@epilot/sdk 2.20.14 → 2.20.15

package/dist/{access-token.d-BhRUc8I-.d.cts → access-token.d-OiCg1gnT.d.cts}

@@ -38,6 +38,22 @@ declare namespace Components {
             journey_id?: /* Journey ID for access token type "journey" */ AccessTokenJourneyId;
             portal_id?: /* Portal ID for access token type "portal" */ PortalId;
             portal_user_id?: /* Portal User ID for access token type "portal_preview" */ PortalUserId;
+            contact_id?: /**
+             * Contact entity ID for access token type "contact_identification"
+             * example:
+             * 5da0a718-c822-403d-9f5d-20d4584e0528
+             */
+            ContactId;
+            origin?: /* Portal origin the token assumes, so the bearer is permission-masked the same way the corresponding portal role is. */ PortalOrigin;
+            allowed_operations?: /**
+             * openapi operationIds the token may call. Enforced by the API that consumes the token, which must additionally deny any operation not on this list. Baked into the token at issue time so widening the consumer's own allowlist later cannot retroactively widen a token that is already in circulation.
+             * example:
+             * [
+             *   "getContact",
+             *   "getContracts"
+             * ]
+             */
+            AllowedOperations;
             assignments?: /* List of role ids attached to an user */ Assignments;
             read_only?: /**
              * When true, the issued token may only perform read-only actions. Any action guarded by permissions that is not read-only (i.e. not a view/export/download action) is denied, regardless of the roles the token carries.
@@ -57,6 +73,12 @@ declare namespace Components {
              * 2026-02-24
              */
             last_used?: string; // date
+            /**
+             * Timestamp when the token expires and stops being accepted (only set for tokens created with expires_in)
+             * example:
+             * 2026-03-01T12:00:00.000Z
+             */
+            expires_at?: string; // date-time
         }
         /**
          * Journey ID for access token type "journey"
@@ -96,7 +118,16 @@ declare namespace Components {
          * example:
          * api
          */
-        export type AccessTokenType = "api" | "journey" | "portal" | "assume" | "app" | "portal_preview";
+        export type AccessTokenType = "api" | "journey" | "portal" | "assume" | "app" | "portal_preview" | "contact_identification";
+        /**
+         * openapi operationIds the token may call. Enforced by the API that consumes the token, which must additionally deny any operation not on this list. Baked into the token at issue time so widening the consumer's own allowlist later cannot retroactively widen a token that is already in circulation.
+         * example:
+         * [
+         *   "getContact",
+         *   "getContracts"
+         * ]
+         */
+        export type AllowedOperations = string[];
         /**
          * Forces PII anonymization on all entity data returned to this token. Cannot be disabled by the token bearer. See entity-api anonymized responses.
          * example:
@@ -157,6 +188,57 @@ declare namespace Components {
              */
             Anonymize;
         }
+        /**
+         * Contact entity ID for access token type "contact_identification"
+         * example:
+         * 5da0a718-c822-403d-9f5d-20d4584e0528
+         */
+        export type ContactId = string;
+        /**
+         * A token that acts as one contact, issued after that contact was identified by a portal's registration identifiers rather than by logging in. Distinct from portal_preview, which impersonates an existing portal user for a 360 operator: this kind belongs to no user, is minted for an unauthenticated caller, and is therefore always short-lived and restricted to an explicit operation allowlist. Never stored, so it cannot be listed or revoked - keep expires_in short.
+         */
+        export interface ContactIdentificationTokenParameters {
+            name: /**
+             * Human readable name for access token
+             * example:
+             * Postman Access Token
+             */
+            AccessTokenName;
+            token_type?: "contact_identification";
+            portal_id: /* Portal ID for access token type "portal" */ PortalId;
+            contact_id: /**
+             * Contact entity ID for access token type "contact_identification"
+             * example:
+             * 5da0a718-c822-403d-9f5d-20d4584e0528
+             */
+            ContactId;
+            /**
+             * Portal surface the token is issued for (see `surfaces` on the portal config in customer-portal-api). Carried as the `custom:surface_id` claim; the consuming API resolves the surface's data access from the portal config on every request.
+             * example:
+             * website-journeys
+             */
+            surface_id: string;
+            origin?: /* Portal origin the token assumes, so the bearer is permission-masked the same way the corresponding portal role is. */ PortalOrigin;
+            allowed_operations: /**
+             * openapi operationIds the token may call. Enforced by the API that consumes the token, which must additionally deny any operation not on this list. Baked into the token at issue time so widening the consumer's own allowlist later cannot retroactively widen a token that is already in circulation.
+             * example:
+             * [
+             *   "getContact",
+             *   "getContracts"
+             * ]
+             */
+            AllowedOperations;
+            /**
+             * Lifetime in seconds. Integer only for this token type (no "5m" strings), and capped server-side by CONTACT_IDENTIFICATION_TOKEN_MAX_EXPIRATION_SECONDS - the value originates from portal configuration, so it is not trusted as-is.
+             * example:
+             * 300
+             */
+            expires_in: number; // int32
+            /**
+             * Optional. Carried as the `email` claim when the consumer needs it (e.g. to attribute an activity). Omit to keep the contact's email out of the token.
+             */
+            email?: string;
+        }
         export type ExpiresIn = number /* int32 */ | string /* ^[0-9]+ ?(ms|milliseconds?|s|seconds?|m|minutes?|h|hours?|d|days?|w|weeks?|y|years?)?$ */;
         export interface JourneyTokenParameters {
             name: /**
@@ -173,6 +255,10 @@ declare namespace Components {
          * Portal ID for access token type "portal"
          */
         export type PortalId = string;
+        /**
+         * Portal origin the token assumes, so the bearer is permission-masked the same way the corresponding portal role is.
+         */
+        export type PortalOrigin = "END_CUSTOMER_PORTAL" | "INSTALLER_PORTAL";
         export interface PortalPreviewTokenParameters {
             name: /**
              * Human readable name for access token
@@ -211,7 +297,7 @@ declare namespace Components {
          * 123:owner
          */
         export type RoleId = string;
-        export type TokenParameters = AccessTokenParameters | JourneyTokenParameters | PortalTokenParameters | AssumeTokenParameters | AppTokenParameters | PortalPreviewTokenParameters;
+        export type TokenParameters = AccessTokenParameters | JourneyTokenParameters | PortalTokenParameters | AssumeTokenParameters | AppTokenParameters | PortalPreviewTokenParameters | /* A token that acts as one contact, issued after that contact was identified by a portal's registration identifiers rather than by logging in. Distinct from portal_preview, which impersonates an existing portal user for a 360 operator: this kind belongs to no user, is minted for an unauthenticated caller, and is therefore always short-lived and restricted to an explicit operation allowlist. Never stored, so it cannot be listed or revoked - keep expires_in short. */ ContactIdentificationTokenParameters;
     }
 }
 declare namespace Paths {
@@ -246,6 +332,22 @@ declare namespace Paths {
                 journey_id?: /* Journey ID for access token type "journey" */ Components.Schemas.AccessTokenJourneyId;
                 portal_id?: /* Portal ID for access token type "portal" */ Components.Schemas.PortalId;
                 portal_user_id?: /* Portal User ID for access token type "portal_preview" */ Components.Schemas.PortalUserId;
+                contact_id?: /**
+                 * Contact entity ID for access token type "contact_identification"
+                 * example:
+                 * 5da0a718-c822-403d-9f5d-20d4584e0528
+                 */
+                Components.Schemas.ContactId;
+                origin?: /* Portal origin the token assumes, so the bearer is permission-masked the same way the corresponding portal role is. */ Components.Schemas.PortalOrigin;
+                allowed_operations?: /**
+                 * openapi operationIds the token may call. Enforced by the API that consumes the token, which must additionally deny any operation not on this list. Baked into the token at issue time so widening the consumer's own allowlist later cannot retroactively widen a token that is already in circulation.
+                 * example:
+                 * [
+                 *   "getContact",
+                 *   "getContracts"
+                 * ]
+                 */
+                Components.Schemas.AllowedOperations;
                 assignments?: /* List of role ids attached to an user */ Components.Schemas.Assignments;
                 read_only?: /**
                  * When true, the issued token may only perform read-only actions. Any action guarded by permissions that is not read-only (i.e. not a view/export/download action) is denied, regardless of the roles the token carries.
@@ -265,6 +367,12 @@ declare namespace Paths {
                  * 2026-02-24
                  */
                 last_used?: string; // date
+                /**
+                 * Timestamp when the token expires and stops being accepted (only set for tokens created with expires_in)
+                 * example:
+                 * 2026-03-01T12:00:00.000Z
+                 */
+                expires_at?: string; // date-time
             }
             export interface $400 {
                 status?: number;
@@ -330,6 +438,60 @@ declare namespace Paths {
             }
         }
     }
+    namespace GetContactIdentificationTokenJwks {
+        namespace Responses {
+            export interface $200 {
+                keys?: {
+                    /**
+                     * example:
+                     * RS256
+                     */
+                    alg?: string;
+                    /**
+                     * example:
+                     * AQAB
+                     */
+                    e?: string;
+                    /**
+                     * example:
+                     * tXWU5mPMbRPczpbQwi6vbhLF4GgF3wlMDSyqo7pfeiw=
+                     */
+                    kid?: string;
+                    /**
+                     * example:
+                     * RSA
+                     */
+                    kty?: string;
+                    /**
+                     * example:
+                     * h_QDoCjZ8W_trtYXaP7_S22wf5r5Wd9XBLED78oT44bJjQXn8ddcFV8Hik65_4IYXVX_hTTU4zpxe3H8vx2j7-Zz3O59mYMp5S0MzODNEdf5Y_2o19eis0brmAJniixsNlQ9LlYkdrVamrgaxHu3ZpP_99zkfFybYeuYoQNzb3PyrT8xVnz_USs_nlFMHpGUxvvz7gfKPqxcLvgLJr4cwI9yzaSY9CD4qW181QVcnL_WzpQ8xx6AuhhHZQ1l_3GG4InTk8ahE7U2ZHVu8RrX6d01pMgc3piEcet9RgFLnhbTg3YIiKGoAbN42wJn_x3lgIAC42T9mbmTsHyUdS6nUQ
+                     */
+                    n?: string;
+                    /**
+                     * example:
+                     * sig
+                     */
+                    use?: string;
+                }[];
+            }
+        }
+    }
+    namespace GetContactIdentificationTokenOIDC {
+        namespace Responses {
+            export interface $200 {
+                /**
+                 * example:
+                 * https://access-token.sls.epilot.io/v1/access-tokens/contact-identification
+                 */
+                issuer?: string; // uri
+                /**
+                 * example:
+                 * https://access-token.sls.epilot.io/v1/access-tokens/contact-identification/.well-known/jwks.json
+                 */
+                jwks_uri?: string; // uri
+            }
+        }
+    }
     namespace GetPortalPreviewTokenJwks {
         namespace Responses {
             export interface $200 {
@@ -587,6 +749,30 @@ interface OperationMethods {
     data?: any,
     config?: AxiosRequestConfig  
   ): OperationResponse<Paths.GetPortalPreviewTokenOIDC.Responses.$200>
+  /**
+   * getContactIdentificationTokenJwks - getContactIdentificationTokenJwks
+   * 
+   * Get jwks public key set to verify contact identification tokens generated by this API
+   */
+  'getContactIdentificationTokenJwks'(
+    parameters?: Parameters<UnknownParamsObject> | null,
+    data?: any,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.GetContactIdentificationTokenJwks.Responses.$200>
+  /**
+   * getContactIdentificationTokenOIDC - getContactIdentificationTokenOIDC
+   * 
+   * OpenID Connect configuration for Access Token API as a contact identification identity provider
+   * 
+   * Note: This API is not a fully compliant OAuth2.0 / OIDC identity provider, but this endpoint is useful to
+   * automate the process of verifying JWT tokens.
+   * 
+   */
+  'getContactIdentificationTokenOIDC'(
+    parameters?: Parameters<UnknownParamsObject> | null,
+    data?: any,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.GetContactIdentificationTokenOIDC.Responses.$200>
 }
 
 interface PathsDictionary {
@@ -720,6 +906,34 @@ interface PathsDictionary {
       config?: AxiosRequestConfig  
     ): OperationResponse<Paths.GetPortalPreviewTokenOIDC.Responses.$200>
   }
+  ['/v1/access-tokens/contact-identification/.well-known/jwks.json']: {
+    /**
+     * getContactIdentificationTokenJwks - getContactIdentificationTokenJwks
+     * 
+     * Get jwks public key set to verify contact identification tokens generated by this API
+     */
+    'get'(
+      parameters?: Parameters<UnknownParamsObject> | null,
+      data?: any,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.GetContactIdentificationTokenJwks.Responses.$200>
+  }
+  ['/v1/access-tokens/contact-identification/.well-known/openid-configuration']: {
+    /**
+     * getContactIdentificationTokenOIDC - getContactIdentificationTokenOIDC
+     * 
+     * OpenID Connect configuration for Access Token API as a contact identification identity provider
+     * 
+     * Note: This API is not a fully compliant OAuth2.0 / OIDC identity provider, but this endpoint is useful to
+     * automate the process of verifying JWT tokens.
+     * 
+     */
+    'get'(
+      parameters?: Parameters<UnknownParamsObject> | null,
+      data?: any,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.GetContactIdentificationTokenOIDC.Responses.$200>
+  }
 }
 
 type Client = OpenAPIClient<OperationMethods, PathsDictionary>
@@ -732,13 +946,17 @@ type AccessTokenJourneyId = Components.Schemas.AccessTokenJourneyId;
 type AccessTokenName = Components.Schemas.AccessTokenName;
 type AccessTokenParameters = Components.Schemas.AccessTokenParameters;
 type AccessTokenType = Components.Schemas.AccessTokenType;
+type AllowedOperations = Components.Schemas.AllowedOperations;
 type Anonymize = Components.Schemas.Anonymize;
 type AppTokenParameters = Components.Schemas.AppTokenParameters;
 type Assignments = Components.Schemas.Assignments;
 type AssumeTokenParameters = Components.Schemas.AssumeTokenParameters;
+type ContactId = Components.Schemas.ContactId;
+type ContactIdentificationTokenParameters = Components.Schemas.ContactIdentificationTokenParameters;
 type ExpiresIn = Components.Schemas.ExpiresIn;
 type JourneyTokenParameters = Components.Schemas.JourneyTokenParameters;
 type PortalId = Components.Schemas.PortalId;
+type PortalOrigin = Components.Schemas.PortalOrigin;
 type PortalPreviewTokenParameters = Components.Schemas.PortalPreviewTokenParameters;
 type PortalTokenParameters = Components.Schemas.PortalTokenParameters;
 type PortalUserId = Components.Schemas.PortalUserId;
@@ -746,4 +964,4 @@ type ReadOnly = Components.Schemas.ReadOnly;
 type RoleId = Components.Schemas.RoleId;
 type TokenParameters = Components.Schemas.TokenParameters;
 
-export { type AccessToken as A, type Client as C, type ExpiresIn as E, type JourneyTokenParameters as J, type OperationMethods as O, Paths as P, type ReadOnly as R, type TokenParameters as T, Components as a, type PathsDictionary as b, type AccessTokenId as c, type AccessTokenItem as d, type AccessTokenJourneyId as e, type AccessTokenName as f, type AccessTokenParameters as g, type AccessTokenType as h, type Anonymize as i, type AppTokenParameters as j, type Assignments as k, type AssumeTokenParameters as l, type PortalId as m, type PortalPreviewTokenParameters as n, type PortalTokenParameters as o, type PortalUserId as p, type RoleId as q };
+export { type AccessToken as A, type Client as C, type ExpiresIn as E, type JourneyTokenParameters as J, type OperationMethods as O, Paths as P, type ReadOnly as R, type TokenParameters as T, Components as a, type PathsDictionary as b, type AccessTokenId as c, type AccessTokenItem as d, type AccessTokenJourneyId as e, type AccessTokenName as f, type AccessTokenParameters as g, type AccessTokenType as h, type AllowedOperations as i, type Anonymize as j, type AppTokenParameters as k, type Assignments as l, type AssumeTokenParameters as m, type ContactId as n, type ContactIdentificationTokenParameters as o, type PortalId as p, type PortalOrigin as q, type PortalPreviewTokenParameters as r, type PortalTokenParameters as s, type PortalUserId as t, type RoleId as u };

package/dist/{access-token.d-BhRUc8I-.d.ts → access-token.d-OiCg1gnT.d.ts}

@@ -38,6 +38,22 @@ declare namespace Components {
             journey_id?: /* Journey ID for access token type "journey" */ AccessTokenJourneyId;
             portal_id?: /* Portal ID for access token type "portal" */ PortalId;
             portal_user_id?: /* Portal User ID for access token type "portal_preview" */ PortalUserId;
+            contact_id?: /**
+             * Contact entity ID for access token type "contact_identification"
+             * example:
+             * 5da0a718-c822-403d-9f5d-20d4584e0528
+             */
+            ContactId;
+            origin?: /* Portal origin the token assumes, so the bearer is permission-masked the same way the corresponding portal role is. */ PortalOrigin;
+            allowed_operations?: /**
+             * openapi operationIds the token may call. Enforced by the API that consumes the token, which must additionally deny any operation not on this list. Baked into the token at issue time so widening the consumer's own allowlist later cannot retroactively widen a token that is already in circulation.
+             * example:
+             * [
+             *   "getContact",
+             *   "getContracts"
+             * ]
+             */
+            AllowedOperations;
             assignments?: /* List of role ids attached to an user */ Assignments;
             read_only?: /**
              * When true, the issued token may only perform read-only actions. Any action guarded by permissions that is not read-only (i.e. not a view/export/download action) is denied, regardless of the roles the token carries.
@@ -57,6 +73,12 @@ declare namespace Components {
              * 2026-02-24
              */
             last_used?: string; // date
+            /**
+             * Timestamp when the token expires and stops being accepted (only set for tokens created with expires_in)
+             * example:
+             * 2026-03-01T12:00:00.000Z
+             */
+            expires_at?: string; // date-time
         }
         /**
          * Journey ID for access token type "journey"
@@ -96,7 +118,16 @@ declare namespace Components {
          * example:
          * api
          */
-        export type AccessTokenType = "api" | "journey" | "portal" | "assume" | "app" | "portal_preview";
+        export type AccessTokenType = "api" | "journey" | "portal" | "assume" | "app" | "portal_preview" | "contact_identification";
+        /**
+         * openapi operationIds the token may call. Enforced by the API that consumes the token, which must additionally deny any operation not on this list. Baked into the token at issue time so widening the consumer's own allowlist later cannot retroactively widen a token that is already in circulation.
+         * example:
+         * [
+         *   "getContact",
+         *   "getContracts"
+         * ]
+         */
+        export type AllowedOperations = string[];
         /**
          * Forces PII anonymization on all entity data returned to this token. Cannot be disabled by the token bearer. See entity-api anonymized responses.
          * example:
@@ -157,6 +188,57 @@ declare namespace Components {
              */
             Anonymize;
         }
+        /**
+         * Contact entity ID for access token type "contact_identification"
+         * example:
+         * 5da0a718-c822-403d-9f5d-20d4584e0528
+         */
+        export type ContactId = string;
+        /**
+         * A token that acts as one contact, issued after that contact was identified by a portal's registration identifiers rather than by logging in. Distinct from portal_preview, which impersonates an existing portal user for a 360 operator: this kind belongs to no user, is minted for an unauthenticated caller, and is therefore always short-lived and restricted to an explicit operation allowlist. Never stored, so it cannot be listed or revoked - keep expires_in short.
+         */
+        export interface ContactIdentificationTokenParameters {
+            name: /**
+             * Human readable name for access token
+             * example:
+             * Postman Access Token
+             */
+            AccessTokenName;
+            token_type?: "contact_identification";
+            portal_id: /* Portal ID for access token type "portal" */ PortalId;
+            contact_id: /**
+             * Contact entity ID for access token type "contact_identification"
+             * example:
+             * 5da0a718-c822-403d-9f5d-20d4584e0528
+             */
+            ContactId;
+            /**
+             * Portal surface the token is issued for (see `surfaces` on the portal config in customer-portal-api). Carried as the `custom:surface_id` claim; the consuming API resolves the surface's data access from the portal config on every request.
+             * example:
+             * website-journeys
+             */
+            surface_id: string;
+            origin?: /* Portal origin the token assumes, so the bearer is permission-masked the same way the corresponding portal role is. */ PortalOrigin;
+            allowed_operations: /**
+             * openapi operationIds the token may call. Enforced by the API that consumes the token, which must additionally deny any operation not on this list. Baked into the token at issue time so widening the consumer's own allowlist later cannot retroactively widen a token that is already in circulation.
+             * example:
+             * [
+             *   "getContact",
+             *   "getContracts"
+             * ]
+             */
+            AllowedOperations;
+            /**
+             * Lifetime in seconds. Integer only for this token type (no "5m" strings), and capped server-side by CONTACT_IDENTIFICATION_TOKEN_MAX_EXPIRATION_SECONDS - the value originates from portal configuration, so it is not trusted as-is.
+             * example:
+             * 300
+             */
+            expires_in: number; // int32
+            /**
+             * Optional. Carried as the `email` claim when the consumer needs it (e.g. to attribute an activity). Omit to keep the contact's email out of the token.
+             */
+            email?: string;
+        }
         export type ExpiresIn = number /* int32 */ | string /* ^[0-9]+ ?(ms|milliseconds?|s|seconds?|m|minutes?|h|hours?|d|days?|w|weeks?|y|years?)?$ */;
         export interface JourneyTokenParameters {
             name: /**
@@ -173,6 +255,10 @@ declare namespace Components {
          * Portal ID for access token type "portal"
          */
         export type PortalId = string;
+        /**
+         * Portal origin the token assumes, so the bearer is permission-masked the same way the corresponding portal role is.
+         */
+        export type PortalOrigin = "END_CUSTOMER_PORTAL" | "INSTALLER_PORTAL";
         export interface PortalPreviewTokenParameters {
             name: /**
              * Human readable name for access token
@@ -211,7 +297,7 @@ declare namespace Components {
          * 123:owner
          */
         export type RoleId = string;
-        export type TokenParameters = AccessTokenParameters | JourneyTokenParameters | PortalTokenParameters | AssumeTokenParameters | AppTokenParameters | PortalPreviewTokenParameters;
+        export type TokenParameters = AccessTokenParameters | JourneyTokenParameters | PortalTokenParameters | AssumeTokenParameters | AppTokenParameters | PortalPreviewTokenParameters | /* A token that acts as one contact, issued after that contact was identified by a portal's registration identifiers rather than by logging in. Distinct from portal_preview, which impersonates an existing portal user for a 360 operator: this kind belongs to no user, is minted for an unauthenticated caller, and is therefore always short-lived and restricted to an explicit operation allowlist. Never stored, so it cannot be listed or revoked - keep expires_in short. */ ContactIdentificationTokenParameters;
     }
 }
 declare namespace Paths {
@@ -246,6 +332,22 @@ declare namespace Paths {
                 journey_id?: /* Journey ID for access token type "journey" */ Components.Schemas.AccessTokenJourneyId;
                 portal_id?: /* Portal ID for access token type "portal" */ Components.Schemas.PortalId;
                 portal_user_id?: /* Portal User ID for access token type "portal_preview" */ Components.Schemas.PortalUserId;
+                contact_id?: /**
+                 * Contact entity ID for access token type "contact_identification"
+                 * example:
+                 * 5da0a718-c822-403d-9f5d-20d4584e0528
+                 */
+                Components.Schemas.ContactId;
+                origin?: /* Portal origin the token assumes, so the bearer is permission-masked the same way the corresponding portal role is. */ Components.Schemas.PortalOrigin;
+                allowed_operations?: /**
+                 * openapi operationIds the token may call. Enforced by the API that consumes the token, which must additionally deny any operation not on this list. Baked into the token at issue time so widening the consumer's own allowlist later cannot retroactively widen a token that is already in circulation.
+                 * example:
+                 * [
+                 *   "getContact",
+                 *   "getContracts"
+                 * ]
+                 */
+                Components.Schemas.AllowedOperations;
                 assignments?: /* List of role ids attached to an user */ Components.Schemas.Assignments;
                 read_only?: /**
                  * When true, the issued token may only perform read-only actions. Any action guarded by permissions that is not read-only (i.e. not a view/export/download action) is denied, regardless of the roles the token carries.
@@ -265,6 +367,12 @@ declare namespace Paths {
                  * 2026-02-24
                  */
                 last_used?: string; // date
+                /**
+                 * Timestamp when the token expires and stops being accepted (only set for tokens created with expires_in)
+                 * example:
+                 * 2026-03-01T12:00:00.000Z
+                 */
+                expires_at?: string; // date-time
             }
             export interface $400 {
                 status?: number;
@@ -330,6 +438,60 @@ declare namespace Paths {
             }
         }
     }
+    namespace GetContactIdentificationTokenJwks {
+        namespace Responses {
+            export interface $200 {
+                keys?: {
+                    /**
+                     * example:
+                     * RS256
+                     */
+                    alg?: string;
+                    /**
+                     * example:
+                     * AQAB
+                     */
+                    e?: string;
+                    /**
+                     * example:
+                     * tXWU5mPMbRPczpbQwi6vbhLF4GgF3wlMDSyqo7pfeiw=
+                     */
+                    kid?: string;
+                    /**
+                     * example:
+                     * RSA
+                     */
+                    kty?: string;
+                    /**
+                     * example:
+                     * h_QDoCjZ8W_trtYXaP7_S22wf5r5Wd9XBLED78oT44bJjQXn8ddcFV8Hik65_4IYXVX_hTTU4zpxe3H8vx2j7-Zz3O59mYMp5S0MzODNEdf5Y_2o19eis0brmAJniixsNlQ9LlYkdrVamrgaxHu3ZpP_99zkfFybYeuYoQNzb3PyrT8xVnz_USs_nlFMHpGUxvvz7gfKPqxcLvgLJr4cwI9yzaSY9CD4qW181QVcnL_WzpQ8xx6AuhhHZQ1l_3GG4InTk8ahE7U2ZHVu8RrX6d01pMgc3piEcet9RgFLnhbTg3YIiKGoAbN42wJn_x3lgIAC42T9mbmTsHyUdS6nUQ
+                     */
+                    n?: string;
+                    /**
+                     * example:
+                     * sig
+                     */
+                    use?: string;
+                }[];
+            }
+        }
+    }
+    namespace GetContactIdentificationTokenOIDC {
+        namespace Responses {
+            export interface $200 {
+                /**
+                 * example:
+                 * https://access-token.sls.epilot.io/v1/access-tokens/contact-identification
+                 */
+                issuer?: string; // uri
+                /**
+                 * example:
+                 * https://access-token.sls.epilot.io/v1/access-tokens/contact-identification/.well-known/jwks.json
+                 */
+                jwks_uri?: string; // uri
+            }
+        }
+    }
     namespace GetPortalPreviewTokenJwks {
         namespace Responses {
             export interface $200 {
@@ -587,6 +749,30 @@ interface OperationMethods {
     data?: any,
     config?: AxiosRequestConfig  
   ): OperationResponse<Paths.GetPortalPreviewTokenOIDC.Responses.$200>
+  /**
+   * getContactIdentificationTokenJwks - getContactIdentificationTokenJwks
+   * 
+   * Get jwks public key set to verify contact identification tokens generated by this API
+   */
+  'getContactIdentificationTokenJwks'(
+    parameters?: Parameters<UnknownParamsObject> | null,
+    data?: any,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.GetContactIdentificationTokenJwks.Responses.$200>
+  /**
+   * getContactIdentificationTokenOIDC - getContactIdentificationTokenOIDC
+   * 
+   * OpenID Connect configuration for Access Token API as a contact identification identity provider
+   * 
+   * Note: This API is not a fully compliant OAuth2.0 / OIDC identity provider, but this endpoint is useful to
+   * automate the process of verifying JWT tokens.
+   * 
+   */
+  'getContactIdentificationTokenOIDC'(
+    parameters?: Parameters<UnknownParamsObject> | null,
+    data?: any,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.GetContactIdentificationTokenOIDC.Responses.$200>
 }
 
 interface PathsDictionary {
@@ -720,6 +906,34 @@ interface PathsDictionary {
       config?: AxiosRequestConfig  
     ): OperationResponse<Paths.GetPortalPreviewTokenOIDC.Responses.$200>
   }
+  ['/v1/access-tokens/contact-identification/.well-known/jwks.json']: {
+    /**
+     * getContactIdentificationTokenJwks - getContactIdentificationTokenJwks
+     * 
+     * Get jwks public key set to verify contact identification tokens generated by this API
+     */
+    'get'(
+      parameters?: Parameters<UnknownParamsObject> | null,
+      data?: any,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.GetContactIdentificationTokenJwks.Responses.$200>
+  }
+  ['/v1/access-tokens/contact-identification/.well-known/openid-configuration']: {
+    /**
+     * getContactIdentificationTokenOIDC - getContactIdentificationTokenOIDC
+     * 
+     * OpenID Connect configuration for Access Token API as a contact identification identity provider
+     * 
+     * Note: This API is not a fully compliant OAuth2.0 / OIDC identity provider, but this endpoint is useful to
+     * automate the process of verifying JWT tokens.
+     * 
+     */
+    'get'(
+      parameters?: Parameters<UnknownParamsObject> | null,
+      data?: any,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.GetContactIdentificationTokenOIDC.Responses.$200>
+  }
 }
 
 type Client = OpenAPIClient<OperationMethods, PathsDictionary>
@@ -732,13 +946,17 @@ type AccessTokenJourneyId = Components.Schemas.AccessTokenJourneyId;
 type AccessTokenName = Components.Schemas.AccessTokenName;
 type AccessTokenParameters = Components.Schemas.AccessTokenParameters;
 type AccessTokenType = Components.Schemas.AccessTokenType;
+type AllowedOperations = Components.Schemas.AllowedOperations;
 type Anonymize = Components.Schemas.Anonymize;
 type AppTokenParameters = Components.Schemas.AppTokenParameters;
 type Assignments = Components.Schemas.Assignments;
 type AssumeTokenParameters = Components.Schemas.AssumeTokenParameters;
+type ContactId = Components.Schemas.ContactId;
+type ContactIdentificationTokenParameters = Components.Schemas.ContactIdentificationTokenParameters;
 type ExpiresIn = Components.Schemas.ExpiresIn;
 type JourneyTokenParameters = Components.Schemas.JourneyTokenParameters;
 type PortalId = Components.Schemas.PortalId;
+type PortalOrigin = Components.Schemas.PortalOrigin;
 type PortalPreviewTokenParameters = Components.Schemas.PortalPreviewTokenParameters;
 type PortalTokenParameters = Components.Schemas.PortalTokenParameters;
 type PortalUserId = Components.Schemas.PortalUserId;
@@ -746,4 +964,4 @@ type ReadOnly = Components.Schemas.ReadOnly;
 type RoleId = Components.Schemas.RoleId;
 type TokenParameters = Components.Schemas.TokenParameters;
 
-export { type AccessToken as A, type Client as C, type ExpiresIn as E, type JourneyTokenParameters as J, type OperationMethods as O, Paths as P, type ReadOnly as R, type TokenParameters as T, Components as a, type PathsDictionary as b, type AccessTokenId as c, type AccessTokenItem as d, type AccessTokenJourneyId as e, type AccessTokenName as f, type AccessTokenParameters as g, type AccessTokenType as h, type Anonymize as i, type AppTokenParameters as j, type Assignments as k, type AssumeTokenParameters as l, type PortalId as m, type PortalPreviewTokenParameters as n, type PortalTokenParameters as o, type PortalUserId as p, type RoleId as q };
+export { type AccessToken as A, type Client as C, type ExpiresIn as E, type JourneyTokenParameters as J, type OperationMethods as O, Paths as P, type ReadOnly as R, type TokenParameters as T, Components as a, type PathsDictionary as b, type AccessTokenId as c, type AccessTokenItem as d, type AccessTokenJourneyId as e, type AccessTokenName as f, type AccessTokenParameters as g, type AccessTokenType as h, type AllowedOperations as i, type Anonymize as j, type AppTokenParameters as k, type Assignments as l, type AssumeTokenParameters as m, type ContactId as n, type ContactIdentificationTokenParameters as o, type PortalId as p, type PortalOrigin as q, type PortalPreviewTokenParameters as r, type PortalTokenParameters as s, type PortalUserId as t, type RoleId as u };