {
     public static cfgAccountsProfileAvatarCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileAvatarCreateData, ThrowOnError>): RequestResult<CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileAvatarCreateErrors, ThrowOnError> {
         return (options?.client ?? client).post<CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileAvatarCreateErrors, ThrowOnError>({
             ...formDataBodySerializer,
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/accounts/profile/avatar/',
             ...options,
             headers: {
@@ -292,11 +281,7 @@ export class CfgAccountsProfile {
      */
     public static cfgAccountsProfileDeleteCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileDeleteCreateData, ThrowOnError>): RequestResult<CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfileDeleteCreateErrors, ThrowOnError> {
         return (options?.client ?? client).post<CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfileDeleteCreateErrors, ThrowOnError>({
-            security: [{
-                    key: 'jwtAuth',
-                    scheme: 'bearer',
-                    type: 'http'
-                }, {
+            security: [{ scheme: 'bearer', type: 'http' }, {
                     in: 'cookie',
                     name: 'sessionid',
                     type: 'apiKey'
@@ -313,11 +298,7 @@ export class CfgAccountsProfile {
      */
     public static cfgAccountsProfilePartialPartialUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfilePartialPartialUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialPartialUpdateErrors, ThrowOnError> {
         return (options?.client ?? client).patch<CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialPartialUpdateErrors, ThrowOnError>({
-            security: [{
-                    key: 'jwtAuth',
-                    scheme: 'bearer',
-                    type: 'http'
-                }, {
+            security: [{ scheme: 'bearer', type: 'http' }, {
                     in: 'cookie',
                     name: 'sessionid',
                     type: 'apiKey'
@@ -338,11 +319,7 @@ export class CfgAccountsProfile {
      */
     public static cfgAccountsProfilePartialUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfilePartialUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfilePartialUpdateErrors, ThrowOnError> {
         return (options?.client ?? client).put<CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfilePartialUpdateErrors, ThrowOnError>({
-            security: [{
-                    key: 'jwtAuth',
-                    scheme: 'bearer',
-                    type: 'http'
-                }, {
+            security: [{ scheme: 'bearer', type: 'http' }, {
                     in: 'cookie',
                     name: 'sessionid',
                     type: 'apiKey'
@@ -363,11 +340,7 @@ export class CfgAccountsProfile {
      */
     public static cfgAccountsProfileUpdatePartialUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileUpdatePartialUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdatePartialUpdateErrors, ThrowOnError> {
         return (options?.client ?? client).patch<CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdatePartialUpdateErrors, ThrowOnError>({
-            security: [{
-                    key: 'jwtAuth',
-                    scheme: 'bearer',
-                    type: 'http'
-                }, {
+            security: [{ scheme: 'bearer', type: 'http' }, {
                     in: 'cookie',
                     name: 'sessionid',
                     type: 'apiKey'
@@ -388,11 +361,7 @@ export class CfgAccountsProfile {
      */
     public static cfgAccountsProfileUpdateUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileUpdateUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfileUpdateUpdateResponses, CfgAccountsProfileUpdateUpdateErrors, ThrowOnError> {
         return (options?.client ?? client).put<CfgAccountsProfileUpdateUpdateResponses, CfgAccountsProfileUpdateUpdateErrors, ThrowOnError>({
-            security: [{
-                    key: 'jwtAuth',
-                    scheme: 'bearer',
-                    type: 'http'
-                }, {
+            security: [{ scheme: 'bearer', type: 'http' }, {
                     in: 'cookie',
                     name: 'sessionid',
                     type: 'apiKey'
@@ -410,6 +379,12 @@ export class CfgAccountsProfile {
 export class CfgAccountsAuth {
     /**
      * Refresh JWT token.
+     *
+     * DPoP-aware: when the incoming refresh token is key-bound (`cnf.jkt`), the
+     * rotated access/refresh in the response are re-stamped with the same `cnf`
+     * (stock SimpleJWT drops it from the derived access), and a matching DPoP
+     * proof is required on the refresh request — so a stolen refresh token can't
+     * be used to mint fresh tokens.
      */
     public static cfgAccountsTokenRefreshCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsTokenRefreshCreateData, ThrowOnError>): RequestResult<CfgAccountsTokenRefreshCreateResponses, unknown, ThrowOnError> {
         return (options.client ?? client).post<CfgAccountsTokenRefreshCreateResponses, unknown, ThrowOnError>({
@@ -431,11 +406,7 @@ export class CfgCentrifugo {
      */
     public static cfgCentrifugoAuthTokenRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgCentrifugoAuthTokenRetrieveData, ThrowOnError>): RequestResult<CfgCentrifugoAuthTokenRetrieveResponses, CfgCentrifugoAuthTokenRetrieveErrors, ThrowOnError> {
         return (options?.client ?? client).get<CfgCentrifugoAuthTokenRetrieveResponses, CfgCentrifugoAuthTokenRetrieveErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/centrifugo/auth/token/',
             ...options
         });
@@ -448,11 +419,7 @@ export class CfgTotpBackupCodes {
      */
     public static cfgTotpBackupCodesRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgTotpBackupCodesRetrieveData, ThrowOnError>): RequestResult<CfgTotpBackupCodesRetrieveResponses, unknown, ThrowOnError> {
         return (options?.client ?? client).get<CfgTotpBackupCodesRetrieveResponses, unknown, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/totp/backup-codes/',
             ...options
         });
@@ -466,11 +433,7 @@ export class CfgTotpBackupCodes {
      */
     public static cfgTotpBackupCodesRegenerateCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpBackupCodesRegenerateCreateData, ThrowOnError>): RequestResult<CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRegenerateCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRegenerateCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/totp/backup-codes/regenerate/',
             ...options,
             headers: {
@@ -487,11 +450,7 @@ export class CfgTotp {
      */
     public static cfgTotpDevicesRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgTotpDevicesRetrieveData, ThrowOnError>): RequestResult<CfgTotpDevicesRetrieveResponses, unknown, ThrowOnError> {
         return (options?.client ?? client).get<CfgTotpDevicesRetrieveResponses, unknown, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/totp/devices/',
             ...options
         });
@@ -504,11 +463,7 @@ export class CfgTotp {
      */
     public static cfgTotpDevicesDestroy<ThrowOnError extends boolean = false>(options: Options<CfgTotpDevicesDestroyData, ThrowOnError>): RequestResult<CfgTotpDevicesDestroyResponses, unknown, ThrowOnError> {
         return (options.client ?? client).delete<CfgTotpDevicesDestroyResponses, unknown, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/totp/devices/{id}/',
             ...options
         });
@@ -521,11 +476,7 @@ export class CfgTotp {
      */
     public static cfgTotpDisableCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpDisableCreateData, ThrowOnError>): RequestResult<CfgTotpDisableCreateResponses, CfgTotpDisableCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgTotpDisableCreateResponses, CfgTotpDisableCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/totp/disable/',
             ...options,
             headers: {
@@ -544,11 +495,7 @@ export class CfgTotpSetup {
      */
     public static cfgTotpSetupCreate<ThrowOnError extends boolean = false>(options?: Options<CfgTotpSetupCreateData, ThrowOnError>): RequestResult<CfgTotpSetupCreateResponses, CfgTotpSetupCreateErrors, ThrowOnError> {
         return (options?.client ?? client).post<CfgTotpSetupCreateResponses, CfgTotpSetupCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/totp/setup/',
             ...options,
             headers: {
@@ -565,11 +512,7 @@ export class CfgTotpSetup {
      */
     public static cfgTotpSetupConfirmCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpSetupConfirmCreateData, ThrowOnError>): RequestResult<CfgTotpSetupConfirmCreateResponses, CfgTotpSetupConfirmCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgTotpSetupConfirmCreateResponses, CfgTotpSetupConfirmCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/totp/setup/confirm/',
             ...options,
             headers: {
@@ -588,11 +531,7 @@ export class CfgTotpVerify {
      */
     public static cfgTotpVerifyCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpVerifyCreateData, ThrowOnError>): RequestResult<CfgTotpVerifyCreateResponses, CfgTotpVerifyCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgTotpVerifyCreateResponses, CfgTotpVerifyCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/totp/verify/',
             ...options,
             headers: {
@@ -609,11 +548,7 @@ export class CfgTotpVerify {
      */
     public static cfgTotpVerifyBackupCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpVerifyBackupCreateData, ThrowOnError>): RequestResult<CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyBackupCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyBackupCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, {
-                    key: 'jwtAuthWithLastLogin',
-                    scheme: 'bearer',
-                    type: 'http'
-                }],
+            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
             url: '/cfg/totp/verify/backup/',
             ...options,
             headers: {

package/src/_api/generated/types.gen.ts

@@ -54,6 +54,24 @@ export type ApiKeyRequest = {
     created_at: string;
 };
 
+/**
+ * Serializer for revealing the current (unrotated) full API key.
+ */
+export type ApiKeyReveal = {
+    /**
+     * Full API key (current value, not rotated)
+     */
+    key: string;
+    /**
+     * When the key was created
+     */
+    created_at: string;
+    /**
+     * When the key was last regenerated
+     */
+    reissued_at: string | null;
+};
+
 /**
  * Serializer for testing an API key.
  */
@@ -930,6 +948,26 @@ export type CfgAccountsApiKeyRegenerateCreateResponses = {
 
 export type CfgAccountsApiKeyRegenerateCreateResponse = CfgAccountsApiKeyRegenerateCreateResponses[keyof CfgAccountsApiKeyRegenerateCreateResponses];
 
+export type CfgAccountsApiKeyRevealCreateData = {
+    body: ApiKeyRequest;
+    path?: never;
+    query?: never;
+    url: '/cfg/accounts/api-key/reveal/';
+};
+
+export type CfgAccountsApiKeyRevealCreateErrors = {
+    /**
+     * Authentication credentials were not provided.
+     */
+    401: unknown;
+};
+
+export type CfgAccountsApiKeyRevealCreateResponses = {
+    200: ApiKeyReveal;
+};
+
+export type CfgAccountsApiKeyRevealCreateResponse = CfgAccountsApiKeyRevealCreateResponses[keyof CfgAccountsApiKeyRevealCreateResponses];
+
 export type CfgAccountsApiKeyTestCreateData = {
     body: ApiKeyTestRequest;
     path?: never;

package/src/hooks/useApiKey.ts

@@ -4,6 +4,7 @@ import { useCallback, useState } from 'react';
 
 import { useCfgAccountsApiKeyRegenerateCreate } from '../_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRegenerateCreate';
 import { useCfgAccountsApiKeyRetrieve } from '../_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRetrieve';
+import { useCfgAccountsApiKeyRevealCreate } from '../_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRevealCreate';
 import { useCfgAccountsApiKeyTestCreate } from '../_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyTestCreate';
 
 export interface ApiKeyTestResult {
@@ -12,12 +13,25 @@ export interface ApiKeyTestResult {
 }
 
 export interface UseApiKeyReturn {
+  /**
+   * The key to display. Masked by default (from retrieve). Becomes the FULL
+   * value after `reveal()` or `regenerate()` resolves, so the user can copy it.
+   */
   apiKey: string | null;
+  /** True once `reveal()`/`regenerate()` has surfaced the full (unmasked) key. */
+  isRevealed: boolean;
   reissuedAt: string | null;
   createdAt: string | null;
   isLoading: boolean;
+  isRevealing: boolean;
   isRegenerating: boolean;
   isTesting: boolean;
+  /**
+   * Fetch the current full key WITHOUT rotating it (the durable value every one
+   * of the user's agents uses). Use this to let the user copy their key for
+   * agent onboarding — `regenerate()` would invalidate the agents already using it.
+   */
+  reveal: () => Promise<void>;
   regenerate: () => Promise<void>;
   testKey: (key: string) => Promise<ApiKeyTestResult>;
   refresh: () => void;
@@ -25,17 +39,28 @@ export interface UseApiKeyReturn {
 
 export function useApiKey(): UseApiKeyReturn {
   const { data, isLoading, mutate } = useCfgAccountsApiKeyRetrieve();
+  const { trigger: revealTrigger, isMutating: isRevealing } = useCfgAccountsApiKeyRevealCreate();
   const { trigger: regenerateTrigger, isMutating: isRegenerating } = useCfgAccountsApiKeyRegenerateCreate();
   const { trigger: testTrigger, isMutating: isTesting } = useCfgAccountsApiKeyTestCreate();
 
-  // After regenerate, the POST response contains the FULL key (shown once).
-  // We store it separately so the user can copy it before we refetch.
+  // reveal/regenerate POST responses contain the FULL key. We store it
+  // separately so the user can copy it before (or instead of) a masked refetch.
   const [freshKey, setFreshKey] = useState<string | null>(null);
 
   const apiKey = freshKey ?? (data?.key ?? null);
+  const isRevealed = freshKey !== null;
   const reissuedAt = (data as Record<string, unknown> | undefined)?.reissued_at as string | null ?? null;
   const createdAt = (data as Record<string, unknown> | undefined)?.created_at as string | null ?? null;
 
+  const reveal = useCallback(async () => {
+    const result = await revealTrigger({} as never);
+    // The reveal response has the current full key — surface it WITHOUT rotating.
+    const fullKey = (result as Record<string, unknown> | undefined)?.key as string | undefined;
+    if (fullKey) {
+      setFreshKey(fullKey);
+    }
+  }, [revealTrigger]);
+
   const regenerate = useCallback(async () => {
     const result = await regenerateTrigger({} as never);
     // The POST response has the full key — surface it immediately.
@@ -61,11 +86,14 @@ export function useApiKey(): UseApiKeyReturn {
 
   return {
     apiKey,
+    isRevealed,
     reissuedAt,
     createdAt,
     isLoading,
+    isRevealing,
     isRegenerating,
     isTesting,
+    reveal,
     regenerate,
     testKey,
     refresh,