@epilot/sdk 2.20.74 → 2.20.75

package/dist/{identity-JDTGYAOV.cjs → identity-XCFH3MIW.cjs}

@@ -1,7 +1,7 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});require('./chunk-NJK5F5TF.cjs');
 
 // src/docs/identity.json
-var identity_default = '# Identity API\n\n- **Base URL:** `https://id.epilot.cloud`\n- **Full API Docs:** [https://docs.epilot.io/api/identity](https://docs.epilot.io/api/identity)\n\n## Usage\n\n```ts\nimport { epilot } from \'@epilot/sdk\'\n\nepilot.authorize(() => \'<token>\')\nconst { data } = await epilot.identity.listClients(...)\n```\n\n### Tree-shakeable import\n\n```ts\nimport { getClient, authorize } from \'@epilot/sdk/identity\'\n\nconst identityClient = getClient()\nauthorize(identityClient, () => \'<token>\')\nconst { data } = await identityClient.listClients(...)\n```\n\n## Operations\n\n**Operator Clients**\n- [`listClients`](#listclients)\n- [`createOidcClient`](#createoidcclient)\n- [`getOidcClient`](#getoidcclient)\n- [`updateClient`](#updateclient)\n- [`retireClient`](#retireclient)\n- [`activateClient`](#activateclient)\n- [`suspendClient`](#suspendclient)\n- [`rotateClientSecret`](#rotateclientsecret)\n\n**Operator Organizations**\n- [`listClientOrganizations`](#listclientorganizations)\n- [`enableClientOrganization`](#enableclientorganization)\n- [`getClientOrganization`](#getclientorganization)\n- [`updateClientOrganization`](#updateclientorganization)\n- [`revokeClientOrganization`](#revokeclientorganization)\n- [`suspendClientOrganization`](#suspendclientorganization)\n- [`activateClientOrganization`](#activateclientorganization)\n- [`getUserSubject`](#getusersubject)\n\n**Session**\n- [`createIdentitySession`](#createidentitysession)\n- [`deleteIdentitySession`](#deleteidentitysession)\n\n**Launch**\n- [`launchClient`](#launchclient)\n\n**Schemas**\n- [`Error`](#error)\n- [`PartnerClientId`](#partnerclientid)\n- [`OrgId`](#orgid)\n- [`UserId`](#userid)\n- [`Environment`](#environment)\n- [`PartnerClientStatus`](#partnerclientstatus)\n- [`Scope`](#scope)\n- [`HttpsUri`](#httpsuri)\n- [`PartnerClientCreate`](#partnerclientcreate)\n- [`PartnerClientUpdate`](#partnerclientupdate)\n- [`PartnerClient`](#partnerclient)\n- [`PartnerClientWithSecret`](#partnerclientwithsecret)\n- [`PartnerClientList`](#partnerclientlist)\n- [`StatusChangeRequest`](#statuschangerequest)\n- [`RotateSecretRequest`](#rotatesecretrequest)\n- [`AuthorizationPolicyInput`](#authorizationpolicyinput)\n- [`AuthorizationPolicy`](#authorizationpolicy)\n- [`OrgEnablementStatus`](#orgenablementstatus)\n- [`OrgEnablementCreate`](#orgenablementcreate)\n- [`OrgEnablementUpdate`](#orgenablementupdate)\n- [`OrgEnablement`](#orgenablement)\n- [`OrgEnablementList`](#orgenablementlist)\n- [`IdentitySession`](#identitysession)\n- [`UserSubject`](#usersubject)\n\n### `listClients`\n\nList registered partner clients. The client secret is never returned.\n\n`GET /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.listClients({\n  partner_key: \'example\',\n  status: \'example\',\n  size: 1,\n  cursor: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "partner_key": "string",\n      "display_name": "string",\n      "description": "string",\n      "environment": "dev",\n      "redirect_uris": ["https://partner.example.com/auth/callback"],\n      "sector_identifier_uri": "https://partner.example.com/auth/callback",\n      "initiate_login_uri": "https://partner.example.com/auth/callback",\n      "launch_target_prefixes": ["string"],\n      "token_endpoint_auth_method": "client_secret_basic",\n      "grant_types": ["authorization_code"],\n      "scopes_allowed": ["openid"],\n      "status": "draft",\n      "status_reason": "string",\n      "config_version": 1,\n      "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n      "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ],\n  "next_cursor": "string"\n}\n```\n\n</details>\n\n---\n\n### `createOidcClient`\n\nCreate a partner client in `draft` status. The client secret is returned exactly once in this\nresponse and can never be read again; use `rotateClientSecret` to obtain a new one.\n\n`POST /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.createOidcClient(\n  null,\n  {\n    partner_key: \'babelforce\',\n    display_name: \'Babelforce\',\n    description: \'string\',\n    environment: \'dev\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `getOidcClient`\n\nRead a partner client. The client secret is never returned.\n\n`GET /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.getOidcClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClient`\n\nReplace the mutable configuration of a client. `config_version` must equal the current\nversion (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.updateClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    config_version: 1,\n    allow_sector_change: false,\n    display_name: \'string\',\n    description: \'string\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `retireClient`\n\nRetire a client. The record is kept as a tombstone, the `client_id` is never reused, every\norganization enablement is revoked and all provider-side artefacts are revoked.\n\n`DELETE /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.retireClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClient`\n\nActivate a `draft` or `suspended` client. Validates that every redirect URI is an absolute\nHTTPS URL without fragment, that `scopes_allowed` contains `openid`, and that the\nauthentication method is `c\n\n`POST /v1/identity/operator/clients/{client_id}:activate`\n\n```ts\nconst { data } = await client.activateClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClient`\n\nImmediately block the client for every organization. Provider-side artefacts (codes, tokens,\ngrants) are revoked; the audit trail is kept. Reversible with `activateClient`.\n\n`POST /v1/identity/operator/clients/{client_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `rotateClientSecret`\n\nIssue a new client secret. The new secret is returned exactly once. The previous secret\nkeeps working until `previous_secret_expires_at` unless `compromise_mode` is set, in which\ncase it stops working\n\n`POST /v1/identity/operator/clients/{client_id}:rotateSecret`\n\n```ts\nconst { data } = await client.rotateClientSecret(\n  {\n    client_id: \'example\',\n  },\n  {\n    compromise_mode: false,\n    migration_window_seconds: 86400\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `listClientOrganizations`\n\nList the organizations enabled on a client, including suspended and revoked ones.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.listClientOrganizations({\n  client_id: \'example\',\n  status: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "org_id": "739224",\n      "status": "active",\n      "status_reason": "string",\n      "authorization_policy": {\n        "mode": "preauthorized",\n        "population": "all_current_org_members",\n        "allowed_scopes": ["openid"],\n        "customer_approval_ref": "string",\n        "approved_at": "1970-01-01T00:00:00.000Z",\n        "version": 1,\n        "mandatory_claims": ["org_id"],\n        "recorded_by": "string",\n        "recorded_at": "1970-01-01T00:00:00.000Z"\n      },\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ]\n}\n```\n\n</details>\n\n---\n\n### `enableClientOrganization`\n\nEnable an epilot organization on a client, recording the customer\'s authorization policy\n(version 1). `allowed_scopes` must contain `openid` and be a subset of the client\'s\n`scopes_allowed`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.enableClientOrganization(\n  {\n    client_id: \'example\',\n  },\n  {\n    org_id: \'739224\',\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getClientOrganization`\n\nRead one organization enablement.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.getClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClientOrganization`\n\nRecord a new version of the customer\'s authorization policy. `expected_policy_version` must\nequal the current version (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.updateClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    expected_policy_version: 1,\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `revokeClientOrganization`\n\nRevoke an organization\'s enablement. The record is kept as an audited tombstone; future\nauthorizations for this organization fail with `access_denied` and provider-side artefacts\nbound to it are revok\n\n`DELETE /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.revokeClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClientOrganization`\n\nTemporarily block one organization on this client. Reversible with `activateClientOrganization`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClientOrganization`\n\nResume a suspended organization on this client. Revoked enablements cannot be re-activated; enabling the organization again (`POST \u2026/organizations`) replaces the revoked entry and continues its policy\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate`\n\n```ts\nconst { data } = await client.activateClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getUserSubject`\n\nThe pairwise `sub` this client receives for one epilot user, so the partner can bind the person on its\nside **before** the first sign-in (for example a Babelforce agent provisioned through SCIM with\n`\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}/users/{user_id}:subject`\n\n```ts\nconst { data } = await client.getUserSubject({\n  client_id: \'example\',\n  org_id: \'example\',\n  user_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "user_id": "100321",\n  "sub": "v1.dGhpcy1pcy1hLWR1bW15LXN1YmplY3QtdmFsdWUtMDAx",\n  "key_version": "v1",\n  "sector": "portal.epilot.cloud"\n}\n```\n\n</details>\n\n---\n\n### `createIdentitySession`\n\nCalled by the epilot portal through the portal-host proxy after every persisted 360 session.\nValidates the 360 bearer token itself and mirrors it into the `identity_session` cookie\n(`HttpOnly; Secure;\n\n`GET /v1/identity/session`\n\n```ts\nconst { data } = await client.createIdentitySession()\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "org_id": "739224",\n  "user_id": "string",\n  "expires_at": "1970-01-01T00:00:00.000Z"\n}\n```\n\n</details>\n\n---\n\n### `deleteIdentitySession`\n\nClears the `identity_session` cookie. Called by the portal on logout.\n\n`DELETE /v1/identity/session`\n\n```ts\nconst { data } = await client.deleteIdentitySession()\n```\n\n---\n\n### `launchClient`\n\nOne validated place for partner start links (manager UI, hosted apps). Redirects the browser to the\nclient\'s registered `initiate_login_uri` with `iss` set to this issuer and, when given, the deep lin\n\n`GET /v1/identity/launch/{client_id}`\n\n```ts\nconst { data } = await client.launchClient({\n  client_id: \'example\',\n  target: \'example\',\n  extra: \'example\',\n})\n```\n\n---\n\n## Schemas\n\n### `Error`\n\n```ts\ntype Error = {\n  status: number\n  error: string\n  details?: Record<string, unknown>[]\n}\n```\n\n### `PartnerClientId`\n\nOpaque client identifier, unique within the issuer, never reused\n\n```ts\ntype PartnerClientId = string\n```\n\n### `OrgId`\n\nepilot organization id, an opaque case-sensitive string\n\n```ts\ntype OrgId = string\n```\n\n### `UserId`\n\nepilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.\n\n```ts\ntype UserId = string\n```\n\n### `Environment`\n\nPartner-side environment this client belongs to\n\n```ts\ntype Environment = "dev" | "staging" | "production"\n```\n\n### `PartnerClientStatus`\n\n```ts\ntype PartnerClientStatus = "draft" | "active" | "suspended" | "retired"\n```\n\n### `Scope`\n\n```ts\ntype Scope = "openid" | "email" | "profile"\n```\n\n### `HttpsUri`\n\nAbsolute HTTPS URL without fragment\n\n```ts\ntype HttpsUri = string // uri\n```\n\n### `PartnerClientCreate`\n\n```ts\ntype PartnerClientCreate = {\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed?: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClientUpdate`\n\n```ts\ntype PartnerClientUpdate = {\n  config_version: number\n  allow_sector_change?: boolean\n  display_name: string\n  description?: string\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClient`\n\n```ts\ntype PartnerClient = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `PartnerClientWithSecret`\n\n```ts\ntype PartnerClientWithSecret = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n  client_secret: string\n}\n```\n\n### `PartnerClientList`\n\n```ts\ntype PartnerClientList = {\n  results: Array<{\n    client_id: string\n    partner_key: string\n    display_name: string\n    description?: string\n    environment: "dev" | "staging" | "production"\n    redirect_uris: string // uri[]\n    sector_identifier_uri?: string // uri\n    initiate_login_uri?: string // uri\n    launch_target_prefixes?: string[]\n    token_endpoint_auth_method: "client_secret_basic"\n    grant_types: "authorization_code"[]\n    scopes_allowed: "openid" | "email" | "profile"[]\n    status: "draft" | "active" | "suspended" | "retired"\n    status_reason?: string\n    config_version: number\n    secret_rotated_at?: string // date-time\n    previous_secret_expires_at?: string // date-time\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n  next_cursor?: string\n}\n```\n\n### `StatusChangeRequest`\n\n```ts\ntype StatusChangeRequest = {\n  reason?: string\n}\n```\n\n### `RotateSecretRequest`\n\n```ts\ntype RotateSecretRequest = {\n  compromise_mode?: boolean\n  migration_window_seconds?: number\n}\n```\n\n### `AuthorizationPolicyInput`\n\n```ts\ntype AuthorizationPolicyInput = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n}\n```\n\n### `AuthorizationPolicy`\n\n```ts\ntype AuthorizationPolicy = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n  version: number\n  mandatory_claims: "org_id"[]\n  recorded_by: string\n  recorded_at: string // date-time\n}\n```\n\n### `OrgEnablementStatus`\n\n```ts\ntype OrgEnablementStatus = "active" | "suspended" | "revoked"\n```\n\n### `OrgEnablementCreate`\n\n```ts\ntype OrgEnablementCreate = {\n  org_id: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n  }\n}\n```\n\n### `OrgEnablementUpdate`\n\n```ts\ntype OrgEnablementUpdate = {\n  expected_policy_version: number\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n  }\n}\n```\n\n### `OrgEnablement`\n\n```ts\ntype OrgEnablement = {\n  client_id: string\n  org_id: string\n  status: "active" | "suspended" | "revoked"\n  status_reason?: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n    version: number\n    mandatory_claims: "org_id"[]\n    recorded_by: string\n    recorded_at: string // date-time\n  }\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `OrgEnablementList`\n\n```ts\ntype OrgEnablementList = {\n  results: Array<{\n    client_id: string\n    org_id: string\n    status: "active" | "suspended" | "revoked"\n    status_reason?: string\n    authorization_policy: {\n      mode?: { ... }\n      population?: { ... }\n      allowed_scopes: { ... }\n      customer_approval_ref: { ... }\n      approved_at: { ... }\n      version: { ... }\n      mandatory_claims: { ... }\n      recorded_by: { ... }\n      recorded_at: { ... }\n    }\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n}\n```\n\n### `IdentitySession`\n\n```ts\ntype IdentitySession = {\n  org_id: string\n  user_id: string\n  expires_at: string // date-time\n}\n```\n\n### `UserSubject`\n\n```ts\ntype UserSubject = {\n  client_id: string\n  org_id: string\n  user_id: string\n  sub: string\n  key_version: string\n  sector: string\n}\n```\n';
+var identity_default = '# Identity API\n\n- **Base URL:** `https://id.epilot.cloud`\n- **Full API Docs:** [https://docs.epilot.io/api/identity](https://docs.epilot.io/api/identity)\n\n## Usage\n\n```ts\nimport { epilot } from \'@epilot/sdk\'\n\nepilot.authorize(() => \'<token>\')\nconst { data } = await epilot.identity.listClients(...)\n```\n\n### Tree-shakeable import\n\n```ts\nimport { getClient, authorize } from \'@epilot/sdk/identity\'\n\nconst identityClient = getClient()\nauthorize(identityClient, () => \'<token>\')\nconst { data } = await identityClient.listClients(...)\n```\n\n## Operations\n\n**Operator Clients**\n- [`listClients`](#listclients)\n- [`createOidcClient`](#createoidcclient)\n- [`getOidcClient`](#getoidcclient)\n- [`updateClient`](#updateclient)\n- [`retireClient`](#retireclient)\n- [`activateClient`](#activateclient)\n- [`suspendClient`](#suspendclient)\n- [`rotateClientSecret`](#rotateclientsecret)\n\n**Operator Organizations**\n- [`listClientOrganizations`](#listclientorganizations)\n- [`enableClientOrganization`](#enableclientorganization)\n- [`getClientOrganization`](#getclientorganization)\n- [`updateClientOrganization`](#updateclientorganization)\n- [`revokeClientOrganization`](#revokeclientorganization)\n- [`suspendClientOrganization`](#suspendclientorganization)\n- [`activateClientOrganization`](#activateclientorganization)\n- [`getUserSubject`](#getusersubject)\n\n**Session**\n- [`createIdentitySession`](#createidentitysession)\n- [`deleteIdentitySession`](#deleteidentitysession)\n\n**Launch**\n- [`launchClient`](#launchclient)\n\n**Schemas**\n- [`Error`](#error)\n- [`PartnerClientId`](#partnerclientid)\n- [`OrgId`](#orgid)\n- [`UserId`](#userid)\n- [`Environment`](#environment)\n- [`PartnerClientStatus`](#partnerclientstatus)\n- [`Scope`](#scope)\n- [`HttpsUri`](#httpsuri)\n- [`PartnerClientCreate`](#partnerclientcreate)\n- [`PartnerClientUpdate`](#partnerclientupdate)\n- [`PartnerClient`](#partnerclient)\n- [`PartnerClientWithSecret`](#partnerclientwithsecret)\n- [`PartnerClientList`](#partnerclientlist)\n- [`StatusChangeRequest`](#statuschangerequest)\n- [`RotateSecretRequest`](#rotatesecretrequest)\n- [`AuthorizationPolicyInput`](#authorizationpolicyinput)\n- [`AuthorizationPolicy`](#authorizationpolicy)\n- [`OrgEnablementStatus`](#orgenablementstatus)\n- [`OrgEnablementCreate`](#orgenablementcreate)\n- [`OrgEnablementUpdate`](#orgenablementupdate)\n- [`OrgEnablement`](#orgenablement)\n- [`OrgEnablementList`](#orgenablementlist)\n- [`IdentitySession`](#identitysession)\n- [`UserSubject`](#usersubject)\n\n### `listClients`\n\nList registered partner clients. The client secret is never returned.\n\n`GET /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.listClients({\n  partner_key: \'example\',\n  status: \'example\',\n  size: 1,\n  cursor: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "partner_key": "string",\n      "display_name": "string",\n      "description": "string",\n      "environment": "dev",\n      "redirect_uris": ["https://partner.example.com/auth/callback"],\n      "sector_identifier_uri": "https://partner.example.com/auth/callback",\n      "initiate_login_uri": "https://partner.example.com/auth/callback",\n      "launch_target_prefixes": ["string"],\n      "token_endpoint_auth_method": "client_secret_basic",\n      "grant_types": ["authorization_code"],\n      "scopes_allowed": ["openid"],\n      "status": "draft",\n      "status_reason": "string",\n      "config_version": 1,\n      "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n      "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ],\n  "next_cursor": "string"\n}\n```\n\n</details>\n\n---\n\n### `createOidcClient`\n\nCreate a partner client in `draft` status. The client secret is returned exactly once in this\nresponse and can never be read again; use `rotateClientSecret` to obtain a new one.\n\n`POST /v1/identity/operator/clients`\n\n```ts\nconst { data } = await client.createOidcClient(\n  null,\n  {\n    partner_key: \'babelforce\',\n    display_name: \'Babelforce\',\n    description: \'string\',\n    environment: \'dev\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `getOidcClient`\n\nRead a partner client. The client secret is never returned.\n\n`GET /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.getOidcClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClient`\n\nReplace the mutable configuration of a client. `config_version` must equal the current\nversion (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.updateClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    config_version: 1,\n    allow_sector_change: false,\n    display_name: \'string\',\n    description: \'string\',\n    redirect_uris: [\'https://partner.example.com/auth/callback\'],\n    sector_identifier_uri: \'https://partner.example.com/auth/callback\',\n    initiate_login_uri: \'https://partner.example.com/auth/callback\',\n    launch_target_prefixes: [\'string\'],\n    scopes_allowed: [\'openid\']\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `retireClient`\n\nRetire a client. The record is kept as a tombstone, the `client_id` is never reused, every\norganization enablement is revoked and all provider-side artefacts are revoked.\n\n`DELETE /v1/identity/operator/clients/{client_id}`\n\n```ts\nconst { data } = await client.retireClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClient`\n\nActivate a `draft` or `suspended` client. Validates that every redirect URI is an absolute\nHTTPS URL without fragment, that `scopes_allowed` contains `openid`, and that the\nauthentication method is `c\n\n`POST /v1/identity/operator/clients/{client_id}:activate`\n\n```ts\nconst { data } = await client.activateClient({\n  client_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClient`\n\nImmediately block the client for every organization. Provider-side artefacts (codes, tokens,\ngrants) are revoked; the audit trail is kept. Reversible with `activateClient`.\n\n`POST /v1/identity/operator/clients/{client_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClient(\n  {\n    client_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `rotateClientSecret`\n\nIssue a new client secret. The new secret is returned exactly once. The previous secret\nkeeps working until `previous_secret_expires_at` unless `compromise_mode` is set, in which\ncase it stops working\n\n`POST /v1/identity/operator/clients/{client_id}:rotateSecret`\n\n```ts\nconst { data } = await client.rotateClientSecret(\n  {\n    client_id: \'example\',\n  },\n  {\n    compromise_mode: false,\n    migration_window_seconds: 86400\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "partner_key": "string",\n  "display_name": "string",\n  "description": "string",\n  "environment": "dev",\n  "redirect_uris": ["https://partner.example.com/auth/callback"],\n  "sector_identifier_uri": "https://partner.example.com/auth/callback",\n  "initiate_login_uri": "https://partner.example.com/auth/callback",\n  "launch_target_prefixes": ["string"],\n  "token_endpoint_auth_method": "client_secret_basic",\n  "grant_types": ["authorization_code"],\n  "scopes_allowed": ["openid"],\n  "status": "draft",\n  "status_reason": "string",\n  "config_version": 1,\n  "secret_rotated_at": "1970-01-01T00:00:00.000Z",\n  "previous_secret_expires_at": "1970-01-01T00:00:00.000Z",\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string",\n  "client_secret": "string"\n}\n```\n\n</details>\n\n---\n\n### `listClientOrganizations`\n\nList the organizations enabled on a client, including suspended and revoked ones.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.listClientOrganizations({\n  client_id: \'example\',\n  status: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "results": [\n    {\n      "client_id": "bf-prod-x7k2",\n      "org_id": "739224",\n      "status": "active",\n      "status_reason": "string",\n      "authorization_policy": {\n        "mode": "preauthorized",\n        "population": "all_current_org_members",\n        "allowed_scopes": ["openid"],\n        "customer_approval_ref": "string",\n        "approved_at": "1970-01-01T00:00:00.000Z",\n        "version": 1,\n        "mandatory_claims": ["org_id"],\n        "recorded_by": "string",\n        "recorded_at": "1970-01-01T00:00:00.000Z"\n      },\n      "created_at": "1970-01-01T00:00:00.000Z",\n      "updated_at": "1970-01-01T00:00:00.000Z",\n      "created_by": "string",\n      "updated_by": "string"\n    }\n  ]\n}\n```\n\n</details>\n\n---\n\n### `enableClientOrganization`\n\nEnable an epilot organization on a client, recording the customer\'s authorization policy\n(version 1). `allowed_scopes` must contain `openid` and be a subset of the client\'s\n`scopes_allowed`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations`\n\n```ts\nconst { data } = await client.enableClientOrganization(\n  {\n    client_id: \'example\',\n  },\n  {\n    org_id: \'739224\',\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getClientOrganization`\n\nRead one organization enablement.\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.getClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `updateClientOrganization`\n\nRecord a new version of the customer\'s authorization policy. `expected_policy_version` must\nequal the current version (compare-and-swap); a mismatch is rejected with `409`.\n\n`PUT /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.updateClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    expected_policy_version: 1,\n    authorization_policy: {\n      mode: \'preauthorized\',\n      population: \'all_current_org_members\',\n      allowed_scopes: [\'openid\'],\n      customer_approval_ref: \'string\',\n      approved_at: \'1970-01-01T00:00:00.000Z\'\n    }\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `revokeClientOrganization`\n\nRevoke an organization\'s enablement. The record is kept as an audited tombstone; future\nauthorizations for this organization fail with `access_denied` and provider-side artefacts\nbound to it are revok\n\n`DELETE /v1/identity/operator/clients/{client_id}/organizations/{org_id}`\n\n```ts\nconst { data } = await client.revokeClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `suspendClientOrganization`\n\nTemporarily block one organization on this client. Reversible with `activateClientOrganization`.\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:suspend`\n\n```ts\nconst { data } = await client.suspendClientOrganization(\n  {\n    client_id: \'example\',\n    org_id: \'example\',\n  },\n  {\n    reason: \'string\'\n  },\n)\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `activateClientOrganization`\n\nResume a suspended organization on this client. Revoked enablements cannot be re-activated; enabling the organization again (`POST \u2026/organizations`) replaces the revoked entry and continues its policy\n\n`POST /v1/identity/operator/clients/{client_id}/organizations/{org_id}:activate`\n\n```ts\nconst { data } = await client.activateClientOrganization({\n  client_id: \'example\',\n  org_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "status": "active",\n  "status_reason": "string",\n  "authorization_policy": {\n    "mode": "preauthorized",\n    "population": "all_current_org_members",\n    "allowed_scopes": ["openid"],\n    "customer_approval_ref": "string",\n    "approved_at": "1970-01-01T00:00:00.000Z",\n    "version": 1,\n    "mandatory_claims": ["org_id"],\n    "recorded_by": "string",\n    "recorded_at": "1970-01-01T00:00:00.000Z"\n  },\n  "created_at": "1970-01-01T00:00:00.000Z",\n  "updated_at": "1970-01-01T00:00:00.000Z",\n  "created_by": "string",\n  "updated_by": "string"\n}\n```\n\n</details>\n\n---\n\n### `getUserSubject`\n\nThe pairwise `sub` this client receives for one epilot user, so the partner can bind the person on its\nside **before** the first sign-in (for example a Babelforce agent provisioned through SCIM with\n`\n\n`GET /v1/identity/operator/clients/{client_id}/organizations/{org_id}/users/{user_id}:subject`\n\n```ts\nconst { data } = await client.getUserSubject({\n  client_id: \'example\',\n  org_id: \'example\',\n  user_id: \'example\',\n})\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "client_id": "bf-prod-x7k2",\n  "org_id": "739224",\n  "user_id": "100321",\n  "sub": "v1.dGhpcy1pcy1hLWR1bW15LXN1YmplY3QtdmFsdWUtMDAx",\n  "key_version": "v1",\n  "sector": "portal.epilot.cloud"\n}\n```\n\n</details>\n\n---\n\n### `createIdentitySession`\n\nCalled by the epilot portal through the portal-host proxy after every persisted 360 session.\nValidates the 360 bearer token itself and mirrors it into the `identity_session` cookie\n(`HttpOnly; Secure;\n\n`GET /v1/identity/session`\n\n```ts\nconst { data } = await client.createIdentitySession()\n```\n\n<details>\n<summary>Response</summary>\n\n```json\n{\n  "org_id": "739224",\n  "user_id": "string",\n  "expires_at": "1970-01-01T00:00:00.000Z"\n}\n```\n\n</details>\n\n---\n\n### `deleteIdentitySession`\n\nClears the `identity_session` cookie. Called by the portal on logout.\n\n`DELETE /v1/identity/session`\n\n```ts\nconst { data } = await client.deleteIdentitySession()\n```\n\n---\n\n### `launchClient`\n\nOne validated place for partner start links (manager UI, hosted apps). Redirects the browser to the\nclient\'s registered `initiate_login_uri` with `iss` set to this issuer and, when given, the deep lin\n\n`GET /v1/identity/launch/{client_id}`\n\n```ts\nconst { data } = await client.launchClient({\n  client_id: \'example\',\n  target: \'example\',\n  extra: \'example\',\n})\n```\n\n---\n\n## Schemas\n\n### `Error`\n\n```ts\ntype Error = {\n  status: number\n  error: string\n  details?: Record<string, unknown>[]\n}\n```\n\n### `PartnerClientId`\n\nOpaque client identifier, unique within the issuer, never reused\n\n```ts\ntype PartnerClientId = string\n```\n\n### `OrgId`\n\nepilot organization id, an opaque case-sensitive string\n\n```ts\ntype OrgId = string\n```\n\n### `UserId`\n\nepilot user id (`custom:ivy_user_id` in a 360 token). A user belongs to exactly one organization.\n\n```ts\ntype UserId = string\n```\n\n### `Environment`\n\nPartner-side environment this client belongs to\n\n```ts\ntype Environment = "dev" | "staging" | "production"\n```\n\n### `PartnerClientStatus`\n\n```ts\ntype PartnerClientStatus = "draft" | "active" | "suspended" | "retired"\n```\n\n### `Scope`\n\n```ts\ntype Scope = "openid" | "email" | "profile"\n```\n\n### `HttpsUri`\n\nAbsolute HTTPS URL without fragment\n\n```ts\ntype HttpsUri = string // uri\n```\n\n### `PartnerClientCreate`\n\n```ts\ntype PartnerClientCreate = {\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed?: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClientUpdate`\n\n```ts\ntype PartnerClientUpdate = {\n  config_version: number\n  allow_sector_change?: boolean\n  display_name: string\n  description?: string\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n}\n```\n\n### `PartnerClient`\n\n```ts\ntype PartnerClient = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `PartnerClientWithSecret`\n\n```ts\ntype PartnerClientWithSecret = {\n  client_id: string\n  partner_key: string\n  display_name: string\n  description?: string\n  environment: "dev" | "staging" | "production"\n  redirect_uris: string // uri[]\n  sector_identifier_uri?: string // uri\n  initiate_login_uri?: string // uri\n  launch_target_prefixes?: string[]\n  token_endpoint_auth_method: "client_secret_basic"\n  grant_types: "authorization_code"[]\n  scopes_allowed: "openid" | "email" | "profile"[]\n  status: "draft" | "active" | "suspended" | "retired"\n  status_reason?: string\n  config_version: number\n  secret_rotated_at?: string // date-time\n  previous_secret_expires_at?: string // date-time\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n  client_secret: string\n}\n```\n\n### `PartnerClientList`\n\n```ts\ntype PartnerClientList = {\n  results: Array<{\n    client_id: string\n    partner_key: string\n    display_name: string\n    description?: string\n    environment: "dev" | "staging" | "production"\n    redirect_uris: string // uri[]\n    sector_identifier_uri?: string // uri\n    initiate_login_uri?: string // uri\n    launch_target_prefixes?: string[]\n    token_endpoint_auth_method: "client_secret_basic"\n    grant_types: "authorization_code"[]\n    scopes_allowed: "openid" | "email" | "profile"[]\n    status: "draft" | "active" | "suspended" | "retired"\n    status_reason?: string\n    config_version: number\n    secret_rotated_at?: string // date-time\n    previous_secret_expires_at?: string // date-time\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n  next_cursor?: string\n}\n```\n\n### `StatusChangeRequest`\n\n```ts\ntype StatusChangeRequest = {\n  reason?: string\n}\n```\n\n### `RotateSecretRequest`\n\n```ts\ntype RotateSecretRequest = {\n  compromise_mode?: boolean\n  migration_window_seconds?: number\n}\n```\n\n### `AuthorizationPolicyInput`\n\n```ts\ntype AuthorizationPolicyInput = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at?: string // date-time\n}\n```\n\n### `AuthorizationPolicy`\n\n```ts\ntype AuthorizationPolicy = {\n  mode?: "preauthorized"\n  population?: "all_current_org_members"\n  allowed_scopes: "openid" | "email" | "profile"[]\n  customer_approval_ref: string\n  approved_at: string // date-time\n  version: number\n  mandatory_claims: "org_id"[]\n  recorded_by: string\n  recorded_at: string // date-time\n}\n```\n\n### `OrgEnablementStatus`\n\n```ts\ntype OrgEnablementStatus = "active" | "suspended" | "revoked"\n```\n\n### `OrgEnablementCreate`\n\n```ts\ntype OrgEnablementCreate = {\n  org_id: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at?: string // date-time\n  }\n}\n```\n\n### `OrgEnablementUpdate`\n\n```ts\ntype OrgEnablementUpdate = {\n  expected_policy_version: number\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at?: string // date-time\n  }\n}\n```\n\n### `OrgEnablement`\n\n```ts\ntype OrgEnablement = {\n  client_id: string\n  org_id: string\n  status: "active" | "suspended" | "revoked"\n  status_reason?: string\n  authorization_policy: {\n    mode?: "preauthorized"\n    population?: "all_current_org_members"\n    allowed_scopes: "openid" | "email" | "profile"[]\n    customer_approval_ref: string\n    approved_at: string // date-time\n    version: number\n    mandatory_claims: "org_id"[]\n    recorded_by: string\n    recorded_at: string // date-time\n  }\n  created_at: string // date-time\n  updated_at: string // date-time\n  created_by?: string\n  updated_by?: string\n}\n```\n\n### `OrgEnablementList`\n\n```ts\ntype OrgEnablementList = {\n  results: Array<{\n    client_id: string\n    org_id: string\n    status: "active" | "suspended" | "revoked"\n    status_reason?: string\n    authorization_policy: {\n      mode?: { ... }\n      population?: { ... }\n      allowed_scopes: { ... }\n      customer_approval_ref: { ... }\n      approved_at: { ... }\n      version: { ... }\n      mandatory_claims: { ... }\n      recorded_by: { ... }\n      recorded_at: { ... }\n    }\n    created_at: string // date-time\n    updated_at: string // date-time\n    created_by?: string\n    updated_by?: string\n  }>\n}\n```\n\n### `IdentitySession`\n\n```ts\ntype IdentitySession = {\n  org_id: string\n  user_id: string\n  expires_at: string // date-time\n}\n```\n\n### `UserSubject`\n\n```ts\ntype UserSubject = {\n  client_id: string\n  org_id: string\n  user_id: string\n  sub: string\n  key_version: string\n  sector: string\n}\n```\n';
 
 
 exports.default = identity_default;

package/dist/{identity.d-CieYn1WL.d.cts → identity.d-DUcoy_-W.d.cts}

@@ -67,6 +67,11 @@ declare namespace Components {
              * Reference to the customer's approval evidence (ticket, signed order, contract clause)
              */
             customer_approval_ref: string;
+            /**
+             * When the customer approved. Optional: enabling an organization defaults it to the time of the
+             * request, and a policy update keeps the current value unless a new one is given.
+             *
+             */
             approved_at: string; // date-time
             version: number;
             mandatory_claims: ("org_id")[];
@@ -90,7 +95,12 @@ declare namespace Components {
              * Reference to the customer's approval evidence (ticket, signed order, contract clause)
              */
             customer_approval_ref: string;
-            approved_at: string; // date-time
+            /**
+             * When the customer approved. Optional: enabling an organization defaults it to the time of the
+             * request, and a policy update keeps the current value unless a new one is given.
+             *
+             */
+            approved_at?: string; // date-time
         }
         /**
          * Partner-side environment this client belongs to

package/dist/{identity.d-CieYn1WL.d.ts → identity.d-DUcoy_-W.d.ts}

@@ -67,6 +67,11 @@ declare namespace Components {
              * Reference to the customer's approval evidence (ticket, signed order, contract clause)
              */
             customer_approval_ref: string;
+            /**
+             * When the customer approved. Optional: enabling an organization defaults it to the time of the
+             * request, and a policy update keeps the current value unless a new one is given.
+             *
+             */
             approved_at: string; // date-time
             version: number;
             mandatory_claims: ("org_id")[];
@@ -90,7 +95,12 @@ declare namespace Components {
              * Reference to the customer's approval evidence (ticket, signed order, contract clause)
              */
             customer_approval_ref: string;
-            approved_at: string; // date-time
+            /**
+             * When the customer approved. Optional: enabling an organization defaults it to the time of the
+             * request, and a policy update keeps the current value unless a new one is given.
+             *
+             */
+            approved_at?: string; // date-time
         }
         /**
          * Partner-side environment this client belongs to

package/dist/index.cjs

@@ -170,7 +170,7 @@ var _chunkWOUASZJWcjs = require('./chunk-WOUASZJW.cjs');
 
 
 
-var _chunk5PG5IEQ7cjs = require('./chunk-5PG5IEQ7.cjs');
+var _chunkJGPHZYSDcjs = require('./chunk-JGPHZYSD.cjs');
 
 
 var _chunkNJK5F5TFcjs = require('./chunk-NJK5F5TF.cjs');
@@ -244,7 +244,7 @@ var resolveClient = (params) => {
   }
   if (!entry.instance) {
     const definition = entry.loader();
-    entry.instance = _chunk5PG5IEQ7cjs.createApiClient.call(void 0, {
+    entry.instance = _chunkJGPHZYSDcjs.createApiClient.call(void 0, {
       definition,
       token: state.token,
       headers: state.globalHeaders,
@@ -277,7 +277,7 @@ var resetAllClients = (registry) => {
 };
 
 // src/apis/_registry.ts
-var expandDef = (mod) => _chunk5PG5IEQ7cjs.expand.call(void 0, _nullishCoalesce(mod.default, () => ( mod)));
+var expandDef = (mod) => _chunkJGPHZYSDcjs.expand.call(void 0, _nullishCoalesce(mod.default, () => ( mod)));
 var registerBuiltinApis = (registry) => {
   registerApi({
     registry,
@@ -640,9 +640,9 @@ var createSDK = () => {
       const available = [...registry.keys()].join(", ");
       throw new Error(`Unknown API: "${name}". Available: ${available}`);
     }
-    return _chunk5PG5IEQ7cjs.createApiHandle.call(void 0, {
+    return _chunkJGPHZYSDcjs.createApiHandle.call(void 0, {
       resolveClient: () => resolveClient({ registry, name, state }),
-      createClient: () => _chunk5PG5IEQ7cjs.createApiClient.call(void 0, { definition: entry.loader(), apiName: name }),
+      createClient: () => _chunkJGPHZYSDcjs.createApiClient.call(void 0, { definition: entry.loader(), apiName: name }),
       apiName: name
     });
   };
@@ -690,9 +690,9 @@ var createSDK = () => {
           return interceptorUse;
         }
         case "help":
-          return (apiName) => _chunk5PG5IEQ7cjs.help.call(void 0, apiName);
+          return (apiName) => _chunkJGPHZYSDcjs.help.call(void 0, apiName);
         case "openapi":
-          return (apiName) => _chunk5PG5IEQ7cjs.openapi.call(void 0, apiName);
+          return (apiName) => _chunkJGPHZYSDcjs.openapi.call(void 0, apiName);
         case "then":
         case "catch":
         case "finally":
@@ -722,4 +722,4 @@ var epilot = createSDK();
 
 
 
-exports.applyLargeResponseInterceptor = applyLargeResponseInterceptor; exports.applyRetryInterceptor = applyRetryInterceptor; exports.authorize = _chunk5PG5IEQ7cjs.authorize; exports.createSDK = createSDK; exports.epilot = epilot; exports.help = _chunk5PG5IEQ7cjs.help; exports.openapi = _chunk5PG5IEQ7cjs.openapi;
+exports.applyLargeResponseInterceptor = applyLargeResponseInterceptor; exports.applyRetryInterceptor = applyRetryInterceptor; exports.authorize = _chunkJGPHZYSDcjs.authorize; exports.createSDK = createSDK; exports.epilot = epilot; exports.help = _chunkJGPHZYSDcjs.help; exports.openapi = _chunkJGPHZYSDcjs.openapi;

package/dist/index.d.cts

@@ -31,7 +31,7 @@ import { C as Client$o } from './event-catalog.d-BrAxYS9D.cjs';
 import { C as Client$p } from './external-values.d-23q55J5P.cjs';
 import { C as Client$q } from './file.d-DELNV63w.cjs';
 import { C as Client$r } from './iban.d-BwdiGbxi.cjs';
-import { C as Client$s } from './identity.d-CieYn1WL.cjs';
+import { C as Client$s } from './identity.d-DUcoy_-W.cjs';
 import { C as Client$t } from './integration-toolkit.d-l5cgwHLa.cjs';
 import { C as Client$u } from './journey.d-CMtM6U3Y.cjs';
 import { C as Client$v } from './kanban.d-BHnSRCYW.cjs';

package/dist/index.d.ts

@@ -31,7 +31,7 @@ import { C as Client$o } from './event-catalog.d-BrAxYS9D.js';
 import { C as Client$p } from './external-values.d-23q55J5P.js';
 import { C as Client$q } from './file.d-DELNV63w.js';
 import { C as Client$r } from './iban.d-BwdiGbxi.js';
-import { C as Client$s } from './identity.d-CieYn1WL.js';
+import { C as Client$s } from './identity.d-DUcoy_-W.js';
 import { C as Client$t } from './integration-toolkit.d-l5cgwHLa.js';
 import { C as Client$u } from './journey.d-CMtM6U3Y.js';
 import { C as Client$v } from './kanban.d-BHnSRCYW.js';

package/dist/index.js

@@ -170,7 +170,7 @@ import {
   expand,
   help,
   openapi
-} from "./chunk-WG7OKIQ3.js";
+} from "./chunk-6B5HXASK.js";
 import {
   __require
 } from "./chunk-YPSWSI3M.js";

package/docs/identity.md

@@ -1139,7 +1139,7 @@ type AuthorizationPolicyInput = {
   population?: "all_current_org_members"
   allowed_scopes: "openid" | "email" | "profile"[]
   customer_approval_ref: string
-  approved_at: string // date-time
+  approved_at?: string // date-time
 }
 ```
 
@@ -1175,7 +1175,7 @@ type OrgEnablementCreate = {
     population?: "all_current_org_members"
     allowed_scopes: "openid" | "email" | "profile"[]
     customer_approval_ref: string
-    approved_at: string // date-time
+    approved_at?: string // date-time
   }
 }
 ```
@@ -1190,7 +1190,7 @@ type OrgEnablementUpdate = {
     population?: "all_current_org_members"
     allowed_scopes: "openid" | "email" | "profile"[]
     customer_approval_ref: string
-    approved_at: string // date-time
+    approved_at?: string // date-time
   }
 }
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@epilot/sdk",
-  "version": "2.20.74",
+  "version": "2.20.75",
   "description": "JavaScript/TypeScript SDK for epilot APIs",
   "type": "module",
   "main": "./dist/index.cjs",