@epilot/cli 0.1.60 → 0.1.62

package/definitions/customer-portal.json

@@ -2190,6 +2190,170 @@
         }
       }
     },
+    "/v3/portal/email-templates:migrate-references": {
+      "post": {
+        "operationId": "migrateEmailTemplateReferences",
+        "summary": "migrateEmailTemplateReferences",
+        "description": "Walk every email-template config row in the caller's org and re-point any\nfield on `email_templates` that currently references `source_template_id`\nat `destination_template_id`. Intended to be called from the email-template\nmigration flow when a duplicated template is refined.\n\nOnly v3-shaped rows are migrated (those carrying `portal_sk_v3`). Returns\nthe portal IDs that were rewritten and any whose update failed.\n",
+        "tags": [
+          "ECP Admin"
+        ],
+        "security": [
+          {
+            "EpilotAuth": []
+          }
+        ],
+        "requestBody": {
+          "description": "Source and destination template ids",
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "source_template_id",
+                  "destination_template_id"
+                ],
+                "properties": {
+                  "source_template_id": {
+                    "type": "string",
+                    "description": "Template id currently referenced on portal rows"
+                  },
+                  "destination_template_id": {
+                    "type": "string",
+                    "description": "Template id to write in place of the source"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Migration completed (may have partial failures in failed_portal_ids).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "migrated_portal_count",
+                    "migrated_portal_ids",
+                    "failed_portal_ids"
+                  ],
+                  "properties": {
+                    "migrated_portal_count": {
+                      "type": "integer",
+                      "example": 2
+                    },
+                    "migrated_portal_ids": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    },
+                    "failed_portal_ids": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerError"
+          }
+        }
+      }
+    },
+    "/v3/portal/email-templates:list-references": {
+      "post": {
+        "operationId": "listEmailTemplateReferences",
+        "summary": "listEmailTemplateReferences",
+        "description": "Read-only sibling of migrateEmailTemplateReferences. Lists every portal in\nthe caller's org whose `email_templates` config references `template_id`,\nwithout rewriting anything. Used by the email-template MFE to show which\nportals a template affects (in template settings and as a pre-migrate\npreview). Uses the same discovery as the migrate path.\n",
+        "tags": [
+          "ECP Admin"
+        ],
+        "security": [
+          {
+            "EpilotAuth": []
+          }
+        ],
+        "requestBody": {
+          "description": "Template id to look up references for",
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "template_id"
+                ],
+                "properties": {
+                  "template_id": {
+                    "type": "string",
+                    "description": "Email template id to find portal references for"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Portals referencing the template.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "portals"
+                  ],
+                  "properties": {
+                    "portals": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "id"
+                        ],
+                        "properties": {
+                          "id": {
+                            "type": "string"
+                          },
+                          "name": {
+                            "type": "string",
+                            "nullable": true,
+                            "description": "Portal display name (or domain); falls back to id when unavailable"
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerError"
+          }
+        }
+      }
+    },
     "/v3/portal/email-templates/{portal_id}": {
       "post": {
         "operationId": "upsertEmailTemplatesByPortalId",
@@ -3831,9 +3995,8 @@
                   "properties": {
                     "message": {
                       "type": "string",
-                      "enum": [
-                        "User Succesfully Deleted"
-                      ]
+                      "description": "`User Succesfully Deleted` when the user was deleted, or `Account deletion requested`\nwhen an asynchronous deleteAccount portal extension hook handed the deletion over to a third party.\n",
+                      "example": "User Succesfully Deleted"
                     },
                     "data": {
                       "$ref": "#/components/schemas/EntityId"
@@ -3873,8 +4036,7 @@
               "schema": {
                 "type": "object",
                 "required": [
-                  "email",
-                  "password"
+                  "email"
                 ],
                 "properties": {
                   "email": {
@@ -3884,7 +4046,7 @@
                   },
                   "password": {
                     "type": "string",
-                    "description": "Password of the portal user for confirmation"
+                    "description": "Password of the portal user for confirmation.\nRequired unless a `changeEmail` portal extension hook with `require_password_confirmation` disabled is configured for the portal.\n"
                   }
                 }
               }
@@ -3901,9 +4063,66 @@
                   "properties": {
                     "message": {
                       "type": "string",
-                      "enum": [
-                        "You will receive a confirmation mail soon on your updated email address."
-                      ]
+                      "description": "`You will receive a confirmation mail soon on your updated email address.` for the built-in flow,\nor `Your email change request has been received.` when a changeEmail portal extension hook handed\nthe change over to a third party.\n",
+                      "example": "You will receive a confirmation mail soon on your updated email address."
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/InvalidRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerError"
+          }
+        }
+      }
+    },
+    "/v2/portal/user/change/password": {
+      "put": {
+        "operationId": "changePortalUserPassword",
+        "summary": "changePortalUserPassword",
+        "description": "Hand over a password change to the third-party system configured via the `changePassword` portal extension hook.\nOnly available when such a hook is configured for the portal; the built-in password change flow does not use this endpoint.\n",
+        "tags": [
+          "ECP"
+        ],
+        "security": [
+          {
+            "PortalAuth": []
+          }
+        ],
+        "requestBody": {
+          "description": "Request payload",
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "new_password": {
+                    "type": "string",
+                    "description": "New password chosen by the portal user.\nRequired when the configured `changePassword` hook has `require_new_password` enabled, ignored otherwise.\n"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The password change request was handed over to the third-party system.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "message": {
+                      "type": "string"
                     }
                   }
                 }
@@ -3916,6 +4135,9 @@
           "401": {
             "$ref": "#/components/responses/Unauthorized"
           },
+          "404": {
+            "description": "No changePassword portal extension hook is configured for this portal."
+          },
           "500": {
             "$ref": "#/components/responses/InternalServerError"
           }
@@ -7034,91 +7256,241 @@
         }
       }
     },
-    "/v2/portal/can-trigger-portal-flow": {
+    "/v2/portal/entity/{slug}": {
       "post": {
-        "operationId": "canTriggerPortalFlow",
-        "summary": "canTriggerPortalFlow",
-        "description": "Returns whether the user can trigger a portal flow",
+        "operationId": "createPortalUserEntity",
+        "summary": "createPortalUserEntity",
+        "description": "**EXPERIMENTAL — do not rely on this endpoint.** It is unstable, currently limited to the `asset` schema, and may change or be removed without notice; third parties must not build on it yet.\nCreate a single entity on behalf of a portal user. The schema slug is passed in the path and must be one of the supported (experimental) schemas; field-level permissions are enforced by the caller's role grants. The request body is the entity to create (its attributes); the created entity is automatically related to the caller's contact.",
+        "deprecated": true,
         "tags": [
-          "ECP Admin"
+          "ECP"
         ],
         "security": [
           {
-            "EpilotAuth": []
+            "PortalAuth": []
           }
         ],
         "parameters": [
           {
-            "in": "query",
-            "name": "origin",
-            "required": false,
-            "deprecated": true,
-            "schema": {
-              "$ref": "#/components/schemas/Origin"
-            },
-            "description": "Origin of the portal"
-          },
-          {
-            "in": "query",
-            "name": "portal_id",
+            "in": "path",
+            "name": "slug",
+            "description": "Entity schema slug to create. Limited to the supported (experimental) schemas, currently `asset`.",
             "required": true,
             "schema": {
               "type": "string",
-              "description": "Portal ID",
-              "example": "123"
+              "enum": [
+                "asset"
+              ],
+              "example": "asset"
             }
           }
         ],
         "requestBody": {
-          "description": "Request of trigger portal flow",
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/TriggerPortalFlow"
+                "$ref": "#/components/schemas/Entity"
+              },
+              "example": {
+                "title": "PV Inverter",
+                "manufacturer": "SMA",
+                "external_id": "device-123"
               }
             }
           }
         },
         "responses": {
-          "200": {
-            "description": "Can Trigger Portal Flow",
+          "201": {
+            "description": "The entity has been created successfully for the portal user.",
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object",
-                  "properties": {
-                    "can_trigger": {
-                      "type": "boolean",
-                      "description": "Whether the flow can be triggered",
-                      "example": true
-                    }
-                  }
+                  "$ref": "#/components/schemas/EntityResponse"
                 }
               }
             }
+          },
+          "400": {
+            "$ref": "#/components/responses/InvalidRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerError"
           }
         }
       }
     },
-    "/v2/portal/automation-context": {
-      "get": {
-        "operationId": "getAutomationContext",
-        "summary": "getAutomationContext",
-        "description": "Retrieves the automation context.",
+    "/v2/portal/entity/{slug}/{id}": {
+      "patch": {
+        "operationId": "patchPortalUserEntity",
+        "summary": "patchPortalUserEntity",
+        "description": "**EXPERIMENTAL — do not rely on this endpoint.** It is unstable, currently limited to the `asset` schema, and may change or be removed without notice; third parties must not build on it yet.\nPartially update a single entity on behalf of a portal user. The schema slug and entity id are passed in the path; the schema must be one of the supported (experimental) schemas. Field-level permissions are enforced by the caller's role grants (use null to clear a field, e.g. external_id). The target entity must already be owned by the caller's contact.",
+        "deprecated": true,
         "tags": [
           "ECP"
         ],
         "security": [
           {
-            "EpilotAuth": []
+            "PortalAuth": []
           }
         ],
         "parameters": [
           {
-            "in": "query",
-            "name": "activity_id",
-            "required": true,
+            "in": "path",
+            "name": "slug",
+            "description": "Entity schema slug to update. Limited to the supported (experimental) schemas, currently `asset`.",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "enum": [
+                "asset"
+              ],
+              "example": "asset"
+            }
+          },
+          {
+            "in": "path",
+            "name": "id",
+            "description": "ID of the entity to update. Must already be owned by the caller's contact.",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/EntityId"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Entity"
+              },
+              "example": {
+                "external_id": null
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The entity has been updated successfully for the portal user.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/EntityResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/InvalidRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerError"
+          }
+        }
+      }
+    },
+    "/v2/portal/can-trigger-portal-flow": {
+      "post": {
+        "operationId": "canTriggerPortalFlow",
+        "summary": "canTriggerPortalFlow",
+        "description": "Returns whether the user can trigger a portal flow",
+        "tags": [
+          "ECP Admin"
+        ],
+        "security": [
+          {
+            "EpilotAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "query",
+            "name": "origin",
+            "required": false,
+            "deprecated": true,
+            "schema": {
+              "$ref": "#/components/schemas/Origin"
+            },
+            "description": "Origin of the portal"
+          },
+          {
+            "in": "query",
+            "name": "portal_id",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "description": "Portal ID",
+              "example": "123"
+            }
+          }
+        ],
+        "requestBody": {
+          "description": "Request of trigger portal flow",
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TriggerPortalFlow"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Can Trigger Portal Flow",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "can_trigger": {
+                      "type": "boolean",
+                      "description": "Whether the flow can be triggered",
+                      "example": true
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v2/portal/automation-context": {
+      "get": {
+        "operationId": "getAutomationContext",
+        "summary": "getAutomationContext",
+        "description": "Retrieves the automation context.",
+        "tags": [
+          "ECP"
+        ],
+        "security": [
+          {
+            "EpilotAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "in": "query",
+            "name": "activity_id",
+            "required": true,
             "schema": {
               "$ref": "#/components/schemas/ActivityId"
             },
@@ -9319,6 +9691,20 @@
               "example": "5da0a718-c822-403d-9f5d-20d4584e0528"
             },
             "description": "Portal ID (readonly UUID generated on portal creation)"
+          },
+          {
+            "in": "query",
+            "name": "page_upsert_mode",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "enum": [
+                "id",
+                "slug"
+              ],
+              "default": "id"
+            },
+            "description": "Determines how pages are matched for upsert operations:\n- `id` (default): Match pages by their ID. Use this when page IDs are stable and known upfront.\n- `slug`: Match pages by their slug. When a request page has the same slug as an existing page, the existing page ID is adopted. Use this when page ids are unknown or when source page IDs differ from destination page IDs.\n"
           }
         ],
         "requestBody": {
@@ -10127,72 +10513,193 @@
           }
         }
       }
-    }
-  },
-  "components": {
-    "responses": {
-      "InvalidRequest": {
-        "description": "The request could not be validated",
-        "content": {
-          "application/json": {
-            "schema": {
-              "$ref": "#/components/schemas/ErrorResp"
-            }
+    },
+    "/v1/portal/mobile-config": {
+      "get": {
+        "operationId": "getMobileConfig",
+        "summary": "getMobileConfig",
+        "description": "Returns the portal's mobile app configuration. By default the response is build-ready (resolved): base info (display_name from the portal name, app_host from the domain, environment) and branding (logo from the portal images, colors from the design palette) are filled in. Pass raw=true to get only the stored mobile_config without resolution.",
+        "tags": [
+          "ECP Admin"
+        ],
+        "security": [
+          {
+            "EpilotAuth": []
           }
-        }
-      },
-      "Unauthorized": {
-        "description": "Could not authenticate the user",
-        "content": {
-          "application/json": {
+        ],
+        "parameters": [
+          {
+            "in": "query",
+            "name": "portal_id",
+            "required": true,
             "schema": {
-              "$ref": "#/components/schemas/ErrorResp"
-            }
-          }
-        }
-      },
-      "Forbidden": {
-        "description": "The user is not allowed to access this resource",
-        "content": {
-          "application/json": {
+              "type": "string"
+            },
+            "description": "Portal ID"
+          },
+          {
+            "in": "query",
+            "name": "raw",
+            "required": false,
             "schema": {
-              "$ref": "#/components/schemas/ErrorResp"
-            }
+              "type": "boolean"
+            },
+            "description": "Return only the stored mobile_config without resolving base info/branding."
           }
-        }
-      },
-      "ForbiddenByRule": {
-        "description": "The user is not allowed to access this resource",
-        "content": {
-          "application/json": {
-            "schema": {
-              "oneOf": [
-                {
-                  "$ref": "#/components/schemas/ErrorResp"
-                },
-                {
-                  "$ref": "#/components/schemas/FailedRuleErrorResp"
+        ],
+        "responses": {
+          "200": {
+            "description": "Mobile config retrieved successfully.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MobileConfig"
                 }
-              ]
+              }
             }
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerError"
           }
         }
       },
-      "Conflict": {
-        "description": "The request conflicts with the current state of the target resource.",
-        "content": {
-          "application/json": {
-            "schema": {
-              "$ref": "#/components/schemas/ErrorResp"
-            }
+      "put": {
+        "operationId": "putMobileConfig",
+        "summary": "putMobileConfig",
+        "description": "Merges the provided fields into the portal's mobile app configuration\n(deep merge). Only mobile_config is modified; all other portal settings\nare left untouched.\n",
+        "tags": [
+          "ECP Admin"
+        ],
+        "security": [
+          {
+            "EpilotAuth": []
           }
-        }
-      },
-      "ContractAssignmentConflict": {
-        "description": "Contract was found but is not assignable in its current state.",
-        "content": {
-          "application/json": {
-            "schema": {
+        ],
+        "parameters": [
+          {
+            "in": "query",
+            "name": "portal_id",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Portal ID"
+          }
+        ],
+        "requestBody": {
+          "description": "Editable mobile fields to merge into the existing mobile_config. Only mobile-relevant settings + app branding are applied; other fields are ignored.",
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/MobileConfigUpdate"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Mobile config updated successfully.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MobileConfig"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/InvalidRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          },
+          "500": {
+            "$ref": "#/components/responses/InternalServerError"
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "responses": {
+      "InvalidRequest": {
+        "description": "The request could not be validated",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/ErrorResp"
+            }
+          }
+        }
+      },
+      "Unauthorized": {
+        "description": "Could not authenticate the user",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/ErrorResp"
+            }
+          }
+        }
+      },
+      "Forbidden": {
+        "description": "The user is not allowed to access this resource",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/ErrorResp"
+            }
+          }
+        }
+      },
+      "ForbiddenByRule": {
+        "description": "The user is not allowed to access this resource",
+        "content": {
+          "application/json": {
+            "schema": {
+              "oneOf": [
+                {
+                  "$ref": "#/components/schemas/ErrorResp"
+                },
+                {
+                  "$ref": "#/components/schemas/FailedRuleErrorResp"
+                }
+              ]
+            }
+          }
+        }
+      },
+      "Conflict": {
+        "description": "The request conflicts with the current state of the target resource.",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/ErrorResp"
+            }
+          }
+        }
+      },
+      "ContractAssignmentConflict": {
+        "description": "Contract was found but is not assignable in its current state.",
+        "content": {
+          "application/json": {
+            "schema": {
               "allOf": [
                 {
                   "$ref": "#/components/schemas/ErrorResp"
@@ -10360,107 +10867,383 @@
       }
     },
     "schemas": {
-      "ContextEntity": {
+      "MobileBuildStatus": {
         "type": "object",
-        "description": "An entity reference for context-aware operations",
+        "description": "Latest build/upload status for a platform (system-written).",
+        "additionalProperties": true,
         "properties": {
-          "entity_schema": {
+          "version": {
+            "type": "string"
+          },
+          "build_number": {
+            "type": "integer"
+          },
+          "track": {
             "type": "string",
-            "description": "Entity schema",
-            "example": "contract"
+            "description": "e.g. testflight | internal | beta"
           },
-          "entity_id": {
+          "status": {
             "type": "string",
-            "format": "uuid",
-            "description": "Entity id",
-            "example": "5da0a718-c822-403d-9f5d-20d4584e0528"
-          }
-        },
-        "required": [
-          "entity_id",
-          "entity_schema"
-        ]
-      },
-      "ContextEntities": {
-        "type": "array",
-        "description": "Additional entities to include in the context for variable interpolation. Portal User and Contact entities are automatically part of the context.",
-        "items": {
-          "$ref": "#/components/schemas/ContextEntity"
-        },
-        "example": [
-          {
-            "entity_id": "5da0a718-c822-403d-9f5d-20d4584e0528",
-            "entity_schema": "contract"
-          }
-        ]
-      },
-      "ErrorResp": {
-        "type": "object",
-        "properties": {
-          "message": {
+            "enum": [
+              "building",
+              "uploaded",
+              "failed"
+            ]
+          },
+          "updated_at": {
             "type": "string",
-            "description": "Error message"
+            "format": "date-time"
+          },
+          "error": {
+            "type": "string"
           }
         }
       },
-      "FailedRuleErrorResp": {
+      "MobileBranding": {
         "type": "object",
+        "additionalProperties": true,
         "properties": {
-          "message": {
-            "type": "string",
-            "description": "Error message"
+          "app_icon": {
+            "type": "string"
           },
-          "failed_rule": {
-            "type": "object",
-            "description": "Failed validation rule"
+          "splash": {
+            "type": "string"
+          },
+          "splash_dark": {
+            "type": "string"
+          },
+          "icon_background_color": {
+            "type": "string"
+          },
+          "splash_background_color": {
+            "type": "string"
+          },
+          "splash_background_color_dark": {
+            "type": "string"
           }
         }
       },
-      "EmailTemplates": {
+      "MobileConfig": {
         "type": "object",
-        "description": "Email templates used for authentication and internal processes",
+        "description": "Mobile app configuration for the portal. Stored inside the portal's config object. Identifiers/branding are non-secret; signing credentials live in a secure store, never here.",
+        "additionalProperties": true,
         "properties": {
-          "confirmAccount": {
-            "$ref": "#/components/schemas/EntityId",
-            "nullable": true,
-            "description": "ID of the confirmation email template upon registration"
+          "portal_id": {
+            "type": "string",
+            "description": "Portal id (response-only; ignored on write)."
           },
-          "advancedAuth": {
-            "$ref": "#/components/schemas/EntityId",
-            "nullable": true,
-            "description": "ID of the advanced Auth with login link and login code"
+          "enabled": {
+            "type": "boolean"
           },
-          "advancedMFA": {
-            "$ref": "#/components/schemas/EntityId",
-            "nullable": true,
-            "deprecated": true,
-            "description": "ID of the advanced MFA with login link and login code"
+          "display_name": {
+            "type": "string",
+            "description": "App display name compiled into the binary."
           },
-          "journeySignUp": {
-            "$ref": "#/components/schemas/EntityId",
-            "nullable": true,
-            "description": "ID of the email template for signing up from Journeys"
+          "app_host": {
+            "type": "string",
+            "description": "Host the mobile shell loads (defaults to the portal domain)."
           },
-          "journeySignInOneTimePassword": {
-            "$ref": "#/components/schemas/EntityId",
-            "nullable": true,
-            "description": "ID of the email template for OTP to sign in from Journeys"
+          "environment": {
+            "type": "string",
+            "enum": [
+              "prod",
+              "staging",
+              "dev"
+            ]
           },
-          "journeyLoginOTP": {
-            "$ref": "#/components/schemas/EntityId",
-            "nullable": true,
-            "description": "ID of the email template for OTP to sign in from Journeys",
-            "deprecated": true
+          "branding": {
+            "$ref": "#/components/schemas/MobileBranding"
           },
-          "forgotPassword": {
-            "$ref": "#/components/schemas/EntityId",
-            "nullable": true,
-            "description": "ID of the email template for forgot password"
+          "ios": {
+            "type": "object",
+            "additionalProperties": true,
+            "properties": {
+              "bundle_id": {
+                "type": "string",
+                "description": "iOS bundle id (matches the App Store Connect app)."
+              },
+              "team_id": {
+                "type": "string",
+                "description": "Apple Developer Team ID."
+              },
+              "credentials_status": {
+                "type": "string",
+                "enum": [
+                  "not_configured",
+                  "configured"
+                ]
+              },
+              "app_store_id": {
+                "type": "string",
+                "description": "Numeric App Store id (system-written after first upload)."
+              },
+              "store_url": {
+                "type": "string",
+                "description": "System-written App Store URL."
+              },
+              "last_build": {
+                "$ref": "#/components/schemas/MobileBuildStatus"
+              }
+            }
           },
-          "invitation": {
-            "$ref": "#/components/schemas/EntityId",
-            "nullable": true,
-            "description": "ID of the email template for invitation when the user is just invited to register on the portal."
+          "android": {
+            "type": "object",
+            "additionalProperties": true,
+            "properties": {
+              "package_name": {
+                "type": "string",
+                "description": "Android package name (matches the Play Console app)."
+              },
+              "credentials_status": {
+                "type": "string",
+                "enum": [
+                  "not_configured",
+                  "configured"
+                ]
+              },
+              "upload_key_status": {
+                "type": "string",
+                "description": "Play App Signing upload-key state.",
+                "enum": [
+                  "not_configured",
+                  "generated",
+                  "enrolled"
+                ]
+              },
+              "store_url": {
+                "type": "string",
+                "description": "System-written Play Store URL."
+              },
+              "last_build": {
+                "$ref": "#/components/schemas/MobileBuildStatus"
+              }
+            }
+          },
+          "ota": {
+            "$ref": "#/components/schemas/MobileOtaConfig"
+          }
+        }
+      },
+      "MobileConfigUpdate": {
+        "type": "object",
+        "description": "Editable mobile fields for PUT. Only mobile-relevant settings + app branding can be changed. Portal-derived values (display_name, app_host), the portal logo, and system-written fields (credentials_status, app_store_id, last_build, …) are ignored if sent.",
+        "additionalProperties": true,
+        "properties": {
+          "enabled": {
+            "type": "boolean"
+          },
+          "ios": {
+            "type": "object",
+            "additionalProperties": true,
+            "properties": {
+              "bundle_id": {
+                "type": "string"
+              },
+              "team_id": {
+                "type": "string"
+              },
+              "store_url": {
+                "type": "string"
+              },
+              "app_store_id": {
+                "type": "string"
+              }
+            }
+          },
+          "android": {
+            "type": "object",
+            "additionalProperties": true,
+            "properties": {
+              "package_name": {
+                "type": "string"
+              },
+              "store_url": {
+                "type": "string"
+              }
+            }
+          },
+          "branding": {
+            "$ref": "#/components/schemas/MobileBranding"
+          },
+          "ota": {
+            "$ref": "#/components/schemas/MobileOtaConfig"
+          }
+        }
+      },
+      "MobileOtaConfig": {
+        "type": "object",
+        "description": "OTA (over-the-air) update settings for the portal's mobile app. Drives the OTA build pipeline and the per-portal manifest. channel / update_strategy / min_native_version are epilot-internal controls.",
+        "additionalProperties": true,
+        "properties": {
+          "enabled": {
+            "type": "boolean",
+            "description": "Whether OTA updates are enabled for this portal."
+          },
+          "channel": {
+            "type": "string",
+            "enum": [
+              "canary",
+              "stable"
+            ],
+            "description": "Release channel this portal follows."
+          },
+          "auto_update": {
+            "type": "boolean",
+            "description": "Whether the app auto-updates or prompts the user."
+          },
+          "update_strategy": {
+            "type": "string",
+            "enum": [
+              "next-launch",
+              "immediate"
+            ],
+            "description": "When to apply a downloaded bundle."
+          },
+          "min_native_version": {
+            "type": "string",
+            "description": "Minimum native app version required to load OTA bundles."
+          }
+        }
+      },
+      "OtaPortal": {
+        "type": "object",
+        "description": "A portal that has mobile OTA updates enabled.",
+        "required": [
+          "domain",
+          "channel",
+          "autoUpdate",
+          "updateStrategy"
+        ],
+        "properties": {
+          "domain": {
+            "type": "string",
+            "description": "Portal hostname — the OTA manifest filename ({domain}.json).",
+            "example": "kundenportal.twl.de"
+          },
+          "channel": {
+            "type": "string",
+            "enum": [
+              "canary",
+              "stable"
+            ]
+          },
+          "autoUpdate": {
+            "type": "boolean"
+          },
+          "updateStrategy": {
+            "type": "string",
+            "enum": [
+              "next-launch",
+              "immediate"
+            ]
+          },
+          "minNativeVersion": {
+            "type": "string",
+            "example": "1.0.0"
+          }
+        }
+      },
+      "ContextEntity": {
+        "type": "object",
+        "description": "An entity reference for context-aware operations",
+        "properties": {
+          "entity_schema": {
+            "type": "string",
+            "description": "Entity schema",
+            "example": "contract"
+          },
+          "entity_id": {
+            "type": "string",
+            "format": "uuid",
+            "description": "Entity id",
+            "example": "5da0a718-c822-403d-9f5d-20d4584e0528"
+          }
+        },
+        "required": [
+          "entity_id",
+          "entity_schema"
+        ]
+      },
+      "ContextEntities": {
+        "type": "array",
+        "description": "Additional entities to include in the context for variable interpolation. Portal User and Contact entities are automatically part of the context.",
+        "items": {
+          "$ref": "#/components/schemas/ContextEntity"
+        },
+        "example": [
+          {
+            "entity_id": "5da0a718-c822-403d-9f5d-20d4584e0528",
+            "entity_schema": "contract"
+          }
+        ]
+      },
+      "ErrorResp": {
+        "type": "object",
+        "properties": {
+          "message": {
+            "type": "string",
+            "description": "Error message"
+          }
+        }
+      },
+      "FailedRuleErrorResp": {
+        "type": "object",
+        "properties": {
+          "message": {
+            "type": "string",
+            "description": "Error message"
+          },
+          "failed_rule": {
+            "type": "object",
+            "description": "Failed validation rule"
+          }
+        }
+      },
+      "EmailTemplates": {
+        "type": "object",
+        "description": "Email templates used for authentication and internal processes",
+        "properties": {
+          "confirmAccount": {
+            "$ref": "#/components/schemas/EntityId",
+            "nullable": true,
+            "description": "ID of the confirmation email template upon registration"
+          },
+          "advancedAuth": {
+            "$ref": "#/components/schemas/EntityId",
+            "nullable": true,
+            "description": "ID of the advanced Auth with login link and login code"
+          },
+          "advancedMFA": {
+            "$ref": "#/components/schemas/EntityId",
+            "nullable": true,
+            "deprecated": true,
+            "description": "ID of the advanced MFA with login link and login code"
+          },
+          "journeySignUp": {
+            "$ref": "#/components/schemas/EntityId",
+            "nullable": true,
+            "description": "ID of the email template for signing up from Journeys"
+          },
+          "journeySignInOneTimePassword": {
+            "$ref": "#/components/schemas/EntityId",
+            "nullable": true,
+            "description": "ID of the email template for OTP to sign in from Journeys"
+          },
+          "journeyLoginOTP": {
+            "$ref": "#/components/schemas/EntityId",
+            "nullable": true,
+            "description": "ID of the email template for OTP to sign in from Journeys",
+            "deprecated": true
+          },
+          "forgotPassword": {
+            "$ref": "#/components/schemas/EntityId",
+            "nullable": true,
+            "description": "ID of the email template for forgot password"
+          },
+          "invitation": {
+            "$ref": "#/components/schemas/EntityId",
+            "nullable": true,
+            "description": "ID of the email template for invitation when the user is just invited to register on the portal."
           },
           "partnerInvitation": {
             "$ref": "#/components/schemas/EntityId",
@@ -10969,6 +11752,10 @@
               "auto_redirect_to_sso": {
                 "type": "boolean",
                 "description": "Decide whether to automatically redirect to the provider page during login, which would completely bypass showing the portal authentication page."
+              },
+              "prevent_user_enumeration": {
+                "type": "boolean",
+                "description": "Opt-in. When true, suppresses responses that reveal whether a user exists for public, pre-authentication actions (the login entry-point check and self-registration), at the expense of some UX. Already-authenticated actions are unaffected. Default false.\n"
               }
             }
           },
@@ -14282,49 +15069,154 @@
                 "$ref": "#/components/schemas/PublicMeterReadingPlausibilityCheckDetails"
               }
             }
+          },
+          "changeEmail": {
+            "type": "object",
+            "properties": {
+              "app": {
+                "$ref": "#/components/schemas/PublicAppDetails"
+              },
+              "extension": {
+                "$ref": "#/components/schemas/PublicExtensionDetails"
+              },
+              "hook": {
+                "$ref": "#/components/schemas/PublicChangeEmailDetails"
+              }
+            }
+          },
+          "changePassword": {
+            "type": "object",
+            "properties": {
+              "app": {
+                "$ref": "#/components/schemas/PublicAppDetails"
+              },
+              "extension": {
+                "$ref": "#/components/schemas/PublicExtensionDetails"
+              },
+              "hook": {
+                "$ref": "#/components/schemas/PublicChangePasswordDetails"
+              }
+            }
+          },
+          "deleteAccount": {
+            "type": "object",
+            "properties": {
+              "app": {
+                "$ref": "#/components/schemas/PublicAppDetails"
+              },
+              "extension": {
+                "$ref": "#/components/schemas/PublicExtensionDetails"
+              },
+              "hook": {
+                "$ref": "#/components/schemas/PublicDeleteAccountDetails"
+              }
+            }
           }
         }
       },
-      "DataRetrievalItem": {
+      "PublicSelfManagementExplanation": {
         "type": "object",
         "properties": {
-          "app": {
-            "$ref": "#/components/schemas/PublicAppDetails"
-          },
-          "extension": {
-            "$ref": "#/components/schemas/PublicExtensionDetails"
-          },
-          "hook": {
-            "$ref": "#/components/schemas/PublicDataRetrievalHookDetails"
+          "en": {
+            "type": "string",
+            "description": "Explanation of the functionality shown to the end user."
           }
-        }
+        },
+        "additionalProperties": {
+          "type": "string",
+          "description": "Explanation of the functionality in language denoted by ISO 3166-1 alpha-2 code."
+        },
+        "required": [
+          "en"
+        ],
+        "description": "Explanation of the hook."
       },
-      "PublicAppDetails": {
+      "PublicChangeEmailDetails": {
         "type": "object",
         "properties": {
-          "app_id": {
+          "id": {
             "type": "string",
-            "description": "Identifier of the app."
+            "description": "Identifier of the hook."
           },
-          "name": {
-            "type": "object",
-            "properties": {
-              "en": {
-                "type": "string",
-                "description": "Name of the app in English."
-              }
-            },
-            "additionalProperties": {
-              "type": "string",
-              "description": "Name of the app in some other language denoted by ISO 3166-1 alpha-2 code."
-            },
-            "required": [
-              "en"
-            ]
+          "require_password_confirmation": {
+            "type": "boolean",
+            "description": "Whether the portal user must confirm their current password before the email change is handed over to the third-party system.",
+            "default": true
+          },
+          "explanation": {
+            "$ref": "#/components/schemas/PublicSelfManagementExplanation"
           }
         }
       },
-      "PublicExtensionDetails": {
+      "PublicChangePasswordDetails": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "description": "Identifier of the hook."
+          },
+          "require_new_password": {
+            "type": "boolean",
+            "description": "Whether the portal user must provide a new password that is passed to the third-party system.",
+            "default": false
+          },
+          "explanation": {
+            "$ref": "#/components/schemas/PublicSelfManagementExplanation"
+          }
+        }
+      },
+      "PublicDeleteAccountDetails": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "description": "Identifier of the hook."
+          },
+          "explanation": {
+            "$ref": "#/components/schemas/PublicSelfManagementExplanation"
+          }
+        }
+      },
+      "DataRetrievalItem": {
+        "type": "object",
+        "properties": {
+          "app": {
+            "$ref": "#/components/schemas/PublicAppDetails"
+          },
+          "extension": {
+            "$ref": "#/components/schemas/PublicExtensionDetails"
+          },
+          "hook": {
+            "$ref": "#/components/schemas/PublicDataRetrievalHookDetails"
+          }
+        }
+      },
+      "PublicAppDetails": {
+        "type": "object",
+        "properties": {
+          "app_id": {
+            "type": "string",
+            "description": "Identifier of the app."
+          },
+          "name": {
+            "type": "object",
+            "properties": {
+              "en": {
+                "type": "string",
+                "description": "Name of the app in English."
+              }
+            },
+            "additionalProperties": {
+              "type": "string",
+              "description": "Name of the app in some other language denoted by ISO 3166-1 alpha-2 code."
+            },
+            "required": [
+              "en"
+            ]
+          }
+        }
+      },
+      "PublicExtensionDetails": {
         "type": "object",
         "properties": {
           "id": {
@@ -14694,6 +15586,15 @@
                     },
                     {
                       "$ref": "#/components/schemas/ExtensionHookVisualizationMetadata"
+                    },
+                    {
+                      "$ref": "#/components/schemas/ExtensionHookChangeEmail"
+                    },
+                    {
+                      "$ref": "#/components/schemas/ExtensionHookChangePassword"
+                    },
+                    {
+                      "$ref": "#/components/schemas/ExtensionHookDeleteAccount"
                     }
                   ]
                 }
@@ -14973,15 +15874,313 @@
                 "description": "Explanation of the functionality shown to the end user.",
                 "example": "This process will give you access to the matching Contracts."
               }
-            },
-            "additionalProperties": {
-              "type": "string",
-              "description": "Explanation of the functionality in language denoted by ISO 3166-1 alpha-2 code."
-            },
-            "required": [
-              "en"
-            ],
-            "description": "Explanation of the hook."
+            },
+            "additionalProperties": {
+              "type": "string",
+              "description": "Explanation of the functionality in language denoted by ISO 3166-1 alpha-2 code."
+            },
+            "required": [
+              "en"
+            ],
+            "description": "Explanation of the hook."
+          },
+          "use_static_ips": {
+            "type": "boolean",
+            "deprecated": true,
+            "description": "Deprecated. Prefer `secure_proxy` instead.\nIf true, requests are made from a set of static IP addresses and only allow connections to a set of allowed IP addresses. Get in touch with us to add your IP addresses.\n",
+            "default": false
+          },
+          "secure_proxy": {
+            "$ref": "#/components/schemas/SecureProxyConfig"
+          }
+        },
+        "required": [
+          "type",
+          "call"
+        ]
+      },
+      "ExtensionHookMeterReadingPlausibilityCheck": {
+        "description": "Hook that checks the plausibility of meter readings before they are saved. This hook makes a POST call whenever a user is trying to save a meter reading. The expected response to the call is:\n  - 200:\n    If meter reading is plausible, the response should contain:\n      - valid: true\n    If meter reading is not plausible, the response should contain:\n      - valid: false\n",
+        "type": "object",
+        "properties": {
+          "type": {
+            "type": "string",
+            "enum": [
+              "meterReadingPlausibilityCheck"
+            ]
+          },
+          "plausibility_mode": {
+            "type": "string",
+            "enum": [
+              "check",
+              "range"
+            ],
+            "default": "check",
+            "description": "Mode for plausibility check:\n- \"check\": Validates meter reading and returns valid: boolean (used during submission)\n- \"range\": Returns min/max allowed values for each counter for validation before submission\n"
+          },
+          "auth": {
+            "$ref": "#/components/schemas/ExtensionAuthBlock"
+          },
+          "call": {
+            "type": "object",
+            "properties": {
+              "url": {
+                "type": "string",
+                "description": "URL to call. Supports variable interpolation."
+              },
+              "body": {
+                "type": "object",
+                "description": "JSON body to use for the call. Supports variable interpolation.",
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "default": {}
+              },
+              "headers": {
+                "type": "object",
+                "description": "Headers to use. Supports variable interpolation.",
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "default": {}
+              }
+            },
+            "required": [
+              "url",
+              "headers",
+              "body"
+            ]
+          },
+          "resolved": {
+            "type": "object",
+            "description": "Response to the call",
+            "properties": {
+              "data_path": {
+                "type": "string",
+                "description": "Optional path to an array in the response. If specified and the path points to an array,\nthe hook will map over each item using 'Item' variable for interpolation.\nRelevant only if plausibility_mode is \"range\".\n",
+                "example": "data.results"
+              },
+              "dataPath": {
+                "type": "string",
+                "deprecated": true,
+                "description": "Deprecated. Use `data_path` instead."
+              },
+              "counter_identifiers": {
+                "description": "Counter identifier(s) used to match against the meter's counters.\nCan be a string (counter ID) or an object with counter properties.\nThe backend resolves this to meter_counter_id in the final response.\nRelevant only if plausibility_mode is \"range\".\n",
+                "oneOf": [
+                  {
+                    "type": "string",
+                    "example": "{{Item.counter_id}}"
+                  },
+                  {
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    },
+                    "example": {
+                      "obis_code": "{{Item.obis}}"
+                    }
+                  }
+                ]
+              },
+              "valid": {
+                "type": "string",
+                "description": "Indicate whether the meter reading is plausible. Relevant only if plausibility_mode is \"check\".",
+                "example": "{{CallResponse.data.valid}}"
+              },
+              "upper_limit": {
+                "type": "string",
+                "description": "Upper allowed limit of the meter reading",
+                "example": "{{CallResponse.data.upper_limit}}"
+              },
+              "lower_limit": {
+                "type": "string",
+                "description": "Lower allowed limit of the meter reading",
+                "example": "{{CallResponse.data.lower_limit}}"
+              },
+              "error_message_path": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
+              }
+            }
+          },
+          "use_static_ips": {
+            "type": "boolean",
+            "deprecated": true,
+            "description": "Deprecated. Prefer `secure_proxy` instead.\nIf true, requests are made from a set of static IP addresses and only allow connections to a set of allowed IP addresses. Get in touch with us to add your IP addresses.\n",
+            "default": false
+          },
+          "secure_proxy": {
+            "$ref": "#/components/schemas/SecureProxyConfig"
+          }
+        },
+        "required": [
+          "type",
+          "call",
+          "resolved"
+        ]
+      },
+      "ExtensionHookPriceDataRetrieval": {
+        "description": "Hook that will allow using the specified source as data for price visualizations. This hook is triggered to fetch the data. Format of the request and response has to follow the following specification: TBD. The expected response to the call is:\n  - 200 with the time series data\n",
+        "type": "object",
+        "properties": {
+          "type": {
+            "type": "string",
+            "enum": [
+              "priceDataRetrieval"
+            ]
+          },
+          "auth": {
+            "$ref": "#/components/schemas/ExtensionAuthBlock"
+          },
+          "call": {
+            "type": "object",
+            "properties": {
+              "method": {
+                "type": "string",
+                "description": "HTTP method to use for the call",
+                "default": "GET"
+              },
+              "url": {
+                "type": "string",
+                "description": "URL to call. Supports variable interpolation."
+              },
+              "params": {
+                "type": "object",
+                "description": "Parameters to append to the URL. Supports variable interpolation.",
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "default": {}
+              },
+              "headers": {
+                "type": "object",
+                "description": "Headers to use. Supports variable interpolation.",
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "default": {}
+              },
+              "body": {
+                "type": "object",
+                "description": "Request body to send. Supports variable interpolation. Content format is determined by Content-Type header.",
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "default": {}
+              }
+            },
+            "required": [
+              "url"
+            ]
+          },
+          "resolved": {
+            "type": "object",
+            "properties": {
+              "data_path": {
+                "type": "string",
+                "description": "Optional path to the data (array) in the response. If omitted, the data is assumed to be on the top level."
+              },
+              "dataPath": {
+                "type": "string",
+                "deprecated": true,
+                "description": "Deprecated. Use `data_path` instead."
+              },
+              "error_message_path": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
+              }
+            }
+          },
+          "use_static_ips": {
+            "type": "boolean",
+            "deprecated": true,
+            "description": "Deprecated. Prefer `secure_proxy` instead.\nIf true, requests are made from a set of static IP addresses and only allow connections to a set of allowed IP addresses. Get in touch with us to add your IP addresses.\n",
+            "default": false
+          },
+          "secure_proxy": {
+            "$ref": "#/components/schemas/SecureProxyConfig"
+          }
+        },
+        "required": [
+          "type",
+          "call"
+        ]
+      },
+      "ExtensionHookConsumptionDataRetrieval": {
+        "description": "Hook that will allow using the specified source as data for consumption visualizations. This hook is triggered to fetch the data. Format of the request and response has to follow the following specification: TBD. The expected response to the call is:\n  - 200 with the time series data\n",
+        "type": "object",
+        "properties": {
+          "type": {
+            "type": "string",
+            "enum": [
+              "consumptionDataRetrieval"
+            ]
+          },
+          "auth": {
+            "$ref": "#/components/schemas/ExtensionAuthBlock"
+          },
+          "call": {
+            "type": "object",
+            "properties": {
+              "method": {
+                "type": "string",
+                "description": "HTTP method to use for the call",
+                "default": "GET"
+              },
+              "url": {
+                "type": "string",
+                "description": "URL to call. Supports variable interpolation."
+              },
+              "params": {
+                "type": "object",
+                "description": "Parameters to append to the URL. Supports variable interpolation.",
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "default": {}
+              },
+              "headers": {
+                "type": "object",
+                "description": "Headers to use. Supports variable interpolation.",
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "default": {}
+              },
+              "body": {
+                "type": "object",
+                "description": "Request body to send. Supports variable interpolation. Content format is determined by Content-Type header.",
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "default": {}
+              }
+            },
+            "required": [
+              "url"
+            ]
+          },
+          "resolved": {
+            "type": "object",
+            "properties": {
+              "data_path": {
+                "type": "string",
+                "description": "Optional path to the data (array) in the response. If omitted, the data is assumed to be on the top level."
+              },
+              "dataPath": {
+                "type": "string",
+                "deprecated": true,
+                "description": "Deprecated. Use `data_path` instead."
+              },
+              "error_message_path": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
+              }
+            }
           },
           "use_static_ips": {
             "type": "boolean",
@@ -14998,24 +16197,22 @@
           "call"
         ]
       },
-      "ExtensionHookMeterReadingPlausibilityCheck": {
-        "description": "Hook that checks the plausibility of meter readings before they are saved. This hook makes a POST call whenever a user is trying to save a meter reading. The expected response to the call is:\n  - 200:\n    If meter reading is plausible, the response should contain:\n      - valid: true\n    If meter reading is not plausible, the response should contain:\n      - valid: false\n",
+      "ExtensionHookDataExport": {
+        "description": "Generic data export hook. When configured on a visualization block, the portal delegates the export action (e.g. CSV/Excel/PDF download) to the configured external source instead of generating the file itself. Can be used by any block that supports export — consumption charts, dynamic tariff charts, etc. The expected response to the call is:\n  - 200 with a JSON body describing the exported file (download_url, optional filename, content_type, expires_at)\n",
         "type": "object",
         "properties": {
           "type": {
             "type": "string",
             "enum": [
-              "meterReadingPlausibilityCheck"
+              "dataExport"
             ]
           },
-          "plausibility_mode": {
-            "type": "string",
-            "enum": [
-              "check",
-              "range"
-            ],
-            "default": "check",
-            "description": "Mode for plausibility check:\n- \"check\": Validates meter reading and returns valid: boolean (used during submission)\n- \"range\": Returns min/max allowed values for each counter for validation before submission\n"
+          "block_types": {
+            "type": "array",
+            "description": "Optional list of portal block types this hook supports. If omitted,\nthe hook is usable on any export-capable block. Allowed values match\nthe block type identifiers used by the portal builder\n(e.g. `consumption_visualization`, `dynamic_tariff`).\n",
+            "items": {
+              "type": "string"
+            }
           },
           "auth": {
             "$ref": "#/components/schemas/ExtensionAuthBlock"
@@ -15023,13 +16220,18 @@
           "call": {
             "type": "object",
             "properties": {
+              "method": {
+                "type": "string",
+                "description": "HTTP method to use for the call",
+                "default": "GET"
+              },
               "url": {
                 "type": "string",
                 "description": "URL to call. Supports variable interpolation."
               },
-              "body": {
+              "params": {
                 "type": "object",
-                "description": "JSON body to use for the call. Supports variable interpolation.",
+                "description": "Parameters to append to the URL. Supports variable interpolation.",
                 "additionalProperties": {
                   "type": "string"
                 },
@@ -15042,61 +16244,23 @@
                   "type": "string"
                 },
                 "default": {}
+              },
+              "body": {
+                "type": "object",
+                "description": "Request body to send. Supports variable interpolation. Content format is determined by Content-Type header.",
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "default": {}
               }
             },
             "required": [
-              "url",
-              "headers",
-              "body"
+              "url"
             ]
           },
           "resolved": {
             "type": "object",
-            "description": "Response to the call",
             "properties": {
-              "data_path": {
-                "type": "string",
-                "description": "Optional path to an array in the response. If specified and the path points to an array,\nthe hook will map over each item using 'Item' variable for interpolation.\nRelevant only if plausibility_mode is \"range\".\n",
-                "example": "data.results"
-              },
-              "dataPath": {
-                "type": "string",
-                "deprecated": true,
-                "description": "Deprecated. Use `data_path` instead."
-              },
-              "counter_identifiers": {
-                "description": "Counter identifier(s) used to match against the meter's counters.\nCan be a string (counter ID) or an object with counter properties.\nThe backend resolves this to meter_counter_id in the final response.\nRelevant only if plausibility_mode is \"range\".\n",
-                "oneOf": [
-                  {
-                    "type": "string",
-                    "example": "{{Item.counter_id}}"
-                  },
-                  {
-                    "type": "object",
-                    "additionalProperties": {
-                      "type": "string"
-                    },
-                    "example": {
-                      "obis_code": "{{Item.obis}}"
-                    }
-                  }
-                ]
-              },
-              "valid": {
-                "type": "string",
-                "description": "Indicate whether the meter reading is plausible. Relevant only if plausibility_mode is \"check\".",
-                "example": "{{CallResponse.data.valid}}"
-              },
-              "upper_limit": {
-                "type": "string",
-                "description": "Upper allowed limit of the meter reading",
-                "example": "{{CallResponse.data.upper_limit}}"
-              },
-              "lower_limit": {
-                "type": "string",
-                "description": "Lower allowed limit of the meter reading",
-                "example": "{{CallResponse.data.lower_limit}}"
-              },
               "error_message_path": {
                 "type": "string",
                 "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
@@ -15116,18 +16280,17 @@
         },
         "required": [
           "type",
-          "call",
-          "resolved"
+          "call"
         ]
       },
-      "ExtensionHookPriceDataRetrieval": {
-        "description": "Hook that will allow using the specified source as data for price visualizations. This hook is triggered to fetch the data. Format of the request and response has to follow the following specification: TBD. The expected response to the call is:\n  - 200 with the time series data\n",
+      "ExtensionHookVisualizationMetadata": {
+        "description": "Hook that returns runtime metadata describing how a visualization should be rendered for a given portal context. Invoked by the portal before fetching data, with the same context the data hook receives.\n",
         "type": "object",
         "properties": {
           "type": {
             "type": "string",
             "enum": [
-              "priceDataRetrieval"
+              "visualizationMetadata"
             ]
           },
           "auth": {
@@ -15179,7 +16342,7 @@
             "properties": {
               "data_path": {
                 "type": "string",
-                "description": "Optional path to the data (array) in the response. If omitted, the data is assumed to be on the top level."
+                "description": "Optional path to the metadata object in the response. If omitted, the metadata is assumed to be on the top level."
               },
               "dataPath": {
                 "type": "string",
@@ -15208,14 +16371,14 @@
           "call"
         ]
       },
-      "ExtensionHookConsumptionDataRetrieval": {
+      "ExtensionHookCostDataRetrieval": {
         "description": "Hook that will allow using the specified source as data for consumption visualizations. This hook is triggered to fetch the data. Format of the request and response has to follow the following specification: TBD. The expected response to the call is:\n  - 200 with the time series data\n",
         "type": "object",
         "properties": {
           "type": {
             "type": "string",
             "enum": [
-              "consumptionDataRetrieval"
+              "costDataRetrieval"
             ]
           },
           "auth": {
@@ -15296,22 +16459,38 @@
           "call"
         ]
       },
-      "ExtensionHookDataExport": {
-        "description": "Generic data export hook. When configured on a visualization block, the portal delegates the export action (e.g. CSV/Excel/PDF download) to the configured external source instead of generating the file itself. Can be used by any block that supports export — consumption charts, dynamic tariff charts, etc. The expected response to the call is:\n  - 200 with a JSON body describing the exported file (download_url, optional filename, content_type, expires_at)\n",
+      "ExtensionHookChangeEmail": {
+        "description": "Hook that replaces the built-in change email functionality for portal users. When configured, the portal does not change the user's login email itself. Instead, this hook makes an HTTP call to the third-party system, which is expected to handle the email change (most likely by sending the user instructions to confirm the new email address).\nThe expected response http status code to the call is:\n  - 2xx if the request was accepted\n  - non-2xx if the request failed (optionally with a human-readable message resolved via `resolved.error_message_path`)\n",
         "type": "object",
         "properties": {
           "type": {
             "type": "string",
             "enum": [
-              "dataExport"
+              "changeEmail"
             ]
           },
-          "block_types": {
-            "type": "array",
-            "description": "Optional list of portal block types this hook supports. If omitted,\nthe hook is usable on any export-capable block. Allowed values match\nthe block type identifiers used by the portal builder\n(e.g. `consumption_visualization`, `dynamic_tariff`).\n",
-            "items": {
-              "type": "string"
-            }
+          "require_password_confirmation": {
+            "type": "boolean",
+            "description": "Whether the portal user must confirm their current password before the change email request is handed over to the third-party system. When true, the portal collects and verifies the current password before calling the hook.\n",
+            "default": true
+          },
+          "explanation": {
+            "type": "object",
+            "properties": {
+              "en": {
+                "type": "string",
+                "description": "Explanation of the functionality shown to the end user.",
+                "example": "You will receive an email with instructions to confirm your new email address."
+              }
+            },
+            "additionalProperties": {
+              "type": "string",
+              "description": "Explanation of the functionality in language denoted by ISO 3166-1 alpha-2 code."
+            },
+            "required": [
+              "en"
+            ],
+            "description": "Optional explanation shown to the user in the change email confirmation dialog."
           },
           "auth": {
             "$ref": "#/components/schemas/ExtensionAuthBlock"
@@ -15322,7 +16501,7 @@
               "method": {
                 "type": "string",
                 "description": "HTTP method to use for the call",
-                "default": "GET"
+                "default": "POST"
               },
               "url": {
                 "type": "string",
@@ -15346,15 +16525,12 @@
               },
               "body": {
                 "type": "object",
-                "description": "Request body to send. Supports variable interpolation. Content format is determined by Content-Type header.",
-                "additionalProperties": {
-                  "type": "string"
-                },
-                "default": {}
+                "description": "Optional JSON body to use for the call. Defaults to an object with the requested new email and portal user context. The requested new email is available as `{{Input.new_email}}` and the current account email as `{{Input.old_email}}`. Supports variable interpolation."
               }
             },
             "required": [
-              "url"
+              "url",
+              "headers"
             ]
           },
           "resolved": {
@@ -15367,12 +16543,6 @@
               }
             }
           },
-          "use_static_ips": {
-            "type": "boolean",
-            "deprecated": true,
-            "description": "Deprecated. Prefer `secure_proxy` instead.\nIf true, requests are made from a set of static IP addresses and only allow connections to a set of allowed IP addresses. Get in touch with us to add your IP addresses.\n",
-            "default": false
-          },
           "secure_proxy": {
             "$ref": "#/components/schemas/SecureProxyConfig"
           }
@@ -15382,16 +16552,39 @@
           "call"
         ]
       },
-      "ExtensionHookVisualizationMetadata": {
-        "description": "Hook that returns runtime metadata describing how a visualization should be rendered for a given portal context. Invoked by the portal before fetching data, with the same context the data hook receives.\n",
+      "ExtensionHookChangePassword": {
+        "description": "Hook that replaces the built-in change password functionality for portal users. When configured, the portal does not change the user's password itself. Instead, this hook makes an HTTP call to the third-party system, which is expected to handle the password change (most likely by sending the user instructions to complete the process).\nThe expected response http status code to the call is:\n  - 2xx if the request was accepted\n  - non-2xx if the request failed (optionally with a human-readable message resolved via `resolved.error_message_path`)\n",
         "type": "object",
         "properties": {
           "type": {
             "type": "string",
             "enum": [
-              "visualizationMetadata"
+              "changePassword"
             ]
           },
+          "require_new_password": {
+            "type": "boolean",
+            "description": "Whether the portal user must provide a new password. When false, the portal only asks the user to confirm (showing the configured explanation) and no new password is collected; the third-party system is expected to handle the password change. When true, the portal collects a new password and passes it to the third-party system as `{{Input.new_password}}`.\n",
+            "default": false
+          },
+          "explanation": {
+            "type": "object",
+            "properties": {
+              "en": {
+                "type": "string",
+                "description": "Explanation of the functionality shown to the end user.",
+                "example": "You will receive an email with instructions to reset your password."
+              }
+            },
+            "additionalProperties": {
+              "type": "string",
+              "description": "Explanation of the functionality in language denoted by ISO 3166-1 alpha-2 code."
+            },
+            "required": [
+              "en"
+            ],
+            "description": "Optional explanation shown to the user in the change password confirmation dialog."
+          },
           "auth": {
             "$ref": "#/components/schemas/ExtensionAuthBlock"
           },
@@ -15401,7 +16594,7 @@
               "method": {
                 "type": "string",
                 "description": "HTTP method to use for the call",
-                "default": "GET"
+                "default": "POST"
               },
               "url": {
                 "type": "string",
@@ -15425,29 +16618,17 @@
               },
               "body": {
                 "type": "object",
-                "description": "Request body to send. Supports variable interpolation. Content format is determined by Content-Type header.",
-                "additionalProperties": {
-                  "type": "string"
-                },
-                "default": {}
+                "description": "Optional JSON body to use for the call. Defaults to an object with portal user context (and the new password as `{{Input.new_password}}` when `require_new_password` is true). Supports variable interpolation."
               }
             },
             "required": [
-              "url"
+              "url",
+              "headers"
             ]
           },
           "resolved": {
             "type": "object",
             "properties": {
-              "data_path": {
-                "type": "string",
-                "description": "Optional path to the metadata object in the response. If omitted, the metadata is assumed to be on the top level."
-              },
-              "dataPath": {
-                "type": "string",
-                "deprecated": true,
-                "description": "Deprecated. Use `data_path` instead."
-              },
               "error_message_path": {
                 "type": "string",
                 "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
@@ -15455,12 +16636,6 @@
               }
             }
           },
-          "use_static_ips": {
-            "type": "boolean",
-            "deprecated": true,
-            "description": "Deprecated. Prefer `secure_proxy` instead.\nIf true, requests are made from a set of static IP addresses and only allow connections to a set of allowed IP addresses. Get in touch with us to add your IP addresses.\n",
-            "default": false
-          },
           "secure_proxy": {
             "$ref": "#/components/schemas/SecureProxyConfig"
           }
@@ -15470,16 +16645,43 @@
           "call"
         ]
       },
-      "ExtensionHookCostDataRetrieval": {
-        "description": "Hook that will allow using the specified source as data for consumption visualizations. This hook is triggered to fetch the data. Format of the request and response has to follow the following specification: TBD. The expected response to the call is:\n  - 200 with the time series data\n",
+      "ExtensionHookDeleteAccount": {
+        "description": "Hook that replaces the built-in delete account functionality for portal users. When configured, the portal does not delete the user itself. Instead, this hook makes an HTTP call to the third-party system, which is expected to handle the deletion.\nThe `deletion_mode` controls what the portal does after the call:\n  - `synchronous`: The third-party system deletes the user immediately. The portal waits for a successful (2xx) response and then also deletes the epilot user.\n  - `asynchronous`: The third-party system handles deletion out-of-band. The portal does not delete anything immediately; cleanup is expected to happen later (e.g. via the user deletion API or webhooks).\n\nThe expected response http status code to the call is:\n  - 2xx if the request was accepted\n  - non-2xx if the request failed (optionally with a human-readable message resolved via `resolved.error_message_path`)\n",
         "type": "object",
         "properties": {
           "type": {
             "type": "string",
             "enum": [
-              "costDataRetrieval"
+              "deleteAccount"
             ]
           },
+          "deletion_mode": {
+            "type": "string",
+            "enum": [
+              "synchronous",
+              "asynchronous"
+            ],
+            "description": "Controls how the account deletion is handled. `synchronous` waits for the third-party system to respond and then also deletes the epilot user. `asynchronous` hands the deletion over entirely to the third-party system and the portal does not delete anything immediately.\n",
+            "default": "synchronous"
+          },
+          "explanation": {
+            "type": "object",
+            "properties": {
+              "en": {
+                "type": "string",
+                "description": "Explanation of the functionality shown to the end user.",
+                "example": "Your account deletion will be processed by our system. This may take a few days."
+              }
+            },
+            "additionalProperties": {
+              "type": "string",
+              "description": "Explanation of the functionality in language denoted by ISO 3166-1 alpha-2 code."
+            },
+            "required": [
+              "en"
+            ],
+            "description": "Optional explanation shown to the user in the delete account confirmation dialog."
+          },
           "auth": {
             "$ref": "#/components/schemas/ExtensionAuthBlock"
           },
@@ -15489,7 +16691,7 @@
               "method": {
                 "type": "string",
                 "description": "HTTP method to use for the call",
-                "default": "GET"
+                "default": "POST"
               },
               "url": {
                 "type": "string",
@@ -15513,29 +16715,17 @@
               },
               "body": {
                 "type": "object",
-                "description": "Request body to send. Supports variable interpolation. Content format is determined by Content-Type header.",
-                "additionalProperties": {
-                  "type": "string"
-                },
-                "default": {}
+                "description": "Optional JSON body to use for the call. Defaults to an object with portal user context, e.g. `{\"portal_user_id\": \"...\", \"email\": \"...\"}`. Supports variable interpolation."
               }
             },
             "required": [
-              "url"
+              "url",
+              "headers"
             ]
           },
           "resolved": {
             "type": "object",
             "properties": {
-              "data_path": {
-                "type": "string",
-                "description": "Optional path to the data (array) in the response. If omitted, the data is assumed to be on the top level."
-              },
-              "dataPath": {
-                "type": "string",
-                "deprecated": true,
-                "description": "Deprecated. Use `data_path` instead."
-              },
               "error_message_path": {
                 "type": "string",
                 "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
@@ -15543,12 +16733,6 @@
               }
             }
           },
-          "use_static_ips": {
-            "type": "boolean",
-            "deprecated": true,
-            "description": "Deprecated. Prefer `secure_proxy` instead.\nIf true, requests are made from a set of static IP addresses and only allow connections to a set of allowed IP addresses. Get in touch with us to add your IP addresses.\n",
-            "default": false
-          },
           "secure_proxy": {
             "$ref": "#/components/schemas/SecureProxyConfig"
           }
@@ -15886,6 +17070,11 @@
           },
           "mobile_oidc_config": {
             "$ref": "#/components/schemas/MoblieOIDCConfig"
+          },
+          "expose_client_secret": {
+            "type": "boolean",
+            "description": "Allow the resolved `client_secret` to be returned through the\npublic single-provider endpoint at SSO initiation. Only set this\nfor OIDC flows that require a public client secret in the\nbrowser (e.g. some PKCE-less authorization-code variants). When\nunset (default), the secret is kept server-side and only used at\nthe token exchange.\n",
+            "example": false
           }
         },
         "required": [
@@ -16748,6 +17937,10 @@
               "auto_redirect_to_sso": {
                 "type": "boolean",
                 "description": "Decide whether to automatically redirect to the provider page during login, which would completely bypass showing the portal authentication page."
+              },
+              "prevent_user_enumeration": {
+                "type": "boolean",
+                "description": "Opt-in. When true, suppresses responses that reveal whether a user exists for public, pre-authentication actions (the login entry-point check and self-registration), at the expense of some UX. Already-authenticated actions are unaffected. Default false.\n"
               }
             }
           },