@epilot/customer-portal-client 0.49.0 → 0.51.0

package/dist/openapi.d.ts

@@ -774,6 +774,20 @@ declare namespace Components {
              * c495fef9-eeca-4019-a989-8390dcd9825b
              */
             id?: string; // uuid
+            /**
+             * Blueprint instance ids managing this block. Non-empty means the block is blueprint-managed and read-only for users until it is detached. Server-managed: ignored (stripped) on every write from a user.
+             *
+             */
+            _manifest?: string[];
+            /**
+             * Stable id of this block in the blueprint source. Server-managed.
+             */
+            _lineage_id?: string;
+            /**
+             * Reserved for author-defined block levels (e.g. `dummy`, `strict`). Not interpreted yet. Server-managed: ignored (stripped) on every write from a user.
+             *
+             */
+            _level?: string;
         }
         /**
          * The id of the block
@@ -1088,6 +1102,16 @@ declare namespace Components {
                      */
                     enabled?: boolean;
                 };
+                /**
+                 * Opt-in, set by the configuring user. When enabled, a second factor is enforced after the password and portal users can add passkeys (fingerprint, face or device PIN) as one variant of it, next to the email code of advanced_mfa. Users with a passkey use it by default; with advanced_mfa off, the passkey is the only second factor once a user has added one. On passwordless portals a passkey can replace the email code. Passkeys are bound to the domain they were added on. Default off; turning it off again restores the previous behaviour and keeps registered passkeys.
+                 *
+                 */
+                passkeys?: {
+                    /**
+                     * Enforce a second factor and allow passkeys as one variant of it
+                     */
+                    enabled?: boolean;
+                };
                 entry_point?: "PASSWORD" | "SSO";
                 preferred_sso_providers?: /**
                  * URL-friendly slug to use as organization-unique identifier for Provider
@@ -1115,6 +1139,12 @@ declare namespace Components {
                  * 6bsd0jkgoie74k2i8mrhc1vest
                  */
                 cognito_user_pool_client_id?: string;
+                /**
+                 * Cognito user pool client ID used by the native portal apps (longer refresh token validity)
+                 * example:
+                 * 3k9fj2l1m0n8b7v6c5x4z3a2s1
+                 */
+                cognito_mobile_client_id?: string;
                 /**
                  * Cognito user pool ARN
                  * example:
@@ -1497,7 +1527,7 @@ declare namespace Components {
              */
             is_dummy?: boolean;
             /**
-             * Whether this is a v3 portal configuration
+             * Always true. Legacy v2 storage was migrated; field kept for compatibility and will be removed.
              */
             is_v3_item?: boolean;
             /**
@@ -1536,6 +1566,7 @@ declare namespace Components {
              * Master toggle for the portal's engagement center (in-app notifications including the notification triggers above). Off when absent — portal users only see the engagement center and receive trigger notifications after an admin enables it.
              */
             engagement_center_enabled?: boolean;
+            engagement_center_task_templates?: /* Handlebars templates rendering each outstanding task (to-do) row in the portal's engagement center. Resolved server-side per task against the task's entity (same variable syntax as page block templates, e.g. `{{order.order_number}}`, custom and environment variables) plus `task.*` (the workflow step, e.g. `{{task.name}}`), `workflow.*` (the execution, e.g. `{{workflow.name}}`) and `entity.*` (the task's entity regardless of its schema, e.g. `{{entity._title}}`). A template that is absent or blank keeps the portal's default rendering for that line. Admin/builder-only — never exposed via the public portal config. */ EngagementCenterTaskTemplates;
         }
         export interface CommonConfigAttributesV3 {
             /**
@@ -1635,6 +1666,16 @@ declare namespace Components {
                      */
                     enabled?: boolean;
                 };
+                /**
+                 * Opt-in, set by the configuring user. When enabled, a second factor is enforced after the password and portal users can add passkeys (fingerprint, face or device PIN) as one variant of it, next to the email code of advanced_mfa. Users with a passkey use it by default; with advanced_mfa off, the passkey is the only second factor once a user has added one. On passwordless portals a passkey can replace the email code. Passkeys are bound to the domain they were added on. Default off; turning it off again restores the previous behaviour and keeps registered passkeys.
+                 *
+                 */
+                passkeys?: {
+                    /**
+                     * Enforce a second factor and allow passkeys as one variant of it
+                     */
+                    enabled?: boolean;
+                };
                 entry_point?: "PASSWORD" | "SSO";
                 preferred_sso_providers?: /**
                  * URL-friendly slug to use as organization-unique identifier for Provider
@@ -1662,6 +1703,12 @@ declare namespace Components {
                  * 6bsd0jkgoie74k2i8mrhc1vest
                  */
                 cognito_user_pool_client_id?: string;
+                /**
+                 * Cognito user pool client ID used by the native portal apps (longer refresh token validity)
+                 * example:
+                 * 3k9fj2l1m0n8b7v6c5x4z3a2s1
+                 */
+                cognito_mobile_client_id?: string;
                 /**
                  * Cognito user pool ARN
                  * example:
@@ -2044,7 +2091,7 @@ declare namespace Components {
              */
             is_dummy?: boolean;
             /**
-             * Whether this is a v3 portal configuration
+             * Always true. Legacy v2 storage was migrated; field kept for compatibility and will be removed.
              */
             is_v3_item?: boolean;
             /**
@@ -2300,6 +2347,14 @@ declare namespace Components {
              * false
              */
             has_portal_user?: boolean;
+            /**
+             * The e-mail the identified contact's portal user on this portal logs in with. It can
+             * differ from the contact's own e-mail. Present only when `has_portal_user` is true.
+             *
+             * example:
+             * john.doe@example.com
+             */
+            portal_user_email?: string;
             /**
              * Present only when no token was issued. NOT_FOUND means the given identifiers did not
              * match any contact (definitive - the client should not retry). TIMEOUT means the contact
@@ -2698,37 +2753,6 @@ declare namespace Components {
             extension?: PublicExtensionDetails;
             hook?: PublicDataRetrievalHookDetails;
         }
-        export interface DeleteEntityFile {
-            entity_id: /**
-             * Entity ID
-             * example:
-             * 5da0a718-c822-403d-9f5d-20d4584e0528
-             */
-            EntityId /* uuid */;
-            /**
-             * Entity type
-             * example:
-             * order
-             */
-            entity_type: string;
-            /**
-             * Array of file entity IDs
-             */
-            file_entity_ids: [
-                /**
-                 * Entity ID
-                 * example:
-                 * 5da0a718-c822-403d-9f5d-20d4584e0528
-                 */
-                EntityId /* uuid */,
-                .../**
-                 * Entity ID
-                 * example:
-                 * 5da0a718-c822-403d-9f5d-20d4584e0528
-                 */
-                EntityId /* uuid */[]
-            ];
-        }
         export type Direction = "feed-in" | "feed-out";
         export interface DocumentWidget {
             id: string;
@@ -2903,6 +2927,23 @@ declare namespace Components {
              */
             EntityId /* uuid */;
         }
+        /**
+         * Handlebars templates rendering each outstanding task (to-do) row in the portal's engagement center. Resolved server-side per task against the task's entity (same variable syntax as page block templates, e.g. `{{order.order_number}}`, custom and environment variables) plus `task.*` (the workflow step, e.g. `{{task.name}}`), `workflow.*` (the execution, e.g. `{{workflow.name}}`) and `entity.*` (the task's entity regardless of its schema, e.g. `{{entity._title}}`). A template that is absent or blank keeps the portal's default rendering for that line. Admin/builder-only — never exposed via the public portal config.
+         */
+        export interface EngagementCenterTaskTemplates {
+            /**
+             * Template for the row title. Default rendering is the step name.
+             * example:
+             * {{task.name}}
+             */
+            title?: string;
+            /**
+             * Template for the row's context line. Default rendering is the workflow name and the entity title.
+             * example:
+             * {{workflow.name}} · {{entity._title}}
+             */
+            subtitle?: string;
+        }
         export interface Entity {
             [name: string]: any;
             /**
@@ -3404,10 +3445,18 @@ declare namespace Components {
                 [name: string]: string | number;
             };
             /**
-             * example:
-             * _created_at:desc
+             * Sort order of the results: an `attribute:order` pair, or a list of Elasticsearch sort fields that are
+             * used as they are, e.g. the sort order of a target as returned by the Targeting API.
+             * Without a sort, the sort order of the first requested target that defines one applies.
+             *
+             */
+            sort?: /**
+             * Sort order of the results: an `attribute:order` pair, or a list of Elasticsearch sort fields that are
+             * used as they are, e.g. the sort order of a target as returned by the Targeting API.
+             * Without a sort, the sort order of the first requested target that defines one applies.
+             *
              */
-            sort?: string;
+            string | string /* ^[^\s:,]+:(asc|desc)$ */[];
             from?: number;
             /**
              * Max search size is 1000 with higher values defaulting to 1000
@@ -5065,6 +5114,23 @@ declare namespace Components {
              */
             effect?: "allow" | "deny";
         }
+        /**
+         * A blueprint-managed page or block a write tried to change; the stored version was kept.
+         */
+        export interface HeldBackNode {
+            /**
+             * example:
+             * 5da0a718-c822-403d-9f5d-20d4584e0528
+             */
+            page_id: string;
+            /**
+             * Set when a single block (not the whole page) was held back
+             * example:
+             * c495fef9-eeca-4019-a989-8390dcd9825b
+             */
+            block_id?: string;
+            reason: "BLUEPRINT_MANAGED";
+        }
         export interface IdentifierAttribute {
             /**
              * Label attribute
@@ -5237,6 +5303,16 @@ declare namespace Components {
                     token: string;
                     at?: string;
                 };
+                /**
+                 * Tells journey-api which route to link; omitted for a portal without an id
+                 */
+                link_hint?: {
+                    route: "portal-settings";
+                    params: {
+                        portal_id: string;
+                        settings?: "journey-actions";
+                    };
+                };
             }[];
         }
         export interface JuiceSettings {
@@ -5279,10 +5355,45 @@ declare namespace Components {
              */
             design_id?: string;
             /**
-             * The portal design as returned by design-builder parse (theme=NEW), for the served document; absent when the design could not be read
+             * Portal design background and accent for the served document. `null` when the portal has no design or it could not be read.
+             *
              */
             design?: {
-                [name: string]: any;
+                /**
+                 * Spark background as hex colours; `null` when the design sets neither
+                 */
+                background: {
+                    /**
+                     * example:
+                     * #f5f5f5
+                     */
+                    light: string | null; // ^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$
+                    /**
+                     * example:
+                     * #101010
+                     */
+                    dark: string | null; // ^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$
+                } | null;
+                /**
+                 * Spark accent as hex colours, falling back to the classic palette primary; dark falls back to light. `null` when the design sets neither
+                 *
+                 */
+                accent: {
+                    /**
+                     * example:
+                     * #005eb4
+                     */
+                    light: string | null; // ^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$
+                    /**
+                     * example:
+                     * #4a9eff
+                     */
+                    dark: string | null; // ^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$
+                } | null;
+                /**
+                 * When the design was last saved
+                 */
+                last_modified_at: string | null;
             } | null;
         }
         /**
@@ -5448,6 +5559,27 @@ declare namespace Components {
                 [name: string]: string;
             };
         }
+        /**
+         * Display details of the counter the readings belong to. Only returned when `include_counter` is true and the counter could be resolved.
+         */
+        export interface MeterReadingCounterDetails {
+            /**
+             * example:
+             * kwh
+             */
+            unit?: string | null;
+            /**
+             * example:
+             * 1-1:1.8.1
+             */
+            obis_number?: string | null;
+            /**
+             * example:
+             * feed-in
+             */
+            direction?: string | null;
+            tariff_type?: string | null;
+        }
         export interface MeterReadingPhoto {
             /**
              * example:
@@ -5715,11 +5847,11 @@ declare namespace Components {
         }
         export interface NotificationTriggerConfig {
             /**
-             * The 360 event that fires this notification trigger.
+             * The 360 event that fires this notification trigger. `entity_added` is the unified trigger written by the Portal Builder: it fires for both the entity-created and the entity-assigned event of its `entity_schema`. `entity_created` / `entity_assigned` are the legacy per-event triggers and keep working; when a portal has both a legacy row and an `entity_added` row for the same schema, the legacy row wins for its event.
              */
-            trigger_type: "entity_created" | "entity_assigned" | "workflow_step_overdue";
+            trigger_type: "entity_added" | "entity_created" | "entity_assigned" | "workflow_step_overdue";
             /**
-             * For `entity_created` / `entity_assigned` triggers, the entity schema slug (e.g. `opportunity`, `order`) whose creation or assignment fires this trigger. Ignored for other trigger types.
+             * For `entity_added` / `entity_created` / `entity_assigned` triggers, the entity schema slug (e.g. `opportunity`, `order`) whose creation or assignment fires this trigger. Ignored for other trigger types.
              * example:
              * opportunity
              */
@@ -5732,6 +5864,10 @@ declare namespace Components {
              * Entity id of the notification_template to render for this trigger.
              */
             template_id?: string; // uuid
+            /**
+             * Targeting segment ids (targets) that narrow this trigger's recipients: the notification is only created for portal users whose contact matches at least one of the targets. Absent or empty means no narrowing — every portal user linked to the entity's contacts is notified.
+             */
+            target_ids?: string[];
         }
         /**
          * OIDC provider configuration. Values are resolved at SSO invocation time
@@ -6156,6 +6292,14 @@ declare namespace Components {
              * Whether submitting the journey from the portal should auto-complete the task. When false, an internal user completes it.
              */
             complete_task_automatically?: boolean;
+            /**
+             * Row title rendered from the portal's `engagement_center_task_templates.title`. Absent when the portal has no title template or it rendered blank for this task; the client then shows `step_name`.
+             */
+            title?: string;
+            /**
+             * Row context line rendered from the portal's `engagement_center_task_templates.subtitle`. Absent when the portal has no subtitle template or it rendered blank for this task; the client then shows the workflow name and entity title.
+             */
+            subtitle?: string;
         }
         export interface Page {
             [name: string]: any;
@@ -6307,6 +6451,21 @@ declare namespace Components {
              * ]
              */
             past_routes?: string[];
+            /**
+             * Blueprint instance ids managing this page. Non-empty means the page is blueprint-managed: its page-level fields and its blueprint-managed blocks are read-only for users (single-target writes answer 409 `BLUEPRINT_MANAGED`, bulk saves keep the stored version), while detached and customer-added blocks on it stay editable and the page keeps receiving blueprint updates. Server-managed: ignored (stripped) on every write from a user.
+             *
+             */
+            _manifest?: string[];
+            /**
+             * Stable id of this page in the blueprint source. Set once: a blueprint install or update (`page_upsert_mode=slug`, portal create, or a revision with `revision_source` `blueprint_sync`) may give a page the lineage it does not have yet, unless another page of the portal holds it. After that it never changes; every other write keeps the stored value. Locks nothing on its own.
+             *
+             */
+            _lineage_id?: string;
+            /**
+             * Lineage ids of blocks on this page that were detached from their blueprint; a blueprint sync leaves them alone. Server-managed.
+             *
+             */
+            detached_lineage_ids?: string[];
         }
         export interface PageRequest {
             [name: string]: any;
@@ -6539,6 +6698,16 @@ declare namespace Components {
                      */
                     enabled?: boolean;
                 };
+                /**
+                 * Opt-in, set by the configuring user. When enabled, a second factor is enforced after the password and portal users can add passkeys (fingerprint, face or device PIN) as one variant of it, next to the email code of advanced_mfa. Users with a passkey use it by default; with advanced_mfa off, the passkey is the only second factor once a user has added one. On passwordless portals a passkey can replace the email code. Passkeys are bound to the domain they were added on. Default off; turning it off again restores the previous behaviour and keeps registered passkeys.
+                 *
+                 */
+                passkeys?: {
+                    /**
+                     * Enforce a second factor and allow passkeys as one variant of it
+                     */
+                    enabled?: boolean;
+                };
                 entry_point?: "PASSWORD" | "SSO";
                 preferred_sso_providers?: /**
                  * URL-friendly slug to use as organization-unique identifier for Provider
@@ -6566,6 +6735,12 @@ declare namespace Components {
                  * 6bsd0jkgoie74k2i8mrhc1vest
                  */
                 cognito_user_pool_client_id?: string;
+                /**
+                 * Cognito user pool client ID used by the native portal apps (longer refresh token validity)
+                 * example:
+                 * 3k9fj2l1m0n8b7v6c5x4z3a2s1
+                 */
+                cognito_mobile_client_id?: string;
                 /**
                  * Cognito user pool ARN
                  * example:
@@ -6948,7 +7123,7 @@ declare namespace Components {
              */
             is_dummy?: boolean;
             /**
-             * Whether this is a v3 portal configuration
+             * Always true. Legacy v2 storage was migrated; field kept for compatibility and will be removed.
              */
             is_v3_item?: boolean;
             /**
@@ -6987,6 +7162,7 @@ declare namespace Components {
              * Master toggle for the portal's engagement center (in-app notifications including the notification triggers above). Off when absent — portal users only see the engagement center and receive trigger notifications after an admin enables it.
              */
             engagement_center_enabled?: boolean;
+            engagement_center_task_templates?: /* Handlebars templates rendering each outstanding task (to-do) row in the portal's engagement center. Resolved server-side per task against the task's entity (same variable syntax as page block templates, e.g. `{{order.order_number}}`, custom and environment variables) plus `task.*` (the workflow step, e.g. `{{task.name}}`), `workflow.*` (the execution, e.g. `{{workflow.name}}`) and `entity.*` (the task's entity regardless of its schema, e.g. `{{entity._title}}`). A template that is absent or blank keeps the portal's default rendering for that line. Admin/builder-only — never exposed via the public portal config. */ EngagementCenterTaskTemplates;
             /**
              * ID of the organization
              * example:
@@ -6999,6 +7175,26 @@ declare namespace Components {
              * 12345
              */
             organization_id?: string;
+            /**
+             * Blueprint instance ids managing this portal. Server-managed: ignored (stripped) on every write from a user.
+             *
+             */
+            _manifest?: string[];
+            /**
+             * Id of this portal in the blueprint source. Set once: a blueprint install or update (portal create, `page_upsert_mode=slug`, or a revision with `revision_source` `blueprint_sync`) may give a portal the lineage it does not have yet, unless another portal of the organization holds it. A portal created as a copy next to the organization's live portal of its origin (downgraded to `ADDITIONAL_PORTAL`) never takes it. After that it never changes; every other write keeps the stored value. Locks nothing on its own.
+             *
+             */
+            _lineage_id?: string;
+            /**
+             * Lineage ids of pages detached from their blueprint; a blueprint sync leaves them alone. Server-managed.
+             *
+             */
+            detached_lineage_ids?: string[];
+            /**
+             * Only present on write responses: blueprint-managed pages/blocks the request tried to change. Their stored version was kept and the rest of the save succeeded.
+             *
+             */
+            held_back?: /* A blueprint-managed page or block a write tried to change; the stored version was kept. */ HeldBackNode[];
             /**
              * Organization settings
              */
@@ -7033,6 +7229,19 @@ declare namespace Components {
              */
             grants?: Grant[];
             identity_providers?: ProviderPublicConfig[];
+            /**
+             * Present only when the request carried a valid `x-portal-preview-token`: the config is this revision's, not the live one.
+             *
+             */
+            preview_revision?: {
+                /**
+                 * example:
+                 * 2026-08-25T14:03:11.482Z-a7f3c1d9
+                 */
+                revision_id: string;
+                name?: string;
+                created_at: string; // date-time
+            };
         }
         /**
          * Lightweight view of a portal config for lists and pickers. Carries the identifying,
@@ -7296,6 +7505,16 @@ declare namespace Components {
                      */
                     enabled?: boolean;
                 };
+                /**
+                 * Opt-in, set by the configuring user. When enabled, a second factor is enforced after the password and portal users can add passkeys (fingerprint, face or device PIN) as one variant of it, next to the email code of advanced_mfa. Users with a passkey use it by default; with advanced_mfa off, the passkey is the only second factor once a user has added one. On passwordless portals a passkey can replace the email code. Passkeys are bound to the domain they were added on. Default off; turning it off again restores the previous behaviour and keeps registered passkeys.
+                 *
+                 */
+                passkeys?: {
+                    /**
+                     * Enforce a second factor and allow passkeys as one variant of it
+                     */
+                    enabled?: boolean;
+                };
                 entry_point?: "PASSWORD" | "SSO";
                 preferred_sso_providers?: /**
                  * URL-friendly slug to use as organization-unique identifier for Provider
@@ -7323,6 +7542,12 @@ declare namespace Components {
                  * 6bsd0jkgoie74k2i8mrhc1vest
                  */
                 cognito_user_pool_client_id?: string;
+                /**
+                 * Cognito user pool client ID used by the native portal apps (longer refresh token validity)
+                 * example:
+                 * 3k9fj2l1m0n8b7v6c5x4z3a2s1
+                 */
+                cognito_mobile_client_id?: string;
                 /**
                  * Cognito user pool ARN
                  * example:
@@ -7705,7 +7930,7 @@ declare namespace Components {
              */
             is_dummy?: boolean;
             /**
-             * Whether this is a v3 portal configuration
+             * Always true. Legacy v2 storage was migrated; field kept for compatibility and will be removed.
              */
             is_v3_item?: boolean;
             /**
@@ -7774,6 +7999,71 @@ declare namespace Components {
             grants?: Grant[];
             pages?: Page[];
         }
+        /**
+         * Contact attributes a portal user can change. Other attributes are ignored.
+         * Value types follow the organization's contact schema.
+         *
+         */
+        export interface PortalContactUpdate {
+            [name: string]: any;
+            /**
+             * example:
+             * de
+             */
+            language?: string;
+            first_name?: any;
+            last_name?: any;
+            salutation?: any;
+            phone?: any;
+            phone_number?: any;
+            mobile?: any;
+            street?: any;
+            street_number?: any;
+            postal_code?: any;
+            city?: any;
+            country?: any;
+            preferred_language?: any;
+            communication_preferences?: any;
+        }
+        /**
+         * Contract attributes a portal user can change. Other attributes are ignored.
+         */
+        export interface PortalContractUpdate {
+            [name: string]: any;
+            /**
+             * Installment amount in cents
+             * example:
+             * 8500
+             */
+            installment_amount?: number;
+            /**
+             * Installment amount as a decimal string
+             * example:
+             * 85.00
+             */
+            installment_amount_decimal?: string;
+        }
+        /**
+         * Limits portal chat to portal users matching targets, with the same rules as page and block visibility. Without targets every signed-in portal user can use the chat.
+         */
+        export interface PortalCopilotVisibility {
+            /**
+             * Target IDs that must match for the portal user to use the chat
+             */
+            visible_for_targets?: string[];
+            /**
+             * Operator for visible_for_targets matching
+             */
+            visible_for_operator?: "and" | "or";
+            /**
+             * Target IDs that if matched deny the portal user the chat
+             */
+            hidden_for_targets?: string[];
+            /**
+             * Operator for hidden_for_targets matching
+             */
+            hidden_for_operator?: "and" | "or";
+        }
         /**
          * One column of the portal data export CSV.
          */
@@ -7889,6 +8179,7 @@ declare namespace Components {
              * ID of the Agent Builder portal agent this portal's copilot chat runs, set by Agent Builder. When unset, or when the agent no longer exists in the portal's organization, the chat runs the default portal copilot.
              */
             portal_copilot_agent_id?: string;
+            portal_copilot_visibility?: /* Limits portal chat to portal users matching targets, with the same rules as page and block visibility. Without targets every signed-in portal user can use the chat. */ PortalCopilotVisibility;
         }
         /**
          * ID of the portal
@@ -8111,6 +8402,23 @@ declare namespace Components {
              */
             next_cursor?: string;
         }
+        export interface PortalRevisionPreview {
+            /**
+             * Short-lived token that makes portal reads return this revision. Send it in the `x-portal-preview-token` header.
+             *
+             */
+            preview_token: string;
+            /**
+             * When the preview token stops being honoured.
+             */
+            expires_at: string; // date-time
+            /**
+             * Link that opens the revision in the portal on its live domain.
+             * example:
+             * https://portal.example.com/?preview_token=eyJhbGciOiJIUzI1NiIs...
+             */
+            url: string;
+        }
         export interface PortalRevisionRequest {
             [name: string]: any;
             /**
@@ -8271,6 +8579,16 @@ declare namespace Components {
                      */
                     enabled?: boolean;
                 };
+                /**
+                 * Opt-in, set by the configuring user. When enabled, a second factor is enforced after the password and portal users can add passkeys (fingerprint, face or device PIN) as one variant of it, next to the email code of advanced_mfa. Users with a passkey use it by default; with advanced_mfa off, the passkey is the only second factor once a user has added one. On passwordless portals a passkey can replace the email code. Passkeys are bound to the domain they were added on. Default off; turning it off again restores the previous behaviour and keeps registered passkeys.
+                 *
+                 */
+                passkeys?: {
+                    /**
+                     * Enforce a second factor and allow passkeys as one variant of it
+                     */
+                    enabled?: boolean;
+                };
                 entry_point?: "PASSWORD" | "SSO";
                 preferred_sso_providers?: /**
                  * URL-friendly slug to use as organization-unique identifier for Provider
@@ -8298,6 +8616,12 @@ declare namespace Components {
                  * 6bsd0jkgoie74k2i8mrhc1vest
                  */
                 cognito_user_pool_client_id?: string;
+                /**
+                 * Cognito user pool client ID used by the native portal apps (longer refresh token validity)
+                 * example:
+                 * 3k9fj2l1m0n8b7v6c5x4z3a2s1
+                 */
+                cognito_mobile_client_id?: string;
                 /**
                  * Cognito user pool ARN
                  * example:
@@ -8680,7 +9004,7 @@ declare namespace Components {
              */
             is_dummy?: boolean;
             /**
-             * Whether this is a v3 portal configuration
+             * Always true. Legacy v2 storage was migrated; field kept for compatibility and will be removed.
              */
             is_v3_item?: boolean;
             /**
@@ -8959,6 +9283,37 @@ declare namespace Components {
             }[];
             _schema: "portal_user";
         }
+        /**
+         * Resolved notification preferences of a portal user. Notifications are opt-out: a channel that was never stored on the portal user resolves to enabled (true).
+         */
+        export interface PortalUserNotificationPreferences {
+            /**
+             * Whether the portal user receives in-app notifications.
+             * example:
+             * true
+             */
+            in_app: boolean;
+        }
+        export interface PortalUserPasskey {
+            /**
+             * WebAuthn credential ID (base64url)
+             */
+            credential_id: string;
+            name?: string;
+            /**
+             * Domain the passkey works on
+             * example:
+             * kundenportal.example.de
+             */
+            rp_id: string;
+            device_type?: "singleDevice" | "multiDevice";
+            /**
+             * Whether the passkey is synced, e.g. via iCloud Keychain or Google Password Manager
+             */
+            backed_up?: boolean;
+            created_at: string; // date-time
+            last_used_at?: string; // date-time
+        }
         export type PortalUserRegistrationStatus = "Registration Pending" | "Confirmation Email Sent" | "Registered" | "Email Update In Progress";
         /**
          * A portal whose design_id is the design asked about.
@@ -9141,9 +9496,19 @@ declare namespace Components {
              * True when the task has been reached in the execution — all predecessor tasks on its
              * path are completed/skipped — so the portal user can act on it (e.g. start its journey).
              * Tasks that are only part of the projected future path are returned with is_active false.
+             * The start date is not taken into account: an active task can still be upcoming (see start_date).
              *
              */
             is_active: boolean;
+            /**
+             * Instant before which nobody may work on the task. While it lies in the future, a task
+             * that is not done yet is upcoming: the Workflows API refuses to complete it, so the
+             * portal shows it as upcoming instead of offering its journey. Neither status nor
+             * is_active reflects it; compare it with the current time. Absent when the task has no
+             * start date or its relative start date has not been resolved yet.
+             *
+             */
+            start_date?: string; // date-time
             ecp?: /* Portal-specific (ECP / installer) display config of a workflow task */ PortalTaskConfig;
             installer?: /* Portal-specific (ECP / installer) display config of a workflow task */ PortalTaskConfig;
             /**
@@ -9187,10 +9552,22 @@ declare namespace Components {
             updated_at?: string;
         }
         /**
-         * The product entity
+         * The revision a config response shows instead of the live portal config.
          */
-        export interface Product {
-            [name: string]: any;
+        export interface PreviewRevision {
+            /**
+             * example:
+             * 2026-08-25T14:03:11.482Z-a7f3c1d9
+             */
+            revision_id: string;
+            name?: string;
+            created_at: string; // date-time
+        }
+        /**
+         * The product entity
+         */
+        export interface Product {
+            [name: string]: any;
             _id: /**
              * Entity ID
              * example:
@@ -9340,6 +9717,21 @@ declare namespace Components {
              * false
              */
             expose_client_secret?: boolean;
+            /**
+             * Temporarily enables SSO debug mode for this provider. While the current time is
+             * before this timestamp, failed SSO logins and token exchanges answer with a `debug`
+             * object (`SSODebugInfo`) next to the error, so admins can see the real cause (e.g. the
+             * IdP's `AADSTS…` error) on the portal login page.
+             *
+             * Capped at 24 hours from the time of the write (plus 5 minutes clock-skew tolerance);
+             * a later value is rejected with 400. `null` or absent turns debug mode off, and an
+             * expired value is simply inactive. Never exposed publicly — public reads only carry
+             * the derived `debug_mode` flag.
+             *
+             * example:
+             * 2026-10-30T12:00:00.000Z
+             */
+            debug_mode_until?: string | null; // date-time
         }
         /**
          * Human-readable display name for identity provider shown in login
@@ -9377,6 +9769,15 @@ declare namespace Components {
              *
              */
             MoblieOIDCConfig;
+            /**
+             * Derived from `ProviderConfig.debug_mode_until`: `true` only while SSO debug mode is
+             * active for this provider. Clients may use it to show technical error details on
+             * failed SSO logins. Absent or `false` when debug mode is off.
+             *
+             * example:
+             * false
+             */
+            debug_mode?: boolean;
         }
         /**
          * Web-only public provider configuration served by `getPublicSSOProviderV3`.
@@ -9409,6 +9810,15 @@ declare namespace Components {
              *
              */
             OIDCProviderConfig;
+            /**
+             * Derived from `ProviderConfig.debug_mode_until`: `true` only while SSO debug mode is
+             * active for this provider. Clients may use it to show technical error details on
+             * failed SSO logins. Absent or `false` when debug mode is off.
+             *
+             * example:
+             * false
+             */
+            debug_mode?: boolean;
         }
         /**
          * URL-friendly slug to use as organization-unique identifier for Provider
@@ -9598,12 +10008,17 @@ declare namespace Components {
              * Stable, machine-readable codes for best-effort post-publish side effects that exhausted their retries. Publishing itself succeeded; these are not error messages and not meant for display as-is. Clients map each code to their own localized text.
              * Known codes: `allowed_entities_change` (portal entity grants and detail pages did not sync), `dns_records_clear` (the previous domain's DNS records were not cleared). New codes may be added without a client update, so treat an unrecognized code as a generic "a follow-up step did not finish" case rather than an error.
              *
+             */
+            post_publish_warnings: string[];
+            /**
+             * Only present when non-empty: blueprint-managed live pages/blocks this publish could not replace because the publisher is not the owning blueprint. Their live version stays as it is; the rest of the revision was published. Detach a node to make it publishable.
+             *
              * example:
              * [
              *   "allowed_entities_change"
              * ]
              */
-            post_publish_warnings: string[];
+            held_back?: /* A blueprint-managed page or block a write tried to change; the stored version was kept. */ HeldBackNode[];
         }
         export interface PublishRevisionRequest {
             /**
@@ -9918,6 +10333,21 @@ declare namespace Components {
              * ]
              */
             past_routes?: string[];
+            /**
+             * Blueprint instance ids managing this page. Non-empty means the page is blueprint-managed: its page-level fields and its blueprint-managed blocks are read-only for users (single-target writes answer 409 `BLUEPRINT_MANAGED`, bulk saves keep the stored version), while detached and customer-added blocks on it stay editable and the page keeps receiving blueprint updates. Server-managed: ignored (stripped) on every write from a user.
+             *
+             */
+            _manifest?: string[];
+            /**
+             * Stable id of this page in the blueprint source. Set once: a blueprint install or update (`page_upsert_mode=slug`, portal create, or a revision with `revision_source` `blueprint_sync`) may give a page the lineage it does not have yet, unless another page of the portal holds it. After that it never changes; every other write keeps the stored value. Locks nothing on its own.
+             *
+             */
+            _lineage_id?: string;
+            /**
+             * Lineage ids of blocks on this page that were detached from their blueprint; a blueprint sync leaves them alone. Server-managed.
+             *
+             */
+            detached_lineage_ids?: string[];
             org_id?: string;
         }
         /**
@@ -10052,6 +10482,101 @@ declare namespace Components {
              */
             scope?: string;
         }
+        /**
+         * Technical details of a failed SSO login or token exchange, returned only while SSO debug
+         * mode is active for the provider. Never carries secrets, authorization codes, PKCE
+         * verifiers, tokens or claim values.
+         *
+         */
+        export interface SSODebugInfo {
+            /**
+             * Which step failed — the backend token exchange (`ssoCallback`) or the login (`ssoLogin`).
+             */
+            stage?: "exchange" | "login";
+            /**
+             * Stable reason code, e.g. `TOKEN_EXCHANGE_FAILED`, `MISSING_EMAIL_CLAIM`, `INVALID_PROVIDER`.
+             * example:
+             * TOKEN_EXCHANGE_FAILED
+             */
+            reason?: string;
+            /**
+             * The API's error message.
+             */
+            message?: string;
+            /**
+             * HTTP status the IdP's token endpoint answered with.
+             * example:
+             * 401
+             */
+            upstream_status?: number;
+            /**
+             * The IdP's RFC 6749 §5.2 `error`.
+             * example:
+             * invalid_client
+             */
+            oauth_error?: string;
+            /**
+             * The IdP's RFC 6749 §5.2 `error_description` (e.g. the full `AADSTS…` text).
+             */
+            oauth_error_description?: string;
+            /**
+             * example:
+             * login.microsoftonline.com
+             */
+            token_endpoint_host?: string;
+            /**
+             * Path of the configured token endpoint, without query.
+             * example:
+             * /contoso.onmicrosoft.com/oauth2/v2.0/token
+             */
+            token_endpoint_path?: string;
+            /**
+             * The redirect URI sent in the token exchange.
+             */
+            redirect_uri?: string;
+            /**
+             * Names (never values) of the claims received from the IdP.
+             */
+            received_claims?: string[];
+            /**
+             * API request id, for support.
+             */
+            request_id?: string;
+            /**
+             * English hint for well-known IdP errors.
+             */
+            hint?: string;
+        }
+        /**
+         * Error response of the public SSO endpoints. Like every error response the message is in
+         * `error`; `reason` carries a stable machine-readable cause when one is known (e.g.
+         * `MISSING_EMAIL_CLAIM`, `INVALID_PROVIDER`, `SELF_REGISTRATION_NOT_ALLOWED`,
+         * `TOKEN_EXCHANGE_FAILED`). `debug` is only present while SSO debug mode is active for the
+         * resolved provider (`ProviderConfig.debug_mode_until`).
+         *
+         */
+        export interface SSOErrorResp {
+            /**
+             * example:
+             * 400
+             */
+            status?: number;
+            /**
+             * Error message
+             */
+            error?: string;
+            /**
+             * Machine-readable cause, when the API can name one.
+             */
+            reason?: string;
+            debug?: /**
+             * Technical details of a failed SSO login or token exchange, returned only while SSO debug
+             * mode is active for the provider. Never carries secrets, authorization codes, PKCE
+             * verifiers, tokens or claim values.
+             *
+             */
+            SSODebugInfo;
+        }
         export type SSOLoginToken = string;
         export interface SaveEntityFile {
             entity_id: /**
@@ -10552,6 +11077,16 @@ declare namespace Components {
                      */
                     enabled?: boolean;
                 };
+                /**
+                 * Opt-in, set by the configuring user. When enabled, a second factor is enforced after the password and portal users can add passkeys (fingerprint, face or device PIN) as one variant of it, next to the email code of advanced_mfa. Users with a passkey use it by default; with advanced_mfa off, the passkey is the only second factor once a user has added one. On passwordless portals a passkey can replace the email code. Passkeys are bound to the domain they were added on. Default off; turning it off again restores the previous behaviour and keeps registered passkeys.
+                 *
+                 */
+                passkeys?: {
+                    /**
+                     * Enforce a second factor and allow passkeys as one variant of it
+                     */
+                    enabled?: boolean;
+                };
                 entry_point?: "PASSWORD" | "SSO";
                 preferred_sso_providers?: /**
                  * URL-friendly slug to use as organization-unique identifier for Provider
@@ -10579,6 +11114,12 @@ declare namespace Components {
                  * 6bsd0jkgoie74k2i8mrhc1vest
                  */
                 cognito_user_pool_client_id?: string;
+                /**
+                 * Cognito user pool client ID used by the native portal apps (longer refresh token validity)
+                 * example:
+                 * 3k9fj2l1m0n8b7v6c5x4z3a2s1
+                 */
+                cognito_mobile_client_id?: string;
                 /**
                  * Cognito user pool ARN
                  * example:
@@ -10961,7 +11502,7 @@ declare namespace Components {
              */
             is_dummy?: boolean;
             /**
-             * Whether this is a v3 portal configuration
+             * Always true. Legacy v2 storage was migrated; field kept for compatibility and will be removed.
              */
             is_v3_item?: boolean;
             /**
@@ -11000,6 +11541,7 @@ declare namespace Components {
              * Master toggle for the portal's engagement center (in-app notifications including the notification triggers above). Off when absent — portal users only see the engagement center and receive trigger notifications after an admin enables it.
              */
             engagement_center_enabled?: boolean;
+            engagement_center_task_templates?: /* Handlebars templates rendering each outstanding task (to-do) row in the portal's engagement center. Resolved server-side per task against the task's entity (same variable syntax as page block templates, e.g. `{{order.order_number}}`, custom and environment variables) plus `task.*` (the workflow step, e.g. `{{task.name}}`), `workflow.*` (the execution, e.g. `{{workflow.name}}`) and `entity.*` (the task's entity regardless of its schema, e.g. `{{entity._title}}`). A template that is absent or blank keeps the portal's default rendering for that line. Admin/builder-only — never exposed via the public portal config. */ EngagementCenterTaskTemplates;
         }
         export interface UpsertPortalConfigV3 {
             /**
@@ -11160,6 +11702,16 @@ declare namespace Components {
                      */
                     enabled?: boolean;
                 };
+                /**
+                 * Opt-in, set by the configuring user. When enabled, a second factor is enforced after the password and portal users can add passkeys (fingerprint, face or device PIN) as one variant of it, next to the email code of advanced_mfa. Users with a passkey use it by default; with advanced_mfa off, the passkey is the only second factor once a user has added one. On passwordless portals a passkey can replace the email code. Passkeys are bound to the domain they were added on. Default off; turning it off again restores the previous behaviour and keeps registered passkeys.
+                 *
+                 */
+                passkeys?: {
+                    /**
+                     * Enforce a second factor and allow passkeys as one variant of it
+                     */
+                    enabled?: boolean;
+                };
                 entry_point?: "PASSWORD" | "SSO";
                 preferred_sso_providers?: /**
                  * URL-friendly slug to use as organization-unique identifier for Provider
@@ -11187,6 +11739,12 @@ declare namespace Components {
                  * 6bsd0jkgoie74k2i8mrhc1vest
                  */
                 cognito_user_pool_client_id?: string;
+                /**
+                 * Cognito user pool client ID used by the native portal apps (longer refresh token validity)
+                 * example:
+                 * 3k9fj2l1m0n8b7v6c5x4z3a2s1
+                 */
+                cognito_mobile_client_id?: string;
                 /**
                  * Cognito user pool ARN
                  * example:
@@ -11569,7 +12127,7 @@ declare namespace Components {
              */
             is_dummy?: boolean;
             /**
-             * Whether this is a v3 portal configuration
+             * Always true. Legacy v2 storage was migrated; field kept for compatibility and will be removed.
              */
             is_v3_item?: boolean;
             /**
@@ -11605,7 +12163,7 @@ declare namespace Components {
              */
             portal_sk_v3?: string;
             /**
-             * Indicates whether the widget configuration is stored as a V3 portal-scoped item
+             * Always true. Legacy v2 storage was migrated; field kept for compatibility and will be removed.
              */
             is_v3_item?: boolean;
             widgets: PortalWidget[];
@@ -11859,6 +12417,27 @@ declare namespace Paths {
             export type $500 = Components.Responses.InternalServerError;
         }
     }
+    namespace AddPortalUserPasskey {
+        export interface RequestBody {
+            /**
+             * WebAuthn RegistrationResponseJSON from the browser
+             */
+            registration_response: {
+                [name: string]: any;
+            };
+            /**
+             * Label shown to the user, e.g. "iPhone"
+             */
+            name?: string;
+        }
+        namespace Responses {
+            export type $201 = Components.Schemas.PortalUserPasskey;
+            export type $400 = Components.Responses.InvalidRequest;
+            export type $401 = Components.Responses.Unauthorized;
+            export type $403 = Components.Responses.Forbidden;
+            export type $500 = Components.Responses.InternalServerError;
+        }
+    }
     namespace CanTriggerPortalFlow {
         namespace Parameters {
             export type Origin = /* Origin of the portal */ Components.Schemas.Origin;
@@ -12375,6 +12954,40 @@ declare namespace Paths {
             export type $500 = Components.Responses.InternalServerError;
         }
     }
+    namespace CreatePortalRevisionPreview {
+        namespace Parameters {
+            /**
+             * example:
+             * 5da0a718-c822-403d-9f5d-20d4584e0528
+             */
+            export type PortalId = string; // uuid
+            /**
+             * example:
+             * 2026-08-25T14:03:11.482Z-a7f3c1d9
+             */
+            export type RevisionId = string;
+        }
+        export interface PathParameters {
+            portal_id: /**
+             * example:
+             * 5da0a718-c822-403d-9f5d-20d4584e0528
+             */
+            Parameters.PortalId /* uuid */;
+            revision_id: /**
+             * example:
+             * 2026-08-25T14:03:11.482Z-a7f3c1d9
+             */
+            Parameters.RevisionId;
+        }
+        namespace Responses {
+            export type $200 = Components.Schemas.PortalRevisionPreview;
+            export type $400 = Components.Responses.InvalidRequest;
+            export type $401 = Components.Responses.Unauthorized;
+            export type $403 = Components.Responses.Forbidden;
+            export type $404 = Components.Responses.NotFound;
+            export type $500 = Components.Responses.InternalServerError;
+        }
+    }
     namespace CreatePortalUserEntity {
         namespace Parameters {
             /**
@@ -12399,6 +13012,23 @@ declare namespace Paths {
             export type $500 = Components.Responses.InternalServerError;
         }
     }
+    namespace CreatePortalUserPasskeyRegistrationOptions {
+        export interface RequestBody {
+            /**
+             * The 6-digit code sent to the user's email address
+             */
+            verification_code: string;
+        }
+        namespace Responses {
+            export interface $200 {
+                [name: string]: any;
+            }
+            export type $400 = Components.Responses.InvalidRequest;
+            export type $401 = Components.Responses.Unauthorized;
+            export type $403 = Components.Responses.Forbidden;
+            export type $500 = Components.Responses.InternalServerError;
+        }
+    }
     namespace CreateUser {
         namespace Parameters {
             export type Origin = /* Origin of the portal */ Components.Schemas.Origin;
@@ -12454,24 +13084,6 @@ declare namespace Paths {
             export type $500 = Components.Responses.InternalServerError;
         }
     }
-    namespace DeleteEntityFile {
-        export type RequestBody = Components.Schemas.DeleteEntityFile;
-        namespace Responses {
-            export interface $202 {
-                deletedFiles?: /**
-                 * Entity ID
-                 * example:
-                 * 5da0a718-c822-403d-9f5d-20d4584e0528
-                 */
-                Components.Schemas.EntityId /* uuid */[];
-            }
-            export type $400 = Components.Responses.InvalidRequest;
-            export type $401 = Components.Responses.Unauthorized;
-            export type $403 = Components.Responses.Forbidden;
-            export type $404 = Components.Responses.NotFound;
-            export type $500 = Components.Responses.InternalServerError;
-        }
-    }
     namespace DeletePortal {
         namespace Parameters {
             export type Origin = /* Origin of the portal */ Components.Schemas.Origin;
@@ -12553,6 +13165,39 @@ declare namespace Paths {
             export type $500 = Components.Responses.InternalServerError;
         }
     }
+    namespace DeletePortalUserPasskey {
+        namespace Parameters {
+            export type CredentialId = string;
+        }
+        export interface PathParameters {
+            credential_id: Parameters.CredentialId;
+        }
+        namespace Responses {
+            export interface $204 {
+            }
+            export type $401 = Components.Responses.Unauthorized;
+            export type $404 = Components.Responses.NotFound;
+            export type $500 = Components.Responses.InternalServerError;
+        }
+    }
+    namespace DetachPortalPage {
+        namespace Responses {
+            export type $200 = Components.Schemas.Page;
+            export type $401 = Components.Responses.Unauthorized;
+            export type $403 = Components.Responses.Forbidden;
+            export type $404 = Components.Responses.NotFound;
+            export type $500 = Components.Responses.InternalServerError;
+        }
+    }
+    namespace DetachPortalPageBlock {
+        namespace Responses {
+            export type $200 = Components.Schemas.Block;
+            export type $401 = Components.Responses.Unauthorized;
+            export type $403 = Components.Responses.Forbidden;
+            export type $404 = Components.Responses.NotFound;
+            export type $500 = Components.Responses.InternalServerError;
+        }
+    }
     namespace DisablePartner {
         namespace Parameters {
             /**
@@ -14901,6 +15546,10 @@ declare namespace Paths {
             counter_templates?: {
                 [name: string]: string;
             };
+            /**
+             * When true, the response includes `counter` with the counter's unit, OBIS number, direction and tariff type. Access is checked by metering-api on the counter's parent meter.
+             */
+            include_counter?: boolean;
             /**
              * Reference to the meter reading block whose admin-configured content provides both the per-reading templates (content_top_name, main_content_name, content_bottom_name) and the counter templates (counter_title_name, counter_subtitle_name), derived server-side.
              */
@@ -14921,6 +15570,7 @@ declare namespace Paths {
                 counter_templates_output?: {
                     [name: string]: string;
                 };
+                counter?: /* Display details of the counter the readings belong to. Only returned when `include_counter` is true and the counter could be resolved. */ Components.Schemas.MeterReadingCounterDetails;
             }
             export type $400 = Components.Responses.InvalidRequest;
             export type $401 = Components.Responses.Unauthorized;
@@ -15223,6 +15873,16 @@ declare namespace Paths {
                          */
                         enabled?: boolean;
                     };
+                    /**
+                     * Opt-in, set by the configuring user. When enabled, a second factor is enforced after the password and portal users can add passkeys (fingerprint, face or device PIN) as one variant of it, next to the email code of advanced_mfa. Users with a passkey use it by default; with advanced_mfa off, the passkey is the only second factor once a user has added one. On passwordless portals a passkey can replace the email code. Passkeys are bound to the domain they were added on. Default off; turning it off again restores the previous behaviour and keeps registered passkeys.
+                     *
+                     */
+                    passkeys?: {
+                        /**
+                         * Enforce a second factor and allow passkeys as one variant of it
+                         */
+                        enabled?: boolean;
+                    };
                     entry_point?: "PASSWORD" | "SSO";
                     preferred_sso_providers?: /**
                      * URL-friendly slug to use as organization-unique identifier for Provider
@@ -15250,6 +15910,12 @@ declare namespace Paths {
                      * 6bsd0jkgoie74k2i8mrhc1vest
                      */
                     cognito_user_pool_client_id?: string;
+                    /**
+                     * Cognito user pool client ID used by the native portal apps (longer refresh token validity)
+                     * example:
+                     * 3k9fj2l1m0n8b7v6c5x4z3a2s1
+                     */
+                    cognito_mobile_client_id?: string;
                     /**
                      * Cognito user pool ARN
                      * example:
@@ -15632,7 +16298,7 @@ declare namespace Paths {
                  */
                 is_dummy?: boolean;
                 /**
-                 * Whether this is a v3 portal configuration
+                 * Always true. Legacy v2 storage was migrated; field kept for compatibility and will be removed.
                  */
                 is_v3_item?: boolean;
                 /**
@@ -15671,6 +16337,7 @@ declare namespace Paths {
                  * Master toggle for the portal's engagement center (in-app notifications including the notification triggers above). Off when absent — portal users only see the engagement center and receive trigger notifications after an admin enables it.
                  */
                 engagement_center_enabled?: boolean;
+                engagement_center_task_templates?: /* Handlebars templates rendering each outstanding task (to-do) row in the portal's engagement center. Resolved server-side per task against the task's entity (same variable syntax as page block templates, e.g. `{{order.order_number}}`, custom and environment variables) plus `task.*` (the workflow step, e.g. `{{task.name}}`), `workflow.*` (the execution, e.g. `{{workflow.name}}`) and `entity.*` (the task's entity regardless of its schema, e.g. `{{entity._title}}`). A template that is absent or blank keeps the portal's default rendering for that line. Admin/builder-only — never exposed via the public portal config. */ Components.Schemas.EngagementCenterTaskTemplates;
                 /**
                  * ID of the organization
                  * example:
@@ -15683,6 +16350,26 @@ declare namespace Paths {
                  * 12345
                  */
                 organization_id?: string;
+                /**
+                 * Blueprint instance ids managing this portal. Server-managed: ignored (stripped) on every write from a user.
+                 *
+                 */
+                _manifest?: string[];
+                /**
+                 * Id of this portal in the blueprint source. Set once: a blueprint install or update (portal create, `page_upsert_mode=slug`, or a revision with `revision_source` `blueprint_sync`) may give a portal the lineage it does not have yet, unless another portal of the organization holds it. A portal created as a copy next to the organization's live portal of its origin (downgraded to `ADDITIONAL_PORTAL`) never takes it. After that it never changes; every other write keeps the stored value. Locks nothing on its own.
+                 *
+                 */
+                _lineage_id?: string;
+                /**
+                 * Lineage ids of pages detached from their blueprint; a blueprint sync leaves them alone. Server-managed.
+                 *
+                 */
+                detached_lineage_ids?: string[];
+                /**
+                 * Only present on write responses: blueprint-managed pages/blocks the request tried to change. Their stored version was kept and the rest of the save succeeded.
+                 *
+                 */
+                held_back?: /* A blueprint-managed page or block a write tried to change; the stored version was kept. */ Components.Schemas.HeldBackNode[];
                 /**
                  * Organization settings
                  */
@@ -15738,6 +16425,19 @@ declare namespace Paths {
                  *
                  */
                 Components.Schemas.ProviderConfig[];
+                /**
+                 * Present only when the request carried a valid `x-portal-preview-token`: the config is this revision's, not the live one.
+                 *
+                 */
+                preview_revision?: {
+                    /**
+                     * example:
+                     * 2026-08-25T14:03:11.482Z-a7f3c1d9
+                     */
+                    revision_id: string;
+                    name?: string;
+                    created_at: string; // date-time
+                };
                 certificate_details?: {
                     /**
                      * Status of the certificate
@@ -15861,12 +16561,22 @@ declare namespace Paths {
                          */
                         enabled?: boolean;
                     };
-                    entry_point?: "PASSWORD" | "SSO";
-                    preferred_sso_providers?: /**
-                     * URL-friendly slug to use as organization-unique identifier for Provider
-                     * example:
-                     * office-365-login
-                     */
+                    /**
+                     * Opt-in, set by the configuring user. When enabled, a second factor is enforced after the password and portal users can add passkeys (fingerprint, face or device PIN) as one variant of it, next to the email code of advanced_mfa. Users with a passkey use it by default; with advanced_mfa off, the passkey is the only second factor once a user has added one. On passwordless portals a passkey can replace the email code. Passkeys are bound to the domain they were added on. Default off; turning it off again restores the previous behaviour and keeps registered passkeys.
+                     *
+                     */
+                    passkeys?: {
+                        /**
+                         * Enforce a second factor and allow passkeys as one variant of it
+                         */
+                        enabled?: boolean;
+                    };
+                    entry_point?: "PASSWORD" | "SSO";
+                    preferred_sso_providers?: /**
+                     * URL-friendly slug to use as organization-unique identifier for Provider
+                     * example:
+                     * office-365-login
+                     */
                     Components.Schemas.ProviderSlug /* [0-9a-z_-]+ */[];
                     /**
                      * Decide whether to automatically redirect to the provider page during login, which would completely bypass showing the portal authentication page.
@@ -15888,6 +16598,12 @@ declare namespace Paths {
                      * 6bsd0jkgoie74k2i8mrhc1vest
                      */
                     cognito_user_pool_client_id?: string;
+                    /**
+                     * Cognito user pool client ID used by the native portal apps (longer refresh token validity)
+                     * example:
+                     * 3k9fj2l1m0n8b7v6c5x4z3a2s1
+                     */
+                    cognito_mobile_client_id?: string;
                     /**
                      * Cognito user pool ARN
                      * example:
@@ -16270,7 +16986,7 @@ declare namespace Paths {
                  */
                 is_dummy?: boolean;
                 /**
-                 * Whether this is a v3 portal configuration
+                 * Always true. Legacy v2 storage was migrated; field kept for compatibility and will be removed.
                  */
                 is_v3_item?: boolean;
                 /**
@@ -16309,6 +17025,7 @@ declare namespace Paths {
                  * Master toggle for the portal's engagement center (in-app notifications including the notification triggers above). Off when absent — portal users only see the engagement center and receive trigger notifications after an admin enables it.
                  */
                 engagement_center_enabled?: boolean;
+                engagement_center_task_templates?: /* Handlebars templates rendering each outstanding task (to-do) row in the portal's engagement center. Resolved server-side per task against the task's entity (same variable syntax as page block templates, e.g. `{{order.order_number}}`, custom and environment variables) plus `task.*` (the workflow step, e.g. `{{task.name}}`), `workflow.*` (the execution, e.g. `{{workflow.name}}`) and `entity.*` (the task's entity regardless of its schema, e.g. `{{entity._title}}`). A template that is absent or blank keeps the portal's default rendering for that line. Admin/builder-only — never exposed via the public portal config. */ Components.Schemas.EngagementCenterTaskTemplates;
                 /**
                  * ID of the organization
                  * example:
@@ -16321,6 +17038,26 @@ declare namespace Paths {
                  * 12345
                  */
                 organization_id?: string;
+                /**
+                 * Blueprint instance ids managing this portal. Server-managed: ignored (stripped) on every write from a user.
+                 *
+                 */
+                _manifest?: string[];
+                /**
+                 * Id of this portal in the blueprint source. Set once: a blueprint install or update (portal create, `page_upsert_mode=slug`, or a revision with `revision_source` `blueprint_sync`) may give a portal the lineage it does not have yet, unless another portal of the organization holds it. A portal created as a copy next to the organization's live portal of its origin (downgraded to `ADDITIONAL_PORTAL`) never takes it. After that it never changes; every other write keeps the stored value. Locks nothing on its own.
+                 *
+                 */
+                _lineage_id?: string;
+                /**
+                 * Lineage ids of pages detached from their blueprint; a blueprint sync leaves them alone. Server-managed.
+                 *
+                 */
+                detached_lineage_ids?: string[];
+                /**
+                 * Only present on write responses: blueprint-managed pages/blocks the request tried to change. Their stored version was kept and the rest of the save succeeded.
+                 *
+                 */
+                held_back?: /* A blueprint-managed page or block a write tried to change; the stored version was kept. */ Components.Schemas.HeldBackNode[];
                 /**
                  * Organization settings
                  */
@@ -16376,6 +17113,19 @@ declare namespace Paths {
                  *
                  */
                 Components.Schemas.ProviderConfig[];
+                /**
+                 * Present only when the request carried a valid `x-portal-preview-token`: the config is this revision's, not the live one.
+                 *
+                 */
+                preview_revision?: {
+                    /**
+                     * example:
+                     * 2026-08-25T14:03:11.482Z-a7f3c1d9
+                     */
+                    revision_id: string;
+                    name?: string;
+                    created_at: string; // date-time
+                };
                 certificate_details?: {
                     /**
                      * Status of the certificate
@@ -16501,6 +17251,15 @@ declare namespace Paths {
             export type $500 = Components.Responses.InternalServerError;
         }
     }
+    namespace GetPortalCopilotAccess {
+        namespace Responses {
+            export interface $200 {
+                allowed: boolean;
+            }
+            export type $401 = Components.Responses.Unauthorized;
+            export type $500 = Components.Responses.InternalServerError;
+        }
+    }
     namespace GetPortalExtensions {
         namespace Parameters {
             export type Origin = /* Origin of the portal */ Components.Schemas.Origin;
@@ -16680,6 +17439,15 @@ declare namespace Paths {
             export type $500 = Components.Responses.InternalServerError;
         }
     }
+    namespace GetPortalUserNotificationPreferences {
+        namespace Responses {
+            export type $200 = /* Resolved notification preferences of a portal user. Notifications are opt-out: a channel that was never stored on the portal user resolves to enabled (true). */ Components.Schemas.PortalUserNotificationPreferences;
+            export type $401 = Components.Responses.Unauthorized;
+            export type $403 = Components.Responses.Forbidden;
+            export type $404 = Components.Responses.NotFound;
+            export type $500 = Components.Responses.InternalServerError;
+        }
+    }
     namespace GetPortalWidgets {
         namespace Parameters {
             export type ContractId = /**
@@ -17053,6 +17821,16 @@ declare namespace Paths {
                          */
                         enabled?: boolean;
                     };
+                    /**
+                     * Opt-in, set by the configuring user. When enabled, a second factor is enforced after the password and portal users can add passkeys (fingerprint, face or device PIN) as one variant of it, next to the email code of advanced_mfa. Users with a passkey use it by default; with advanced_mfa off, the passkey is the only second factor once a user has added one. On passwordless portals a passkey can replace the email code. Passkeys are bound to the domain they were added on. Default off; turning it off again restores the previous behaviour and keeps registered passkeys.
+                     *
+                     */
+                    passkeys?: {
+                        /**
+                         * Enforce a second factor and allow passkeys as one variant of it
+                         */
+                        enabled?: boolean;
+                    };
                     entry_point?: "PASSWORD" | "SSO";
                     preferred_sso_providers?: /**
                      * URL-friendly slug to use as organization-unique identifier for Provider
@@ -17080,6 +17858,12 @@ declare namespace Paths {
                      * 6bsd0jkgoie74k2i8mrhc1vest
                      */
                     cognito_user_pool_client_id?: string;
+                    /**
+                     * Cognito user pool client ID used by the native portal apps (longer refresh token validity)
+                     * example:
+                     * 3k9fj2l1m0n8b7v6c5x4z3a2s1
+                     */
+                    cognito_mobile_client_id?: string;
                     /**
                      * Cognito user pool ARN
                      * example:
@@ -17462,7 +18246,7 @@ declare namespace Paths {
                  */
                 is_dummy?: boolean;
                 /**
-                 * Whether this is a v3 portal configuration
+                 * Always true. Legacy v2 storage was migrated; field kept for compatibility and will be removed.
                  */
                 is_v3_item?: boolean;
                 /**
@@ -17501,6 +18285,7 @@ declare namespace Paths {
                  * Master toggle for the portal's engagement center (in-app notifications including the notification triggers above). Off when absent — portal users only see the engagement center and receive trigger notifications after an admin enables it.
                  */
                 engagement_center_enabled?: boolean;
+                engagement_center_task_templates?: /* Handlebars templates rendering each outstanding task (to-do) row in the portal's engagement center. Resolved server-side per task against the task's entity (same variable syntax as page block templates, e.g. `{{order.order_number}}`, custom and environment variables) plus `task.*` (the workflow step, e.g. `{{task.name}}`), `workflow.*` (the execution, e.g. `{{workflow.name}}`) and `entity.*` (the task's entity regardless of its schema, e.g. `{{entity._title}}`). A template that is absent or blank keeps the portal's default rendering for that line. Admin/builder-only — never exposed via the public portal config. */ Components.Schemas.EngagementCenterTaskTemplates;
                 /**
                  * ID of the organization
                  * example:
@@ -17513,6 +18298,26 @@ declare namespace Paths {
                  * 12345
                  */
                 organization_id?: string;
+                /**
+                 * Blueprint instance ids managing this portal. Server-managed: ignored (stripped) on every write from a user.
+                 *
+                 */
+                _manifest?: string[];
+                /**
+                 * Id of this portal in the blueprint source. Set once: a blueprint install or update (portal create, `page_upsert_mode=slug`, or a revision with `revision_source` `blueprint_sync`) may give a portal the lineage it does not have yet, unless another portal of the organization holds it. A portal created as a copy next to the organization's live portal of its origin (downgraded to `ADDITIONAL_PORTAL`) never takes it. After that it never changes; every other write keeps the stored value. Locks nothing on its own.
+                 *
+                 */
+                _lineage_id?: string;
+                /**
+                 * Lineage ids of pages detached from their blueprint; a blueprint sync leaves them alone. Server-managed.
+                 *
+                 */
+                detached_lineage_ids?: string[];
+                /**
+                 * Only present on write responses: blueprint-managed pages/blocks the request tried to change. Their stored version was kept and the rest of the save succeeded.
+                 *
+                 */
+                held_back?: /* A blueprint-managed page or block a write tried to change; the stored version was kept. */ Components.Schemas.HeldBackNode[];
                 /**
                  * Organization settings
                  */
@@ -17553,6 +18358,19 @@ declare namespace Paths {
                  *
                  */
                 identity_providers?: /* Minimal public identity provider info — enough to render a provider login button. */ Components.Schemas.PublicIdentityProvider[];
+                /**
+                 * Present only when the request carried a valid `x-portal-preview-token`: the config is this revision's, not the live one.
+                 *
+                 */
+                preview_revision?: {
+                    /**
+                     * example:
+                     * 2026-08-25T14:03:11.482Z-a7f3c1d9
+                     */
+                    revision_id: string;
+                    name?: string;
+                    created_at: string; // date-time
+                };
             }
             export type $500 = Components.Responses.InternalServerError;
         }
@@ -18468,6 +19286,16 @@ declare namespace Paths {
             export type $500 = Components.Responses.InternalServerError;
         }
     }
+    namespace ListPortalUserPasskeys {
+        namespace Responses {
+            export interface $200 {
+                results?: Components.Schemas.PortalUserPasskey[];
+            }
+            export type $401 = Components.Responses.Unauthorized;
+            export type $403 = Components.Responses.Forbidden;
+            export type $500 = Components.Responses.InternalServerError;
+        }
+    }
     namespace LoginToPortalAsUser {
         export interface RequestBody {
             /**
@@ -18492,6 +19320,12 @@ declare namespace Paths {
                  * A generated login_as_token to log in to a portal impersonating a user.
                  */
                 login_as_token?: string;
+                /**
+                 * URL of the portal on its epilot domain, to open `/login-as?token=<login_as_token>` on.
+                 * example:
+                 * https://my-portal.ecp.epilot.io
+                 */
+                portal_url?: string;
             }
         }
     }
@@ -19115,6 +19949,16 @@ declare namespace Paths {
             export type $500 = Components.Responses.InternalServerError;
         }
     }
+    namespace SendPortalUserPasskeyVerificationCode {
+        namespace Responses {
+            export interface $204 {
+            }
+            export type $401 = Components.Responses.Unauthorized;
+            export type $403 = Components.Responses.Forbidden;
+            export type $429 = Components.Responses.TooManyRequests;
+            export type $500 = Components.Responses.InternalServerError;
+        }
+    }
     namespace SsoCallback {
         namespace Parameters {
             /**
@@ -19135,6 +19979,15 @@ declare namespace Paths {
         export type RequestBody = Components.Schemas.SSOCallbackRequest;
         namespace Responses {
             export type $200 = Components.Schemas.SSOCallbackResponse;
+            export type $400 = /**
+             * Error response of the public SSO endpoints. Like every error response the message is in
+             * `error`; `reason` carries a stable machine-readable cause when one is known (e.g.
+             * `MISSING_EMAIL_CLAIM`, `INVALID_PROVIDER`, `SELF_REGISTRATION_NOT_ALLOWED`,
+             * `TOKEN_EXCHANGE_FAILED`). `debug` is only present while SSO debug mode is active for the
+             * resolved provider (`ProviderConfig.debug_mode_until`).
+             *
+             */
+            Components.Schemas.SSOErrorResp;
             export type $500 = Components.Responses.InternalServerError;
         }
     }
@@ -19183,6 +20036,15 @@ declare namespace Paths {
                  */
                 email?: string;
             }
+            export type $400 = /**
+             * Error response of the public SSO endpoints. Like every error response the message is in
+             * `error`; `reason` carries a stable machine-readable cause when one is known (e.g.
+             * `MISSING_EMAIL_CLAIM`, `INVALID_PROVIDER`, `SELF_REGISTRATION_NOT_ALLOWED`,
+             * `TOKEN_EXCHANGE_FAILED`). `debug` is only present while SSO debug mode is active for the
+             * resolved provider (`ProviderConfig.debug_mode_until`).
+             *
+             */
+            Components.Schemas.SSOErrorResp;
         }
     }
     namespace SsoLoginV3 {
@@ -19241,7 +20103,15 @@ declare namespace Paths {
                  */
                 email?: string;
             }
-            export type $400 = Components.Responses.InvalidRequest;
+            export type $400 = /**
+             * Error response of the public SSO endpoints. Like every error response the message is in
+             * `error`; `reason` carries a stable machine-readable cause when one is known (e.g.
+             * `MISSING_EMAIL_CLAIM`, `INVALID_PROVIDER`, `SELF_REGISTRATION_NOT_ALLOWED`,
+             * `TOKEN_EXCHANGE_FAILED`). `debug` is only present while SSO debug mode is active for the
+             * resolved provider (`ProviderConfig.debug_mode_until`).
+             *
+             */
+            Components.Schemas.SSOErrorResp;
         }
     }
     namespace SsoRedirect {
@@ -19333,6 +20203,7 @@ declare namespace Paths {
             export type $401 = Components.Responses.Unauthorized;
             export type $403 = Components.Responses.Forbidden;
             export type $404 = Components.Responses.NotFound;
+            export type $409 = Components.Schemas.ErrorResp;
             export type $500 = Components.Responses.InternalServerError;
         }
     }
@@ -19501,7 +20372,12 @@ declare namespace Paths {
         }
     }
     namespace UpdateContact {
-        export type RequestBody = Components.Schemas.Entity;
+        export type RequestBody = /**
+         * Contact attributes a portal user can change. Other attributes are ignored.
+         * Value types follow the organization's contact schema.
+         *
+         */
+        Components.Schemas.PortalContactUpdate;
         namespace Responses {
             export interface $200 {
                 data?: /* The mapped contact of the portal user */ Components.Schemas.Contact;
@@ -19524,7 +20400,7 @@ declare namespace Paths {
         export interface PathParameters {
             id: Parameters.Id;
         }
-        export type RequestBody = Components.Schemas.Entity;
+        export type RequestBody = /* Contract attributes a portal user can change. Other attributes are ignored. */ Components.Schemas.PortalContractUpdate;
         namespace Responses {
             export interface $200 {
                 data?: /* The contract entity */ Components.Schemas.Contract;
@@ -19564,52 +20440,6 @@ declare namespace Paths {
             export type $500 = Components.Responses.InternalServerError;
         }
     }
-    namespace UpdateOpportunity {
-        namespace Parameters {
-            export type Id = /**
-             * Entity ID
-             * example:
-             * 5da0a718-c822-403d-9f5d-20d4584e0528
-             */
-            Components.Schemas.EntityId /* uuid */;
-        }
-        export interface PathParameters {
-            id: Parameters.Id;
-        }
-        export type RequestBody = Components.Schemas.Entity;
-        namespace Responses {
-            export interface $200 {
-                data?: /* The opportunity entity */ Components.Schemas.Opportunity;
-            }
-            export type $401 = Components.Responses.Unauthorized;
-            export type $403 = Components.Responses.Forbidden;
-            export type $404 = Components.Responses.NotFound;
-            export type $500 = Components.Responses.InternalServerError;
-        }
-    }
-    namespace UpdateOrder {
-        namespace Parameters {
-            export type Id = /**
-             * Entity ID
-             * example:
-             * 5da0a718-c822-403d-9f5d-20d4584e0528
-             */
-            Components.Schemas.EntityId /* uuid */;
-        }
-        export interface PathParameters {
-            id: Parameters.Id;
-        }
-        export type RequestBody = Components.Schemas.Entity;
-        namespace Responses {
-            export interface $200 {
-                data?: /* The order entity */ Components.Schemas.Order;
-            }
-            export type $401 = Components.Responses.Unauthorized;
-            export type $403 = Components.Responses.Forbidden;
-            export type $404 = Components.Responses.NotFound;
-            export type $500 = Components.Responses.InternalServerError;
-        }
-    }
     namespace UpdatePortalPage {
         export type RequestBody = Components.Schemas.PageRequest;
         namespace Responses {
@@ -19665,16 +20495,6 @@ declare namespace Paths {
             export type $500 = Components.Responses.InternalServerError;
         }
     }
-    namespace UpdatePortalUser {
-        export type RequestBody = Components.Schemas.Entity;
-        namespace Responses {
-            export interface $200 {
-                data?: /* The portal user entity */ Components.Schemas.PortalUser;
-            }
-            export type $401 = Components.Responses.Unauthorized;
-            export type $500 = Components.Responses.InternalServerError;
-        }
-    }
     namespace UpdatePortalUserEmail {
         export interface RequestBody {
             /**
@@ -19710,6 +20530,25 @@ declare namespace Paths {
             export type $500 = Components.Responses.InternalServerError;
         }
     }
+    namespace UpdatePortalUserNotificationPreferences {
+        /**
+         * Channels to update. Omitted channels are left unchanged.
+         */
+        export interface RequestBody {
+            /**
+             * Whether the portal user wants to receive in-app notifications.
+             */
+            in_app?: boolean;
+        }
+        namespace Responses {
+            export type $200 = /* Resolved notification preferences of a portal user. Notifications are opt-out: a channel that was never stored on the portal user resolves to enabled (true). */ Components.Schemas.PortalUserNotificationPreferences;
+            export type $400 = Components.Responses.InvalidRequest;
+            export type $401 = Components.Responses.Unauthorized;
+            export type $403 = Components.Responses.Forbidden;
+            export type $404 = Components.Responses.NotFound;
+            export type $500 = Components.Responses.InternalServerError;
+        }
+    }
     namespace UpdateWorkflowStepAsDone {
         namespace Parameters {
             /**
@@ -20066,6 +20905,48 @@ declare namespace Paths {
             Parameters.BlockId /* uuid */;
         }
     }
+    namespace V2PortalPages$IdBlocks$BlockIdDetach {
+        namespace Parameters {
+            /**
+             * example:
+             * c495fef9-eeca-4019-a989-8390dcd9825b
+             */
+            export type BlockId = string; // uuid
+            /**
+             * example:
+             * 5da0a718-c822-403d-9f5d-20d4584e0528
+             */
+            export type Id = string; // uuid
+        }
+        export interface PathParameters {
+            id: /**
+             * example:
+             * 5da0a718-c822-403d-9f5d-20d4584e0528
+             */
+            Parameters.Id /* uuid */;
+            block_id: /**
+             * example:
+             * c495fef9-eeca-4019-a989-8390dcd9825b
+             */
+            Parameters.BlockId /* uuid */;
+        }
+    }
+    namespace V2PortalPages$IdDetach {
+        namespace Parameters {
+            /**
+             * example:
+             * 5da0a718-c822-403d-9f5d-20d4584e0528
+             */
+            export type Id = string; // uuid
+        }
+        export interface PathParameters {
+            id: /**
+             * example:
+             * 5da0a718-c822-403d-9f5d-20d4584e0528
+             */
+            Parameters.Id /* uuid */;
+        }
+    }
     namespace ValidateCaaRecords {
         namespace Parameters {
             export type Origin = /* Origin of the portal */ Components.Schemas.Origin;
@@ -20526,8 +21407,8 @@ export interface OperationMethods {
    * at `destination_template_id`. Intended to be called from the email-template
    * migration flow when a duplicated template is refined.
    * 
-   * Only v3-shaped rows are migrated (those carrying `portal_sk_v3`). Returns
-   * the portal IDs that were rewritten and any whose update failed.
+   * Rows are keyed by portal id (`portal_sk_v3`); a row without one is skipped.
+   * Returns the portal IDs that were rewritten and any whose update failed.
    * 
    */
   'migrateEmailTemplateReferences'(
@@ -20751,7 +21632,9 @@ export interface OperationMethods {
   /**
    * updateContact - updateContact
    * 
-   * Updates the contact details.
+   * Updates the portal user's contact. Only the attributes in `PortalContactUpdate` can be changed;
+   * other attributes are ignored. Returns 403 when the body has none of them.
+   * 
    */
   'updateContact'(
     parameters?: Parameters<UnknownParamsObject> | null,
@@ -20844,25 +21727,25 @@ export interface OperationMethods {
     config?: AxiosRequestConfig  
   ): OperationResponse<Paths.GetValidSecondaryAttributes.Responses.$200>
   /**
-   * getPortalUser - getPortalUser
+   * getPortalCopilotAccess - getPortalCopilotAccess
    * 
-   * Get the portal user details
+   * Whether the signed-in portal user may use the portal chat. False when the chat is off for the portal, when the user does not match its target visibility, or when targets cannot be matched.
    */
-  'getPortalUser'(
+  'getPortalCopilotAccess'(
     parameters?: Parameters<UnknownParamsObject> | null,
     data?: any,
     config?: AxiosRequestConfig  
-  ): OperationResponse<Paths.GetPortalUser.Responses.$200>
+  ): OperationResponse<Paths.GetPortalCopilotAccess.Responses.$200>
   /**
-   * updatePortalUser - updatePortalUser
+   * getPortalUser - getPortalUser
    * 
-   * Update the portal user details
+   * Get the portal user details
    */
-  'updatePortalUser'(
+  'getPortalUser'(
     parameters?: Parameters<UnknownParamsObject> | null,
-    data?: Paths.UpdatePortalUser.RequestBody,
+    data?: any,
     config?: AxiosRequestConfig  
-  ): OperationResponse<Paths.UpdatePortalUser.Responses.$200>
+  ): OperationResponse<Paths.GetPortalUser.Responses.$200>
   /**
    * deletePortalUser - deletePortalUser
    * 
@@ -20895,6 +21778,86 @@ export interface OperationMethods {
     data?: Paths.ChangePortalUserPassword.RequestBody,
     config?: AxiosRequestConfig  
   ): OperationResponse<Paths.ChangePortalUserPassword.Responses.$200>
+  /**
+   * getPortalUserNotificationPreferences - getPortalUserNotificationPreferences
+   * 
+   * Returns the notification preferences of the authenticated portal user. Notifications follow an opt-out model: a preference that was never stored on the portal user defaults to enabled (true). Responds 404 while the engagement-center v2 feature is not enabled for the organization.
+   */
+  'getPortalUserNotificationPreferences'(
+    parameters?: Parameters<UnknownParamsObject> | null,
+    data?: any,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.GetPortalUserNotificationPreferences.Responses.$200>
+  /**
+   * updatePortalUserNotificationPreferences - updatePortalUserNotificationPreferences
+   * 
+   * Partially updates the notification preferences of the authenticated portal user. Only the channels present in the request body are changed; omitted channels keep their stored value (or the enabled-by-default behaviour when never set). Returns the resulting full preferences. Responds 404 while the engagement-center v2 feature is not enabled for the organization.
+   */
+  'updatePortalUserNotificationPreferences'(
+    parameters?: Parameters<UnknownParamsObject> | null,
+    data?: Paths.UpdatePortalUserNotificationPreferences.RequestBody,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.UpdatePortalUserNotificationPreferences.Responses.$200>
+  /**
+   * listPortalUserPasskeys - listPortalUserPasskeys
+   * 
+   * Lists the passkeys the logged-in portal user has added.
+   */
+  'listPortalUserPasskeys'(
+    parameters?: Parameters<UnknownParamsObject> | null,
+    data?: any,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.ListPortalUserPasskeys.Responses.$200>
+  /**
+   * addPortalUserPasskey - addPortalUserPasskey
+   * 
+   * Stores a new passkey for the logged-in portal user.
+   * Send the browser's `navigator.credentials.create()` result for options from `createPortalUserPasskeyRegistrationOptions`.
+   * Only available when `auth_settings.passkeys.enabled` is set for the portal.
+   * 
+   */
+  'addPortalUserPasskey'(
+    parameters?: Parameters<UnknownParamsObject> | null,
+    data?: Paths.AddPortalUserPasskey.RequestBody,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.AddPortalUserPasskey.Responses.$201>
+  /**
+   * createPortalUserPasskeyRegistrationOptions - createPortalUserPasskeyRegistrationOptions
+   * 
+   * Returns WebAuthn options for `navigator.credentials.create()` to add a passkey for the logged-in portal user.
+   * Needs the code from `sendPortalUserPasskeyVerificationCode`, so a session alone can't add a passkey; the code is used up here.
+   * The passkey is bound to the domain in the request's `Origin` header, which must be one of the portal's domains.
+   * Only available when `auth_settings.passkeys.enabled` is set for the portal.
+   * 
+   */
+  'createPortalUserPasskeyRegistrationOptions'(
+    parameters?: Parameters<UnknownParamsObject> | null,
+    data?: Paths.CreatePortalUserPasskeyRegistrationOptions.RequestBody,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.CreatePortalUserPasskeyRegistrationOptions.Responses.$200>
+  /**
+   * sendPortalUserPasskeyVerificationCode - sendPortalUserPasskeyVerificationCode
+   * 
+   * Emails the logged-in portal user a 6-digit code needed to add a passkey (`createPortalUserPasskeyRegistrationOptions`).
+   * The code is valid for 10 minutes and allows 5 attempts; a new code replaces the previous one and can be requested once a minute.
+   * Only available when `auth_settings.passkeys.enabled` is set for the portal.
+   * 
+   */
+  'sendPortalUserPasskeyVerificationCode'(
+    parameters?: Parameters<UnknownParamsObject> | null,
+    data?: any,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.SendPortalUserPasskeyVerificationCode.Responses.$204>
+  /**
+   * deletePortalUserPasskey - deletePortalUserPasskey
+   * 
+   * Removes one of the logged-in portal user's passkeys. Works even when passkeys are turned off for the portal.
+   */
+  'deletePortalUserPasskey'(
+    parameters?: Parameters<Paths.DeletePortalUserPasskey.PathParameters> | null,
+    data?: any,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.DeletePortalUserPasskey.Responses.$204>
   /**
    * resendConfirmationEmail - resendConfirmationEmail
    * 
@@ -21019,16 +21982,6 @@ export interface OperationMethods {
     data?: any,
     config?: AxiosRequestConfig  
   ): OperationResponse<Paths.GetOrder.Responses.$200>
-  /**
-   * updateOrder - updateOrder
-   * 
-   * Update an order by id. Use getPortalUserEntity instead.
-   */
-  'updateOrder'(
-    parameters?: Parameters<Paths.UpdateOrder.PathParameters> | null,
-    data?: Paths.UpdateOrder.RequestBody,
-    config?: AxiosRequestConfig  
-  ): OperationResponse<Paths.UpdateOrder.Responses.$200>
   /**
    * getAllOpportunities - getAllOpportunities
    * 
@@ -21069,16 +22022,6 @@ export interface OperationMethods {
     data?: any,
     config?: AxiosRequestConfig  
   ): OperationResponse<Paths.GetOpportunity.Responses.$200>
-  /**
-   * updateOpportunity - updateOpportunity
-   * 
-   * Update an opportunity by id.
-   */
-  'updateOpportunity'(
-    parameters?: Parameters<Paths.UpdateOpportunity.PathParameters> | null,
-    data?: Paths.UpdateOpportunity.RequestBody,
-    config?: AxiosRequestConfig  
-  ): OperationResponse<Paths.UpdateOpportunity.Responses.$200>
   /**
    * getAllRequests - getAllRequests
    * 
@@ -21112,7 +22055,9 @@ export interface OperationMethods {
   /**
    * updateContract - updateContract
    * 
-   * Update a contract by id. Use getPortalUserEntity instead.
+   * Updates a contract of the portal user. Only the attributes in `PortalContractUpdate` can be changed;
+   * other attributes are ignored. Returns 403 when the body has none of them.
+   * 
    */
   'updateContract'(
     parameters?: Parameters<Paths.UpdateContract.PathParameters> | null,
@@ -21202,16 +22147,6 @@ export interface OperationMethods {
     data?: Paths.SaveEntityFile.RequestBody,
     config?: AxiosRequestConfig  
   ): OperationResponse<Paths.SaveEntityFile.Responses.$201>
-  /**
-   * deleteEntityFile - deleteEntityFile
-   * 
-   * Delete files from an entity
-   */
-  'deleteEntityFile'(
-    parameters?: Parameters<UnknownParamsObject> | null,
-    data?: Paths.DeleteEntityFile.RequestBody,
-    config?: AxiosRequestConfig  
-  ): OperationResponse<Paths.DeleteEntityFile.Responses.$202>
   /**
    * savePortalFiles - savePortalFiles
    * 
@@ -21324,6 +22259,10 @@ export interface OperationMethods {
    * 2. Using domain
    * 3. Using origin (legacy)
    * 
+   * A partner user can log in as a portal user the vendor shared with their organization by sending
+   * `x-epilot-org-id: <vendor org id>` with a `portal_id`. This needs `portal:login_as_user` on that portal in the
+   * partner role and the portal user shared with the partner organization.
+   * 
    */
   'loginToPortalAsUser'(
     parameters?: Parameters<UnknownParamsObject> | null,
@@ -21439,7 +22378,7 @@ export interface OperationMethods {
   /**
    * getOutstandingTasks - Get outstanding workflow tasks for the portal user
    * 
-   * Returns all outstanding workflow journey tasks for the authenticated portal user, across their opportunity, order and contract entities. Each task is an active workflow step that exposes a journey the customer still needs to fill out.
+   * Returns all outstanding workflow journey tasks for the authenticated portal user, across their opportunity, order and contract entities. Each task is an active workflow step that exposes a journey the customer still needs to fill out. A step whose start date still lies in the future is left out until that date.
    */
   'getOutstandingTasks'(
     parameters?: Parameters<UnknownParamsObject> | null,
@@ -21660,6 +22599,28 @@ export interface OperationMethods {
     data?: any,
     config?: AxiosRequestConfig  
   ): OperationResponse<Paths.DeletePortalPage.Responses.$204>
+  /**
+   * detachPortalPage - detachPortalPage
+   * 
+   * Detach a blueprint-managed page from its blueprint. The page and all of its blocks become local (editable, no longer updated by the blueprint) and the page's lineage is tombstoned on the portal so future syncs skip it. One-way. Idempotent for pages that are not managed.
+   * 
+   */
+  'detachPortalPage'(
+    parameters?: Parameters<Paths.V2PortalPages$IdDetach.PathParameters> | null,
+    data?: any,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.DetachPortalPage.Responses.$200>
+  /**
+   * detachPortalPageBlock - detachPortalPageBlock
+   * 
+   * Detach a blueprint-managed block. The block becomes the customer's and its lineage is tombstoned on the page so future syncs skip it. A managed page stays managed and keeps receiving blueprint updates for everything else. One-way. Idempotent for blocks that are not managed.
+   * 
+   */
+  'detachPortalPageBlock'(
+    parameters?: Parameters<Paths.V2PortalPages$IdBlocks$BlockIdDetach.PathParameters> | null,
+    data?: any,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.DetachPortalPageBlock.Responses.$200>
   /**
    * getPortalPages - getPortalPages
    * 
@@ -21974,6 +22935,21 @@ export interface OperationMethods {
     data?: Paths.UpdatePortalRevision.RequestBody,
     config?: AxiosRequestConfig  
   ): OperationResponse<Paths.UpdatePortalRevision.Responses.$200>
+  /**
+   * createPortalRevisionPreview - createPortalRevisionPreview
+   * 
+   * Mints a short-lived preview token for one revision and returns a link that opens the revision inside the real end-customer portal, on the portal's live domain, without publishing it.
+   * 
+   * The portal sends the token back in the `x-portal-preview-token` header. Public and portal-user config, page, widget and extension reads that honour it answer with the revision's config and pages instead of the live ones and add `preview_revision` to config responses. Server-owned fields (ids, domains, Cognito pool identifiers, extension secrets) always come from the live portal. Nothing is written: the live portal, its pages and which revision is published stay as they are.
+   * 
+   * Requires view permission on the portal. Returns `404` when portal versioning or revision preview is not enabled for the organization, or when the revision does not exist.
+   * 
+   */
+  'createPortalRevisionPreview'(
+    parameters?: Parameters<Paths.CreatePortalRevisionPreview.PathParameters> | null,
+    data?: any,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.CreatePortalRevisionPreview.Responses.$200>
   /**
    * publishPortalRevision - publishPortalRevision
    * 
@@ -22533,8 +23509,8 @@ export interface PathsDictionary {
      * at `destination_template_id`. Intended to be called from the email-template
      * migration flow when a duplicated template is refined.
      * 
-     * Only v3-shaped rows are migrated (those carrying `portal_sk_v3`). Returns
-     * the portal IDs that were rewritten and any whose update failed.
+     * Rows are keyed by portal id (`portal_sk_v3`); a row without one is skipped.
+     * Returns the portal IDs that were rewritten and any whose update failed.
      * 
      */
     'post'(
@@ -22792,7 +23768,9 @@ export interface PathsDictionary {
     /**
      * updateContact - updateContact
      * 
-     * Updates the contact details.
+     * Updates the portal user's contact. Only the attributes in `PortalContactUpdate` can be changed;
+     * other attributes are ignored. Returns 403 when the body has none of them.
+     * 
      */
     'patch'(
       parameters?: Parameters<UnknownParamsObject> | null,
@@ -22897,27 +23875,29 @@ export interface PathsDictionary {
       config?: AxiosRequestConfig  
     ): OperationResponse<Paths.GetValidSecondaryAttributes.Responses.$200>
   }
-  ['/v2/portal/user']: {
+  ['/v2/portal/copilot/access']: {
     /**
-     * getPortalUser - getPortalUser
+     * getPortalCopilotAccess - getPortalCopilotAccess
      * 
-     * Get the portal user details
+     * Whether the signed-in portal user may use the portal chat. False when the chat is off for the portal, when the user does not match its target visibility, or when targets cannot be matched.
      */
     'get'(
       parameters?: Parameters<UnknownParamsObject> | null,
       data?: any,
       config?: AxiosRequestConfig  
-    ): OperationResponse<Paths.GetPortalUser.Responses.$200>
+    ): OperationResponse<Paths.GetPortalCopilotAccess.Responses.$200>
+  }
+  ['/v2/portal/user']: {
     /**
-     * updatePortalUser - updatePortalUser
+     * getPortalUser - getPortalUser
      * 
-     * Update the portal user details
+     * Get the portal user details
      */
-    'patch'(
+    'get'(
       parameters?: Parameters<UnknownParamsObject> | null,
-      data?: Paths.UpdatePortalUser.RequestBody,
+      data?: any,
       config?: AxiosRequestConfig  
-    ): OperationResponse<Paths.UpdatePortalUser.Responses.$200>
+    ): OperationResponse<Paths.GetPortalUser.Responses.$200>
     /**
      * deletePortalUser - deletePortalUser
      * 
@@ -22955,6 +23935,96 @@ export interface PathsDictionary {
       config?: AxiosRequestConfig  
     ): OperationResponse<Paths.ChangePortalUserPassword.Responses.$200>
   }
+  ['/v2/portal/user/notification-preferences']: {
+    /**
+     * getPortalUserNotificationPreferences - getPortalUserNotificationPreferences
+     * 
+     * Returns the notification preferences of the authenticated portal user. Notifications follow an opt-out model: a preference that was never stored on the portal user defaults to enabled (true). Responds 404 while the engagement-center v2 feature is not enabled for the organization.
+     */
+    'get'(
+      parameters?: Parameters<UnknownParamsObject> | null,
+      data?: any,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.GetPortalUserNotificationPreferences.Responses.$200>
+    /**
+     * updatePortalUserNotificationPreferences - updatePortalUserNotificationPreferences
+     * 
+     * Partially updates the notification preferences of the authenticated portal user. Only the channels present in the request body are changed; omitted channels keep their stored value (or the enabled-by-default behaviour when never set). Returns the resulting full preferences. Responds 404 while the engagement-center v2 feature is not enabled for the organization.
+     */
+    'put'(
+      parameters?: Parameters<UnknownParamsObject> | null,
+      data?: Paths.UpdatePortalUserNotificationPreferences.RequestBody,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.UpdatePortalUserNotificationPreferences.Responses.$200>
+  }
+  ['/v2/portal/user/passkeys']: {
+    /**
+     * listPortalUserPasskeys - listPortalUserPasskeys
+     * 
+     * Lists the passkeys the logged-in portal user has added.
+     */
+    'get'(
+      parameters?: Parameters<UnknownParamsObject> | null,
+      data?: any,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.ListPortalUserPasskeys.Responses.$200>
+    /**
+     * addPortalUserPasskey - addPortalUserPasskey
+     * 
+     * Stores a new passkey for the logged-in portal user.
+     * Send the browser's `navigator.credentials.create()` result for options from `createPortalUserPasskeyRegistrationOptions`.
+     * Only available when `auth_settings.passkeys.enabled` is set for the portal.
+     * 
+     */
+    'post'(
+      parameters?: Parameters<UnknownParamsObject> | null,
+      data?: Paths.AddPortalUserPasskey.RequestBody,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.AddPortalUserPasskey.Responses.$201>
+  }
+  ['/v2/portal/user/passkeys/registration-options']: {
+    /**
+     * createPortalUserPasskeyRegistrationOptions - createPortalUserPasskeyRegistrationOptions
+     * 
+     * Returns WebAuthn options for `navigator.credentials.create()` to add a passkey for the logged-in portal user.
+     * Needs the code from `sendPortalUserPasskeyVerificationCode`, so a session alone can't add a passkey; the code is used up here.
+     * The passkey is bound to the domain in the request's `Origin` header, which must be one of the portal's domains.
+     * Only available when `auth_settings.passkeys.enabled` is set for the portal.
+     * 
+     */
+    'post'(
+      parameters?: Parameters<UnknownParamsObject> | null,
+      data?: Paths.CreatePortalUserPasskeyRegistrationOptions.RequestBody,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.CreatePortalUserPasskeyRegistrationOptions.Responses.$200>
+  }
+  ['/v2/portal/user/passkeys/verification-code']: {
+    /**
+     * sendPortalUserPasskeyVerificationCode - sendPortalUserPasskeyVerificationCode
+     * 
+     * Emails the logged-in portal user a 6-digit code needed to add a passkey (`createPortalUserPasskeyRegistrationOptions`).
+     * The code is valid for 10 minutes and allows 5 attempts; a new code replaces the previous one and can be requested once a minute.
+     * Only available when `auth_settings.passkeys.enabled` is set for the portal.
+     * 
+     */
+    'post'(
+      parameters?: Parameters<UnknownParamsObject> | null,
+      data?: any,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.SendPortalUserPasskeyVerificationCode.Responses.$204>
+  }
+  ['/v2/portal/user/passkeys/{credential_id}']: {
+    /**
+     * deletePortalUserPasskey - deletePortalUserPasskey
+     * 
+     * Removes one of the logged-in portal user's passkeys. Works even when passkeys are turned off for the portal.
+     */
+    'delete'(
+      parameters?: Parameters<Paths.DeletePortalUserPasskey.PathParameters> | null,
+      data?: any,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.DeletePortalUserPasskey.Responses.$204>
+  }
   ['/v2/portal/user/resend/confirmation-email/{id}']: {
     /**
      * resendConfirmationEmail - resendConfirmationEmail
@@ -23102,16 +24172,6 @@ export interface PathsDictionary {
       data?: any,
       config?: AxiosRequestConfig  
     ): OperationResponse<Paths.GetOrder.Responses.$200>
-    /**
-     * updateOrder - updateOrder
-     * 
-     * Update an order by id. Use getPortalUserEntity instead.
-     */
-    'patch'(
-      parameters?: Parameters<Paths.UpdateOrder.PathParameters> | null,
-      data?: Paths.UpdateOrder.RequestBody,
-      config?: AxiosRequestConfig  
-    ): OperationResponse<Paths.UpdateOrder.Responses.$200>
   }
   ['/v2/portal/opportunity']: {
     /**
@@ -23160,16 +24220,6 @@ export interface PathsDictionary {
       data?: any,
       config?: AxiosRequestConfig  
     ): OperationResponse<Paths.GetOpportunity.Responses.$200>
-    /**
-     * updateOpportunity - updateOpportunity
-     * 
-     * Update an opportunity by id.
-     */
-    'patch'(
-      parameters?: Parameters<Paths.UpdateOpportunity.PathParameters> | null,
-      data?: Paths.UpdateOpportunity.RequestBody,
-      config?: AxiosRequestConfig  
-    ): OperationResponse<Paths.UpdateOpportunity.Responses.$200>
   }
   ['/v2/portal/request']: {
     /**
@@ -23209,7 +24259,9 @@ export interface PathsDictionary {
     /**
      * updateContract - updateContract
      * 
-     * Update a contract by id. Use getPortalUserEntity instead.
+     * Updates a contract of the portal user. Only the attributes in `PortalContractUpdate` can be changed;
+     * other attributes are ignored. Returns 403 when the body has none of them.
+     * 
      */
     'patch'(
       parameters?: Parameters<Paths.UpdateContract.PathParameters> | null,
@@ -23315,16 +24367,6 @@ export interface PathsDictionary {
       data?: Paths.SaveEntityFile.RequestBody,
       config?: AxiosRequestConfig  
     ): OperationResponse<Paths.SaveEntityFile.Responses.$201>
-    /**
-     * deleteEntityFile - deleteEntityFile
-     * 
-     * Delete files from an entity
-     */
-    'delete'(
-      parameters?: Parameters<UnknownParamsObject> | null,
-      data?: Paths.DeleteEntityFile.RequestBody,
-      config?: AxiosRequestConfig  
-    ): OperationResponse<Paths.DeleteEntityFile.Responses.$202>
   }
   ['/v2/portal/portal/files']: {
     /**
@@ -23459,6 +24501,10 @@ export interface PathsDictionary {
      * 2. Using domain
      * 3. Using origin (legacy)
      * 
+     * A partner user can log in as a portal user the vendor shared with their organization by sending
+     * `x-epilot-org-id: <vendor org id>` with a `portal_id`. This needs `portal:login_as_user` on that portal in the
+     * partner role and the portal user shared with the partner organization.
+     * 
      */
     'post'(
       parameters?: Parameters<UnknownParamsObject> | null,
@@ -23596,7 +24642,7 @@ export interface PathsDictionary {
     /**
      * getOutstandingTasks - Get outstanding workflow tasks for the portal user
      * 
-     * Returns all outstanding workflow journey tasks for the authenticated portal user, across their opportunity, order and contract entities. Each task is an active workflow step that exposes a journey the customer still needs to fill out.
+     * Returns all outstanding workflow journey tasks for the authenticated portal user, across their opportunity, order and contract entities. Each task is an active workflow step that exposes a journey the customer still needs to fill out. A step whose start date still lies in the future is left out until that date.
      */
     'get'(
       parameters?: Parameters<UnknownParamsObject> | null,
@@ -23844,6 +24890,32 @@ export interface PathsDictionary {
       config?: AxiosRequestConfig  
     ): OperationResponse<Paths.DeletePortalPage.Responses.$204>
   }
+  ['/v2/portal/pages/{id}/detach']: {
+    /**
+     * detachPortalPage - detachPortalPage
+     * 
+     * Detach a blueprint-managed page from its blueprint. The page and all of its blocks become local (editable, no longer updated by the blueprint) and the page's lineage is tombstoned on the portal so future syncs skip it. One-way. Idempotent for pages that are not managed.
+     * 
+     */
+    'post'(
+      parameters?: Parameters<Paths.V2PortalPages$IdDetach.PathParameters> | null,
+      data?: any,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.DetachPortalPage.Responses.$200>
+  }
+  ['/v2/portal/pages/{id}/blocks/{block_id}/detach']: {
+    /**
+     * detachPortalPageBlock - detachPortalPageBlock
+     * 
+     * Detach a blueprint-managed block. The block becomes the customer's and its lineage is tombstoned on the page so future syncs skip it. A managed page stays managed and keeps receiving blueprint updates for everything else. One-way. Idempotent for blocks that are not managed.
+     * 
+     */
+    'post'(
+      parameters?: Parameters<Paths.V2PortalPages$IdBlocks$BlockIdDetach.PathParameters> | null,
+      data?: any,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.DetachPortalPageBlock.Responses.$200>
+  }
   ['/v2/portal/pages']: {
     /**
      * getPortalPages - getPortalPages
@@ -24200,6 +25272,23 @@ export interface PathsDictionary {
       config?: AxiosRequestConfig  
     ): OperationResponse<Paths.UpdatePortalRevision.Responses.$200>
   }
+  ['/v3/portal/config/{portal_id}/revisions/{revision_id}:preview']: {
+    /**
+     * createPortalRevisionPreview - createPortalRevisionPreview
+     * 
+     * Mints a short-lived preview token for one revision and returns a link that opens the revision inside the real end-customer portal, on the portal's live domain, without publishing it.
+     * 
+     * The portal sends the token back in the `x-portal-preview-token` header. Public and portal-user config, page, widget and extension reads that honour it answer with the revision's config and pages instead of the live ones and add `preview_revision` to config responses. Server-owned fields (ids, domains, Cognito pool identifiers, extension secrets) always come from the live portal. Nothing is written: the live portal, its pages and which revision is published stay as they are.
+     * 
+     * Requires view permission on the portal. Returns `404` when portal versioning or revision preview is not enabled for the organization, or when the revision does not exist.
+     * 
+     */
+    'post'(
+      parameters?: Parameters<Paths.CreatePortalRevisionPreview.PathParameters> | null,
+      data?: any,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.CreatePortalRevisionPreview.Responses.$200>
+  }
   ['/v3/portal/config/{portal_id}/publish']: {
     /**
      * publishPortalRevision - publishPortalRevision
@@ -24443,11 +25532,11 @@ export type CreateSupportRequest = Components.Schemas.CreateSupportRequest;
 export type CreateUserRequest = Components.Schemas.CreateUserRequest;
 export type Currency = Components.Schemas.Currency;
 export type DataRetrievalItem = Components.Schemas.DataRetrievalItem;
-export type DeleteEntityFile = Components.Schemas.DeleteEntityFile;
 export type Direction = Components.Schemas.Direction;
 export type DocumentWidget = Components.Schemas.DocumentWidget;
 export type DomainSettings = Components.Schemas.DomainSettings;
 export type EmailTemplates = Components.Schemas.EmailTemplates;
+export type EngagementCenterTaskTemplates = Components.Schemas.EngagementCenterTaskTemplates;
 export type Entity = Components.Schemas.Entity;
 export type EntityEditRule = Components.Schemas.EntityEditRule;
 export type EntityFileCount = Components.Schemas.EntityFileCount;
@@ -24490,6 +25579,7 @@ export type File = Components.Schemas.File;
 export type FileItem = Components.Schemas.FileItem;
 export type FilePreviewResult = Components.Schemas.FilePreviewResult;
 export type Grant = Components.Schemas.Grant;
+export type HeldBackNode = Components.Schemas.HeldBackNode;
 export type IdentifierAttribute = Components.Schemas.IdentifierAttribute;
 export type InstallmentEvent = Components.Schemas.InstallmentEvent;
 export type JourneyActions = Components.Schemas.JourneyActions;
@@ -24499,6 +25589,7 @@ export type JuiceSettings = Components.Schemas.JuiceSettings;
 export type Meter = Components.Schemas.Meter;
 export type MeterChartWidget = Components.Schemas.MeterChartWidget;
 export type MeterReading = Components.Schemas.MeterReading;
+export type MeterReadingCounterDetails = Components.Schemas.MeterReadingCounterDetails;
 export type MeterReadingPhoto = Components.Schemas.MeterReadingPhoto;
 export type MeterReadingPhotoData = Components.Schemas.MeterReadingPhotoData;
 export type MeterReadingWidget = Components.Schemas.MeterReadingWidget;
@@ -24524,6 +25615,9 @@ export type PaymentWidget = Components.Schemas.PaymentWidget;
 export type PortalConfig = Components.Schemas.PortalConfig;
 export type PortalConfigSummaryV3 = Components.Schemas.PortalConfigSummaryV3;
 export type PortalConfigV3 = Components.Schemas.PortalConfigV3;
+export type PortalContactUpdate = Components.Schemas.PortalContactUpdate;
+export type PortalContractUpdate = Components.Schemas.PortalContractUpdate;
+export type PortalCopilotVisibility = Components.Schemas.PortalCopilotVisibility;
 export type PortalDataExportColumn = Components.Schemas.PortalDataExportColumn;
 export type PortalDescriptionOverrides = Components.Schemas.PortalDescriptionOverrides;
 export type PortalFeatureSettings = Components.Schemas.PortalFeatureSettings;
@@ -24533,6 +25627,7 @@ export type PortalNotification = Components.Schemas.PortalNotification;
 export type PortalRevision = Components.Schemas.PortalRevision;
 export type PortalRevisionCreated = Components.Schemas.PortalRevisionCreated;
 export type PortalRevisionList = Components.Schemas.PortalRevisionList;
+export type PortalRevisionPreview = Components.Schemas.PortalRevisionPreview;
 export type PortalRevisionRequest = Components.Schemas.PortalRevisionRequest;
 export type PortalRevisionSummary = Components.Schemas.PortalRevisionSummary;
 export type PortalSurface = Components.Schemas.PortalSurface;
@@ -24540,12 +25635,15 @@ export type PortalSurfaceDataAccess = Components.Schemas.PortalSurfaceDataAccess
 export type PortalSurfaceEntityAccess = Components.Schemas.PortalSurfaceEntityAccess;
 export type PortalTaskConfig = Components.Schemas.PortalTaskConfig;
 export type PortalUser = Components.Schemas.PortalUser;
+export type PortalUserNotificationPreferences = Components.Schemas.PortalUserNotificationPreferences;
+export type PortalUserPasskey = Components.Schemas.PortalUserPasskey;
 export type PortalUserRegistrationStatus = Components.Schemas.PortalUserRegistrationStatus;
 export type PortalUsingDesign = Components.Schemas.PortalUsingDesign;
 export type PortalWidget = Components.Schemas.PortalWidget;
 export type PortalWorkflow = Components.Schemas.PortalWorkflow;
 export type PortalWorkflowStage = Components.Schemas.PortalWorkflowStage;
 export type PortalWorkflowTask = Components.Schemas.PortalWorkflowTask;
+export type PreviewRevision = Components.Schemas.PreviewRevision;
 export type Product = Components.Schemas.Product;
 export type ProductRecommendationsWidget = Components.Schemas.ProductRecommendationsWidget;
 export type ProviderConfig = Components.Schemas.ProviderConfig;
@@ -24578,6 +25676,8 @@ export type Rule = Components.Schemas.Rule;
 export type SAMLProviderConfig = Components.Schemas.SAMLProviderConfig;
 export type SSOCallbackRequest = Components.Schemas.SSOCallbackRequest;
 export type SSOCallbackResponse = Components.Schemas.SSOCallbackResponse;
+export type SSODebugInfo = Components.Schemas.SSODebugInfo;
+export type SSOErrorResp = Components.Schemas.SSOErrorResp;
 export type SSOLoginToken = Components.Schemas.SSOLoginToken;
 export type SaveEntityFile = Components.Schemas.SaveEntityFile;
 export type SavePortalFile = Components.Schemas.SavePortalFile;