@epilot/sdk 2.20.70 → 2.20.71

package/docs/identity.md

@@ -42,6 +42,7 @@ const { data } = await identityClient.listClients(...)
 - [`revokeClientOrganization`](#revokeclientorganization)
 - [`suspendClientOrganization`](#suspendclientorganization)
 - [`activateClientOrganization`](#activateclientorganization)
+- [`getUserSubject`](#getusersubject)
 
 **Session**
 - [`createIdentitySession`](#createidentitysession)
@@ -54,6 +55,7 @@ const { data } = await identityClient.listClients(...)
 - [`Error`](#error)
 - [`PartnerClientId`](#partnerclientid)
 - [`OrgId`](#orgid)
+- [`UserId`](#userid)
 - [`Environment`](#environment)
 - [`PartnerClientStatus`](#partnerclientstatus)
 - [`Scope`](#scope)
@@ -67,13 +69,13 @@ const { data } = await identityClient.listClients(...)
 - [`RotateSecretRequest`](#rotatesecretrequest)
 - [`AuthorizationPolicyInput`](#authorizationpolicyinput)
 - [`AuthorizationPolicy`](#authorizationpolicy)
-- [`PartnerAccount`](#partneraccount)
 - [`OrgEnablementStatus`](#orgenablementstatus)
 - [`OrgEnablementCreate`](#orgenablementcreate)
 - [`OrgEnablementUpdate`](#orgenablementupdate)
 - [`OrgEnablement`](#orgenablement)
 - [`OrgEnablementList`](#orgenablementlist)
 - [`IdentitySession`](#identitysession)
+- [`UserSubject`](#usersubject)
 
 ### `listClients`
 
@@ -523,10 +525,6 @@ const { data } = await client.listClientOrganizations({
         "recorded_by": "string",
         "recorded_at": "1970-01-01T00:00:00.000Z"
       },
-      "partner_account": {
-        "id": "string",
-        "label": "string"
-      },
       "created_at": "1970-01-01T00:00:00.000Z",
       "updated_at": "1970-01-01T00:00:00.000Z",
       "created_by": "string",
@@ -561,10 +559,6 @@ const { data } = await client.enableClientOrganization(
       allowed_scopes: ['openid'],
       customer_approval_ref: 'string',
       approved_at: '1970-01-01T00:00:00.000Z'
-    },
-    partner_account: {
-      id: 'string',
-      label: 'string'
     }
   },
 )
@@ -590,10 +584,6 @@ const { data } = await client.enableClientOrganization(
     "recorded_by": "string",
     "recorded_at": "1970-01-01T00:00:00.000Z"
   },
-  "partner_account": {
-    "id": "string",
-    "label": "string"
-  },
   "created_at": "1970-01-01T00:00:00.000Z",
   "updated_at": "1970-01-01T00:00:00.000Z",
   "created_by": "string",
@@ -638,10 +628,6 @@ const { data } = await client.getClientOrganization({
     "recorded_by": "string",
     "recorded_at": "1970-01-01T00:00:00.000Z"
   },
-  "partner_account": {
-    "id": "string",
-    "label": "string"
-  },
   "created_at": "1970-01-01T00:00:00.000Z",
   "updated_at": "1970-01-01T00:00:00.000Z",
   "created_by": "string",
@@ -674,10 +660,6 @@ const { data } = await client.updateClientOrganization(
       allowed_scopes: ['openid'],
       customer_approval_ref: 'string',
       approved_at: '1970-01-01T00:00:00.000Z'
-    },
-    partner_account: {
-      id: 'string',
-      label: 'string'
     }
   },
 )
@@ -703,10 +685,6 @@ const { data } = await client.updateClientOrganization(
     "recorded_by": "string",
     "recorded_at": "1970-01-01T00:00:00.000Z"
   },
-  "partner_account": {
-    "id": "string",
-    "label": "string"
-  },
   "created_at": "1970-01-01T00:00:00.000Z",
   "updated_at": "1970-01-01T00:00:00.000Z",
   "created_by": "string",
@@ -758,10 +736,6 @@ const { data } = await client.revokeClientOrganization(
     "recorded_by": "string",
     "recorded_at": "1970-01-01T00:00:00.000Z"
   },
-  "partner_account": {
-    "id": "string",
-    "label": "string"
-  },
   "created_at": "1970-01-01T00:00:00.000Z",
   "updated_at": "1970-01-01T00:00:00.000Z",
   "created_by": "string",
@@ -811,10 +785,6 @@ const { data } = await client.suspendClientOrganization(
     "recorded_by": "string",
     "recorded_at": "1970-01-01T00:00:00.000Z"
   },
-  "partner_account": {
-    "id": "string",
-    "label": "string"
-  },
   "created_at": "1970-01-01T00:00:00.000Z",
   "updated_at": "1970-01-01T00:00:00.000Z",
   "created_by": "string",
@@ -859,10 +829,6 @@ const { data } = await client.activateClientOrganization({
     "recorded_by": "string",
     "recorded_at": "1970-01-01T00:00:00.000Z"
   },
-  "partner_account": {
-    "id": "string",
-    "label": "string"
-  },
   "created_at": "1970-01-01T00:00:00.000Z",
   "updated_at": "1970-01-01T00:00:00.000Z",
   "created_by": "string",
@@ -874,6 +840,40 @@ const { data } = await client.activateClientOrganization({
 
 ---
 
+### `getUserSubject`
+
+The pairwise `sub` this client receives for one epilot user, so the partner can bind the person on its
+side **before** the first sign-in (for example a Babelforce agent provisioned through SCIM with
+`
+
+`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}/users/{user_id}:subject`
+
+```ts
+const { data } = await client.getUserSubject({
+  client_id: 'example',
+  org_id: 'example',
+  user_id: 'example',
+})
+```
+
+<details>
+<summary>Response</summary>
+
+```json
+{
+  "client_id": "bf-prod-x7k2",
+  "org_id": "739224",
+  "user_id": "100321",
+  "sub": "v1.dGhpcy1pcy1hLWR1bW15LXN1YmplY3QtdmFsdWUtMDAx",
+  "key_version": "v1",
+  "sector": "portal.epilot.cloud"
+}
+```
+
+</details>
+
+---
+
 ### `createIdentitySession`
 
 Called by the epilot portal through the portal-host proxy after every persisted 360 session.
@@ -958,6 +958,14 @@ epilot organization id, an opaque case-sensitive string
 type OrgId = string
 ```
 
+### `UserId`
+
+epilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.
+
+```ts
+type UserId = string
+```
+
 ### `Environment`
 
 Partner-side environment this client belongs to
@@ -1151,17 +1159,6 @@ type AuthorizationPolicy = {
 }
 ```
 
-### `PartnerAccount`
-
-Optional audit reference to the partner tenant this organization maps to. The partner enforces the mapping.
-
-```ts
-type PartnerAccount = {
-  id: string
-  label?: string
-}
-```
-
 ### `OrgEnablementStatus`
 
 ```ts
@@ -1180,10 +1177,6 @@ type OrgEnablementCreate = {
     customer_approval_ref: string
     approved_at: string // date-time
   }
-  partner_account?: {
-    id: string
-    label?: string
-  }
 }
 ```
 
@@ -1199,10 +1192,6 @@ type OrgEnablementUpdate = {
     customer_approval_ref: string
     approved_at: string // date-time
   }
-  partner_account?: {
-    id: string
-    label?: string
-  }
 }
 ```
 
@@ -1225,10 +1214,6 @@ type OrgEnablement = {
     recorded_by: string
     recorded_at: string // date-time
   }
-  partner_account?: {
-    id: string
-    label?: string
-  }
   created_at: string // date-time
   updated_at: string // date-time
   created_by?: string
@@ -1256,10 +1241,6 @@ type OrgEnablementList = {
       recorded_by: { ... }
       recorded_at: { ... }
     }
-    partner_account?: {
-      id: { ... }
-      label?: { ... }
-    }
     created_at: string // date-time
     updated_at: string // date-time
     created_by?: string
@@ -1277,3 +1258,16 @@ type IdentitySession = {
   expires_at: string // date-time
 }
 ```
+
+### `UserSubject`
+
+```ts
+type UserSubject = {
+  client_id: string
+  org_id: string
+  user_id: string
+  sub: string
+  key_version: string
+  sector: string
+}
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@epilot/sdk",
-  "version": "2.20.70",
+  "version": "2.20.71",
   "description": "JavaScript/TypeScript SDK for epilot APIs",
   "type": "module",
   "main": "./dist/index.cjs",

package/dist/identity-EG35NBZW.js

@@ -1,7 +0,0 @@
-import "./chunk-YPSWSI3M.js";
-
-// src/docs/identity.json
-var identity_default = '# Identity API\n\n- **Base URL:** `https://id.epilot.cloud`\n- **Full API Docs:** [https://docs.epilot.io/api/identity](https://docs.epilot.io/api/identity)\n\n## Usage\n\n```ts\nimport { epilot } from \'@epilot/sdk\'\n\nepilot.authorize(() => \'<token>\')\nconst { data } = await epilot.identity.listClients(...)\n```\n\n### Tree-shakeable import\n\n```ts\nimport { getClient, authorize } from \'@epilot/sdk/identity\'\n\nconst identityClient = getClient()\nauthorize(identityClient, () => \'<token>\')\nconst { data } = await identityClient.listClients(...)\n```\n\n## Operations\n\n**Operator Clients**\n- [`listClients`](#listclients)\n- [`createOidcClient`](#createoidcclient)\n- [`getOidcClient`](#getoidcclient)\n- [`updateClient`](#updateclient)\n- [`retireClient`](#retireclient)\n- [`activateClient`](#activateclient)\n- [`suspendClient`](#suspendclient)\n- [`rotateClientSecret`](#rotateclientsecret)\n\n**Operator Organizations**\n- [`listClientOrganizations`](#listclientorganizations)\n- [`enableClientOrganization`](#enableclientorganization)\n- [`getClientOrganization`](#getclientorganization)\n- [`updateClientOrganization`](#updateclientorganization)\n- [`revokeClientOrganization`](#revokeclientorganization)\n- [`suspendClientOrganization`](#suspendclientorganization)\n- [`activateClientOrganization`](#activateclientorganization)\n\n**Session**\n- [`createIdentitySession`](#createidentitysession)\n- [`deleteIdentitySession`](#deleteidentitysession)\n\n**Launch**\n- [`launchClient`](#launchclient)\n\n**Schemas**\n- [`Error`](#error)\n- [`PartnerClientId`](#partnerclientid)\n- [`OrgId`](#orgid)\n- [`Environment`](#environment)\n- [`PartnerClientStatus`](#partnerclientstatus)\n- [`Scope`](#scope)\n- [`HttpsUri`](#httpsuri)\n- [`PartnerClientCreate`](#partnerclientcreate)\n- [`PartnerClientUpdate`](#partnerclientupdate)\n- [`PartnerClient`](#partnerclient)\n- [`PartnerClientWithSecret`](#partnerclientwithsecret)\n- [`PartnerClientList`](#partnerclientlist)\n- [`StatusChangeRequest`](#statuschangerequest)\n- [`RotateSecretRequest`](#rotatesecretrequest)\n- [`AuthorizationPolicyInput`](#authorizationpolicyinput)\n- [`AuthorizationPolicy`](#authorizationpolicy)\n- [`PartnerAccount`](#partneraccount)\n- [`OrgEnablementStatus`](#orgenablementstatus)\n- [`OrgEnablementCreate`](#orgenablementcreate)\n- [`OrgEnablementUpdate`](#orgenablementupdate)\n- [`OrgEnablement`](#orgenablement)\n- [`OrgEnablementList`](#orgenablementlist)\n- [`IdentitySession`](#identitysession)\n\n### `listClients`\n\nList registered partner clients. The client secret is never returned.\n\n`GET /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.listClients({\n  partner_key: \'example\',\n  status: \'example\',\n  size: 1,\n  cursor: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "partner_key": "string",\n      "display_name": "string",\n      "description": "string",\n      "environment": "dev",\n      "redirect_uris": ["https://partner.example.com/auth/callback"],\n      "sector_identifier_uri": "https://partner.example.com/auth/callback",\n      "initiate_login_uri": "https://partner.example.com/auth/callback",\n      "launch_target_prefixes": ["string"],\n      "token_endpoint_auth_method": "client_secret_basic",\n      "grant_types": ["authorization_code"],\n      "scopes_allowed": ["openid"],\n      "status": "draft",\n      "status_reason": "string",\n      "config_version": 1,\n      "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n      "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ],\n  "next_cursor": "string"\n}\n```\n\n</details>\n\n---\n\n### `createOidcClient`\n\nCreate a partner client in `draft` status. The client secret is returned exactly once in this\nresponse and can never be read again; use `rotateClientSecret` to obtain a new one.\n\n`POST /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.createOidcClient(\n  null,\n  {\n    partner_key: \'babelforce\',\n    display_name: \'Babelforce\',\n    description: \'string\',\n    environment: \'dev\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `getOidcClient`\n\nRead a partner client. The client secret is never returned.\n\n`GET /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.getOidcClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClient`\n\nReplace the mutable configuration of a client. `config_version` must equal the current\nversion (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.updateClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    config_version: 1,\n    allow_sector_change: false,\n    display_name: \'string\',\n    description: \'string\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `retireClient`\n\nRetire a client. The record is kept as a tombstone, the `client_id` is never reused, every\norganization enablement is revoked and all provider-side artefacts are revoked.\n\n`DELETE /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.retireClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClient`\n\nActivate a `draft` or `suspended` client. Validates that every redirect URI is an absolute\nHTTPS URL without fragment, that `scopes_allowed` contains `openid`, and that the\nauthentication method is `c\n\n`POST /v1/identity/operator/clients/{client_id}:activate`\n\n```ts\nconst { data } = await client.activateClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClient`\n\nImmediately block the client for every organization. Provider-side artefacts (codes, tokens,\ngrants) are revoked; the audit trail is kept. Reversible with `activateClient`.\n\n`POST /v1/identity/operator/clients/{client_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `rotateClientSecret`\n\nIssue a new client secret. The new secret is returned exactly once. The previous secret\nkeeps working until `previous_secret_expires_at` unless `compromise_mode` is set, in which\ncase it stops working\n\n`POST /v1/identity/operator/clients/{client_id}:rotateSecret`\n\n```ts\nconst { data } = await client.rotateClientSecret(\n  {\n    client_id: \'example\',\n  },\n  {\n    compromise_mode: false,\n    migration_window_seconds: 86400\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `listClientOrganizations`\n\nList the organizations enabled on a client, including suspended and revoked ones.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.listClientOrganizations({\n  client_id: \'example\',\n  status: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "org_id": "739224",\n      "status": "active",\n      "status_reason": "string",\n      "authorization_policy": {\n        "mode": "preauthorized",\n        "population": "all_current_org_members",\n        "allowed_scopes": ["openid"],\n        "customer_approval_ref": "string",\n        "approved_at": "1970-01-01T00:00:00.000Z",\n        "version": 1,\n        "mandatory_claims": ["org_id"],\n        "recorded_by": "string",\n        "recorded_at": "1970-01-01T00:00:00.000Z"\n      },\n      "partner_account": {\n        "id": "string",\n        "label": "string"\n      },\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ]\n}\n```\n\n</details>\n\n---\n\n### `enableClientOrganization`\n\nEnable an epilot organization on a client, recording the customer\'s authorization policy\n(version 1). `allowed_scopes` must contain `openid` and be a subset of the client\'s\n`scopes_allowed`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.enableClientOrganization(\n  {\n    client_id: \'example\',\n  },\n  {\n    org_id: \'739224\',\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    },\n    partner_account: {\n      id: \'string\',\n      label: \'string\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "partner_account": {\n    "id": "string",\n    "label": "string"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getClientOrganization`\n\nRead one organization enablement.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.getClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "partner_account": {\n    "id": "string",\n    "label": "string"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClientOrganization`\n\nRecord a new version of the customer\'s authorization policy. `expected_policy_version` must\nequal the current version (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.updateClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    expected_policy_version: 1,\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    },\n    partner_account: {\n      id: \'string\',\n      label: \'string\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "partner_account": {\n    "id": "string",\n    "label": "string"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `revokeClientOrganization`\n\nRevoke an organization\'s enablement. The record is kept as an audited tombstone; future\nauthorizations for this organization fail with `access_denied` and provider-side artefacts\nbound to it are revok\n\n`DELETE /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.revokeClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "partner_account": {\n    "id": "string",\n    "label": "string"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClientOrganization`\n\nTemporarily block one organization on this client. Reversible with `activateClientOrganization`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "partner_account": {\n    "id": "string",\n    "label": "string"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClientOrganization`\n\nResume a suspended organization on this client. Revoked enablements cannot be re-activated; enabling the organization again (`POST \u2026/organizations`) replaces the revoked entry and continues its policy\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate`\n\n```ts\nconst { data } = await client.activateClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "partner_account": {\n    "id": "string",\n    "label": "string"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `createIdentitySession`\n\nCalled by the epilot portal through the portal-host proxy after every persisted 360 session.\nValidates the 360 bearer token itself and mirrors it into the `identity_session` cookie\n(`HttpOnly; Secure;\n\n`GET /v1/identity/session`\n\n```ts\nconst { data } = await client.createIdentitySession()\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "org_id": "739224",\n  "user_id": "string",\n  "expires_at": "1970-01-01T00:00:00.000Z"\n}\n```\n\n</details>\n\n---\n\n### `deleteIdentitySession`\n\nClears the `identity_session` cookie. Called by the portal on logout.\n\n`DELETE /v1/identity/session`\n\n```ts\nconst { data } = await client.deleteIdentitySession()\n```\n\n---\n\n### `launchClient`\n\nOne validated place for partner start links (manager UI, hosted apps). Redirects the browser to the\nclient\'s registered `initiate_login_uri` with `iss` set to this issuer and, when given, the deep lin\n\n`GET /v1/identity/launch/{client_id}`\n\n```ts\nconst { data } = await client.launchClient({\n  client_id: \'example\',\n  target: \'example\',\n  extra: \'example\',\n})\n```\n\n---\n\n## Schemas\n\n### `Error`\n\n```ts\ntype Error = {\n  status: number\n  error: string\n  details?: Record<string, unknown>[]\n}\n```\n\n### `PartnerClientId`\n\nOpaque client identifier, unique within the issuer, never reused\n\n```ts\ntype PartnerClientId = string\n```\n\n### `OrgId`\n\nepilot organization id, an opaque case-sensitive string\n\n```ts\ntype OrgId = string\n```\n\n### `Environment`\n\nPartner-side environment this client belongs to\n\n```ts\ntype Environment = "dev" | "staging" | "production"\n```\n\n### `PartnerClientStatus`\n\n```ts\ntype PartnerClientStatus = "draft" | "active" | "suspended" | "retired"\n```\n\n### `Scope`\n\n```ts\ntype Scope = "openid" | "email" | "profile"\n```\n\n### `HttpsUri`\n\nAbsolute HTTPS URL without fragment\n\n```ts\ntype HttpsUri = string // uri\n```\n\n### `PartnerClientCreate`\n\n```ts\ntype PartnerClientCreate = {\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed?: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClientUpdate`\n\n```ts\ntype PartnerClientUpdate = {\n  config_version: number\n  allow_sector_change?: boolean\n  display_name: string\n  description?: string\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClient`\n\n```ts\ntype PartnerClient = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `PartnerClientWithSecret`\n\n```ts\ntype PartnerClientWithSecret = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n  client_secret: string\n}\n```\n\n### `PartnerClientList`\n\n```ts\ntype PartnerClientList = {\n  results: Array<{\n    client_id: string\n    partner_key: string\n    display_name: string\n    description?: string\n    environment: "dev" | "staging" | "production"\n    redirect_uris: string // uri[]\n    sector_identifier_uri?: string // uri\n    initiate_login_uri?: string // uri\n    launch_target_prefixes?: string[]\n    token_endpoint_auth_method: "client_secret_basic"\n    grant_types: "authorization_code"[]\n    scopes_allowed: "openid" | "email" | "profile"[]\n    status: "draft" | "active" | "suspended" | "retired"\n    status_reason?: string\n    config_version: number\n    secret_rotated_at?: string // date-time\n    previous_secret_expires_at?: string // date-time\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n  next_cursor?: string\n}\n```\n\n### `StatusChangeRequest`\n\n```ts\ntype StatusChangeRequest = {\n  reason?: string\n}\n```\n\n### `RotateSecretRequest`\n\n```ts\ntype RotateSecretRequest = {\n  compromise_mode?: boolean\n  migration_window_seconds?: number\n}\n```\n\n### `AuthorizationPolicyInput`\n\n```ts\ntype AuthorizationPolicyInput = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n}\n```\n\n### `AuthorizationPolicy`\n\n```ts\ntype AuthorizationPolicy = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n  version: number\n  mandatory_claims: "org_id"[]\n  recorded_by: string\n  recorded_at: string // date-time\n}\n```\n\n### `PartnerAccount`\n\nOptional audit reference to the partner tenant this organization maps to. The partner enforces the mapping.\n\n```ts\ntype PartnerAccount = {\n  id: string\n  label?: string\n}\n```\n\n### `OrgEnablementStatus`\n\n```ts\ntype OrgEnablementStatus = "active" | "suspended" | "revoked"\n```\n\n### `OrgEnablementCreate`\n\n```ts\ntype OrgEnablementCreate = {\n  org_id: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n  }\n  partner_account?: {\n    id: string\n    label?: string\n  }\n}\n```\n\n### `OrgEnablementUpdate`\n\n```ts\ntype OrgEnablementUpdate = {\n  expected_policy_version: number\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n  }\n  partner_account?: {\n    id: string\n    label?: string\n  }\n}\n```\n\n### `OrgEnablement`\n\n```ts\ntype OrgEnablement = {\n  client_id: string\n  org_id: string\n  status: "active" | "suspended" | "revoked"\n  status_reason?: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n    version: number\n    mandatory_claims: "org_id"[]\n    recorded_by: string\n    recorded_at: string // date-time\n  }\n  partner_account?: {\n    id: string\n    label?: string\n  }\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `OrgEnablementList`\n\n```ts\ntype OrgEnablementList = {\n  results: Array<{\n    client_id: string\n    org_id: string\n    status: "active" | "suspended" | "revoked"\n    status_reason?: string\n    authorization_policy: {\n      mode?: { ... }\n      population?: { ... }\n      allowed_scopes: { ... }\n      customer_approval_ref: { ... }\n      approved_at: { ... }\n      version: { ... }\n      mandatory_claims: { ... }\n      recorded_by: { ... }\n      recorded_at: { ... }\n    }\n    partner_account?: {\n      id: { ... }\n      label?: { ... }\n    }\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n}\n```\n\n### `IdentitySession`\n\n```ts\ntype IdentitySession = {\n  org_id: string\n  user_id: string\n  expires_at: string // date-time\n}\n```\n';
-export {
-  identity_default as default
-};

package/dist/identity-XMX3VFXR.cjs

@@ -1,7 +0,0 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});require('./chunk-NJK5F5TF.cjs');
-
-// src/docs/identity.json
-var identity_default = '# Identity API\n\n- **Base URL:** `https://id.epilot.cloud`\n- **Full API Docs:** [https://docs.epilot.io/api/identity](https://docs.epilot.io/api/identity)\n\n## Usage\n\n```ts\nimport { epilot } from \'@epilot/sdk\'\n\nepilot.authorize(() => \'<token>\')\nconst { data } = await epilot.identity.listClients(...)\n```\n\n### Tree-shakeable import\n\n```ts\nimport { getClient, authorize } from \'@epilot/sdk/identity\'\n\nconst identityClient = getClient()\nauthorize(identityClient, () => \'<token>\')\nconst { data } = await identityClient.listClients(...)\n```\n\n## Operations\n\n**Operator Clients**\n- [`listClients`](#listclients)\n- [`createOidcClient`](#createoidcclient)\n- [`getOidcClient`](#getoidcclient)\n- [`updateClient`](#updateclient)\n- [`retireClient`](#retireclient)\n- [`activateClient`](#activateclient)\n- [`suspendClient`](#suspendclient)\n- [`rotateClientSecret`](#rotateclientsecret)\n\n**Operator Organizations**\n- [`listClientOrganizations`](#listclientorganizations)\n- [`enableClientOrganization`](#enableclientorganization)\n- [`getClientOrganization`](#getclientorganization)\n- [`updateClientOrganization`](#updateclientorganization)\n- [`revokeClientOrganization`](#revokeclientorganization)\n- [`suspendClientOrganization`](#suspendclientorganization)\n- [`activateClientOrganization`](#activateclientorganization)\n\n**Session**\n- [`createIdentitySession`](#createidentitysession)\n- [`deleteIdentitySession`](#deleteidentitysession)\n\n**Launch**\n- [`launchClient`](#launchclient)\n\n**Schemas**\n- [`Error`](#error)\n- [`PartnerClientId`](#partnerclientid)\n- [`OrgId`](#orgid)\n- [`Environment`](#environment)\n- [`PartnerClientStatus`](#partnerclientstatus)\n- [`Scope`](#scope)\n- [`HttpsUri`](#httpsuri)\n- [`PartnerClientCreate`](#partnerclientcreate)\n- [`PartnerClientUpdate`](#partnerclientupdate)\n- [`PartnerClient`](#partnerclient)\n- [`PartnerClientWithSecret`](#partnerclientwithsecret)\n- [`PartnerClientList`](#partnerclientlist)\n- [`StatusChangeRequest`](#statuschangerequest)\n- [`RotateSecretRequest`](#rotatesecretrequest)\n- [`AuthorizationPolicyInput`](#authorizationpolicyinput)\n- [`AuthorizationPolicy`](#authorizationpolicy)\n- [`PartnerAccount`](#partneraccount)\n- [`OrgEnablementStatus`](#orgenablementstatus)\n- [`OrgEnablementCreate`](#orgenablementcreate)\n- [`OrgEnablementUpdate`](#orgenablementupdate)\n- [`OrgEnablement`](#orgenablement)\n- [`OrgEnablementList`](#orgenablementlist)\n- [`IdentitySession`](#identitysession)\n\n### `listClients`\n\nList registered partner clients. The client secret is never returned.\n\n`GET /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.listClients({\n  partner_key: \'example\',\n  status: \'example\',\n  size: 1,\n  cursor: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "partner_key": "string",\n      "display_name": "string",\n      "description": "string",\n      "environment": "dev",\n      "redirect_uris": ["https://partner.example.com/auth/callback"],\n      "sector_identifier_uri": "https://partner.example.com/auth/callback",\n      "initiate_login_uri": "https://partner.example.com/auth/callback",\n      "launch_target_prefixes": ["string"],\n      "token_endpoint_auth_method": "client_secret_basic",\n      "grant_types": ["authorization_code"],\n      "scopes_allowed": ["openid"],\n      "status": "draft",\n      "status_reason": "string",\n      "config_version": 1,\n      "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n      "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ],\n  "next_cursor": "string"\n}\n```\n\n</details>\n\n---\n\n### `createOidcClient`\n\nCreate a partner client in `draft` status. The client secret is returned exactly once in this\nresponse and can never be read again; use `rotateClientSecret` to obtain a new one.\n\n`POST /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.createOidcClient(\n  null,\n  {\n    partner_key: \'babelforce\',\n    display_name: \'Babelforce\',\n    description: \'string\',\n    environment: \'dev\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `getOidcClient`\n\nRead a partner client. The client secret is never returned.\n\n`GET /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.getOidcClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClient`\n\nReplace the mutable configuration of a client. `config_version` must equal the current\nversion (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.updateClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    config_version: 1,\n    allow_sector_change: false,\n    display_name: \'string\',\n    description: \'string\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `retireClient`\n\nRetire a client. The record is kept as a tombstone, the `client_id` is never reused, every\norganization enablement is revoked and all provider-side artefacts are revoked.\n\n`DELETE /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.retireClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClient`\n\nActivate a `draft` or `suspended` client. Validates that every redirect URI is an absolute\nHTTPS URL without fragment, that `scopes_allowed` contains `openid`, and that the\nauthentication method is `c\n\n`POST /v1/identity/operator/clients/{client_id}:activate`\n\n```ts\nconst { data } = await client.activateClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClient`\n\nImmediately block the client for every organization. Provider-side artefacts (codes, tokens,\ngrants) are revoked; the audit trail is kept. Reversible with `activateClient`.\n\n`POST /v1/identity/operator/clients/{client_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `rotateClientSecret`\n\nIssue a new client secret. The new secret is returned exactly once. The previous secret\nkeeps working until `previous_secret_expires_at` unless `compromise_mode` is set, in which\ncase it stops working\n\n`POST /v1/identity/operator/clients/{client_id}:rotateSecret`\n\n```ts\nconst { data } = await client.rotateClientSecret(\n  {\n    client_id: \'example\',\n  },\n  {\n    compromise_mode: false,\n    migration_window_seconds: 86400\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `listClientOrganizations`\n\nList the organizations enabled on a client, including suspended and revoked ones.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.listClientOrganizations({\n  client_id: \'example\',\n  status: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "org_id": "739224",\n      "status": "active",\n      "status_reason": "string",\n      "authorization_policy": {\n        "mode": "preauthorized",\n        "population": "all_current_org_members",\n        "allowed_scopes": ["openid"],\n        "customer_approval_ref": "string",\n        "approved_at": "1970-01-01T00:00:00.000Z",\n        "version": 1,\n        "mandatory_claims": ["org_id"],\n        "recorded_by": "string",\n        "recorded_at": "1970-01-01T00:00:00.000Z"\n      },\n      "partner_account": {\n        "id": "string",\n        "label": "string"\n      },\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ]\n}\n```\n\n</details>\n\n---\n\n### `enableClientOrganization`\n\nEnable an epilot organization on a client, recording the customer\'s authorization policy\n(version 1). `allowed_scopes` must contain `openid` and be a subset of the client\'s\n`scopes_allowed`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.enableClientOrganization(\n  {\n    client_id: \'example\',\n  },\n  {\n    org_id: \'739224\',\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    },\n    partner_account: {\n      id: \'string\',\n      label: \'string\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "partner_account": {\n    "id": "string",\n    "label": "string"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getClientOrganization`\n\nRead one organization enablement.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.getClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "partner_account": {\n    "id": "string",\n    "label": "string"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClientOrganization`\n\nRecord a new version of the customer\'s authorization policy. `expected_policy_version` must\nequal the current version (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.updateClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    expected_policy_version: 1,\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    },\n    partner_account: {\n      id: \'string\',\n      label: \'string\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "partner_account": {\n    "id": "string",\n    "label": "string"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `revokeClientOrganization`\n\nRevoke an organization\'s enablement. The record is kept as an audited tombstone; future\nauthorizations for this organization fail with `access_denied` and provider-side artefacts\nbound to it are revok\n\n`DELETE /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.revokeClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "partner_account": {\n    "id": "string",\n    "label": "string"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClientOrganization`\n\nTemporarily block one organization on this client. Reversible with `activateClientOrganization`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "partner_account": {\n    "id": "string",\n    "label": "string"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClientOrganization`\n\nResume a suspended organization on this client. Revoked enablements cannot be re-activated; enabling the organization again (`POST \u2026/organizations`) replaces the revoked entry and continues its policy\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate`\n\n```ts\nconst { data } = await client.activateClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "partner_account": {\n    "id": "string",\n    "label": "string"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `createIdentitySession`\n\nCalled by the epilot portal through the portal-host proxy after every persisted 360 session.\nValidates the 360 bearer token itself and mirrors it into the `identity_session` cookie\n(`HttpOnly; Secure;\n\n`GET /v1/identity/session`\n\n```ts\nconst { data } = await client.createIdentitySession()\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "org_id": "739224",\n  "user_id": "string",\n  "expires_at": "1970-01-01T00:00:00.000Z"\n}\n```\n\n</details>\n\n---\n\n### `deleteIdentitySession`\n\nClears the `identity_session` cookie. Called by the portal on logout.\n\n`DELETE /v1/identity/session`\n\n```ts\nconst { data } = await client.deleteIdentitySession()\n```\n\n---\n\n### `launchClient`\n\nOne validated place for partner start links (manager UI, hosted apps). Redirects the browser to the\nclient\'s registered `initiate_login_uri` with `iss` set to this issuer and, when given, the deep lin\n\n`GET /v1/identity/launch/{client_id}`\n\n```ts\nconst { data } = await client.launchClient({\n  client_id: \'example\',\n  target: \'example\',\n  extra: \'example\',\n})\n```\n\n---\n\n## Schemas\n\n### `Error`\n\n```ts\ntype Error = {\n  status: number\n  error: string\n  details?: Record<string, unknown>[]\n}\n```\n\n### `PartnerClientId`\n\nOpaque client identifier, unique within the issuer, never reused\n\n```ts\ntype PartnerClientId = string\n```\n\n### `OrgId`\n\nepilot organization id, an opaque case-sensitive string\n\n```ts\ntype OrgId = string\n```\n\n### `Environment`\n\nPartner-side environment this client belongs to\n\n```ts\ntype Environment = "dev" | "staging" | "production"\n```\n\n### `PartnerClientStatus`\n\n```ts\ntype PartnerClientStatus = "draft" | "active" | "suspended" | "retired"\n```\n\n### `Scope`\n\n```ts\ntype Scope = "openid" | "email" | "profile"\n```\n\n### `HttpsUri`\n\nAbsolute HTTPS URL without fragment\n\n```ts\ntype HttpsUri = string // uri\n```\n\n### `PartnerClientCreate`\n\n```ts\ntype PartnerClientCreate = {\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed?: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClientUpdate`\n\n```ts\ntype PartnerClientUpdate = {\n  config_version: number\n  allow_sector_change?: boolean\n  display_name: string\n  description?: string\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClient`\n\n```ts\ntype PartnerClient = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `PartnerClientWithSecret`\n\n```ts\ntype PartnerClientWithSecret = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n  client_secret: string\n}\n```\n\n### `PartnerClientList`\n\n```ts\ntype PartnerClientList = {\n  results: Array<{\n    client_id: string\n    partner_key: string\n    display_name: string\n    description?: string\n    environment: "dev" | "staging" | "production"\n    redirect_uris: string // uri[]\n    sector_identifier_uri?: string // uri\n    initiate_login_uri?: string // uri\n    launch_target_prefixes?: string[]\n    token_endpoint_auth_method: "client_secret_basic"\n    grant_types: "authorization_code"[]\n    scopes_allowed: "openid" | "email" | "profile"[]\n    status: "draft" | "active" | "suspended" | "retired"\n    status_reason?: string\n    config_version: number\n    secret_rotated_at?: string // date-time\n    previous_secret_expires_at?: string // date-time\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n  next_cursor?: string\n}\n```\n\n### `StatusChangeRequest`\n\n```ts\ntype StatusChangeRequest = {\n  reason?: string\n}\n```\n\n### `RotateSecretRequest`\n\n```ts\ntype RotateSecretRequest = {\n  compromise_mode?: boolean\n  migration_window_seconds?: number\n}\n```\n\n### `AuthorizationPolicyInput`\n\n```ts\ntype AuthorizationPolicyInput = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n}\n```\n\n### `AuthorizationPolicy`\n\n```ts\ntype AuthorizationPolicy = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n  version: number\n  mandatory_claims: "org_id"[]\n  recorded_by: string\n  recorded_at: string // date-time\n}\n```\n\n### `PartnerAccount`\n\nOptional audit reference to the partner tenant this organization maps to. The partner enforces the mapping.\n\n```ts\ntype PartnerAccount = {\n  id: string\n  label?: string\n}\n```\n\n### `OrgEnablementStatus`\n\n```ts\ntype OrgEnablementStatus = "active" | "suspended" | "revoked"\n```\n\n### `OrgEnablementCreate`\n\n```ts\ntype OrgEnablementCreate = {\n  org_id: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n  }\n  partner_account?: {\n    id: string\n    label?: string\n  }\n}\n```\n\n### `OrgEnablementUpdate`\n\n```ts\ntype OrgEnablementUpdate = {\n  expected_policy_version: number\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n  }\n  partner_account?: {\n    id: string\n    label?: string\n  }\n}\n```\n\n### `OrgEnablement`\n\n```ts\ntype OrgEnablement = {\n  client_id: string\n  org_id: string\n  status: "active" | "suspended" | "revoked"\n  status_reason?: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n    version: number\n    mandatory_claims: "org_id"[]\n    recorded_by: string\n    recorded_at: string // date-time\n  }\n  partner_account?: {\n    id: string\n    label?: string\n  }\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `OrgEnablementList`\n\n```ts\ntype OrgEnablementList = {\n  results: Array<{\n    client_id: string\n    org_id: string\n    status: "active" | "suspended" | "revoked"\n    status_reason?: string\n    authorization_policy: {\n      mode?: { ... }\n      population?: { ... }\n      allowed_scopes: { ... }\n      customer_approval_ref: { ... }\n      approved_at: { ... }\n      version: { ... }\n      mandatory_claims: { ... }\n      recorded_by: { ... }\n      recorded_at: { ... }\n    }\n    partner_account?: {\n      id: { ... }\n      label?: { ... }\n    }\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n}\n```\n\n### `IdentitySession`\n\n```ts\ntype IdentitySession = {\n  org_id: string\n  user_id: string\n  expires_at: string // date-time\n}\n```\n';
-
-
-exports.default = identity_default;