@epilot/cli 0.1.25 → 0.1.27

package/definitions/customer-portal.json

@@ -818,17 +818,6 @@
                             "description": "Optional type of the consumption, such as 'nt' (night time) and 'ht' (high time) or 'feed-in' and 'feed-out'. Can be any string.",
                             "example": "nt"
                           },
-                          "aggregation_method": {
-                            "type": "string",
-                            "description": "The method used to aggregate the consumption data. Assumed default is 'sum'.",
-                            "enum": [
-                              "sum",
-                              "average",
-                              "max",
-                              "min"
-                            ],
-                            "example": "sum"
-                          },
                           "unit": {
                             "type": "string",
                             "description": "Optional unit of the consumption value. Defaults to unit present on the relevant Meter Counter.",
@@ -965,6 +954,74 @@
         }
       }
     },
+    "/v2/portal/visualization/metadata": {
+      "get": {
+        "operationId": "getVisualizationMetadata",
+        "summary": "Get Visualization Metadata",
+        "description": "Returns runtime metadata describing how a visualization (consumption / price / cost chart) should be rendered for a given portal context (meter, contract, etc). Resolves the extension's `visualizationMetadata` hook implicitly from `app_id` + `extensionId` and invokes it. Supplies the response as a structured payload that the portal uses to configure type/aggregation options, supported intervals, and the available data range.\n",
+        "tags": [
+          "ECP"
+        ],
+        "security": [
+          {
+            "PortalAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "query",
+            "name": "app_id",
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "description": "App ID providing the visualizationMetadata hook."
+          },
+          {
+            "in": "query",
+            "name": "extensionId",
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "description": "Extension ID providing the visualizationMetadata hook."
+          },
+          {
+            "in": "query",
+            "name": "context_entities",
+            "required": false,
+            "description": "Entities to include in the context for variable interpolation in the hook (typically the meter and any other entities that scope the visualization).",
+            "schema": {
+              "$ref": "#/components/schemas/ContextEntities"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Visualization metadata returned successfully.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/VisualizationMetadata"
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerError"
+          }
+        }
+      }
+    },
     "/v2/portal/costs": {
       "get": {
         "operationId": "getCosts",
@@ -1810,6 +1867,13 @@
                               "example": "CAA_ERROR"
                             }
                           }
+                        },
+                        "identity_providers": {
+                          "type": "array",
+                          "description": "SSO identity providers configured for the portal. Includes raw\n`oidc_config.client_secret` values so the admin UI can round-trip\nthem. Customers are encouraged to reference secrets via env\ntemplates (`{{ env.VAR }}`) rather than embed raw values.\n",
+                          "items": {
+                            "$ref": "#/components/schemas/ProviderConfig"
+                          }
                         }
                       }
                     }
@@ -1937,6 +2001,13 @@
                               "example": "CAA_ERROR"
                             }
                           }
+                        },
+                        "identity_providers": {
+                          "type": "array",
+                          "description": "SSO identity providers configured for the portal. Includes raw\n`oidc_config.client_secret` values so the admin UI can round-trip\nthem. Customers are encouraged to reference secrets via env\ntemplates (`{{ env.VAR }}`) rather than embed raw values.\n",
+                          "items": {
+                            "$ref": "#/components/schemas/ProviderConfig"
+                          }
                         }
                       }
                     }
@@ -3504,6 +3575,84 @@
                     "contactId": {
                       "$ref": "#/components/schemas/EntityId",
                       "description": "ID of the contact if exists"
+                    },
+                    "accountId": {
+                      "$ref": "#/components/schemas/EntityId",
+                      "description": "ID of the resolved account when the portal is configured for account-based registration"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/InvalidRequest"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerError"
+          }
+        }
+      }
+    },
+    "/v3/portal/public/account/exists": {
+      "post": {
+        "operationId": "checkAccountExists",
+        "summary": "checkAccountExists",
+        "description": "True if account with given identifiers exists.\nSupports two identification methods:\n1. Using portal_id\n2. Using domain\n",
+        "security": [],
+        "tags": [
+          "Public"
+        ],
+        "parameters": [
+          {
+            "in": "query",
+            "name": "portal_id",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/PortalId"
+            },
+            "description": "PortalId of the portal (required if domain is not provided)"
+          },
+          {
+            "in": "query",
+            "name": "domain",
+            "required": false,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Portal domain for identification (alternative to portal_id)"
+          }
+        ],
+        "requestBody": {
+          "description": "Request payload",
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AccountExistsRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Return result true|false if the account with given identifiers exists.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "exists": {
+                      "type": "boolean",
+                      "description": "Whether the account exists with the given identifier values",
+                      "example": true
+                    },
+                    "accountId": {
+                      "$ref": "#/components/schemas/EntityId",
+                      "description": "ID of the account if exists"
                     }
                   }
                 }
@@ -7470,6 +7619,90 @@
         }
       }
     },
+    "/v2/portal/public/sso/providers/{provider_slug}": {
+      "get": {
+        "operationId": "getSSOProvider",
+        "summary": "getSSOProvider",
+        "description": "Returns the public configuration of a single SSO identity provider with env var\nplaceholders (incl. secrets) already resolved against the organization's environment.\n\nUse this endpoint at SSO initiation time (i.e. when the end user clicks \"Sign in with X\")\nto obtain the resolved OIDC settings needed to construct the authorization URL.\nThe web `client_secret` is intentionally never returned — it is used server-side by\nthe SSO callback to exchange the authorization code for tokens.\n\nSupports three identification methods:\n1. `org_id` + `origin`\n2. `org_id` + `portal_id`\n3. `domain`\n",
+        "security": [],
+        "tags": [
+          "Public"
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "provider_slug",
+            "required": true,
+            "description": "Provider slug (organization-unique)",
+            "schema": {
+              "$ref": "#/components/schemas/ProviderSlug"
+            }
+          },
+          {
+            "in": "query",
+            "name": "org_id",
+            "required": false,
+            "description": "epilot organization id (required with `origin` or `portal_id`)",
+            "schema": {
+              "type": "string",
+              "example": 123
+            }
+          },
+          {
+            "in": "query",
+            "name": "origin",
+            "required": false,
+            "description": "Origin of the Portal",
+            "schema": {
+              "type": "string",
+              "enum": [
+                "END_CUSTOMER_PORTAL",
+                "INSTALLER_PORTAL"
+              ]
+            }
+          },
+          {
+            "in": "query",
+            "name": "portal_id",
+            "required": false,
+            "description": "ID of the Portal",
+            "schema": {
+              "$ref": "#/components/schemas/PortalId"
+            }
+          },
+          {
+            "in": "query",
+            "name": "domain",
+            "required": false,
+            "description": "Portal domain for identification (alternative to org_id + origin/portal_id)",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Resolved public SSO provider configuration. The handler strips `oidc_config.client_secret` from the response (kept server-side for the token exchange); the schema includes it for shape compatibility with the portal-config response.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProviderPublicConfig"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/InvalidRequest"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerError"
+          }
+        }
+      }
+    },
     "/v2/portal/public/sso/login": {
       "post": {
         "operationId": "ssoLogin",
@@ -9661,39 +9894,182 @@
           }
         }
       }
-    }
-  },
-  "components": {
-    "responses": {
-      "InvalidRequest": {
-        "description": "The request could not be validated",
-        "content": {
-          "application/json": {
-            "schema": {
-              "$ref": "#/components/schemas/ErrorResp"
-            }
-          }
-        }
-      },
-      "Unauthorized": {
-        "description": "Could not authenticate the user",
-        "content": {
-          "application/json": {
-            "schema": {
-              "$ref": "#/components/schemas/ErrorResp"
-            }
+    },
+    "/v3/portal/verify-dns": {
+      "post": {
+        "operationId": "verifyDns",
+        "summary": "verifyDns",
+        "description": "Manually triggers DNS verification for a portal's domain setup. Runs the same verification logic as the scheduled processAllPendingNetworks lambda.",
+        "tags": [
+          "ECP Admin"
+        ],
+        "security": [
+          {
+            "EpilotAuth": []
           }
-        }
-      },
-      "Forbidden": {
-        "description": "The user is not allowed to access this resource",
-        "content": {
-          "application/json": {
+        ],
+        "parameters": [
+          {
+            "in": "query",
+            "name": "portal_id",
+            "required": true,
             "schema": {
-              "$ref": "#/components/schemas/ErrorResp"
-            }
+              "$ref": "#/components/schemas/PortalId"
+            },
+            "description": "PortalId of the portal"
           }
-        }
+        ],
+        "responses": {
+          "200": {
+            "description": "DNS verification result",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "domain_status": {
+                      "type": "string",
+                      "description": "The status of the custom domain verification",
+                      "enum": [
+                        "PENDING",
+                        "SUCCEED"
+                      ]
+                    },
+                    "message": {
+                      "type": "string",
+                      "description": "A message describing the result"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerError"
+          }
+        }
+      }
+    },
+    "/v2/portal/proxy/execute": {
+      "post": {
+        "operationId": "portalProxyExecute",
+        "summary": "portalProxyExecute",
+        "description": "Execute an Integration Hub managed-call use case on behalf of a portal user.\nBridges PortalAuth to the Integration API by generating an internal token.\n",
+        "security": [
+          {
+            "PortalAuth": []
+          }
+        ],
+        "tags": [
+          "ECP"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "integration_id",
+                  "use_case_slug"
+                ],
+                "properties": {
+                  "integration_id": {
+                    "type": "string",
+                    "format": "uuid",
+                    "description": "Integration ID containing the managed-call use case"
+                  },
+                  "use_case_slug": {
+                    "type": "string",
+                    "description": "Use case slug (acts as the RPC method name)"
+                  },
+                  "payload": {
+                    "type": "object",
+                    "description": "Input data for the managed-call operation",
+                    "additionalProperties": true
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Managed-call execution result envelope.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "success"
+                  ],
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "data": {
+                      "type": "object",
+                      "additionalProperties": true,
+                      "description": "Managed-call response payload. Shape is defined by the use\ncase's JSONata response_mapping; if no mapping is\nconfigured the raw external API response is returned.\n"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/InvalidRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerError"
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "responses": {
+      "InvalidRequest": {
+        "description": "The request could not be validated",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/ErrorResp"
+            }
+          }
+        }
+      },
+      "Unauthorized": {
+        "description": "Could not authenticate the user",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/ErrorResp"
+            }
+          }
+        }
+      },
+      "Forbidden": {
+        "description": "The user is not allowed to access this resource",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/ErrorResp"
+            }
+          }
+        }
       },
       "ForbiddenByRule": {
         "description": "The user is not allowed to access this resource",
@@ -10346,6 +10722,13 @@
                 "description": "Default admin users for pending user notification to notify"
               }
             }
+          },
+          "identity_providers": {
+            "type": "array",
+            "description": "SSO identity providers for the portal. When sent on a portal save (PUT/POST),\nthe list is fully synced — incoming providers are upserted and any existing\nproviders not in the list are deleted. Omit the field to leave SSO\nconfiguration unchanged; send an empty array to remove all providers.\n\nEach provider is persisted verbatim — `oidc_config.client_secret` is stored\nas sent. Customers are encouraged to reference an org env secret via\n`{{ env.VAR }}` rather than embed raw values.\n",
+            "items": {
+              "$ref": "#/components/schemas/ProviderConfig"
+            }
           }
         }
       },
@@ -10373,6 +10756,14 @@
             "type": "boolean",
             "description": "Mark true if the domain is an Epilot domain"
           },
+          "epilot_domain": {
+            "type": "string",
+            "description": "The URL on which the portal is accessible",
+            "example": "example-portal-12345.ecp.epilot.cloud"
+          },
+          "domain_settings": {
+            "$ref": "#/components/schemas/DomainSettings"
+          },
           "design_id": {
             "$ref": "#/components/schemas/EntityId",
             "description": "ID of the design used to build the portal"
@@ -10399,6 +10790,24 @@
               "BLOCK_IF_PORTAL_USER_EXISTS"
             ]
           },
+          "self_registration_account_setting": {
+            "type": "string",
+            "description": "Controls behavior of self-registration when account is used as the registration entity",
+            "enum": [
+              "ALLOW_WITH_CONTACT_CREATION",
+              "DENY",
+              "ALWAYS_CREATE_CONTACT",
+              "DISALLOW_COMPLETELY"
+            ]
+          },
+          "self_registration_entity": {
+            "type": "string",
+            "description": "Entity type used as the primary identifier for self-registration",
+            "enum": [
+              "contact",
+              "account"
+            ]
+          },
           "user_account_self_management": {
             "type": "boolean",
             "description": "Enable or disable user account self management",
@@ -10823,6 +11232,13 @@
             "additionalProperties": {
               "$ref": "#/components/schemas/Page"
             }
+          },
+          "global_blocks": {
+            "type": "object",
+            "description": "Portal-level blocks shared across all pages (e.g. footer). Keyed by block id.",
+            "additionalProperties": {
+              "$ref": "#/components/schemas/Block"
+            }
           }
         }
       },
@@ -10929,6 +11345,24 @@
           }
         }
       },
+      "DomainSettings": {
+        "type": "object",
+        "description": "Domain settings for the portal",
+        "properties": {
+          "is_custom_domain_enabled": {
+            "type": "boolean",
+            "description": "Whether the custom domain is enabled"
+          },
+          "is_epilot_domain_enabled": {
+            "type": "boolean",
+            "description": "Whether the Epilot domain is enabled"
+          },
+          "is_redirection_enabled": {
+            "type": "boolean",
+            "description": "Whether the redirection is enabled"
+          }
+        }
+      },
       "WidgetBase": {
         "type": "object",
         "required": [
@@ -11285,6 +11719,38 @@
           }
         }
       },
+      "AccountExistsRequest": {
+        "type": "object",
+        "required": [
+          "registration_identifiers",
+          "org_id"
+        ],
+        "properties": {
+          "org_id": {
+            "type": "string",
+            "example": 728,
+            "description": "ID of the organization"
+          },
+          "registration_identifiers": {
+            "type": "object",
+            "description": "Identifier-value pairs per schema to identify an account during portal user registration",
+            "additionalProperties": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              }
+            },
+            "example": {
+              "account": {
+                "customer_number": "ACC-123456"
+              },
+              "contract": {
+                "contract_number": "123456"
+              }
+            }
+          }
+        }
+      },
       "UserRequest": {
         "type": "object",
         "properties": {
@@ -13727,10 +14193,11 @@
           },
           "intervals": {
             "type": "array",
+            "deprecated": true,
             "items": {
               "type": "string"
             },
-            "description": "The intervals associated with the hook."
+            "description": "Deprecated. Prefer fetching `intervals` from the `visualizationMetadata` endpoint\n(`GET /v2/portal/visualization/metadata`) so the supported intervals can vary per\nmeter/contract. Still emitted as a fallback for clients that have not migrated yet.\n"
           },
           "block_types": {
             "type": "array",
@@ -13741,6 +14208,109 @@
           }
         }
       },
+      "VisualizationMetadata": {
+        "type": "object",
+        "description": "Runtime metadata describing how a visualization should be rendered for a given portal context. Returned by `GET /v2/portal/visualization/metadata`.\n",
+        "properties": {
+          "type_options": {
+            "type": "array",
+            "description": "Types advertised for the current context (e.g. `ht`/`nt`, `feed-in`/`feed-out`). The `id` matches the `type` field returned by the data hook.\n",
+            "items": {
+              "$ref": "#/components/schemas/VisualizationTypeOption"
+            }
+          },
+          "intervals": {
+            "type": "array",
+            "description": "Intervals supported for the current context. If omitted, all intervals are assumed supported.",
+            "items": {
+              "type": "string",
+              "enum": [
+                "PT15M",
+                "PT1H",
+                "P1D",
+                "P1M"
+              ]
+            }
+          },
+          "data_range": {
+            "$ref": "#/components/schemas/VisualizationDataRange"
+          }
+        }
+      },
+      "VisualizationTypeOption": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "description": "Identifier of the type. Matches the `type` field on the data hook response."
+          },
+          "label": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Localized label for the type, keyed by ISO 3166-1 alpha-2 language code."
+          },
+          "aggregation_group": {
+            "type": "string",
+            "description": "Optional grouping key. Types in the same `aggregation_group` are visually combined; types in different groups (or without a group) render separately. How they combine depends on each type's `statistical_method`:\n  - bar chart (`sum`): same-group types are stacked into a single bar (e.g. ht/nt\n    summed into total consumption); different-group types render side-by-side.\n  - line chart (`min` / `average` / `max`): same-group types are rendered as an\n    area chart; different-group types render as separate lines.\n"
+          },
+          "statistical_method": {
+            "type": "string",
+            "enum": [
+              "sum",
+              "average",
+              "min",
+              "max"
+            ],
+            "description": "Statistical method already applied to this type's data. Determines the chart shape used to render the type's values: `sum` is shown as a bar chart; `min`, `average`, and `max` are shown as a line chart. Each type advertises its own method, so a single visualization can mix bar-shaped types with line-shaped types. Defaults to `sum` when omitted.\n"
+          },
+          "unit": {
+            "type": "string",
+            "description": "Unit shared by all values of this type (e.g. \"kWh\")."
+          },
+          "color": {
+            "type": "string",
+            "enum": [
+              "primary",
+              "slate",
+              "mauve",
+              "orange",
+              "red",
+              "tomato",
+              "amber",
+              "green",
+              "blue"
+            ],
+            "description": "Optional Spark color token used to render this type in the visualization. Maps onto the portal's Spark palette (`primary` is the org's primary brand color). When omitted the consumer falls back to its own per-type default.\n"
+          },
+          "precision": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 10,
+            "description": "Optional number of decimal places to show when rendering values of this type in the visualization (axis labels, tooltips, summaries). When omitted the consumer falls back to its own default precision.\n"
+          }
+        },
+        "required": [
+          "id"
+        ]
+      },
+      "VisualizationDataRange": {
+        "type": "object",
+        "description": "Earliest / latest timestamps for which data is available in the current context.",
+        "properties": {
+          "from": {
+            "type": "string",
+            "format": "date-time",
+            "description": "ISO 8601 timestamp of the earliest available data point."
+          },
+          "to": {
+            "type": "string",
+            "format": "date-time",
+            "description": "ISO 8601 timestamp of the latest available data point."
+          }
+        }
+      },
       "PublicContractIdentificationDetails": {
         "type": "object",
         "properties": {
@@ -13940,6 +14510,9 @@
                     },
                     {
                       "$ref": "#/components/schemas/ExtensionHookMeterReadingPlausibilityCheck"
+                    },
+                    {
+                      "$ref": "#/components/schemas/ExtensionHookVisualizationMetadata"
                     }
                   ]
                 }
@@ -14307,6 +14880,11 @@
                 "type": "string",
                 "description": "Lower allowed limit of the meter reading",
                 "example": "{{CallResponse.data.lower_limit}}"
+              },
+              "errorMessagePath": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
               }
             }
           },
@@ -14386,6 +14964,11 @@
               "dataPath": {
                 "type": "string",
                 "description": "Optional path to the data (array) in the response. If omitted, the data is assumed to be on the top level."
+              },
+              "errorMessagePath": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
               }
             }
           },
@@ -14464,6 +15047,11 @@
               "dataPath": {
                 "type": "string",
                 "description": "Optional path to the data (array) in the response. If omitted, the data is assumed to be on the top level."
+              },
+              "errorMessagePath": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
               }
             }
           },
@@ -14543,6 +15131,99 @@
               "url"
             ]
           },
+          "resolved": {
+            "type": "object",
+            "properties": {
+              "errorMessagePath": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
+              }
+            }
+          },
+          "use_static_ips": {
+            "type": "boolean",
+            "deprecated": true,
+            "description": "Deprecated. Prefer `secure_proxy` instead.\nIf true, requests are made from a set of static IP addresses and only allow connections to a set of allowed IP addresses. Get in touch with us to add your IP addresses.\n",
+            "default": false
+          },
+          "secure_proxy": {
+            "$ref": "#/components/schemas/SecureProxyConfig"
+          }
+        },
+        "required": [
+          "type",
+          "call"
+        ]
+      },
+      "ExtensionHookVisualizationMetadata": {
+        "description": "Hook that returns runtime metadata describing how a visualization should be rendered for a given portal context. Invoked by the portal before fetching data, with the same context the data hook receives.\n",
+        "type": "object",
+        "properties": {
+          "type": {
+            "type": "string",
+            "enum": [
+              "visualizationMetadata"
+            ]
+          },
+          "auth": {
+            "$ref": "#/components/schemas/ExtensionAuthBlock"
+          },
+          "call": {
+            "type": "object",
+            "properties": {
+              "method": {
+                "type": "string",
+                "description": "HTTP method to use for the call",
+                "default": "GET"
+              },
+              "url": {
+                "type": "string",
+                "description": "URL to call. Supports variable interpolation."
+              },
+              "params": {
+                "type": "object",
+                "description": "Parameters to append to the URL. Supports variable interpolation.",
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "default": {}
+              },
+              "headers": {
+                "type": "object",
+                "description": "Headers to use. Supports variable interpolation.",
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "default": {}
+              },
+              "body": {
+                "type": "object",
+                "description": "Request body to send. Supports variable interpolation. Content format is determined by Content-Type header.",
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "default": {}
+              }
+            },
+            "required": [
+              "url"
+            ]
+          },
+          "resolved": {
+            "type": "object",
+            "properties": {
+              "dataPath": {
+                "type": "string",
+                "description": "Optional path to the metadata object in the response. If omitted, the metadata is assumed to be on the top level."
+              },
+              "errorMessagePath": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
+              }
+            }
+          },
           "use_static_ips": {
             "type": "boolean",
             "deprecated": true,
@@ -14618,6 +15299,11 @@
               "dataPath": {
                 "type": "string",
                 "description": "Optional path to the data (array) in the response. If omitted, the data is assumed to be on the top level."
+              },
+              "errorMessagePath": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
               }
             }
           },
@@ -14939,6 +15625,7 @@
       },
       "ProviderConfig": {
         "type": "object",
+        "description": "SSO identity provider configuration.\n\nEnv var interpolation: only string fields under `oidc_config` and\n`mobile_oidc_config` (incl. their nested `metadata`) are passed through\nLiquid templating, so they may contain `{{ env.VAR }}` placeholders that\nget resolved at runtime against the organization's environment.\n\nThe following fields are used as literal values and MUST NOT contain\ntemplate syntax: `slug`, `display_name`, `provider_type`, all keys and\nvalues under `attribute_mappings` (used as JSONPath-like accessors into\ntoken claims), and all keys and values under `entity_matching`.\n",
         "properties": {
           "slug": {
             "$ref": "#/components/schemas/ProviderSlug"
@@ -15130,6 +15817,7 @@
       },
       "OIDCProviderConfig": {
         "type": "object",
+        "description": "OIDC provider configuration. Values are resolved at SSO invocation time\n(login / callback), so the fields below may reference org env vars via\nmustache-like templates, e.g. `{{ env.MY_PROVIDER_CLIENT_SECRET }}`.\n\nFields used to render the SSO buttons up-front (`ProviderConfig.slug`,\n`ProviderConfig.display_name`) are NOT interpolated and must be literal.\n",
         "properties": {
           "type": {
             "type": "string",
@@ -15141,20 +15829,22 @@
           },
           "oidc_issuer": {
             "type": "string",
-            "description": "Issuing Authority URL",
+            "description": "Issuing Authority URL. Supports env var interpolation, e.g. `{{ env.MY_ISSUER }}`.",
             "example": "https://login.microsoftonline.com/33d4f3e5-3df2-421e-b92e-a63cfa680a88/v2.0"
           },
           "redirect_uri": {
             "type": "string",
-            "description": "Redirect URI for the OIDC flow",
+            "description": "Redirect URI for the OIDC flow. Supports env var interpolation.",
             "example": "https://customer-portal.com/login"
           },
           "client_id": {
             "type": "string",
+            "description": "Supports env var interpolation, e.g. `{{ env.MY_CLIENT_ID }}`.",
             "example": "ab81daf8-8b1f-42d6-94ca-c51621054c75"
           },
           "client_secret": {
             "type": "string",
+            "description": "Client Secret. Supports env var interpolation (incl. secrets), e.g.\n`{{ env.MY_CLIENT_SECRET }}`. Prefer storing the actual secret as an org\nenv var and referencing it here.\n",
             "example": "7BIUnn~6shh.7fNtXb..3k1Mp3s6k6WK3B"
           },
           "has_client_secret": {
@@ -15187,15 +15877,16 @@
       },
       "MoblieOIDCConfig": {
         "type": "object",
+        "description": "Mobile OIDC configuration. Values are resolved at SSO invocation time, so the\nfields below may reference org env vars via mustache-like templates, e.g.\n`{{ env.MOBILE_CLIENT_SECRET }}`.\n",
         "properties": {
           "client_id": {
             "type": "string",
-            "description": "Client ID for the mobile app",
+            "description": "Client ID for the mobile app. Supports env var interpolation.",
             "example": 123456
           },
           "client_secret": {
             "type": "string",
-            "description": "Client Secret for the mobile app",
+            "description": "Client Secret for the mobile app. Supports env var interpolation (incl. secrets),\ne.g. `{{ env.MOBILE_CLIENT_SECRET }}`.\n",
             "example": 123456
           }
         }
@@ -15203,6 +15894,18 @@
       "OIDCProviderMetadata": {
         "type": "object",
         "properties": {
+          "response_modes_supported": {
+            "type": "array",
+            "description": "Response modes the provider accepts (e.g. `form_post` for Apple)",
+            "items": {
+              "type": "string",
+              "enum": [
+                "form_post",
+                "fragment",
+                "query"
+              ]
+            }
+          },
           "authorization_endpoint": {
             "type": "string",
             "description": "URL of the authorization endpoint",
@@ -15240,12 +15943,12 @@
           },
           "test_auth_username": {
             "type": "string",
-            "description": "The username for the test auth, only used for testing on auth code flow",
+            "description": "The username for the test auth, only used for testing on auth code flow.\nSupports env var interpolation, e.g. `{{ env.MY_TEST_AUTH_USERNAME }}`.\n",
             "example": "test@epilot.io"
           },
           "test_auth_password": {
             "type": "string",
-            "description": "The password for the test auth, only used for testing on auth code flow"
+            "description": "The password for the test auth, only used for testing on auth code flow.\nSupports env var interpolation (incl. secrets), e.g. `{{ env.MY_TEST_AUTH_PASSWORD }}`.\n"
           }
         }
       },
@@ -15682,6 +16385,14 @@
             "type": "boolean",
             "description": "Mark true if the domain is an Epilot domain"
           },
+          "epilot_domain": {
+            "type": "string",
+            "description": "The Epilot domain on which the portal is accessible",
+            "example": "example-portal-1.ecp.epilot.io"
+          },
+          "domain_settings": {
+            "$ref": "#/components/schemas/DomainSettings"
+          },
           "design_id": {
             "$ref": "#/components/schemas/EntityId",
             "description": "ID of the design used to build the portal"
@@ -15708,6 +16419,24 @@
               "BLOCK_IF_PORTAL_USER_EXISTS"
             ]
           },
+          "self_registration_account_setting": {
+            "type": "string",
+            "description": "Controls behavior of self-registration when account is used as the registration entity",
+            "enum": [
+              "ALLOW_WITH_CONTACT_CREATION",
+              "DENY",
+              "ALWAYS_CREATE_CONTACT",
+              "DISALLOW_COMPLETELY"
+            ]
+          },
+          "self_registration_entity": {
+            "type": "string",
+            "description": "Entity type used as the primary identifier for self-registration",
+            "enum": [
+              "contact",
+              "account"
+            ]
+          },
           "user_account_self_management": {
             "type": "boolean",
             "description": "Enable or disable user account self management",
@@ -16126,6 +16855,13 @@
           },
           "origin": {
             "$ref": "#/components/schemas/Origin"
+          },
+          "global_blocks": {
+            "type": "object",
+            "description": "Portal-level blocks shared across all pages (e.g. footer). Keyed by block id.",
+            "additionalProperties": {
+              "$ref": "#/components/schemas/Block"
+            }
           }
         }
       },
@@ -16238,6 +16974,11 @@
           "is_canary": {
             "type": "boolean",
             "description": "Whether the org is in canary mode"
+          },
+          "redirect_to": {
+            "type": "string",
+            "description": "The URL to redirect to",
+            "example": "https://example.com"
           }
         }
       },