@epilot/sdk 2.20.73 → 2.20.75

package/dist/{identity-JDTGYAOV.cjs → identity-XCFH3MIW.cjs}

@@ -1,7 +1,7 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});require('./chunk-NJK5F5TF.cjs');
 
 // src/docs/identity.json
-var identity_default = '# Identity API\n\n- **Base URL:** `https://id.epilot.cloud`\n- **Full API Docs:** [https://docs.epilot.io/api/identity](https://docs.epilot.io/api/identity)\n\n## Usage\n\n```ts\nimport { epilot } from \'@epilot/sdk\'\n\nepilot.authorize(() => \'<token>\')\nconst { data } = await epilot.identity.listClients(...)\n```\n\n### Tree-shakeable import\n\n```ts\nimport { getClient, authorize } from \'@epilot/sdk/identity\'\n\nconst identityClient = getClient()\nauthorize(identityClient, () => \'<token>\')\nconst { data } = await identityClient.listClients(...)\n```\n\n## Operations\n\n**Operator Clients**\n- [`listClients`](#listclients)\n- [`createOidcClient`](#createoidcclient)\n- [`getOidcClient`](#getoidcclient)\n- [`updateClient`](#updateclient)\n- [`retireClient`](#retireclient)\n- [`activateClient`](#activateclient)\n- [`suspendClient`](#suspendclient)\n- [`rotateClientSecret`](#rotateclientsecret)\n\n**Operator Organizations**\n- [`listClientOrganizations`](#listclientorganizations)\n- [`enableClientOrganization`](#enableclientorganization)\n- [`getClientOrganization`](#getclientorganization)\n- [`updateClientOrganization`](#updateclientorganization)\n- [`revokeClientOrganization`](#revokeclientorganization)\n- [`suspendClientOrganization`](#suspendclientorganization)\n- [`activateClientOrganization`](#activateclientorganization)\n- [`getUserSubject`](#getusersubject)\n\n**Session**\n- [`createIdentitySession`](#createidentitysession)\n- [`deleteIdentitySession`](#deleteidentitysession)\n\n**Launch**\n- [`launchClient`](#launchclient)\n\n**Schemas**\n- [`Error`](#error)\n- [`PartnerClientId`](#partnerclientid)\n- [`OrgId`](#orgid)\n- [`UserId`](#userid)\n- [`Environment`](#environment)\n- [`PartnerClientStatus`](#partnerclientstatus)\n- [`Scope`](#scope)\n- [`HttpsUri`](#httpsuri)\n- [`PartnerClientCreate`](#partnerclientcreate)\n- [`PartnerClientUpdate`](#partnerclientupdate)\n- [`PartnerClient`](#partnerclient)\n- [`PartnerClientWithSecret`](#partnerclientwithsecret)\n- [`PartnerClientList`](#partnerclientlist)\n- [`StatusChangeRequest`](#statuschangerequest)\n- [`RotateSecretRequest`](#rotatesecretrequest)\n- [`AuthorizationPolicyInput`](#authorizationpolicyinput)\n- [`AuthorizationPolicy`](#authorizationpolicy)\n- [`OrgEnablementStatus`](#orgenablementstatus)\n- [`OrgEnablementCreate`](#orgenablementcreate)\n- [`OrgEnablementUpdate`](#orgenablementupdate)\n- [`OrgEnablement`](#orgenablement)\n- [`OrgEnablementList`](#orgenablementlist)\n- [`IdentitySession`](#identitysession)\n- [`UserSubject`](#usersubject)\n\n### `listClients`\n\nList registered partner clients. The client secret is never returned.\n\n`GET /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.listClients({\n  partner_key: \'example\',\n  status: \'example\',\n  size: 1,\n  cursor: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "partner_key": "string",\n      "display_name": "string",\n      "description": "string",\n      "environment": "dev",\n      "redirect_uris": ["https://partner.example.com/auth/callback"],\n      "sector_identifier_uri": "https://partner.example.com/auth/callback",\n      "initiate_login_uri": "https://partner.example.com/auth/callback",\n      "launch_target_prefixes": ["string"],\n      "token_endpoint_auth_method": "client_secret_basic",\n      "grant_types": ["authorization_code"],\n      "scopes_allowed": ["openid"],\n      "status": "draft",\n      "status_reason": "string",\n      "config_version": 1,\n      "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n      "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ],\n  "next_cursor": "string"\n}\n```\n\n</details>\n\n---\n\n### `createOidcClient`\n\nCreate a partner client in `draft` status. The client secret is returned exactly once in this\nresponse and can never be read again; use `rotateClientSecret` to obtain a new one.\n\n`POST /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.createOidcClient(\n  null,\n  {\n    partner_key: \'babelforce\',\n    display_name: \'Babelforce\',\n    description: \'string\',\n    environment: \'dev\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `getOidcClient`\n\nRead a partner client. The client secret is never returned.\n\n`GET /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.getOidcClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClient`\n\nReplace the mutable configuration of a client. `config_version` must equal the current\nversion (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.updateClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    config_version: 1,\n    allow_sector_change: false,\n    display_name: \'string\',\n    description: \'string\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `retireClient`\n\nRetire a client. The record is kept as a tombstone, the `client_id` is never reused, every\norganization enablement is revoked and all provider-side artefacts are revoked.\n\n`DELETE /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.retireClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClient`\n\nActivate a `draft` or `suspended` client. Validates that every redirect URI is an absolute\nHTTPS URL without fragment, that `scopes_allowed` contains `openid`, and that the\nauthentication method is `c\n\n`POST /v1/identity/operator/clients/{client_id}:activate`\n\n```ts\nconst { data } = await client.activateClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClient`\n\nImmediately block the client for every organization. Provider-side artefacts (codes, tokens,\ngrants) are revoked; the audit trail is kept. Reversible with `activateClient`.\n\n`POST /v1/identity/operator/clients/{client_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `rotateClientSecret`\n\nIssue a new client secret. The new secret is returned exactly once. The previous secret\nkeeps working until `previous_secret_expires_at` unless `compromise_mode` is set, in which\ncase it stops working\n\n`POST /v1/identity/operator/clients/{client_id}:rotateSecret`\n\n```ts\nconst { data } = await client.rotateClientSecret(\n  {\n    client_id: \'example\',\n  },\n  {\n    compromise_mode: false,\n    migration_window_seconds: 86400\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `listClientOrganizations`\n\nList the organizations enabled on a client, including suspended and revoked ones.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.listClientOrganizations({\n  client_id: \'example\',\n  status: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "org_id": "739224",\n      "status": "active",\n      "status_reason": "string",\n      "authorization_policy": {\n        "mode": "preauthorized",\n        "population": "all_current_org_members",\n        "allowed_scopes": ["openid"],\n        "customer_approval_ref": "string",\n        "approved_at": "1970-01-01T00:00:00.000Z",\n        "version": 1,\n        "mandatory_claims": ["org_id"],\n        "recorded_by": "string",\n        "recorded_at": "1970-01-01T00:00:00.000Z"\n      },\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ]\n}\n```\n\n</details>\n\n---\n\n### `enableClientOrganization`\n\nEnable an epilot organization on a client, recording the customer\'s authorization policy\n(version 1). `allowed_scopes` must contain `openid` and be a subset of the client\'s\n`scopes_allowed`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.enableClientOrganization(\n  {\n    client_id: \'example\',\n  },\n  {\n    org_id: \'739224\',\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getClientOrganization`\n\nRead one organization enablement.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.getClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClientOrganization`\n\nRecord a new version of the customer\'s authorization policy. `expected_policy_version` must\nequal the current version (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.updateClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    expected_policy_version: 1,\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `revokeClientOrganization`\n\nRevoke an organization\'s enablement. The record is kept as an audited tombstone; future\nauthorizations for this organization fail with `access_denied` and provider-side artefacts\nbound to it are revok\n\n`DELETE /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.revokeClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClientOrganization`\n\nTemporarily block one organization on this client. Reversible with `activateClientOrganization`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClientOrganization`\n\nResume a suspended organization on this client. Revoked enablements cannot be re-activated; enabling the organization again (`POST \u2026/organizations`) replaces the revoked entry and continues its policy\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate`\n\n```ts\nconst { data } = await client.activateClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getUserSubject`\n\nThe pairwise `sub` this client receives for one epilot user, so the partner can bind the person on its\nside **before** the first sign-in (for example a Babelforce agent provisioned through SCIM with\n`\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}/users/{user_id}:subject`\n\n```ts\nconst { data } = await client.getUserSubject({\n  client_id: \'example\',\n  org_id: \'example\',\n  user_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "user_id": "100321",\n  "sub": "v1.dGhpcy1pcy1hLWR1bW15LXN1YmplY3QtdmFsdWUtMDAx",\n  "key_version": "v1",\n  "sector": "portal.epilot.cloud"\n}\n```\n\n</details>\n\n---\n\n### `createIdentitySession`\n\nCalled by the epilot portal through the portal-host proxy after every persisted 360 session.\nValidates the 360 bearer token itself and mirrors it into the `identity_session` cookie\n(`HttpOnly; Secure;\n\n`GET /v1/identity/session`\n\n```ts\nconst { data } = await client.createIdentitySession()\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "org_id": "739224",\n  "user_id": "string",\n  "expires_at": "1970-01-01T00:00:00.000Z"\n}\n```\n\n</details>\n\n---\n\n### `deleteIdentitySession`\n\nClears the `identity_session` cookie. Called by the portal on logout.\n\n`DELETE /v1/identity/session`\n\n```ts\nconst { data } = await client.deleteIdentitySession()\n```\n\n---\n\n### `launchClient`\n\nOne validated place for partner start links (manager UI, hosted apps). Redirects the browser to the\nclient\'s registered `initiate_login_uri` with `iss` set to this issuer and, when given, the deep lin\n\n`GET /v1/identity/launch/{client_id}`\n\n```ts\nconst { data } = await client.launchClient({\n  client_id: \'example\',\n  target: \'example\',\n  extra: \'example\',\n})\n```\n\n---\n\n## Schemas\n\n### `Error`\n\n```ts\ntype Error = {\n  status: number\n  error: string\n  details?: Record<string, unknown>[]\n}\n```\n\n### `PartnerClientId`\n\nOpaque client identifier, unique within the issuer, never reused\n\n```ts\ntype PartnerClientId = string\n```\n\n### `OrgId`\n\nepilot organization id, an opaque case-sensitive string\n\n```ts\ntype OrgId = string\n```\n\n### `UserId`\n\nepilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.\n\n```ts\ntype UserId = string\n```\n\n### `Environment`\n\nPartner-side environment this client belongs to\n\n```ts\ntype Environment = "dev" | "staging" | "production"\n```\n\n### `PartnerClientStatus`\n\n```ts\ntype PartnerClientStatus = "draft" | "active" | "suspended" | "retired"\n```\n\n### `Scope`\n\n```ts\ntype Scope = "openid" | "email" | "profile"\n```\n\n### `HttpsUri`\n\nAbsolute HTTPS URL without fragment\n\n```ts\ntype HttpsUri = string // uri\n```\n\n### `PartnerClientCreate`\n\n```ts\ntype PartnerClientCreate = {\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed?: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClientUpdate`\n\n```ts\ntype PartnerClientUpdate = {\n  config_version: number\n  allow_sector_change?: boolean\n  display_name: string\n  description?: string\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClient`\n\n```ts\ntype PartnerClient = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `PartnerClientWithSecret`\n\n```ts\ntype PartnerClientWithSecret = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n  client_secret: string\n}\n```\n\n### `PartnerClientList`\n\n```ts\ntype PartnerClientList = {\n  results: Array<{\n    client_id: string\n    partner_key: string\n    display_name: string\n    description?: string\n    environment: "dev" | "staging" | "production"\n    redirect_uris: string // uri[]\n    sector_identifier_uri?: string // uri\n    initiate_login_uri?: string // uri\n    launch_target_prefixes?: string[]\n    token_endpoint_auth_method: "client_secret_basic"\n    grant_types: "authorization_code"[]\n    scopes_allowed: "openid" | "email" | "profile"[]\n    status: "draft" | "active" | "suspended" | "retired"\n    status_reason?: string\n    config_version: number\n    secret_rotated_at?: string // date-time\n    previous_secret_expires_at?: string // date-time\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n  next_cursor?: string\n}\n```\n\n### `StatusChangeRequest`\n\n```ts\ntype StatusChangeRequest = {\n  reason?: string\n}\n```\n\n### `RotateSecretRequest`\n\n```ts\ntype RotateSecretRequest = {\n  compromise_mode?: boolean\n  migration_window_seconds?: number\n}\n```\n\n### `AuthorizationPolicyInput`\n\n```ts\ntype AuthorizationPolicyInput = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n}\n```\n\n### `AuthorizationPolicy`\n\n```ts\ntype AuthorizationPolicy = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n  version: number\n  mandatory_claims: "org_id"[]\n  recorded_by: string\n  recorded_at: string // date-time\n}\n```\n\n### `OrgEnablementStatus`\n\n```ts\ntype OrgEnablementStatus = "active" | "suspended" | "revoked"\n```\n\n### `OrgEnablementCreate`\n\n```ts\ntype OrgEnablementCreate = {\n  org_id: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n  }\n}\n```\n\n### `OrgEnablementUpdate`\n\n```ts\ntype OrgEnablementUpdate = {\n  expected_policy_version: number\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n  }\n}\n```\n\n### `OrgEnablement`\n\n```ts\ntype OrgEnablement = {\n  client_id: string\n  org_id: string\n  status: "active" | "suspended" | "revoked"\n  status_reason?: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n    version: number\n    mandatory_claims: "org_id"[]\n    recorded_by: string\n    recorded_at: string // date-time\n  }\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `OrgEnablementList`\n\n```ts\ntype OrgEnablementList = {\n  results: Array<{\n    client_id: string\n    org_id: string\n    status: "active" | "suspended" | "revoked"\n    status_reason?: string\n    authorization_policy: {\n      mode?: { ... }\n      population?: { ... }\n      allowed_scopes: { ... }\n      customer_approval_ref: { ... }\n      approved_at: { ... }\n      version: { ... }\n      mandatory_claims: { ... }\n      recorded_by: { ... }\n      recorded_at: { ... }\n    }\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n}\n```\n\n### `IdentitySession`\n\n```ts\ntype IdentitySession = {\n  org_id: string\n  user_id: string\n  expires_at: string // date-time\n}\n```\n\n### `UserSubject`\n\n```ts\ntype UserSubject = {\n  client_id: string\n  org_id: string\n  user_id: string\n  sub: string\n  key_version: string\n  sector: string\n}\n```\n';
+var identity_default = '# Identity API\n\n- **Base URL:** `https://id.epilot.cloud`\n- **Full API Docs:** [https://docs.epilot.io/api/identity](https://docs.epilot.io/api/identity)\n\n## Usage\n\n```ts\nimport { epilot } from \'@epilot/sdk\'\n\nepilot.authorize(() => \'<token>\')\nconst { data } = await epilot.identity.listClients(...)\n```\n\n### Tree-shakeable import\n\n```ts\nimport { getClient, authorize } from \'@epilot/sdk/identity\'\n\nconst identityClient = getClient()\nauthorize(identityClient, () => \'<token>\')\nconst { data } = await identityClient.listClients(...)\n```\n\n## Operations\n\n**Operator Clients**\n- [`listClients`](#listclients)\n- [`createOidcClient`](#createoidcclient)\n- [`getOidcClient`](#getoidcclient)\n- [`updateClient`](#updateclient)\n- [`retireClient`](#retireclient)\n- [`activateClient`](#activateclient)\n- [`suspendClient`](#suspendclient)\n- [`rotateClientSecret`](#rotateclientsecret)\n\n**Operator Organizations**\n- [`listClientOrganizations`](#listclientorganizations)\n- [`enableClientOrganization`](#enableclientorganization)\n- [`getClientOrganization`](#getclientorganization)\n- [`updateClientOrganization`](#updateclientorganization)\n- [`revokeClientOrganization`](#revokeclientorganization)\n- [`suspendClientOrganization`](#suspendclientorganization)\n- [`activateClientOrganization`](#activateclientorganization)\n- [`getUserSubject`](#getusersubject)\n\n**Session**\n- [`createIdentitySession`](#createidentitysession)\n- [`deleteIdentitySession`](#deleteidentitysession)\n\n**Launch**\n- [`launchClient`](#launchclient)\n\n**Schemas**\n- [`Error`](#error)\n- [`PartnerClientId`](#partnerclientid)\n- [`OrgId`](#orgid)\n- [`UserId`](#userid)\n- [`Environment`](#environment)\n- [`PartnerClientStatus`](#partnerclientstatus)\n- [`Scope`](#scope)\n- [`HttpsUri`](#httpsuri)\n- [`PartnerClientCreate`](#partnerclientcreate)\n- [`PartnerClientUpdate`](#partnerclientupdate)\n- [`PartnerClient`](#partnerclient)\n- [`PartnerClientWithSecret`](#partnerclientwithsecret)\n- [`PartnerClientList`](#partnerclientlist)\n- [`StatusChangeRequest`](#statuschangerequest)\n- [`RotateSecretRequest`](#rotatesecretrequest)\n- [`AuthorizationPolicyInput`](#authorizationpolicyinput)\n- [`AuthorizationPolicy`](#authorizationpolicy)\n- [`OrgEnablementStatus`](#orgenablementstatus)\n- [`OrgEnablementCreate`](#orgenablementcreate)\n- [`OrgEnablementUpdate`](#orgenablementupdate)\n- [`OrgEnablement`](#orgenablement)\n- [`OrgEnablementList`](#orgenablementlist)\n- [`IdentitySession`](#identitysession)\n- [`UserSubject`](#usersubject)\n\n### `listClients`\n\nList registered partner clients. The client secret is never returned.\n\n`GET /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.listClients({\n  partner_key: \'example\',\n  status: \'example\',\n  size: 1,\n  cursor: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "partner_key": "string",\n      "display_name": "string",\n      "description": "string",\n      "environment": "dev",\n      "redirect_uris": ["https://partner.example.com/auth/callback"],\n      "sector_identifier_uri": "https://partner.example.com/auth/callback",\n      "initiate_login_uri": "https://partner.example.com/auth/callback",\n      "launch_target_prefixes": ["string"],\n      "token_endpoint_auth_method": "client_secret_basic",\n      "grant_types": ["authorization_code"],\n      "scopes_allowed": ["openid"],\n      "status": "draft",\n      "status_reason": "string",\n      "config_version": 1,\n      "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n      "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ],\n  "next_cursor": "string"\n}\n```\n\n</details>\n\n---\n\n### `createOidcClient`\n\nCreate a partner client in `draft` status. The client secret is returned exactly once in this\nresponse and can never be read again; use `rotateClientSecret` to obtain a new one.\n\n`POST /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.createOidcClient(\n  null,\n  {\n    partner_key: \'babelforce\',\n    display_name: \'Babelforce\',\n    description: \'string\',\n    environment: \'dev\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `getOidcClient`\n\nRead a partner client. The client secret is never returned.\n\n`GET /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.getOidcClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClient`\n\nReplace the mutable configuration of a client. `config_version` must equal the current\nversion (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.updateClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    config_version: 1,\n    allow_sector_change: false,\n    display_name: \'string\',\n    description: \'string\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `retireClient`\n\nRetire a client. The record is kept as a tombstone, the `client_id` is never reused, every\norganization enablement is revoked and all provider-side artefacts are revoked.\n\n`DELETE /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.retireClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClient`\n\nActivate a `draft` or `suspended` client. Validates that every redirect URI is an absolute\nHTTPS URL without fragment, that `scopes_allowed` contains `openid`, and that the\nauthentication method is `c\n\n`POST /v1/identity/operator/clients/{client_id}:activate`\n\n```ts\nconst { data } = await client.activateClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClient`\n\nImmediately block the client for every organization. Provider-side artefacts (codes, tokens,\ngrants) are revoked; the audit trail is kept. Reversible with `activateClient`.\n\n`POST /v1/identity/operator/clients/{client_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `rotateClientSecret`\n\nIssue a new client secret. The new secret is returned exactly once. The previous secret\nkeeps working until `previous_secret_expires_at` unless `compromise_mode` is set, in which\ncase it stops working\n\n`POST /v1/identity/operator/clients/{client_id}:rotateSecret`\n\n```ts\nconst { data } = await client.rotateClientSecret(\n  {\n    client_id: \'example\',\n  },\n  {\n    compromise_mode: false,\n    migration_window_seconds: 86400\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `listClientOrganizations`\n\nList the organizations enabled on a client, including suspended and revoked ones.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.listClientOrganizations({\n  client_id: \'example\',\n  status: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "org_id": "739224",\n      "status": "active",\n      "status_reason": "string",\n      "authorization_policy": {\n        "mode": "preauthorized",\n        "population": "all_current_org_members",\n        "allowed_scopes": ["openid"],\n        "customer_approval_ref": "string",\n        "approved_at": "1970-01-01T00:00:00.000Z",\n        "version": 1,\n        "mandatory_claims": ["org_id"],\n        "recorded_by": "string",\n        "recorded_at": "1970-01-01T00:00:00.000Z"\n      },\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ]\n}\n```\n\n</details>\n\n---\n\n### `enableClientOrganization`\n\nEnable an epilot organization on a client, recording the customer\'s authorization policy\n(version 1). `allowed_scopes` must contain `openid` and be a subset of the client\'s\n`scopes_allowed`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.enableClientOrganization(\n  {\n    client_id: \'example\',\n  },\n  {\n    org_id: \'739224\',\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getClientOrganization`\n\nRead one organization enablement.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.getClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClientOrganization`\n\nRecord a new version of the customer\'s authorization policy. `expected_policy_version` must\nequal the current version (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.updateClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    expected_policy_version: 1,\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `revokeClientOrganization`\n\nRevoke an organization\'s enablement. The record is kept as an audited tombstone; future\nauthorizations for this organization fail with `access_denied` and provider-side artefacts\nbound to it are revok\n\n`DELETE /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.revokeClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClientOrganization`\n\nTemporarily block one organization on this client. Reversible with `activateClientOrganization`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClientOrganization`\n\nResume a suspended organization on this client. Revoked enablements cannot be re-activated; enabling the organization again (`POST \u2026/organizations`) replaces the revoked entry and continues its policy\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate`\n\n```ts\nconst { data } = await client.activateClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getUserSubject`\n\nThe pairwise `sub` this client receives for one epilot user, so the partner can bind the person on its\nside **before** the first sign-in (for example a Babelforce agent provisioned through SCIM with\n`\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}/users/{user_id}:subject`\n\n```ts\nconst { data } = await client.getUserSubject({\n  client_id: \'example\',\n  org_id: \'example\',\n  user_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "user_id": "100321",\n  "sub": "v1.dGhpcy1pcy1hLWR1bW15LXN1YmplY3QtdmFsdWUtMDAx",\n  "key_version": "v1",\n  "sector": "portal.epilot.cloud"\n}\n```\n\n</details>\n\n---\n\n### `createIdentitySession`\n\nCalled by the epilot portal through the portal-host proxy after every persisted 360 session.\nValidates the 360 bearer token itself and mirrors it into the `identity_session` cookie\n(`HttpOnly; Secure;\n\n`GET /v1/identity/session`\n\n```ts\nconst { data } = await client.createIdentitySession()\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "org_id": "739224",\n  "user_id": "string",\n  "expires_at": "1970-01-01T00:00:00.000Z"\n}\n```\n\n</details>\n\n---\n\n### `deleteIdentitySession`\n\nClears the `identity_session` cookie. Called by the portal on logout.\n\n`DELETE /v1/identity/session`\n\n```ts\nconst { data } = await client.deleteIdentitySession()\n```\n\n---\n\n### `launchClient`\n\nOne validated place for partner start links (manager UI, hosted apps). Redirects the browser to the\nclient\'s registered `initiate_login_uri` with `iss` set to this issuer and, when given, the deep lin\n\n`GET /v1/identity/launch/{client_id}`\n\n```ts\nconst { data } = await client.launchClient({\n  client_id: \'example\',\n  target: \'example\',\n  extra: \'example\',\n})\n```\n\n---\n\n## Schemas\n\n### `Error`\n\n```ts\ntype Error = {\n  status: number\n  error: string\n  details?: Record<string, unknown>[]\n}\n```\n\n### `PartnerClientId`\n\nOpaque client identifier, unique within the issuer, never reused\n\n```ts\ntype PartnerClientId = string\n```\n\n### `OrgId`\n\nepilot organization id, an opaque case-sensitive string\n\n```ts\ntype OrgId = string\n```\n\n### `UserId`\n\nepilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.\n\n```ts\ntype UserId = string\n```\n\n### `Environment`\n\nPartner-side environment this client belongs to\n\n```ts\ntype Environment = "dev" | "staging" | "production"\n```\n\n### `PartnerClientStatus`\n\n```ts\ntype PartnerClientStatus = "draft" | "active" | "suspended" | "retired"\n```\n\n### `Scope`\n\n```ts\ntype Scope = "openid" | "email" | "profile"\n```\n\n### `HttpsUri`\n\nAbsolute HTTPS URL without fragment\n\n```ts\ntype HttpsUri = string // uri\n```\n\n### `PartnerClientCreate`\n\n```ts\ntype PartnerClientCreate = {\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed?: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClientUpdate`\n\n```ts\ntype PartnerClientUpdate = {\n  config_version: number\n  allow_sector_change?: boolean\n  display_name: string\n  description?: string\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClient`\n\n```ts\ntype PartnerClient = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `PartnerClientWithSecret`\n\n```ts\ntype PartnerClientWithSecret = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n  client_secret: string\n}\n```\n\n### `PartnerClientList`\n\n```ts\ntype PartnerClientList = {\n  results: Array<{\n    client_id: string\n    partner_key: string\n    display_name: string\n    description?: string\n    environment: "dev" | "staging" | "production"\n    redirect_uris: string // uri[]\n    sector_identifier_uri?: string // uri\n    initiate_login_uri?: string // uri\n    launch_target_prefixes?: string[]\n    token_endpoint_auth_method: "client_secret_basic"\n    grant_types: "authorization_code"[]\n    scopes_allowed: "openid" | "email" | "profile"[]\n    status: "draft" | "active" | "suspended" | "retired"\n    status_reason?: string\n    config_version: number\n    secret_rotated_at?: string // date-time\n    previous_secret_expires_at?: string // date-time\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n  next_cursor?: string\n}\n```\n\n### `StatusChangeRequest`\n\n```ts\ntype StatusChangeRequest = {\n  reason?: string\n}\n```\n\n### `RotateSecretRequest`\n\n```ts\ntype RotateSecretRequest = {\n  compromise_mode?: boolean\n  migration_window_seconds?: number\n}\n```\n\n### `AuthorizationPolicyInput`\n\n```ts\ntype AuthorizationPolicyInput = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at?: string // date-time\n}\n```\n\n### `AuthorizationPolicy`\n\n```ts\ntype AuthorizationPolicy = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n  version: number\n  mandatory_claims: "org_id"[]\n  recorded_by: string\n  recorded_at: string // date-time\n}\n```\n\n### `OrgEnablementStatus`\n\n```ts\ntype OrgEnablementStatus = "active" | "suspended" | "revoked"\n```\n\n### `OrgEnablementCreate`\n\n```ts\ntype OrgEnablementCreate = {\n  org_id: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at?: string // date-time\n  }\n}\n```\n\n### `OrgEnablementUpdate`\n\n```ts\ntype OrgEnablementUpdate = {\n  expected_policy_version: number\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at?: string // date-time\n  }\n}\n```\n\n### `OrgEnablement`\n\n```ts\ntype OrgEnablement = {\n  client_id: string\n  org_id: string\n  status: "active" | "suspended" | "revoked"\n  status_reason?: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n    version: number\n    mandatory_claims: "org_id"[]\n    recorded_by: string\n    recorded_at: string // date-time\n  }\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `OrgEnablementList`\n\n```ts\ntype OrgEnablementList = {\n  results: Array<{\n    client_id: string\n    org_id: string\n    status: "active" | "suspended" | "revoked"\n    status_reason?: string\n    authorization_policy: {\n      mode?: { ... }\n      population?: { ... }\n      allowed_scopes: { ... }\n      customer_approval_ref: { ... }\n      approved_at: { ... }\n      version: { ... }\n      mandatory_claims: { ... }\n      recorded_by: { ... }\n      recorded_at: { ... }\n    }\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n}\n```\n\n### `IdentitySession`\n\n```ts\ntype IdentitySession = {\n  org_id: string\n  user_id: string\n  expires_at: string // date-time\n}\n```\n\n### `UserSubject`\n\n```ts\ntype UserSubject = {\n  client_id: string\n  org_id: string\n  user_id: string\n  sub: string\n  key_version: string\n  sector: string\n}\n```\n';
 
 
 exports.default = identity_default;

package/dist/{identity.d-BBL0NI_O.d.cts → identity.d-DUcoy_-W.d.cts}

@@ -25,10 +25,17 @@ declare namespace Components {
         Schemas.OrgId /* ^[A-Za-z0-9_-]+$ */;
         export type PartnerKeyQuery = string;
         export type SizeQuery = number;
+        export type UserIdPath = /**
+         * epilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.
+         * example:
+         * 100321
+         */
+        Schemas.UserId /* ^[A-Za-z0-9_-]+$ */;
     }
     export interface PathParameters {
         ClientIdPath?: Parameters.ClientIdPath;
         OrgIdPath?: Parameters.OrgIdPath;
+        UserIdPath?: Parameters.UserIdPath;
     }
     export interface QueryParameters {
         AnyOtherQueryParameters?: Parameters.AnyOtherQueryParameters;
@@ -60,9 +67,17 @@ declare namespace Components {
              * Reference to the customer's approval evidence (ticket, signed order, contract clause)
              */
             customer_approval_ref: string;
+            /**
+             * When the customer approved. Optional: enabling an organization defaults it to the time of the
+             * request, and a policy update keeps the current value unless a new one is given.
+             *
+             */
             approved_at: string; // date-time
             version: number;
             mandatory_claims: ("org_id")[];
+            /**
+             * Email of the admin-portal operator who recorded this policy version
+             */
             recorded_by: string;
             recorded_at: string; // date-time
         }
@@ -80,7 +95,12 @@ declare namespace Components {
              * Reference to the customer's approval evidence (ticket, signed order, contract clause)
              */
             customer_approval_ref: string;
-            approved_at: string; // date-time
+            /**
+             * When the customer approved. Optional: enabling an organization defaults it to the time of the
+             * request, and a policy update keeps the current value unless a new one is given.
+             *
+             */
+            approved_at?: string; // date-time
         }
         /**
          * Partner-side environment this client belongs to
@@ -122,7 +142,7 @@ declare namespace Components {
              */
             user_id: string;
             /**
-             * When the mirrored credential, and therefore the cookie, expires
+             * When the cookie expires (the mirrored credential's expiry, capped at 15 minutes)
              */
             expires_at: string; // date-time
         }
@@ -142,10 +162,15 @@ declare namespace Components {
             status: OrgEnablementStatus;
             status_reason?: string;
             authorization_policy: AuthorizationPolicy;
-            partner_account?: /* Optional audit reference to the partner tenant this organization maps to. The partner enforces the mapping. */ PartnerAccount;
             created_at: string; // date-time
             updated_at: string; // date-time
+            /**
+             * Email of the admin-portal operator who enabled the organization
+             */
             created_by?: string;
+            /**
+             * Email of the admin-portal operator who last changed the enablement
+             */
             updated_by?: string;
         }
         export interface OrgEnablementCreate {
@@ -156,7 +181,6 @@ declare namespace Components {
              */
             OrgId /* ^[A-Za-z0-9_-]+$ */;
             authorization_policy: AuthorizationPolicyInput;
-            partner_account?: /* Optional audit reference to the partner tenant this organization maps to. The partner enforces the mapping. */ PartnerAccount;
         }
         export interface OrgEnablementList {
             results: OrgEnablement[];
@@ -168,7 +192,6 @@ declare namespace Components {
              */
             expected_policy_version: number;
             authorization_policy: AuthorizationPolicyInput;
-            partner_account?: /* Optional audit reference to the partner tenant this organization maps to. The partner enforces the mapping. */ PartnerAccount;
         }
         /**
          * epilot organization id, an opaque case-sensitive string
@@ -176,13 +199,6 @@ declare namespace Components {
          * 739224
          */
         export type OrgId = string; // ^[A-Za-z0-9_-]+$
-        /**
-         * Optional audit reference to the partner tenant this organization maps to. The partner enforces the mapping.
-         */
-        export interface PartnerAccount {
-            id: string;
-            label?: string;
-        }
         export interface PartnerClient {
             client_id: /**
              * Opaque client identifier, unique within the issuer, never reused
@@ -230,9 +246,12 @@ declare namespace Components {
             created_at: string; // date-time
             updated_at: string; // date-time
             /**
-             * Admin-portal identity of the operator who created the client
+             * Email of the admin-portal operator who created the client (their Cognito identity when the pool holds no email)
              */
             created_by?: string;
+            /**
+             * Email of the admin-portal operator who last changed the client
+             */
             updated_by?: string;
         }
         export interface PartnerClientCreate {
@@ -393,9 +412,12 @@ declare namespace Components {
             created_at: string; // date-time
             updated_at: string; // date-time
             /**
-             * Admin-portal identity of the operator who created the client
+             * Email of the admin-portal operator who created the client (their Cognito identity when the pool holds no email)
              */
             created_by?: string;
+            /**
+             * Email of the admin-portal operator who last changed the client
+             */
             updated_by?: string;
             /**
              * Returned exactly once. Store it securely; it cannot be retrieved again.
@@ -416,6 +438,50 @@ declare namespace Components {
         export interface StatusChangeRequest {
             reason?: string;
         }
+        /**
+         * epilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.
+         * example:
+         * 100321
+         */
+        export type UserId = string; // ^[A-Za-z0-9_-]+$
+        export interface UserSubject {
+            client_id: /**
+             * Opaque client identifier, unique within the issuer, never reused
+             * example:
+             * bf-prod-x7k2
+             */
+            PartnerClientId /* ^[A-Za-z0-9._~-]+$ */;
+            org_id: /**
+             * epilot organization id, an opaque case-sensitive string
+             * example:
+             * 739224
+             */
+            OrgId /* ^[A-Za-z0-9_-]+$ */;
+            user_id: /**
+             * epilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.
+             * example:
+             * 100321
+             */
+            UserId /* ^[A-Za-z0-9_-]+$ */;
+            /**
+             * The pairwise subject this client receives for the user, `<key_version>.<base64url digest>`
+             * example:
+             * v1.dGhpcy1pcy1hLWR1bW15LXN1YmplY3QtdmFsdWUtMDAx
+             */
+            sub: string;
+            /**
+             * Active pairwise key version the value was derived with
+             * example:
+             * v1
+             */
+            key_version: string;
+            /**
+             * Pairwise sector the value was derived for (sector_identifier_uri host, else the first redirect host)
+             * example:
+             * portal.epilot.cloud
+             */
+            sector: string;
+        }
     }
 }
 declare namespace Paths {
@@ -486,6 +552,16 @@ declare namespace Paths {
             export type $404 = Components.Responses.NotFound;
         }
     }
+    namespace GetUserSubject {
+        namespace Responses {
+            export type $200 = Components.Schemas.UserSubject;
+            export type $400 = Components.Schemas.Error;
+            export type $401 = Components.Responses.Unauthorized;
+            export type $403 = Components.Responses.Forbidden;
+            export type $404 = Components.Schemas.Error;
+            export type $409 = Components.Schemas.Error;
+        }
+    }
     namespace LaunchClient {
         namespace Parameters {
             export interface Extra {
@@ -652,6 +728,13 @@ declare namespace Paths {
             export type $1 = Components.Parameters.OrgIdPath;
         }
     }
+    namespace V1IdentityOperatorClients$ClientIdOrganizations$OrgIdUsers$UserIdSubject {
+        namespace Parameters {
+            export type $0 = Components.Parameters.ClientIdPath;
+            export type $1 = Components.Parameters.OrgIdPath;
+            export type $2 = Components.Parameters.UserIdPath;
+        }
+    }
     namespace V1IdentityOperatorClients$ClientIdRotateSecret {
         namespace Parameters {
             export type $0 = Components.Parameters.ClientIdPath;
@@ -838,12 +921,37 @@ interface OperationMethods {
     data?: any,
     config?: AxiosRequestConfig  
   ): OperationResponse<Paths.ActivateClientOrganization.Responses.$200>
+  /**
+   * getUserSubject - getUserSubject
+   * 
+   * The pairwise `sub` this client receives for one epilot user, so the partner can bind the person on its
+   * side **before** the first sign-in (for example a Babelforce agent provisioned through SCIM with
+   * `externalId = sub`).
+   * 
+   * Derived exactly as the token endpoint derives it, never stored:
+   * `sub = key_version + "." + base64url(HMAC-SHA256(key[key_version], sector + "\n" + user_id))`, where the
+   * sector is the client's `sector_identifier_uri` host or, without one, the host of its first redirect URI.
+   * The same inputs always give the same value; it changes only when the client's sector or the active key
+   * version changes.
+   * 
+   * Requires an **active** client (a draft client's sector may still change and would invalidate every binding),
+   * an organization enablement that is not revoked, and the user being an active member of that organization
+   * (checked live against user-api). Every read is written to the audit trail: the value is a partner-facing
+   * identifier.
+   * 
+   */
+  'getUserSubject'(
+    parameters?: Parameters<UnknownParamsObject> | null,
+    data?: any,
+    config?: AxiosRequestConfig  
+  ): OperationResponse<Paths.GetUserSubject.Responses.$200>
   /**
    * createIdentitySession - createIdentitySession
    * 
    * Called by the epilot portal through the portal-host proxy after every persisted 360 session.
    * Validates the 360 bearer token itself and mirrors it into the `identity_session` cookie
-   * (`HttpOnly; Secure; Path=/v1/identity`) whose lifetime equals the remaining token lifetime.
+   * (`HttpOnly; Secure; Path=/v1/identity`) whose lifetime is the remaining token lifetime, capped at 15 minutes
+   * (the portal mirrors the credential again on every token refresh and just before a partner sign-in).
    * The cookie is what proves the live 360 session during `completeInteraction`.
    * 
    */
@@ -1073,13 +1181,40 @@ interface PathsDictionary {
       config?: AxiosRequestConfig  
     ): OperationResponse<Paths.ActivateClientOrganization.Responses.$200>
   }
+  ['/v1/identity/operator/clients/{client_id}/organizations/{org_id}/users/{user_id}:subject']: {
+    /**
+     * getUserSubject - getUserSubject
+     * 
+     * The pairwise `sub` this client receives for one epilot user, so the partner can bind the person on its
+     * side **before** the first sign-in (for example a Babelforce agent provisioned through SCIM with
+     * `externalId = sub`).
+     * 
+     * Derived exactly as the token endpoint derives it, never stored:
+     * `sub = key_version + "." + base64url(HMAC-SHA256(key[key_version], sector + "\n" + user_id))`, where the
+     * sector is the client's `sector_identifier_uri` host or, without one, the host of its first redirect URI.
+     * The same inputs always give the same value; it changes only when the client's sector or the active key
+     * version changes.
+     * 
+     * Requires an **active** client (a draft client's sector may still change and would invalidate every binding),
+     * an organization enablement that is not revoked, and the user being an active member of that organization
+     * (checked live against user-api). Every read is written to the audit trail: the value is a partner-facing
+     * identifier.
+     * 
+     */
+    'get'(
+      parameters?: Parameters<UnknownParamsObject> | null,
+      data?: any,
+      config?: AxiosRequestConfig  
+    ): OperationResponse<Paths.GetUserSubject.Responses.$200>
+  }
   ['/v1/identity/session']: {
     /**
      * createIdentitySession - createIdentitySession
      * 
      * Called by the epilot portal through the portal-host proxy after every persisted 360 session.
      * Validates the 360 bearer token itself and mirrors it into the `identity_session` cookie
-     * (`HttpOnly; Secure; Path=/v1/identity`) whose lifetime equals the remaining token lifetime.
+     * (`HttpOnly; Secure; Path=/v1/identity`) whose lifetime is the remaining token lifetime, capped at 15 minutes
+     * (the portal mirrors the credential again on every token refresh and just before a partner sign-in).
      * The cookie is what proves the live 360 session during `completeInteraction`.
      * 
      */
@@ -1138,7 +1273,6 @@ type OrgEnablementList = Components.Schemas.OrgEnablementList;
 type OrgEnablementStatus = Components.Schemas.OrgEnablementStatus;
 type OrgEnablementUpdate = Components.Schemas.OrgEnablementUpdate;
 type OrgId = Components.Schemas.OrgId;
-type PartnerAccount = Components.Schemas.PartnerAccount;
 type PartnerClient = Components.Schemas.PartnerClient;
 type PartnerClientCreate = Components.Schemas.PartnerClientCreate;
 type PartnerClientId = Components.Schemas.PartnerClientId;
@@ -1149,5 +1283,7 @@ type PartnerClientWithSecret = Components.Schemas.PartnerClientWithSecret;
 type RotateSecretRequest = Components.Schemas.RotateSecretRequest;
 type Scope = Components.Schemas.Scope;
 type StatusChangeRequest = Components.Schemas.StatusChangeRequest;
+type UserId = Components.Schemas.UserId;
+type UserSubject = Components.Schemas.UserSubject;
 
-export { type AuthorizationPolicy as A, type Client as C, type Environment as E, type HttpsUri as H, type IdentitySession as I, type OperationMethods as O, Paths as P, type RotateSecretRequest as R, type Scope as S, Components as a, type PathsDictionary as b, type AuthorizationPolicyInput as c, type Error as d, type OrgEnablement as e, type OrgEnablementCreate as f, type OrgEnablementList as g, type OrgEnablementStatus as h, type OrgEnablementUpdate as i, type OrgId as j, type PartnerAccount as k, type PartnerClient as l, type PartnerClientCreate as m, type PartnerClientId as n, type PartnerClientList as o, type PartnerClientStatus as p, type PartnerClientUpdate as q, type PartnerClientWithSecret as r, type StatusChangeRequest as s };
+export { type AuthorizationPolicy as A, type Client as C, type Environment as E, type HttpsUri as H, type IdentitySession as I, type OperationMethods as O, Paths as P, type RotateSecretRequest as R, type Scope as S, type UserId as U, Components as a, type PathsDictionary as b, type AuthorizationPolicyInput as c, type Error as d, type OrgEnablement as e, type OrgEnablementCreate as f, type OrgEnablementList as g, type OrgEnablementStatus as h, type OrgEnablementUpdate as i, type OrgId as j, type PartnerClient as k, type PartnerClientCreate as l, type PartnerClientId as m, type PartnerClientList as n, type PartnerClientStatus as o, type PartnerClientUpdate as p, type PartnerClientWithSecret as q, type StatusChangeRequest as r, type UserSubject as s };