@epilot/customer-portal-client 0.39.0 → 0.39.2

package/dist/openapi.d.ts

@@ -3387,6 +3387,14 @@ declare namespace Components {
                  * Optional path to the data (array) in the response. If omitted, the data is assumed to be on the top level.
                  */
                 dataPath?: string;
+                /**
+                 * Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).
+                 * If specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.
+                 *
+                 * example:
+                 * error.message
+                 */
+                errorMessagePath?: string;
             };
             /**
              * Deprecated. Prefer `secure_proxy` instead.
@@ -3516,6 +3524,14 @@ declare namespace Components {
                  * Optional path to the data (array) in the response. If omitted, the data is assumed to be on the top level.
                  */
                 dataPath?: string;
+                /**
+                 * Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).
+                 * If specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.
+                 *
+                 * example:
+                 * error.message
+                 */
+                errorMessagePath?: string;
             };
             /**
              * Deprecated. Prefer `secure_proxy` instead.
@@ -3569,6 +3585,16 @@ declare namespace Components {
                     [name: string]: string;
                 };
             };
+            resolved?: {
+                /**
+                 * Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).
+                 * If specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.
+                 *
+                 * example:
+                 * error.message
+                 */
+                errorMessagePath?: string;
+            };
             /**
              * Deprecated. Prefer `secure_proxy` instead.
              * If true, requests are made from a set of static IP addresses and only allow connections to a set of allowed IP addresses. Get in touch with us to add your IP addresses.
@@ -3662,6 +3688,14 @@ declare namespace Components {
                  * {{CallResponse.data.lower_limit}}
                  */
                 lower_limit?: string;
+                /**
+                 * Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).
+                 * If specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.
+                 *
+                 * example:
+                 * error.message
+                 */
+                errorMessagePath?: string;
             };
             /**
              * Deprecated. Prefer `secure_proxy` instead.
@@ -3712,6 +3746,14 @@ declare namespace Components {
                  * Optional path to the data (array) in the response. If omitted, the data is assumed to be on the top level.
                  */
                 dataPath?: string;
+                /**
+                 * Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).
+                 * If specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.
+                 *
+                 * example:
+                 * error.message
+                 */
+                errorMessagePath?: string;
             };
             /**
              * Deprecated. Prefer `secure_proxy` instead.
@@ -3824,6 +3866,14 @@ declare namespace Components {
                  * Optional path to the metadata object in the response. If omitted, the metadata is assumed to be on the top level.
                  */
                 dataPath?: string;
+                /**
+                 * Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).
+                 * If specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.
+                 *
+                 * example:
+                 * error.message
+                 */
+                errorMessagePath?: string;
             };
             /**
              * Deprecated. Prefer `secure_proxy` instead.
@@ -4564,8 +4614,9 @@ declare namespace Components {
             schema?: string;
         }
         /**
-         * Mobile OIDC configuration. All string fields support env var interpolation
-         * (incl. secrets) via mustache-like templates, e.g. `{{ env.MOBILE_CLIENT_SECRET }}`.
+         * Mobile OIDC configuration. Values are resolved at SSO invocation time, so the
+         * fields below may reference org env vars via mustache-like templates, e.g.
+         * `{{ env.MOBILE_CLIENT_SECRET }}`.
          *
          */
         export interface MoblieOIDCConfig {
@@ -4585,8 +4636,12 @@ declare namespace Components {
             client_secret?: string;
         }
         /**
-         * OIDC provider configuration. All string fields support env var interpolation
-         * (incl. secrets) via mustache-like templates, e.g. `{{ env.MY_PROVIDER_CLIENT_SECRET }}`.
+         * OIDC provider configuration. Values are resolved at SSO invocation time
+         * (login / callback), so the fields below may reference org env vars via
+         * mustache-like templates, e.g. `{{ env.MY_PROVIDER_CLIENT_SECRET }}`.
+         *
+         * Fields used to render the SSO buttons up-front (`ProviderConfig.slug`,
+         * `ProviderConfig.display_name`) are NOT interpolated and must be literal.
          *
          */
         export interface OIDCProviderConfig {
@@ -4634,6 +4689,10 @@ declare namespace Components {
             prompt?: "login" | "select_account" | "consent";
         }
         export interface OIDCProviderMetadata {
+            /**
+             * Response modes the provider accepts (e.g. `form_post` for Apple)
+             */
+            response_modes_supported?: ("form_post" | "fragment" | "query")[];
             /**
              * URL of the authorization endpoint
              * example:
@@ -4689,47 +4748,6 @@ declare namespace Components {
              */
             test_auth_password?: string;
         }
-        /**
-         * Public OIDC provider configuration. Same as OIDCProviderConfig but never includes
-         * the `client_secret` field — it is kept server-side and only used to exchange the
-         * authorization code at the SSO callback. String fields are returned with env var
-         * placeholders already resolved when fetched via `GET /v2/portal/public/sso/providers/{provider_slug}`.
-         *
-         */
-        export interface OIDCProviderPublicConfig {
-            type?: "authorization_code" | "implicit";
-            /**
-             * Issuing Authority URL
-             * example:
-             * https://login.microsoftonline.com/33d4f3e5-3df2-421e-b92e-a63cfa680a88/v2.0
-             */
-            oidc_issuer: string;
-            /**
-             * Redirect URI for the OIDC flow
-             * example:
-             * https://customer-portal.com/login
-             */
-            redirect_uri?: string;
-            /**
-             * example:
-             * ab81daf8-8b1f-42d6-94ca-c51621054c75
-             */
-            client_id: string;
-            /**
-             * Whether the client secret is present (the value itself is kept server-side)
-             * example:
-             * true
-             */
-            has_client_secret?: boolean;
-            /**
-             * Space-separated list of OAuth 2.0 scopes to request from OpenID Connect
-             * example:
-             * openid email
-             */
-            scope: string;
-            metadata?: OIDCProviderMetadata;
-            prompt?: "login" | "select_account" | "consent";
-        }
         /**
          * The opportunity entity
          */
@@ -5800,6 +5818,18 @@ declare namespace Components {
                  */
                 onPendingUser?: AdminUser[];
             };
+            /**
+             * SSO identity providers for the portal. When sent on a portal save (PUT/POST),
+             * the list is fully synced — incoming providers are upserted and any existing
+             * providers not in the list are deleted. Omit the field to leave SSO
+             * configuration unchanged; send an empty array to remove all providers.
+             *
+             * Each provider is persisted verbatim — `oidc_config.client_secret` is stored
+             * as sent. Customers are encouraged to reference an org env secret via
+             * `{{ env.VAR }}` rather than embed raw values.
+             *
+             */
+            identity_providers?: ProviderPublicConfig[];
             /**
              * Enable/Disable the portal access
              */
@@ -6273,7 +6303,6 @@ declare namespace Components {
              * Permissions granted to a portal user while accessing entities
              */
             grants?: Grant[];
-            identity_providers?: ProviderPublicConfig[];
             pages?: Page[];
         }
         /**
@@ -6477,14 +6506,19 @@ declare namespace Components {
             attribute_mappings?: /* Dictionary of epilot user attributes to claims */ AttributeMappingConfig;
             entity_matching?: /* Configuration for matching existing entities during SSO login using token claims */ EntityMatchingConfig;
             oidc_config?: /**
-             * OIDC provider configuration. All string fields support env var interpolation
-             * (incl. secrets) via mustache-like templates, e.g. `{{ env.MY_PROVIDER_CLIENT_SECRET }}`.
+             * OIDC provider configuration. Values are resolved at SSO invocation time
+             * (login / callback), so the fields below may reference org env vars via
+             * mustache-like templates, e.g. `{{ env.MY_PROVIDER_CLIENT_SECRET }}`.
+             *
+             * Fields used to render the SSO buttons up-front (`ProviderConfig.slug`,
+             * `ProviderConfig.display_name`) are NOT interpolated and must be literal.
              *
              */
             OIDCProviderConfig;
             mobile_oidc_config?: /**
-             * Mobile OIDC configuration. All string fields support env var interpolation
-             * (incl. secrets) via mustache-like templates, e.g. `{{ env.MOBILE_CLIENT_SECRET }}`.
+             * Mobile OIDC configuration. Values are resolved at SSO invocation time, so the
+             * fields below may reference org env vars via mustache-like templates, e.g.
+             * `{{ env.MOBILE_CLIENT_SECRET }}`.
              *
              */
             MoblieOIDCConfig;
@@ -6509,16 +6543,19 @@ declare namespace Components {
              */
             ProviderDisplayName;
             oidc_config?: /**
-             * Public OIDC provider configuration. Same as OIDCProviderConfig but never includes
-             * the `client_secret` field — it is kept server-side and only used to exchange the
-             * authorization code at the SSO callback. String fields are returned with env var
-             * placeholders already resolved when fetched via `GET /v2/portal/public/sso/providers/{provider_slug}`.
+             * OIDC provider configuration. Values are resolved at SSO invocation time
+             * (login / callback), so the fields below may reference org env vars via
+             * mustache-like templates, e.g. `{{ env.MY_PROVIDER_CLIENT_SECRET }}`.
+             *
+             * Fields used to render the SSO buttons up-front (`ProviderConfig.slug`,
+             * `ProviderConfig.display_name`) are NOT interpolated and must be literal.
              *
              */
-            OIDCProviderPublicConfig;
+            OIDCProviderConfig;
             mobile_oidc_config?: /**
-             * Mobile OIDC configuration. All string fields support env var interpolation
-             * (incl. secrets) via mustache-like templates, e.g. `{{ env.MOBILE_CLIENT_SECRET }}`.
+             * Mobile OIDC configuration. Values are resolved at SSO invocation time, so the
+             * fields below may reference org env vars via mustache-like templates, e.g.
+             * `{{ env.MOBILE_CLIENT_SECRET }}`.
              *
              */
             MoblieOIDCConfig;
@@ -7055,6 +7092,32 @@ declare namespace Components {
                  */
                 onPendingUser?: AdminUser[];
             };
+            /**
+             * SSO identity providers for the portal. When sent on a portal save (PUT/POST),
+             * the list is fully synced — incoming providers are upserted and any existing
+             * providers not in the list are deleted. Omit the field to leave SSO
+             * configuration unchanged; send an empty array to remove all providers.
+             *
+             * Each provider is persisted verbatim — `oidc_config.client_secret` is stored
+             * as sent. Customers are encouraged to reference an org env secret via
+             * `{{ env.VAR }}` rather than embed raw values.
+             *
+             */
+            identity_providers?: /**
+             * SSO identity provider configuration.
+             *
+             * Env var interpolation: only string fields under `oidc_config` and
+             * `mobile_oidc_config` (incl. their nested `metadata`) are passed through
+             * Liquid templating, so they may contain `{{ env.VAR }}` placeholders that
+             * get resolved at runtime against the organization's environment.
+             *
+             * The following fields are used as literal values and MUST NOT contain
+             * template syntax: `slug`, `display_name`, `provider_type`, all keys and
+             * values under `attribute_mappings` (used as JSONPath-like accessors into
+             * token claims), and all keys and values under `entity_matching`.
+             *
+             */
+            ProviderConfig[];
         }
         export interface UpsertPortalConfig {
             /**
@@ -7097,6 +7160,32 @@ declare namespace Components {
                  */
                 onPendingUser?: AdminUser[];
             };
+            /**
+             * SSO identity providers for the portal. When sent on a portal save (PUT/POST),
+             * the list is fully synced — incoming providers are upserted and any existing
+             * providers not in the list are deleted. Omit the field to leave SSO
+             * configuration unchanged; send an empty array to remove all providers.
+             *
+             * Each provider is persisted verbatim — `oidc_config.client_secret` is stored
+             * as sent. Customers are encouraged to reference an org env secret via
+             * `{{ env.VAR }}` rather than embed raw values.
+             *
+             */
+            identity_providers?: /**
+             * SSO identity provider configuration.
+             *
+             * Env var interpolation: only string fields under `oidc_config` and
+             * `mobile_oidc_config` (incl. their nested `metadata`) are passed through
+             * Liquid templating, so they may contain `{{ env.VAR }}` placeholders that
+             * get resolved at runtime against the organization's environment.
+             *
+             * The following fields are used as literal values and MUST NOT contain
+             * template syntax: `slug`, `display_name`, `provider_type`, all keys and
+             * values under `attribute_mappings` (used as JSONPath-like accessors into
+             * token claims), and all keys and values under `entity_matching`.
+             *
+             */
+            ProviderConfig[];
             /**
              * Enable/Disable the portal access
              */
@@ -7576,6 +7665,32 @@ declare namespace Components {
                  */
                 onPendingUser?: AdminUser[];
             };
+            /**
+             * SSO identity providers for the portal. When sent on a portal save (PUT/POST),
+             * the list is fully synced — incoming providers are upserted and any existing
+             * providers not in the list are deleted. Omit the field to leave SSO
+             * configuration unchanged; send an empty array to remove all providers.
+             *
+             * Each provider is persisted verbatim — `oidc_config.client_secret` is stored
+             * as sent. Customers are encouraged to reference an org env secret via
+             * `{{ env.VAR }}` rather than embed raw values.
+             *
+             */
+            identity_providers?: /**
+             * SSO identity provider configuration.
+             *
+             * Env var interpolation: only string fields under `oidc_config` and
+             * `mobile_oidc_config` (incl. their nested `metadata`) are passed through
+             * Liquid templating, so they may contain `{{ env.VAR }}` placeholders that
+             * get resolved at runtime against the organization's environment.
+             *
+             * The following fields are used as literal values and MUST NOT contain
+             * template syntax: `slug`, `display_name`, `provider_type`, all keys and
+             * values under `attribute_mappings` (used as JSONPath-like accessors into
+             * token claims), and all keys and values under `entity_matching`.
+             *
+             */
+            ProviderConfig[];
             /**
              * Enable/Disable the portal access
              */
@@ -10911,7 +11026,28 @@ declare namespace Paths {
                  * Permissions granted to a portal user while accessing entities
                  */
                 grants?: Components.Schemas.Grant[];
-                identity_providers?: Components.Schemas.ProviderPublicConfig[];
+                /**
+                 * SSO identity providers configured for the portal. Includes raw
+                 * `oidc_config.client_secret` values so the admin UI can round-trip
+                 * them. Customers are encouraged to reference secrets via env
+                 * templates (`{{ env.VAR }}`) rather than embed raw values.
+                 *
+                 */
+                identity_providers?: /**
+                 * SSO identity provider configuration.
+                 *
+                 * Env var interpolation: only string fields under `oidc_config` and
+                 * `mobile_oidc_config` (incl. their nested `metadata`) are passed through
+                 * Liquid templating, so they may contain `{{ env.VAR }}` placeholders that
+                 * get resolved at runtime against the organization's environment.
+                 *
+                 * The following fields are used as literal values and MUST NOT contain
+                 * template syntax: `slug`, `display_name`, `provider_type`, all keys and
+                 * values under `attribute_mappings` (used as JSONPath-like accessors into
+                 * token claims), and all keys and values under `entity_matching`.
+                 *
+                 */
+                Components.Schemas.ProviderConfig[];
                 certificate_details?: {
                     /**
                      * Status of the certificate
@@ -11426,7 +11562,28 @@ declare namespace Paths {
                  * Permissions granted to a portal user while accessing entities
                  */
                 grants?: Components.Schemas.Grant[];
-                identity_providers?: Components.Schemas.ProviderPublicConfig[];
+                /**
+                 * SSO identity providers configured for the portal. Includes raw
+                 * `oidc_config.client_secret` values so the admin UI can round-trip
+                 * them. Customers are encouraged to reference secrets via env
+                 * templates (`{{ env.VAR }}`) rather than embed raw values.
+                 *
+                 */
+                identity_providers?: /**
+                 * SSO identity provider configuration.
+                 *
+                 * Env var interpolation: only string fields under `oidc_config` and
+                 * `mobile_oidc_config` (incl. their nested `metadata`) are passed through
+                 * Liquid templating, so they may contain `{{ env.VAR }}` placeholders that
+                 * get resolved at runtime against the organization's environment.
+                 *
+                 * The following fields are used as literal values and MUST NOT contain
+                 * template syntax: `slug`, `display_name`, `provider_type`, all keys and
+                 * values under `attribute_mappings` (used as JSONPath-like accessors into
+                 * token claims), and all keys and values under `entity_matching`.
+                 *
+                 */
+                Components.Schemas.ProviderConfig[];
                 certificate_details?: {
                     /**
                      * Status of the certificate
@@ -17647,7 +17804,6 @@ export type MeterReadingWidget = Components.Schemas.MeterReadingWidget;
 export type MoblieOIDCConfig = Components.Schemas.MoblieOIDCConfig;
 export type OIDCProviderConfig = Components.Schemas.OIDCProviderConfig;
 export type OIDCProviderMetadata = Components.Schemas.OIDCProviderMetadata;
-export type OIDCProviderPublicConfig = Components.Schemas.OIDCProviderPublicConfig;
 export type Opportunity = Components.Schemas.Opportunity;
 export type Order = Components.Schemas.Order;
 export type OrganizationSettings = Components.Schemas.OrganizationSettings;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@epilot/customer-portal-client",
-  "version": "0.39.0",
+  "version": "0.39.2",
   "description": "API Client for epilot portal API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/openapi.json

@@ -1867,6 +1867,13 @@
                               "example": "CAA_ERROR"
                             }
                           }
+                        },
+                        "identity_providers": {
+                          "type": "array",
+                          "description": "SSO identity providers configured for the portal. Includes raw\n`oidc_config.client_secret` values so the admin UI can round-trip\nthem. Customers are encouraged to reference secrets via env\ntemplates (`{{ env.VAR }}`) rather than embed raw values.\n",
+                          "items": {
+                            "$ref": "#/components/schemas/ProviderConfig"
+                          }
                         }
                       }
                     }
@@ -1994,6 +2001,13 @@
                               "example": "CAA_ERROR"
                             }
                           }
+                        },
+                        "identity_providers": {
+                          "type": "array",
+                          "description": "SSO identity providers configured for the portal. Includes raw\n`oidc_config.client_secret` values so the admin UI can round-trip\nthem. Customers are encouraged to reference secrets via env\ntemplates (`{{ env.VAR }}`) rather than embed raw values.\n",
+                          "items": {
+                            "$ref": "#/components/schemas/ProviderConfig"
+                          }
                         }
                       }
                     }
@@ -7668,7 +7682,7 @@
         ],
         "responses": {
           "200": {
-            "description": "Resolved public SSO provider configuration",
+            "description": "Resolved public SSO provider configuration. The handler strips `oidc_config.client_secret` from the response (kept server-side for the token exchange); the schema includes it for shape compatibility with the portal-config response.",
             "content": {
               "application/json": {
                 "schema": {
@@ -10708,6 +10722,13 @@
                 "description": "Default admin users for pending user notification to notify"
               }
             }
+          },
+          "identity_providers": {
+            "type": "array",
+            "description": "SSO identity providers for the portal. When sent on a portal save (PUT/POST),\nthe list is fully synced — incoming providers are upserted and any existing\nproviders not in the list are deleted. Omit the field to leave SSO\nconfiguration unchanged; send an empty array to remove all providers.\n\nEach provider is persisted verbatim — `oidc_config.client_secret` is stored\nas sent. Customers are encouraged to reference an org env secret via\n`{{ env.VAR }}` rather than embed raw values.\n",
+            "items": {
+              "$ref": "#/components/schemas/ProviderConfig"
+            }
           }
         }
       },
@@ -14859,6 +14880,11 @@
                 "type": "string",
                 "description": "Lower allowed limit of the meter reading",
                 "example": "{{CallResponse.data.lower_limit}}"
+              },
+              "errorMessagePath": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
               }
             }
           },
@@ -14938,6 +14964,11 @@
               "dataPath": {
                 "type": "string",
                 "description": "Optional path to the data (array) in the response. If omitted, the data is assumed to be on the top level."
+              },
+              "errorMessagePath": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
               }
             }
           },
@@ -15016,6 +15047,11 @@
               "dataPath": {
                 "type": "string",
                 "description": "Optional path to the data (array) in the response. If omitted, the data is assumed to be on the top level."
+              },
+              "errorMessagePath": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
               }
             }
           },
@@ -15095,6 +15131,16 @@
               "url"
             ]
           },
+          "resolved": {
+            "type": "object",
+            "properties": {
+              "errorMessagePath": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
+              }
+            }
+          },
           "use_static_ips": {
             "type": "boolean",
             "deprecated": true,
@@ -15170,6 +15216,11 @@
               "dataPath": {
                 "type": "string",
                 "description": "Optional path to the metadata object in the response. If omitted, the metadata is assumed to be on the top level."
+              },
+              "errorMessagePath": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
               }
             }
           },
@@ -15248,6 +15299,11 @@
               "dataPath": {
                 "type": "string",
                 "description": "Optional path to the data (array) in the response. If omitted, the data is assumed to be on the top level."
+              },
+              "errorMessagePath": {
+                "type": "string",
+                "description": "Optional path to a human-readable error message in the third-party response body, used when the call fails (non-2xx status).\nIf specified and the path resolves to a string, that message is forwarded to the end user instead of a generic error.\n",
+                "example": "error.message"
               }
             }
           },
@@ -15611,7 +15667,7 @@
             "$ref": "#/components/schemas/ProviderDisplayName"
           },
           "oidc_config": {
-            "$ref": "#/components/schemas/OIDCProviderPublicConfig"
+            "$ref": "#/components/schemas/OIDCProviderConfig"
           },
           "mobile_oidc_config": {
             "$ref": "#/components/schemas/MoblieOIDCConfig"
@@ -15761,7 +15817,7 @@
       },
       "OIDCProviderConfig": {
         "type": "object",
-        "description": "OIDC provider configuration. All string fields support env var interpolation\n(incl. secrets) via mustache-like templates, e.g. `{{ env.MY_PROVIDER_CLIENT_SECRET }}`.\n",
+        "description": "OIDC provider configuration. Values are resolved at SSO invocation time\n(login / callback), so the fields below may reference org env vars via\nmustache-like templates, e.g. `{{ env.MY_PROVIDER_CLIENT_SECRET }}`.\n\nFields used to render the SSO buttons up-front (`ProviderConfig.slug`,\n`ProviderConfig.display_name`) are NOT interpolated and must be literal.\n",
         "properties": {
           "type": {
             "type": "string",
@@ -15819,63 +15875,9 @@
           "scope"
         ]
       },
-      "OIDCProviderPublicConfig": {
-        "type": "object",
-        "description": "Public OIDC provider configuration. Same as OIDCProviderConfig but never includes\nthe `client_secret` field — it is kept server-side and only used to exchange the\nauthorization code at the SSO callback. String fields are returned with env var\nplaceholders already resolved when fetched via `GET /v2/portal/public/sso/providers/{provider_slug}`.\n",
-        "properties": {
-          "type": {
-            "type": "string",
-            "enum": [
-              "authorization_code",
-              "implicit"
-            ],
-            "default": "implicit"
-          },
-          "oidc_issuer": {
-            "type": "string",
-            "description": "Issuing Authority URL",
-            "example": "https://login.microsoftonline.com/33d4f3e5-3df2-421e-b92e-a63cfa680a88/v2.0"
-          },
-          "redirect_uri": {
-            "type": "string",
-            "description": "Redirect URI for the OIDC flow",
-            "example": "https://customer-portal.com/login"
-          },
-          "client_id": {
-            "type": "string",
-            "example": "ab81daf8-8b1f-42d6-94ca-c51621054c75"
-          },
-          "has_client_secret": {
-            "type": "boolean",
-            "description": "Whether the client secret is present (the value itself is kept server-side)",
-            "example": true
-          },
-          "scope": {
-            "type": "string",
-            "description": "Space-separated list of OAuth 2.0 scopes to request from OpenID Connect",
-            "example": "openid email"
-          },
-          "metadata": {
-            "$ref": "#/components/schemas/OIDCProviderMetadata"
-          },
-          "prompt": {
-            "type": "string",
-            "enum": [
-              "login",
-              "select_account",
-              "consent"
-            ]
-          }
-        },
-        "required": [
-          "oidc_issuer",
-          "client_id",
-          "scope"
-        ]
-      },
       "MoblieOIDCConfig": {
         "type": "object",
-        "description": "Mobile OIDC configuration. All string fields support env var interpolation\n(incl. secrets) via mustache-like templates, e.g. `{{ env.MOBILE_CLIENT_SECRET }}`.\n",
+        "description": "Mobile OIDC configuration. Values are resolved at SSO invocation time, so the\nfields below may reference org env vars via mustache-like templates, e.g.\n`{{ env.MOBILE_CLIENT_SECRET }}`.\n",
         "properties": {
           "client_id": {
             "type": "string",
@@ -15892,6 +15894,18 @@
       "OIDCProviderMetadata": {
         "type": "object",
         "properties": {
+          "response_modes_supported": {
+            "type": "array",
+            "description": "Response modes the provider accepts (e.g. `form_post` for Apple)",
+            "items": {
+              "type": "string",
+              "enum": [
+                "form_post",
+                "fragment",
+                "query"
+              ]
+            }
+          },
           "authorization_endpoint": {
             "type": "string",
             "description": "URL of the authorization endpoint",