@eudiplo/sdk-core 5.1.0 → 6.0.0-main.a2a87ad

package/dist/{types.gen-CdvErMyl.d.ts → types.gen-Cg-nB7uf.d.ts}

@@ -401,7 +401,11 @@ type OfferRequestDto = {
     /**
      * The type of response expected for the offer request.
      */
-    response_type: 'uri' | 'dc-api';
+    response_type: 'uri' | 'dc-api' | 'iso-18013-7';
+    /**
+     * Authorization server id from issuer configuration. If omitted, the first enabled server is used.
+     */
+    authorization_server?: string;
     /**
      * Credential claims configuration per credential. Keys must match credentialConfigurationIds.
      */
@@ -440,10 +444,6 @@ type OfferRequestDto = {
      * List of credential configuration ids to be included in the offer.
      */
     credentialConfigurationIds: Array<string>;
-    /**
-     * Optional authorization server to be used for this issuance flow.
-     */
-    authorization_server?: string;
     /**
      * ID of the webhook endpoint to notify about the status of the issuance process.
      */
@@ -520,6 +520,16 @@ type Session = {
      * Flag indicating whether to use the DC API for the presentation request.
      */
     useDcApi: boolean;
+    /**
+     * DC API sub-protocol: "oid4vp" (OpenID4VP via DC API) or "iso-18013-7" (org.iso.mdoc).
+     * Null/undefined means the standard OID4VP flow (useDcApi=false).
+     */
+    dcApiProtocol?: string;
+    /**
+     * Browser page origin recorded at offer time for BrowserHandover session transcript.
+     * Used exclusively by the ISO 18013-7 Annex C flow.
+     */
+    browserOrigin?: string;
     /**
      * Tenant ID for multi-tenancy support.
      */
@@ -651,8 +661,9 @@ type Session = {
      */
     consumed: boolean;
     /**
-     * Timestamp when the session offer was consumed.
-     * Null if the offer has not yet been consumed.
+     * Timestamp of the first consumption event for the session offer.
+     * For OID4VCI this can be URI resolution or later flow completion.
+     * Null if no consumption event has happened yet.
      */
     consumedAt?: string;
 };
@@ -797,6 +808,98 @@ type AuthenticationMethodPresentation = {
     method: 'presentationDuringIssuance';
     config: PresentationDuringIssuanceConfig;
 };
+type ManagedAuthorizationServerConfig = {
+    /**
+     * Authorization server implementation type
+     */
+    type: 'external' | 'oid4vp' | 'chained' | 'built-in';
+    /**
+     * Unique identifier for this authorization server
+     */
+    id: string;
+    /**
+     * Human-friendly label for the UI
+     */
+    label?: string;
+    /**
+     * Whether this managed authorization server is enabled
+     */
+    enabled?: boolean;
+};
+type ExternalAuthorizationServerConfig = {
+    /**
+     * Authorization server implementation type
+     */
+    type: 'external';
+    /**
+     * Unique identifier for this authorization server
+     */
+    id: string;
+    /**
+     * Human-friendly label for the UI
+     */
+    label?: string;
+    /**
+     * Whether this managed authorization server is enabled
+     */
+    enabled?: boolean;
+    /**
+     * Issuer URL for external authorization servers
+     */
+    issuer: string;
+};
+type ChainedAsTokenConfig = {
+    /**
+     * Access token lifetime in seconds
+     */
+    lifetimeSeconds?: number;
+    /**
+     * Key ID for token signing
+     */
+    signingKeyId?: string;
+    /**
+     * Whether refresh tokens should be issued
+     */
+    refreshTokenEnabled?: boolean;
+    /**
+     * Refresh token lifetime in seconds
+     */
+    refreshTokenExpiresInSeconds?: number;
+};
+type Oid4VpAuthorizationServerConfig = {
+    /**
+     * Authorization server implementation type
+     */
+    type: 'oid4vp';
+    /**
+     * Stable identifier used in the AS URL path
+     */
+    id: string;
+    /**
+     * Human-friendly label for the UI
+     */
+    label?: string;
+    /**
+     * Whether this managed authorization server is enabled
+     */
+    enabled?: boolean;
+    /**
+     * Presentation configuration ID to use for OID4VP
+     */
+    presentationConfigId: string;
+    /**
+     * Immediately redirect the browser into the wallet OID4VP request
+     */
+    immediateWalletRedirect?: boolean;
+    /**
+     * Token configuration for this authorization server
+     */
+    token?: ChainedAsTokenConfig;
+    /**
+     * Require DPoP for token requests issued by this authorization server
+     */
+    requireDPoP?: boolean;
+};
 type UpstreamOidcConfig = {
     /**
      * The OIDC issuer URL of the upstream provider
@@ -815,31 +918,59 @@ type UpstreamOidcConfig = {
      */
     scopes?: Array<string>;
 };
-type ChainedAsTokenConfig = {
+type ChainedAuthorizationServerConfig = {
     /**
-     * Access token lifetime in seconds
+     * Authorization server implementation type
      */
-    lifetimeSeconds?: number;
+    type: 'chained';
     /**
-     * Key ID for token signing
+     * Unique identifier for this authorization server
      */
-    signingKeyId?: string;
+    id: string;
+    /**
+     * Human-friendly label for the UI
+     */
+    label?: string;
+    /**
+     * Whether this managed authorization server is enabled
+     */
+    enabled?: boolean;
+    /**
+     * Upstream OIDC provider configuration for chained mode
+     */
+    upstream: UpstreamOidcConfig;
+    /**
+     * Token configuration for this authorization server
+     */
+    token?: ChainedAsTokenConfig;
+    /**
+     * Require DPoP for token requests issued by this authorization server
+     */
+    requireDPoP?: boolean;
 };
-type ChainedAsConfig = {
+type BuiltInAuthorizationServerConfig = {
     /**
-     * Enable chained AS mode
+     * Authorization server implementation type
      */
-    enabled: boolean;
+    type: 'built-in';
     /**
-     * Upstream OIDC provider configuration
+     * Unique identifier for this authorization server
      */
-    upstream?: UpstreamOidcConfig;
+    id: string;
     /**
-     * Token configuration
+     * Human-friendly label for the UI
+     */
+    label?: string;
+    /**
+     * Whether this managed authorization server is enabled
+     */
+    enabled?: boolean;
+    /**
+     * Token configuration for this authorization server
      */
     token?: ChainedAsTokenConfig;
     /**
-     * Require DPoP binding for tokens
+     * Require DPoP for token requests issued by this authorization server
      */
     requireDPoP?: boolean;
 };
@@ -879,6 +1010,66 @@ type FederationConfig = {
      */
     trustAnchors: Array<FederationTrustAnchorConfig>;
 };
+type IssuerProvidedAttestation = {
+    /**
+     * Attestation format as expected by the registrar (for example dc+sd-jwt, mso_mdoc).
+     */
+    format?: string;
+    /**
+     * Arbitrary attestation metadata forwarded to the registrar.
+     */
+    meta?: {
+        [key: string]: unknown;
+    };
+};
+type IssuerRegistrationCertificateConfig = {
+    /**
+     * Enable inclusion of a registration certificate in credential issuer metadata.
+     */
+    enabled?: boolean;
+    /**
+     * import: use an existing JWT, generate: create via registrar from provided attestations and selected credential configurations.
+     */
+    mode?: 'import' | 'generate';
+    /**
+     * Existing registration certificate JWT used when mode is import.
+     */
+    jwt?: string;
+    /**
+     * Schema metadata IDs selected for inclusion in generated registration certificates.
+     */
+    schemaMetadataIds?: Array<string>;
+    /**
+     * Privacy policy URL used when generating a registration certificate (optional if registrar defaults are configured).
+     */
+    privacyPolicy?: string;
+    /**
+     * Support URI used when generating a registration certificate (optional if registrar defaults are configured).
+     */
+    supportUri?: string;
+    /**
+     * Provided attestations included in generated registration certificates.
+     */
+    providedAttestations?: Array<IssuerProvidedAttestation>;
+};
+type IssuerRegistrationCertificateCache = {
+    /**
+     * Cached registration certificate JWT generated by EUDIPLO.
+     */
+    readonly jwt?: string;
+    /**
+     * Config fingerprint used to detect cache invalidation.
+     */
+    readonly fingerprint?: string;
+    /**
+     * JWT iat claim, seconds since epoch.
+     */
+    readonly issuedAt?: number;
+    /**
+     * JWT exp claim, seconds since epoch.
+     */
+    readonly expiresAt?: number;
+};
 type DisplayLogo = {
     uri: string;
     alt_text?: string;
@@ -894,20 +1085,23 @@ type IssuanceConfig = {
      */
     signingKeyId?: string;
     /**
-     * Configuration for Chained Authorization Server mode.
-     * When enabled, EUDIPLO acts as an OAuth AS facade, delegating user authentication
-     * to an upstream OIDC provider while issuing its own tokens with issuer_state.
+     * Dedicated managed authorization servers hosted by this issuer. At least one entry is required.
      */
-    chainedAs?: ChainedAsConfig;
+    authorizationServers: Array<ExternalAuthorizationServerConfig | Oid4VpAuthorizationServerConfig | ChainedAuthorizationServerConfig | BuiltInAuthorizationServerConfig>;
     /**
      * Optional OpenID Federation configuration used for trust evaluation.
      * When omitted, trust checks rely on existing LoTE trust-list behavior.
      */
     federation?: FederationConfig;
     /**
-     * Whether refresh tokens should be issued for OID4VCI token responses.
+     * Optional registration certificate configuration for issuer metadata (`issuer_info`).
+     * Supports importing an existing JWT or generating one via registrar.
      */
-    refreshTokenEnabled?: boolean;
+    registrationCertificate?: IssuerRegistrationCertificateConfig;
+    /**
+     * Server-managed cache for generated issuer registration certificates.
+     */
+    readonly registrationCertificateCache?: IssuerRegistrationCertificateCache;
     /**
      * Whether `credential_response_encryption` should be advertised in the credential issuer metadata.
      */
@@ -916,10 +1110,6 @@ type IssuanceConfig = {
      * Whether `credential_request_encryption` should be advertised in the credential issuer metadata.
      */
     credentialRequestEncryption?: boolean;
-    /**
-     * Refresh token lifetime in seconds. Defaults to 2592000 (30 days).
-     */
-    refreshTokenExpiresInSeconds?: number;
     /**
      * Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5.
      */
@@ -928,10 +1118,6 @@ type IssuanceConfig = {
      * The tenant that owns this object.
      */
     tenant: TenantEntity;
-    /**
-     * Authentication server URL for the issuance process.
-     */
-    authServers?: Array<string>;
     /**
      * Value to determine the amount of credentials that are issued in a batch.
      * Default is 1.
@@ -953,13 +1139,6 @@ type IssuanceConfig = {
      * If empty and walletAttestationRequired is true, all wallet providers are rejected.
      */
     walletProviderTrustLists?: Array<string>;
-    /**
-     * The URL of the preferred authorization server for wallet-initiated flows.
-     * When set, this AS is placed first in the `authorization_servers` array
-     * of the credential issuer metadata, signaling wallets to use it by default.
-     * Must match one of the configured auth servers, the chained AS URL, or "built-in".
-     */
-    preferredAuthServer?: string;
     display: Array<DisplayInfo>;
     /**
      * The timestamp when the VP request was created.
@@ -970,26 +1149,29 @@ type IssuanceConfig = {
      */
     updatedAt: string;
 };
-type IssuanceDto = {
+type UpdateIssuanceDto = {
     /**
      * Key ID for signing access tokens. If unset, the default signing key is used.
      */
     signingKeyId?: string;
     /**
-     * Configuration for Chained Authorization Server mode.
-     * When enabled, EUDIPLO acts as an OAuth AS facade, delegating user authentication
-     * to an upstream OIDC provider while issuing its own tokens with issuer_state.
+     * Dedicated managed authorization servers hosted by this issuer. At least one entry is required.
      */
-    chainedAs?: ChainedAsConfig;
+    authorizationServers?: Array<ExternalAuthorizationServerConfig | Oid4VpAuthorizationServerConfig | ChainedAuthorizationServerConfig | BuiltInAuthorizationServerConfig>;
     /**
      * Optional OpenID Federation configuration used for trust evaluation.
      * When omitted, trust checks rely on existing LoTE trust-list behavior.
      */
     federation?: FederationConfig;
     /**
-     * Whether refresh tokens should be issued for OID4VCI token responses.
+     * Optional registration certificate configuration for issuer metadata (`issuer_info`).
+     * Supports importing an existing JWT or generating one via registrar.
      */
-    refreshTokenEnabled?: boolean;
+    registrationCertificate?: IssuerRegistrationCertificateConfig;
+    /**
+     * Server-managed cache for generated issuer registration certificates.
+     */
+    readonly registrationCertificateCache?: IssuerRegistrationCertificateCache;
     /**
      * Whether `credential_response_encryption` should be advertised in the credential issuer metadata.
      */
@@ -998,18 +1180,10 @@ type IssuanceDto = {
      * Whether `credential_request_encryption` should be advertised in the credential issuer metadata.
      */
     credentialRequestEncryption?: boolean;
-    /**
-     * Refresh token lifetime in seconds. Defaults to 2592000 (30 days).
-     */
-    refreshTokenExpiresInSeconds?: number;
     /**
      * Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5.
      */
     txCodeMaxAttempts?: number;
-    /**
-     * Authentication server URL for the issuance process.
-     */
-    authServers?: Array<string>;
     /**
      * Value to determine the amount of credentials that are issued in a batch.
      * Default is 1.
@@ -1031,14 +1205,7 @@ type IssuanceDto = {
      * If empty and walletAttestationRequired is true, all wallet providers are rejected.
      */
     walletProviderTrustLists?: Array<string>;
-    /**
-     * The URL of the preferred authorization server for wallet-initiated flows.
-     * When set, this AS is placed first in the `authorization_servers` array
-     * of the credential issuer metadata, signaling wallets to use it by default.
-     * Must match one of the configured auth servers, the chained AS URL, or "built-in".
-     */
-    preferredAuthServer?: string;
-    display: Array<DisplayInfo>;
+    display?: Array<DisplayInfo>;
 };
 type ClaimsQuery = {
     id?: string;
@@ -1050,6 +1217,10 @@ type TrustedAuthorityQuery = {
     values: Array<string>;
 };
 type CredentialQuery = {
+    /**
+     * Ordered alternative claim combinations for this credential query.
+     */
+    claim_sets?: Array<Array<string>>;
     id: string;
     format: string;
     multiple?: boolean;
@@ -1156,7 +1327,7 @@ type SchemaUriEntry = {
     /**
      * Schema-format specific metadata (for example { vct: 'urn:example:vct' } for dc+sd-jwt).
      */
-    meta: {
+    meta?: {
         [key: string]: unknown;
     };
 };
@@ -1173,16 +1344,12 @@ type TrustAuthorityEntry = {
      * URI of the trust list or trust anchor (ignored when trustListId is set)
      */
     value?: string;
-    /**
-     * Whether this trust authority is a List of Trusted Entities (LoTE)
-     */
-    isLoTE?: boolean;
     /**
      * Optional verification material for external trusted authorities (for example a JWK). For internal trust-list URLs, EUDIPLO resolves verification material from the database.
      */
     verificationMethod?: {
         [key: string]: unknown;
-    };
+    } | string;
 };
 type SchemaMetaConfig = {
     /**
@@ -1271,7 +1438,7 @@ type FieldDisplayDto = {
 };
 type ClaimFieldDefinitionDto = {
     /**
-     * Path to claim value
+     * Path to claim value. For nested child fields this can be relative to the parent path.
      */
     path: Array<string | number | null>;
     /**
@@ -1293,7 +1460,7 @@ type ClaimFieldDefinitionDto = {
      */
     disclosable?: boolean;
     /**
-     * Namespace for mDOC field
+     * Namespace for mDOC field. Optional when the namespace is already present as the first path segment.
      */
     namespace?: string;
     display?: Array<FieldDisplayDto>;
@@ -1303,6 +1470,10 @@ type ClaimFieldDefinitionDto = {
     constraints?: {
         [key: string]: unknown;
     };
+    /**
+     * Optional nested child fields. Child paths may be specified relative to the parent field path.
+     */
+    children?: Array<ClaimFieldDefinitionDto>;
 };
 type AttributeProviderEntity = {
     auth: WebHookAuthConfigNone | WebHookAuthConfigHeader;
@@ -1564,13 +1735,9 @@ type CredentialConfigUpdate = {
 };
 type SignSchemaMetaConfigDto = {
     /**
-     * The schema metadata configuration to sign and submit
+     * The schema metadata configuration to submit. Registrar builds and signs the final schema metadata.
      */
     config: SchemaMetaConfig;
-    /**
-     * ID of the key chain to use for signing. Defaults to the tenant's default key chain.
-     */
-    keyChainId?: string;
     /**
      * ID of the credential config to link back after submission. When provided, schemaMeta.id on the credential config is updated with the reserved attestation ID.
      */
@@ -1578,13 +1745,9 @@ type SignSchemaMetaConfigDto = {
 };
 type SignVersionSchemaMetaConfigDto = {
     /**
-     * The schema metadata configuration to sign and submit as a new version. Must include the existing id.
+     * The schema metadata configuration to submit as a new version. Must include the existing id.
      */
     config: SchemaMetaConfig;
-    /**
-     * ID of the key chain to use for signing. Defaults to the tenant's default key chain.
-     */
-    keyChainId?: string;
 };
 type VocabularyEntryDto = {
     /**
@@ -1632,9 +1795,9 @@ type MetadataSchemaDto = {
      */
     uri?: string;
     /**
-     * Inline schema content (JSON Schema)
+     * Format-specific metadata for the schema entry
      */
-    schemaContent?: {
+    meta?: {
         [key: string]: unknown;
     };
     /**
@@ -1722,10 +1885,6 @@ type SchemaMetadataResponseDto = {
      * Issuer from the JWT (`iss` claim)
      */
     issuer: string;
-    /**
-     * Serial number of the access certificate that signed this schema metadata
-     */
-    signerCertificateSerial: string;
     /**
      * The access certificate used to sign this schema metadata
      */
@@ -1745,7 +1904,7 @@ type SchemaMetadataResponseDto = {
     /**
      * Whether this version is deprecated
      */
-    deprecated?: boolean;
+    deprecated: boolean;
     /**
      * Deprecation message shown to consumers
      */
@@ -1754,6 +1913,10 @@ type SchemaMetadataResponseDto = {
      * The version that supersedes this one
      */
     supersededByVersion?: string;
+    /**
+     * Timestamp when this version was marked as deprecated
+     */
+    deprecatedAt?: string;
 };
 type UpdateSchemaMetadataDto = {
     /**
@@ -1843,11 +2006,7 @@ type TrustListCreateDto = {
     data?: {
         [key: string]: unknown;
     };
-    entities: Array<({
-        type: 'internal';
-    } & InternalTrustListEntity) | ({
-        type: 'external';
-    } & ExternalTrustListEntity)>;
+    entities: Array<InternalTrustListEntity | ExternalTrustListEntity>;
     id?: string;
     keyChainId?: string;
 };
@@ -1994,8 +2153,16 @@ type PresentationConfig = {
      * The registration certificate request containing the necessary details.
      */
     registration_cert?: RegistrationCertificateRequest;
+    /**
+     * Reference to the webhook endpoint used for notifications.
+     * Optional: if set, notifications will be sent to this endpoint.
+     */
+    webhookEndpointId?: string;
+    webhookEndpoint?: WebhookEndpointEntity;
     /**
      * Optional webhook URL to receive the response.
+     *
+     * @deprecated
      */
     webhook?: WebhookConfig;
     /**
@@ -2038,6 +2205,12 @@ type ResolveSchemaMetadataDto = {
      */
     schemaMetadataUrl: string;
 };
+type ResolveSchemaMetadataJwtDto = {
+    /**
+     * Signed schema metadata JWT to resolve server-side. The JWT will be verified, resolved, and converted to DCQL.
+     */
+    signedJwt: string;
+};
 type PresentationConfigCreateDto = {
     /**
      * Unique identifier for the VP request.
@@ -2060,8 +2233,16 @@ type PresentationConfigCreateDto = {
      * The registration certificate request containing the necessary details.
      */
     registration_cert?: RegistrationCertificateRequest;
+    /**
+     * Reference to the webhook endpoint used for notifications.
+     * Optional: if set, notifications will be sent to this endpoint.
+     */
+    webhookEndpointId?: string;
+    webhookEndpoint?: WebhookEndpointEntity;
     /**
      * Optional webhook URL to receive the response.
+     *
+     * @deprecated
      */
     webhook?: WebhookConfig;
     /**
@@ -2106,8 +2287,16 @@ type PresentationConfigUpdateDto = {
      * The registration certificate request containing the necessary details.
      */
     registration_cert?: RegistrationCertificateRequest;
+    /**
+     * Reference to the webhook endpoint used for notifications.
+     * Optional: if set, notifications will be sent to this endpoint.
+     */
+    webhookEndpointId?: string;
+    webhookEndpoint?: WebhookEndpointEntity;
     /**
      * Optional webhook URL to receive the response.
+     *
+     * @deprecated
      */
     webhook?: WebhookConfig;
     /**
@@ -2246,6 +2435,90 @@ type NotificationRequestDto = {
     notification_id: string;
     event: 'credential_accepted' | 'credential_failure' | 'credential_deleted';
 };
+type OfferResponse = {
+    uri: string;
+    /**
+     * URI for cross-device flows (no redirect after completion)
+     */
+    crossDeviceUri?: string;
+    session: string;
+};
+type CompleteDeferredDto = {
+    /**
+     * Claims to include in the credential. The structure should match the credential configuration's expected claims.
+     */
+    claims: {
+        [key: string]: unknown;
+    };
+};
+type DeferredOperationResponse = {
+    /**
+     * The transaction ID
+     */
+    transactionId: string;
+    /**
+     * The new status of the transaction
+     */
+    status: 'pending' | 'ready' | 'retrieved' | 'expired' | 'failed';
+    /**
+     * Optional message
+     */
+    message?: string;
+};
+type FailDeferredDto = {
+    /**
+     * Optional error message explaining why the issuance failed
+     */
+    error?: string;
+};
+type EcPublic = {
+    /**
+     * The key type, which is always 'EC' for Elliptic Curve keys.
+     */
+    kty: string;
+    /**
+     * The algorithm intended for use with the key, such as 'ES256'.
+     */
+    crv: string;
+    /**
+     * The x coordinate of the EC public key.
+     */
+    x: string;
+    /**
+     * The y coordinate of the EC public key.
+     */
+    y: string;
+};
+type JwksResponseDto = {
+    /**
+     * An array of EC public keys in JWK format.
+     */
+    keys: Array<EcPublic>;
+};
+type AuthorizationResponse = {
+    /**
+     * The response string containing the authorization details (JWE-encrypted VP token).
+     * Required for success responses, absent for error responses.
+     */
+    response?: string;
+    /**
+     * When set to true, the authorization response will be sent to the client.
+     */
+    sendResponse?: boolean;
+    error?: string;
+    /**
+     * Human-readable description of the error.
+     */
+    error_description?: string;
+    /**
+     * URI with additional information about the error.
+     */
+    error_uri?: string;
+    /**
+     * State value from the authorization request (for correlation).
+     */
+    state?: string;
+};
 type Object$1 = {
     [key: string]: unknown;
 };
@@ -2425,139 +2698,285 @@ type ChainedAsTokenResponseDto = {
      */
     refresh_token?: string;
 };
-type OfferResponse = {
-    uri: string;
+type KmsProviderCapabilitiesDto = {
     /**
-     * URI for cross-device flows (no redirect after completion)
+     * Whether the provider supports importing existing keys.
      */
-    crossDeviceUri?: string;
-    session: string;
+    canImport: boolean;
+    /**
+     * Whether the provider supports generating new keys.
+     */
+    canCreate: boolean;
+    /**
+     * Whether the provider supports deleting keys.
+     */
+    canDelete: boolean;
+    /**
+     * Signing algorithms supported by the provider.
+     */
+    supportedAlgs: Array<string>;
+    /**
+     * Default signing algorithm used when caller does not specify one.
+     */
+    defaultAlg: string;
 };
-type CompleteDeferredDto = {
+type KmsProviderInfoDto = {
     /**
-     * Claims to include in the credential. The structure should match the credential configuration's expected claims.
+     * Unique provider ID (matches the id in kms.json).
      */
-    claims: {
-        [key: string]: unknown;
-    };
+    name: string;
+    /**
+     * Type of the KMS provider (db, vault, aws-kms).
+     */
+    type: string;
+    /**
+     * Human-readable description of this provider instance.
+     */
+    description?: string;
+    /**
+     * Capabilities of this provider.
+     */
+    capabilities: KmsProviderCapabilitiesDto;
 };
-type DeferredOperationResponse = {
+type KmsProvidersResponseDto = {
     /**
-     * The transaction ID
+     * Detailed info for each registered KMS provider.
      */
-    transactionId: string;
+    providers: Array<KmsProviderInfoDto>;
     /**
-     * The new status of the transaction
+     * The default KMS provider name.
      */
-    status: 'pending' | 'ready' | 'retrieved' | 'expired' | 'failed';
+    default: string;
+};
+type DbKmsConfigDto = {
     /**
-     * Optional message
+     * Unique identifier for this provider instance. Used when generating keys to specify which provider to use.
      */
-    message?: string;
+    id: string;
+    /**
+     * Type of the KMS provider.
+     */
+    type: 'db';
+    /**
+     * Human-readable description of this provider instance.
+     */
+    description?: string;
 };
-type FailDeferredDto = {
+type VaultKmsConfigDto = {
     /**
-     * Optional error message explaining why the issuance failed
+     * Unique identifier for this provider instance. Used when generating keys to specify which provider to use.
      */
-    error?: string;
+    id: string;
+    /**
+     * Type of the KMS provider.
+     */
+    type: 'vault';
+    /**
+     * Human-readable description of this provider instance.
+     */
+    description?: string;
+    /**
+     * URL of the HashiCorp Vault instance. Supports ${ENV_VAR} placeholders.
+     */
+    vaultUrl: string;
+    /**
+     * Authentication token for HashiCorp Vault. Supports ${ENV_VAR} placeholders.
+     */
+    vaultToken: string;
 };
-type EcPublic = {
+type AwsKmsConfigDto = {
     /**
-     * The key type, which is always 'EC' for Elliptic Curve keys.
+     * Unique identifier for this provider instance. Used when generating keys to specify which provider to use.
      */
-    kty: string;
+    id: string;
     /**
-     * The algorithm intended for use with the key, such as 'ES256'.
+     * Type of the KMS provider.
      */
-    crv: string;
+    type: 'aws-kms';
     /**
-     * The x coordinate of the EC public key.
+     * Human-readable description of this provider instance.
      */
-    x: string;
+    description?: string;
     /**
-     * The y coordinate of the EC public key.
+     * AWS region for KMS. Supports ${ENV_VAR} placeholders.
      */
-    y: string;
+    region: string;
+    /**
+     * AWS access key ID. Optional — uses SDK credential chain if not provided. Supports ${ENV_VAR} placeholders.
+     */
+    accessKeyId?: string;
+    /**
+     * AWS secret access key. Optional — uses SDK credential chain if not provided. Supports ${ENV_VAR} placeholders.
+     */
+    secretAccessKey?: string;
 };
-type JwksResponseDto = {
+type Pkcs11KmsConfigDto = {
     /**
-     * An array of EC public keys in JWK format.
+     * Unique identifier for this provider instance. Used when generating keys to specify which provider to use.
      */
-    keys: Array<EcPublic>;
+    id: string;
+    /**
+     * Type of the KMS provider.
+     */
+    type: 'pkcs11';
+    /**
+     * Human-readable description of this provider instance.
+     */
+    description?: string;
+    /**
+     * Absolute path to the PKCS#11 module library (.so/.dll/.dylib). Supports ${ENV_VAR} placeholders.
+     */
+    library: string;
+    /**
+     * Slot selection. Either the numeric slot index (as a string for ENV interpolation, or a number) or the token label. Supports ${ENV_VAR} placeholders.
+     */
+    slot: {
+        [key: string]: unknown;
+    };
+    /**
+     * User PIN used for C_Login. Supports ${ENV_VAR} placeholders.
+     */
+    pin: string;
+    /**
+     * Open the PKCS#11 session in read-only mode. Defaults to false.
+     */
+    readOnly?: boolean;
 };
-type AuthorizationResponse = {
+type HttpAuthBaseConfigDto = {
     /**
-     * The response string containing the authorization details (JWE-encrypted VP token).
-     * Required for success responses, absent for error responses.
+     * Authentication method for the remote KMS service.
      */
-    response?: string;
+    type: 'none' | 'bearer' | 'oauth2-client-credentials' | 'mtls';
+};
+type HttpKmsConfigDto = {
     /**
-     * When set to true, the authorization response will be sent to the client.
+     * Unique identifier for this provider instance. Used when generating keys to specify which provider to use.
      */
-    sendResponse?: boolean;
-    error?: string;
+    id: string;
     /**
-     * Human-readable description of the error.
+     * Type of the KMS provider.
      */
-    error_description?: string;
+    type: 'http';
     /**
-     * URI with additional information about the error.
+     * Human-readable description of this provider instance.
      */
-    error_uri?: string;
+    description?: string;
     /**
-     * State value from the authorization request (for correlation).
+     * Base URL of the remote KMS microservice (no trailing slash). Supports ${ENV_VAR} placeholders.
      */
-    state?: string;
+    baseUrl: string;
+    /**
+     * Authentication method for the remote KMS service. Supports bearer token, OAuth 2.0 client credentials, and mutual TLS. Omit (or set type to "none") for unauthenticated services.
+     */
+    auth?: HttpAuthBaseConfigDto;
+    /**
+     * Path prefix for key endpoints on the remote service. Defaults to /keys.
+     */
+    keysPath?: string;
+    /**
+     * Path for the health check endpoint on the remote service. Defaults to /health.
+     */
+    healthPath?: string;
+    /**
+     * Whether the remote service supports key import via POST {keysPath}/{kid}/import. Defaults to false.
+     */
+    canImport?: boolean;
 };
-type KmsProviderCapabilitiesDto = {
+type CscAuthorizeAuthDataDto = {
     /**
-     * Whether the provider supports importing existing keys.
+     * Authentication factor identifier expected by the CSC provider (e.g., PIN, OTP).
      */
-    canImport: boolean;
+    id: string;
     /**
-     * Whether the provider supports generating new keys.
+     * Authentication factor value sent to CSC credentials/authorize.
      */
-    canCreate: boolean;
+    value: string;
+};
+type CscKmsConfigDto = {
     /**
-     * Whether the provider supports deleting keys.
+     * Unique identifier for this provider instance. Used when generating keys to specify which provider to use.
      */
-    canDelete: boolean;
+    id: string;
+    /**
+     * Type of the KMS provider.
+     */
+    type: 'csc';
+    /**
+     * Human-readable description of this provider instance.
+     */
+    description?: string;
+    /**
+     * Base URL of the CSC service (without trailing slash). Supports ${ENV_VAR} placeholders.
+     */
+    baseUrl: string;
+    /**
+     * OAuth2 token endpoint URL for client-credentials flow. Supports ${ENV_VAR} placeholders.
+     */
+    tokenUrl: string;
+    /**
+     * OAuth2 client ID. Supports ${ENV_VAR} placeholders.
+     */
+    clientId: string;
+    /**
+     * OAuth2 client secret. Supports ${ENV_VAR} placeholders.
+     */
+    clientSecret: string;
+    /**
+     * OAuth2 scope to request during token acquisition.
+     */
+    scope?: string;
+    /**
+     * Default CSC credential ID. If omitted, the adapter calls credentials/list and picks the first entry.
+     */
+    credentialId?: string;
+    /**
+     * Optional CSC user ID used in credentials/list requests.
+     */
+    userId?: string;
+    /**
+     * CSC API path prefix appended to baseUrl. Defaults to /csc/v2.
+     */
+    apiPath?: string;
+    /**
+     * Hash algorithm OID for signatures/signHash and credentials/authorize. Defaults to SHA-256 OID.
+     */
+    hashAlgorithmOid?: string;
     /**
-     * Signing algorithms supported by the provider.
+     * Signature algorithm OID for signatures/signHash. Defaults to ecdsa-with-SHA256 OID.
      */
-    supportedAlgs: Array<string>;
+    signAlgorithmOid?: string;
     /**
-     * Default signing algorithm used when caller does not specify one.
+     * Static SAD token. If set, the adapter sends it directly in signatures/signHash requests.
      */
-    defaultAlg: string;
-};
-type KmsProviderInfoDto = {
+    sad?: string;
     /**
-     * Unique provider ID (matches the id in kms.json).
+     * When true and no static SAD is provided, the adapter calls credentials/authorize to obtain SAD before signatures/signHash.
      */
-    name: string;
+    useAuthorizeEndpoint?: boolean;
     /**
-     * Type of the KMS provider (db, vault, aws-kms).
+     * Optional authData array passed to credentials/authorize (e.g., PIN/OTP factors).
      */
-    type: string;
+    authorizeAuthData?: Array<CscAuthorizeAuthDataDto>;
+};
+type KmsConfigDto = {
     /**
-     * Human-readable description of this provider instance.
+     * ID of the default KMS provider. Defaults to "db" if not set.
      */
-    description?: string;
+    defaultProvider?: string;
     /**
-     * Capabilities of this provider.
+     * List of KMS provider configurations. Each provider must have a unique id and a type.
      */
-    capabilities: KmsProviderCapabilitiesDto;
+    providers: Array<DbKmsConfigDto | VaultKmsConfigDto | AwsKmsConfigDto | Pkcs11KmsConfigDto | HttpKmsConfigDto | CscKmsConfigDto>;
 };
-type KmsProvidersResponseDto = {
+type KmsTenantConfigResponseDto = {
     /**
-     * Detailed info for each registered KMS provider.
+     * Tenant-specific KMS configuration from <CONFIG_FOLDER>/<tenantId>/kms.json. Null when no tenant file exists.
      */
-    providers: Array<KmsProviderInfoDto>;
+    tenantConfig?: KmsConfigDto;
     /**
-     * The default KMS provider name.
+     * Effective configuration used at runtime for the tenant (global + tenant merge).
      */
-    default: string;
+    effectiveConfig: KmsConfigDto;
 };
 type CertificateInfoDto = {
     /**
@@ -2830,7 +3249,7 @@ type KeyChainImportDto = {
      */
     usageType: 'access' | 'attestation' | 'trustList' | 'statusList' | 'encrypt';
     /**
-     * Certificate chain in PEM format (leaf first, then intermediates/CA).
+     * Certificate chain (leaf first). Each entry may be PEM or base64-encoded DER; values are normalized to PEM during import.
      */
     crt?: Array<string>;
     /**
@@ -2874,7 +3293,7 @@ type PresentationRequest = {
     /**
      * The type of response expected from the presentation request.
      */
-    response_type: 'uri' | 'dc-api';
+    response_type: 'uri' | 'dc-api' | 'iso-18013-7';
     /**
      * Identifier of the presentation configuration
      */
@@ -2903,6 +3322,126 @@ type PresentationRequest = {
 type FileUploadDto = {
     file: Blob | File;
 };
+type IssuanceConfigWritable = {
+    /**
+     * Key ID for signing access tokens. If unset, the default signing key is used.
+     */
+    signingKeyId?: string;
+    /**
+     * Dedicated managed authorization servers hosted by this issuer. At least one entry is required.
+     */
+    authorizationServers: Array<ExternalAuthorizationServerConfig | Oid4VpAuthorizationServerConfig | ChainedAuthorizationServerConfig | BuiltInAuthorizationServerConfig>;
+    /**
+     * Optional OpenID Federation configuration used for trust evaluation.
+     * When omitted, trust checks rely on existing LoTE trust-list behavior.
+     */
+    federation?: FederationConfig;
+    /**
+     * Optional registration certificate configuration for issuer metadata (`issuer_info`).
+     * Supports importing an existing JWT or generating one via registrar.
+     */
+    registrationCertificate?: IssuerRegistrationCertificateConfig;
+    /**
+     * Whether `credential_response_encryption` should be advertised in the credential issuer metadata.
+     */
+    credentialResponseEncryption?: boolean;
+    /**
+     * Whether `credential_request_encryption` should be advertised in the credential issuer metadata.
+     */
+    credentialRequestEncryption?: boolean;
+    /**
+     * Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5.
+     */
+    txCodeMaxAttempts?: number;
+    /**
+     * The tenant that owns this object.
+     */
+    tenant: TenantEntity;
+    /**
+     * Value to determine the amount of credentials that are issued in a batch.
+     * Default is 1.
+     */
+    batchSize?: number;
+    /**
+     * Indicates whether DPoP is required for the issuance process. Default value is true.
+     */
+    dPopRequired?: boolean;
+    /**
+     * Indicates whether wallet attestation is required for the token endpoint.
+     * When enabled, wallets must provide OAuth-Client-Attestation headers.
+     * Default value is false.
+     */
+    walletAttestationRequired?: boolean;
+    /**
+     * URLs of trust lists containing trusted wallet providers.
+     * The wallet attestation's X.509 certificate will be validated against these trust lists.
+     * If empty and walletAttestationRequired is true, all wallet providers are rejected.
+     */
+    walletProviderTrustLists?: Array<string>;
+    display: Array<DisplayInfo>;
+    /**
+     * The timestamp when the VP request was created.
+     */
+    createdAt: string;
+    /**
+     * The timestamp when the VP request was last updated.
+     */
+    updatedAt: string;
+};
+type UpdateIssuanceDtoWritable = {
+    /**
+     * Key ID for signing access tokens. If unset, the default signing key is used.
+     */
+    signingKeyId?: string;
+    /**
+     * Dedicated managed authorization servers hosted by this issuer. At least one entry is required.
+     */
+    authorizationServers?: Array<ExternalAuthorizationServerConfig | Oid4VpAuthorizationServerConfig | ChainedAuthorizationServerConfig | BuiltInAuthorizationServerConfig>;
+    /**
+     * Optional OpenID Federation configuration used for trust evaluation.
+     * When omitted, trust checks rely on existing LoTE trust-list behavior.
+     */
+    federation?: FederationConfig;
+    /**
+     * Optional registration certificate configuration for issuer metadata (`issuer_info`).
+     * Supports importing an existing JWT or generating one via registrar.
+     */
+    registrationCertificate?: IssuerRegistrationCertificateConfig;
+    /**
+     * Whether `credential_response_encryption` should be advertised in the credential issuer metadata.
+     */
+    credentialResponseEncryption?: boolean;
+    /**
+     * Whether `credential_request_encryption` should be advertised in the credential issuer metadata.
+     */
+    credentialRequestEncryption?: boolean;
+    /**
+     * Maximum failed tx_code attempts before the pre-authorized code is invalidated. Defaults to 5.
+     */
+    txCodeMaxAttempts?: number;
+    /**
+     * Value to determine the amount of credentials that are issued in a batch.
+     * Default is 1.
+     */
+    batchSize?: number;
+    /**
+     * Indicates whether DPoP is required for the issuance process. Default value is true.
+     */
+    dPopRequired?: boolean;
+    /**
+     * Indicates whether wallet attestation is required for the token endpoint.
+     * When enabled, wallets must provide OAuth-Client-Attestation headers.
+     * Default value is false.
+     */
+    walletAttestationRequired?: boolean;
+    /**
+     * URLs of trust lists containing trusted wallet providers.
+     * The wallet attestation's X.509 certificate will be validated against these trust lists.
+     * If empty and walletAttestationRequired is true, all wallet providers are rejected.
+     */
+    walletProviderTrustLists?: Array<string>;
+    display?: Array<DisplayInfo>;
+};
 type PresentationConfigWritable = {
     /**
      * Unique identifier for the VP request.
@@ -2929,8 +3468,16 @@ type PresentationConfigWritable = {
      * The registration certificate request containing the necessary details.
      */
     registration_cert?: RegistrationCertificateRequest;
+    /**
+     * Reference to the webhook endpoint used for notifications.
+     * Optional: if set, notifications will be sent to this endpoint.
+     */
+    webhookEndpointId?: string;
+    webhookEndpoint?: WebhookEndpointEntity;
     /**
      * Optional webhook URL to receive the response.
+     *
+     * @deprecated
      */
     webhook?: WebhookConfig;
     /**
@@ -3488,7 +4035,7 @@ type IssuanceConfigControllerGetIssuanceConfigurationsResponses = {
 };
 type IssuanceConfigControllerGetIssuanceConfigurationsResponse = IssuanceConfigControllerGetIssuanceConfigurationsResponses[keyof IssuanceConfigControllerGetIssuanceConfigurationsResponses];
 type IssuanceConfigControllerStoreIssuanceConfigurationData = {
-    body: IssuanceDto;
+    body: UpdateIssuanceDtoWritable;
     path?: never;
     query?: never;
     url: '/api/issuer/config';
@@ -3561,36 +4108,60 @@ type CredentialConfigControllerUpdateCredentialConfigurationResponses = {
     };
 };
 type CredentialConfigControllerUpdateCredentialConfigurationResponse = CredentialConfigControllerUpdateCredentialConfigurationResponses[keyof CredentialConfigControllerUpdateCredentialConfigurationResponses];
-type SchemaMetadataControllerSignSchemaMetaConfigData = {
+type SchemaMetadataControllerPublishSchemaMetadataData = {
     body: SignSchemaMetaConfigDto;
     path?: never;
     query?: never;
-    url: '/api/schema-metadata/sign';
+    url: '/api/schema-metadata/publish';
 };
-type SchemaMetadataControllerSignSchemaMetaConfigErrors = {
+type SchemaMetadataControllerPublishSchemaMetadataErrors = {
     /**
-     * Invalid schema metadata or missing certificate for signing
+     * Invalid schema metadata input or file mapping
      */
     400: unknown;
 };
+type SchemaMetadataControllerPublishSchemaMetadataResponses = {
+    /**
+     * Registrar metadata entry for the freshly submitted schema metadata.
+     */
+    201: unknown;
+};
+type SchemaMetadataControllerSignSchemaMetaConfigData = {
+    body: SignSchemaMetaConfigDto;
+    path?: never;
+    query?: never;
+    url: '/api/schema-metadata/sign';
+};
 type SchemaMetadataControllerSignSchemaMetaConfigResponses = {
     /**
      * Registrar metadata entry for the freshly submitted schema metadata.
      */
     201: unknown;
 };
-type SchemaMetadataControllerSignVersionSchemaMetaConfigData = {
+type SchemaMetadataControllerPublishSchemaMetadataVersionData = {
     body: SignVersionSchemaMetaConfigDto;
     path?: never;
     query?: never;
-    url: '/api/schema-metadata/sign-version';
+    url: '/api/schema-metadata/publish-version';
 };
-type SchemaMetadataControllerSignVersionSchemaMetaConfigErrors = {
+type SchemaMetadataControllerPublishSchemaMetadataVersionErrors = {
     /**
      * config.id is required; or invalid schema metadata
      */
     400: unknown;
 };
+type SchemaMetadataControllerPublishSchemaMetadataVersionResponses = {
+    /**
+     * Registrar metadata entry for the newly submitted version.
+     */
+    201: unknown;
+};
+type SchemaMetadataControllerSignVersionSchemaMetaConfigData = {
+    body: SignVersionSchemaMetaConfigDto;
+    path?: never;
+    query?: never;
+    url: '/api/schema-metadata/sign-version';
+};
 type SchemaMetadataControllerSignVersionSchemaMetaConfigResponses = {
     /**
      * Registrar metadata entry for the newly submitted version.
@@ -3710,24 +4281,6 @@ type SchemaMetadataControllerGetJwtResponses = {
     200: string;
 };
 type SchemaMetadataControllerGetJwtResponse = SchemaMetadataControllerGetJwtResponses[keyof SchemaMetadataControllerGetJwtResponses];
-type SchemaMetadataControllerExportData = {
-    body?: never;
-    path: {
-        id: string;
-        version: string;
-    };
-    query?: never;
-    url: '/api/schema-metadata/{id}/versions/{version}/export';
-};
-type SchemaMetadataControllerExportResponses = {
-    /**
-     * Registrar-defined catalog document
-     */
-    200: {
-        [key: string]: unknown;
-    };
-};
-type SchemaMetadataControllerExportResponse = SchemaMetadataControllerExportResponses[keyof SchemaMetadataControllerExportResponses];
 type SchemaMetadataControllerGetSchemaData = {
     body?: never;
     path: {
@@ -4128,6 +4681,24 @@ type PresentationManagementControllerResolveSchemaMetadataResponses = {
      */
     200: unknown;
 };
+type PresentationManagementControllerResolveSchemaMetadataJwtData = {
+    body: ResolveSchemaMetadataJwtDto;
+    path?: never;
+    query?: never;
+    url: '/api/verifier/config/schema-metadata/resolve-jwt';
+};
+type PresentationManagementControllerResolveSchemaMetadataJwtErrors = {
+    /**
+     * Invalid JWT or invalid schema metadata
+     */
+    400: unknown;
+};
+type PresentationManagementControllerResolveSchemaMetadataJwtResponses = {
+    /**
+     * Resolved schema metadata import payload
+     */
+    200: unknown;
+};
 type PresentationManagementControllerListSchemaMetadataCatalogData = {
     body?: never;
     path?: never;
@@ -4364,6 +4935,108 @@ type DeferredControllerFailDeferredResponses = {
     200: DeferredOperationResponse;
 };
 type DeferredControllerFailDeferredResponse = DeferredControllerFailDeferredResponses[keyof DeferredControllerFailDeferredResponses];
+type ChainedAsVpControllerParData = {
+    body?: never;
+    headers?: {
+        /**
+         * DPoP proof JWT
+         */
+        DPoP?: string;
+        /**
+         * Wallet attestation JWT
+         */
+        'OAuth-Client-Attestation'?: string;
+        /**
+         * Wallet attestation proof-of-possession JWT
+         */
+        'OAuth-Client-Attestation-PoP'?: string;
+    };
+    path: {
+        /**
+         * Tenant identifier
+         */
+        tenantId: string;
+    };
+    query?: never;
+    url: '/api/issuers/{tenantId}/chained-as-vp/par';
+};
+type ChainedAsVpControllerParErrors = {
+    400: ChainedAsErrorResponseDto;
+};
+type ChainedAsVpControllerParError = ChainedAsVpControllerParErrors[keyof ChainedAsVpControllerParErrors];
+type ChainedAsVpControllerParResponses = {
+    201: ChainedAsParResponseDto;
+};
+type ChainedAsVpControllerParResponse = ChainedAsVpControllerParResponses[keyof ChainedAsVpControllerParResponses];
+type ChainedAsVpControllerAuthorizeData = {
+    body?: never;
+    path: {
+        /**
+         * Tenant identifier
+         */
+        tenantId: string;
+    };
+    query: {
+        /**
+         * Client identifier
+         */
+        client_id: string;
+        /**
+         * Request URI from PAR response
+         */
+        request_uri: string;
+    };
+    url: '/api/issuers/{tenantId}/chained-as-vp/authorize';
+};
+type ChainedAsVpControllerAuthorizeErrors = {
+    400: ChainedAsErrorResponseDto;
+};
+type ChainedAsVpControllerAuthorizeError = ChainedAsVpControllerAuthorizeErrors[keyof ChainedAsVpControllerAuthorizeErrors];
+type ChainedAsVpControllerVpCallbackData = {
+    body?: never;
+    path: {
+        /**
+         * Tenant identifier
+         */
+        tenantId: string;
+    };
+    query: {
+        cas: string;
+        response_code?: string;
+        error?: string;
+        error_description?: string;
+    };
+    url: '/api/issuers/{tenantId}/chained-as-vp/vp-callback';
+};
+type ChainedAsVpControllerVpCallbackErrors = {
+    400: ChainedAsErrorResponseDto;
+};
+type ChainedAsVpControllerVpCallbackError = ChainedAsVpControllerVpCallbackErrors[keyof ChainedAsVpControllerVpCallbackErrors];
+type ChainedAsVpControllerTokenData = {
+    body: ChainedAsTokenRequestDto;
+    headers?: {
+        /**
+         * DPoP proof JWT
+         */
+        DPoP?: string;
+    };
+    path: {
+        /**
+         * Tenant identifier
+         */
+        tenantId: string;
+    };
+    query?: never;
+    url: '/api/issuers/{tenantId}/chained-as-vp/token';
+};
+type ChainedAsVpControllerTokenErrors = {
+    400: ChainedAsErrorResponseDto;
+};
+type ChainedAsVpControllerTokenError = ChainedAsVpControllerTokenErrors[keyof ChainedAsVpControllerTokenErrors];
+type ChainedAsVpControllerTokenResponses = {
+    200: ChainedAsTokenResponseDto;
+};
+type ChainedAsVpControllerTokenResponse = ChainedAsVpControllerTokenResponses[keyof ChainedAsVpControllerTokenResponses];
 type KeyChainControllerGetProvidersData = {
     body?: never;
     path?: never;
@@ -4389,6 +5062,44 @@ type KeyChainControllerGetProvidersHealthResponses = {
      */
     200: unknown;
 };
+type KeyChainControllerDeleteTenantKmsConfigData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/key-chain/providers/config';
+};
+type KeyChainControllerDeleteTenantKmsConfigResponses = {
+    /**
+     * Tenant-specific KMS config removed.
+     */
+    200: unknown;
+};
+type KeyChainControllerGetTenantKmsConfigData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/key-chain/providers/config';
+};
+type KeyChainControllerGetTenantKmsConfigResponses = {
+    /**
+     * Tenant and effective KMS configuration.
+     */
+    200: KmsTenantConfigResponseDto;
+};
+type KeyChainControllerGetTenantKmsConfigResponse = KeyChainControllerGetTenantKmsConfigResponses[keyof KeyChainControllerGetTenantKmsConfigResponses];
+type KeyChainControllerUpdateTenantKmsConfigData = {
+    body: KmsConfigDto;
+    path?: never;
+    query?: never;
+    url: '/api/key-chain/providers/config';
+};
+type KeyChainControllerUpdateTenantKmsConfigResponses = {
+    /**
+     * Updated tenant KMS config.
+     */
+    200: KmsTenantConfigResponseDto;
+};
+type KeyChainControllerUpdateTenantKmsConfigResponse = KeyChainControllerUpdateTenantKmsConfigResponses[keyof KeyChainControllerUpdateTenantKmsConfigResponses];
 type KeyChainControllerGetAllData = {
     body?: never;
     path?: never;
@@ -4559,4 +5270,4 @@ type StorageControllerUploadResponses = {
 };
 type StorageControllerUploadResponse = StorageControllerUploadResponses[keyof StorageControllerUploadResponses];
 
-export type { ChainedAsParResponseDto as $, AccessCertificateRefDto as A, AuthControllerGetOAuth2TokenData as B, ClientOptions as C, AuthControllerGetOAuth2TokenErrors as D, AuthControllerGetOAuth2TokenResponse as E, AuthControllerGetOAuth2TokenResponses as F, AuthenticationMethodAuth as G, AuthenticationMethodNone as H, AuthenticationMethodPresentation as I, AuthenticationUrlConfig as J, AuthorizationResponse as K, AuthorizeQueries as L, CacheControllerClearAllCachesData as M, CacheControllerClearAllCachesResponse as N, CacheControllerClearAllCachesResponses as O, CacheControllerClearStatusListCacheData as P, CacheControllerClearStatusListCacheResponse as Q, CacheControllerClearStatusListCacheResponses as R, Session as S, CacheControllerClearTrustListCacheData as T, CacheControllerClearTrustListCacheResponse as U, CacheControllerClearTrustListCacheResponses as V, CacheControllerGetStatsData as W, CacheControllerGetStatsResponses as X, CertificateInfoDto as Y, ChainedAsConfig as Z, ChainedAsErrorResponseDto as _, AllowListPolicy as a, DeferredControllerCompleteDeferredResponse as a$, ChainedAsTokenConfig as a0, ChainedAsTokenRequestDto as a1, ChainedAsTokenResponseDto as a2, ClaimFieldDefinitionDto as a3, ClaimsQuery as a4, ClientControllerCreateClientData as a5, ClientControllerCreateClientResponse as a6, ClientControllerCreateClientResponses as a7, ClientControllerDeleteClientData as a8, ClientControllerDeleteClientResponses as a9, CreateWebhookEndpointDto as aA, CredentialConfig as aB, CredentialConfigControllerDeleteIssuanceConfigurationData as aC, CredentialConfigControllerDeleteIssuanceConfigurationResponse as aD, CredentialConfigControllerDeleteIssuanceConfigurationResponses as aE, CredentialConfigControllerGetConfigByIdData as aF, CredentialConfigControllerGetConfigByIdResponse as aG, CredentialConfigControllerGetConfigByIdResponses as aH, CredentialConfigControllerGetConfigsData as aI, CredentialConfigControllerGetConfigsResponse as aJ, CredentialConfigControllerGetConfigsResponses as aK, CredentialConfigControllerStoreCredentialConfigurationData as aL, CredentialConfigControllerStoreCredentialConfigurationResponse as aM, CredentialConfigControllerStoreCredentialConfigurationResponses as aN, CredentialConfigControllerUpdateCredentialConfigurationData as aO, CredentialConfigControllerUpdateCredentialConfigurationResponse as aP, CredentialConfigControllerUpdateCredentialConfigurationResponses as aQ, CredentialConfigCreate as aR, CredentialConfigUpdate as aS, CredentialOfferControllerGetOfferData as aT, CredentialOfferControllerGetOfferResponse as aU, CredentialOfferControllerGetOfferResponses as aV, CredentialQuery as aW, CredentialSetQuery as aX, Dcql as aY, DeferredControllerCompleteDeferredData as aZ, DeferredControllerCompleteDeferredErrors as a_, ClientControllerGetClientData as aa, ClientControllerGetClientResponse as ab, ClientControllerGetClientResponses as ac, ClientControllerGetClientSecretData as ad, ClientControllerGetClientSecretResponse as ae, ClientControllerGetClientSecretResponses as af, ClientControllerGetClientsData as ag, ClientControllerGetClientsResponse as ah, ClientControllerGetClientsResponses as ai, ClientControllerRotateClientSecretData as aj, ClientControllerRotateClientSecretResponse as ak, ClientControllerRotateClientSecretResponses as al, ClientControllerUpdateClientData as am, ClientControllerUpdateClientResponse as an, ClientControllerUpdateClientResponses as ao, ClientCredentialsDto as ap, ClientEntity as aq, ClientSecretResponseDto as ar, CompleteDeferredDto as as, CreateAccessCertificateDto as at, CreateAttributeProviderDto as au, CreateClientDto as av, CreateRegistrarConfigDto as aw, CreateStatusListDto as ax, CreateTenantDto as ay, CreateUserDto as az, ApiKeyConfig as b, KeyChainControllerGetProvidersResponses as b$, DeferredControllerCompleteDeferredResponses as b0, DeferredControllerFailDeferredData as b1, DeferredControllerFailDeferredErrors as b2, DeferredControllerFailDeferredResponse as b3, DeferredControllerFailDeferredResponses as b4, DeferredCredentialRequestDto as b5, DeferredOperationResponse as b6, DeprecateSchemaMetadataDto as b7, Display as b8, DisplayImage as b9, IssuanceConfigControllerStoreIssuanceConfigurationData as bA, IssuanceConfigControllerStoreIssuanceConfigurationResponse as bB, IssuanceConfigControllerStoreIssuanceConfigurationResponses as bC, IssuanceDto as bD, IssuerMetadataCredentialConfig as bE, JwksResponseDto as bF, KeyAttestationsRequired as bG, KeyChainControllerCreateData as bH, KeyChainControllerCreateResponses as bI, KeyChainControllerDeleteData as bJ, KeyChainControllerDeleteErrors as bK, KeyChainControllerDeleteResponses as bL, KeyChainControllerExportData as bM, KeyChainControllerExportErrors as bN, KeyChainControllerExportResponse as bO, KeyChainControllerExportResponses as bP, KeyChainControllerGetAllData as bQ, KeyChainControllerGetAllResponse as bR, KeyChainControllerGetAllResponses as bS, KeyChainControllerGetByIdData as bT, KeyChainControllerGetByIdErrors as bU, KeyChainControllerGetByIdResponse as bV, KeyChainControllerGetByIdResponses as bW, KeyChainControllerGetProvidersData as bX, KeyChainControllerGetProvidersHealthData as bY, KeyChainControllerGetProvidersHealthResponses as bZ, KeyChainControllerGetProvidersResponse as b_, DisplayInfo as ba, DisplayLogo as bb, EcJwk as bc, EcPublic as bd, EmbeddedDisclosurePolicy as be, ExportEcJwk as bf, ExportRotationPolicyDto as bg, ExternalTrustListEntity as bh, FailDeferredDto as bi, FederationConfig as bj, FederationTrustAnchorConfig as bk, FieldDisplayDto as bl, FileUploadDto as bm, FrontendConfigResponseDto as bn, GrafanaConfigDto as bo, IaeActionOpenid4VpPresentation as bp, IaeActionRedirectToWeb as bq, ImportTenantDto as br, InteractiveAuthorizationCodeResponseDto as bs, InteractiveAuthorizationErrorResponseDto as bt, InteractiveAuthorizationRequestDto as bu, InternalTrustListEntity as bv, IssuanceConfig as bw, IssuanceConfigControllerGetIssuanceConfigurationsData as bx, IssuanceConfigControllerGetIssuanceConfigurationsResponse as by, IssuanceConfigControllerGetIssuanceConfigurationsResponses as bz, AppControllerGetFrontendConfigData as c, RegistrarControllerCreateAccessCertificateErrors as c$, KeyChainControllerImportData as c0, KeyChainControllerImportResponses as c1, KeyChainControllerRotateData as c2, KeyChainControllerRotateErrors as c3, KeyChainControllerRotateResponses as c4, KeyChainControllerUpdateData as c5, KeyChainControllerUpdateErrors as c6, KeyChainControllerUpdateResponses as c7, KeyChainCreateDto as c8, KeyChainEntity as c9, PresentationManagementControllerConfigurationResponses as cA, PresentationManagementControllerDeleteConfigurationData as cB, PresentationManagementControllerDeleteConfigurationResponses as cC, PresentationManagementControllerGetConfigurationData as cD, PresentationManagementControllerGetConfigurationResponse as cE, PresentationManagementControllerGetConfigurationResponses as cF, PresentationManagementControllerListSchemaMetadataCatalogData as cG, PresentationManagementControllerListSchemaMetadataCatalogResponses as cH, PresentationManagementControllerReissueRegistrationCertificateData as cI, PresentationManagementControllerReissueRegistrationCertificateErrors as cJ, PresentationManagementControllerReissueRegistrationCertificateResponses as cK, PresentationManagementControllerResolveIssuerMetadataData as cL, PresentationManagementControllerResolveIssuerMetadataErrors as cM, PresentationManagementControllerResolveIssuerMetadataResponses as cN, PresentationManagementControllerResolveSchemaMetadataData as cO, PresentationManagementControllerResolveSchemaMetadataErrors as cP, PresentationManagementControllerResolveSchemaMetadataResponses as cQ, PresentationManagementControllerStorePresentationConfigData as cR, PresentationManagementControllerStorePresentationConfigResponse as cS, PresentationManagementControllerStorePresentationConfigResponses as cT, PresentationManagementControllerUpdateConfigurationData as cU, PresentationManagementControllerUpdateConfigurationResponse as cV, PresentationManagementControllerUpdateConfigurationResponses as cW, PresentationRequest as cX, PublicKeyInfoDto as cY, RegistrarConfigResponseDto as cZ, RegistrarControllerCreateAccessCertificateData as c_, KeyChainExportDto as ca, KeyChainImportDto as cb, KeyChainResponseDto as cc, KeyChainUpdateDto as cd, KmsProviderCapabilitiesDto as ce, KmsProviderInfoDto as cf, KmsProvidersResponseDto as cg, ManagedUserDto as ch, MetadataSchemaDto as ci, NoneTrustPolicy as cj, NotificationRequestDto as ck, Object$1 as cl, ObjectWritable as cm, OfferRequestDto as cn, OfferResponse as co, PaginatedSessionResponseDto as cp, ParResponseDto as cq, PolicyCredential as cr, PresentationAttachment as cs, PresentationConfig as ct, PresentationConfigCreateDto as cu, PresentationConfigUpdateDto as cv, PresentationConfigWritable as cw, PresentationDuringIssuanceConfig as cx, PresentationManagementControllerConfigurationData as cy, PresentationManagementControllerConfigurationResponse as cz, AppControllerGetFrontendConfigResponse as d, SchemaMetadataControllerSignSchemaMetaConfigData as d$, RegistrarControllerCreateAccessCertificateResponse as d0, RegistrarControllerCreateAccessCertificateResponses as d1, RegistrarControllerCreateConfigData as d2, RegistrarControllerCreateConfigErrors as d3, RegistrarControllerCreateConfigResponse as d4, RegistrarControllerCreateConfigResponses as d5, RegistrarControllerDeleteConfigData as d6, RegistrarControllerDeleteConfigResponse as d7, RegistrarControllerDeleteConfigResponses as d8, RegistrarControllerGetConfigData as d9, SchemaMetadataControllerExportResponses as dA, SchemaMetadataControllerFindAllData as dB, SchemaMetadataControllerFindAllResponse as dC, SchemaMetadataControllerFindAllResponses as dD, SchemaMetadataControllerFindOneData as dE, SchemaMetadataControllerFindOneResponse as dF, SchemaMetadataControllerFindOneResponses as dG, SchemaMetadataControllerGetJwtData as dH, SchemaMetadataControllerGetJwtResponse as dI, SchemaMetadataControllerGetJwtResponses as dJ, SchemaMetadataControllerGetLatestData as dK, SchemaMetadataControllerGetLatestResponse as dL, SchemaMetadataControllerGetLatestResponses as dM, SchemaMetadataControllerGetMineData as dN, SchemaMetadataControllerGetMineResponse as dO, SchemaMetadataControllerGetMineResponses as dP, SchemaMetadataControllerGetSchemaData as dQ, SchemaMetadataControllerGetSchemaResponse as dR, SchemaMetadataControllerGetSchemaResponses as dS, SchemaMetadataControllerGetVersionsData as dT, SchemaMetadataControllerGetVersionsResponse as dU, SchemaMetadataControllerGetVersionsResponses as dV, SchemaMetadataControllerGetVocabulariesData as dW, SchemaMetadataControllerGetVocabulariesResponse as dX, SchemaMetadataControllerGetVocabulariesResponses as dY, SchemaMetadataControllerRemoveData as dZ, SchemaMetadataControllerRemoveResponses as d_, RegistrarControllerGetConfigErrors as da, RegistrarControllerGetConfigResponse as db, RegistrarControllerGetConfigResponses as dc, RegistrarControllerUpdateConfigData as dd, RegistrarControllerUpdateConfigErrors as de, RegistrarControllerUpdateConfigResponse as df, RegistrarControllerUpdateConfigResponses as dg, RegistrationCertificateBody as dh, RegistrationCertificateDefaults as di, RegistrationCertificatePurpose as dj, RegistrationCertificateRequest as dk, ResolveIssuerMetadataDto as dl, ResolveSchemaMetadataDto as dm, RoleDto as dn, RootOfTrustPolicy as dp, RotationPolicyCreateDto as dq, RotationPolicyImportDto as dr, RotationPolicyResponseDto as ds, RotationPolicyUpdateDto as dt, SchemaMetaConfig as du, SchemaMetadataControllerDeprecateVersionData as dv, SchemaMetadataControllerDeprecateVersionResponse as dw, SchemaMetadataControllerDeprecateVersionResponses as dx, SchemaMetadataControllerExportData as dy, SchemaMetadataControllerExportResponse as dz, AppControllerGetFrontendConfigResponses as e, StatusListManagementControllerUpdateListResponse as e$, SchemaMetadataControllerSignSchemaMetaConfigErrors as e0, SchemaMetadataControllerSignSchemaMetaConfigResponses as e1, SchemaMetadataControllerSignVersionSchemaMetaConfigData as e2, SchemaMetadataControllerSignVersionSchemaMetaConfigErrors as e3, SchemaMetadataControllerSignVersionSchemaMetaConfigResponses as e4, SchemaMetadataControllerUpdateData as e5, SchemaMetadataControllerUpdateResponse as e6, SchemaMetadataControllerUpdateResponses as e7, SchemaMetadataResponseDto as e8, SchemaMetadataVocabulariesDto as e9, SignSchemaMetaConfigDto as eA, SignVersionSchemaMetaConfigDto as eB, StatusListAggregationDto as eC, StatusListConfig as eD, StatusListConfigControllerGetConfigData as eE, StatusListConfigControllerGetConfigResponse as eF, StatusListConfigControllerGetConfigResponses as eG, StatusListConfigControllerResetConfigData as eH, StatusListConfigControllerResetConfigResponse as eI, StatusListConfigControllerResetConfigResponses as eJ, StatusListConfigControllerUpdateConfigData as eK, StatusListConfigControllerUpdateConfigResponse as eL, StatusListConfigControllerUpdateConfigResponses as eM, StatusListImportDto as eN, StatusListManagementControllerCreateListData as eO, StatusListManagementControllerCreateListResponse as eP, StatusListManagementControllerCreateListResponses as eQ, StatusListManagementControllerDeleteListData as eR, StatusListManagementControllerDeleteListResponse as eS, StatusListManagementControllerDeleteListResponses as eT, StatusListManagementControllerGetListData as eU, StatusListManagementControllerGetListResponse as eV, StatusListManagementControllerGetListResponses as eW, StatusListManagementControllerGetListsData as eX, StatusListManagementControllerGetListsResponse as eY, StatusListManagementControllerGetListsResponses as eZ, StatusListManagementControllerUpdateListData as e_, SchemaUriEntry as ea, SessionConfigControllerGetConfigData as eb, SessionConfigControllerGetConfigResponse as ec, SessionConfigControllerGetConfigResponses as ed, SessionConfigControllerResetConfigData as ee, SessionConfigControllerResetConfigResponses as ef, SessionConfigControllerUpdateConfigData as eg, SessionConfigControllerUpdateConfigResponse as eh, SessionConfigControllerUpdateConfigResponses as ei, SessionControllerDeleteSessionData as ej, SessionControllerDeleteSessionResponses as ek, SessionControllerGetAllSessionsData as el, SessionControllerGetAllSessionsResponse as em, SessionControllerGetAllSessionsResponses as en, SessionControllerGetSessionData as eo, SessionControllerGetSessionLogsData as ep, SessionControllerGetSessionLogsResponse as eq, SessionControllerGetSessionLogsResponses as er, SessionControllerGetSessionResponse as es, SessionControllerGetSessionResponses as et, SessionControllerRevokeAllData as eu, SessionControllerRevokeAllResponses as ev, SessionEventsControllerSubscribeToSessionEventsData as ew, SessionEventsControllerSubscribeToSessionEventsResponses as ex, SessionLogEntryResponseDto as ey, SessionStorageConfig as ez, AppControllerGetVersionData as f, UpstreamOidcConfig as f$, StatusListManagementControllerUpdateListResponses as f0, StatusListResponseDto as f1, StatusUpdateDto as f2, StorageControllerUploadData as f3, StorageControllerUploadResponse as f4, StorageControllerUploadResponses as f5, TenantControllerDeleteTenantData as f6, TenantControllerDeleteTenantResponses as f7, TenantControllerGetTenantData as f8, TenantControllerGetTenantResponse as f9, TrustListControllerGetAllTrustListsResponses as fA, TrustListControllerGetTrustListData as fB, TrustListControllerGetTrustListResponse as fC, TrustListControllerGetTrustListResponses as fD, TrustListControllerGetTrustListVersionData as fE, TrustListControllerGetTrustListVersionResponse as fF, TrustListControllerGetTrustListVersionResponses as fG, TrustListControllerGetTrustListVersionsData as fH, TrustListControllerGetTrustListVersionsResponse as fI, TrustListControllerGetTrustListVersionsResponses as fJ, TrustListControllerUpdateTrustListData as fK, TrustListControllerUpdateTrustListResponse as fL, TrustListControllerUpdateTrustListResponses as fM, TrustListCreateDto as fN, TrustListEntityInfo as fO, TrustListVersion as fP, TrustedAuthorityQuery as fQ, UpdateAttributeProviderDto as fR, UpdateClientDto as fS, UpdateRegistrarConfigDto as fT, UpdateSchemaMetadataDto as fU, UpdateSessionConfigDto as fV, UpdateStatusListConfigDto as fW, UpdateStatusListDto as fX, UpdateTenantDto as fY, UpdateUserDto as fZ, UpdateWebhookEndpointDto as f_, TenantControllerGetTenantResponses as fa, TenantControllerGetTenantsData as fb, TenantControllerGetTenantsResponse as fc, TenantControllerGetTenantsResponses as fd, TenantControllerInitTenantData as fe, TenantControllerInitTenantResponse as ff, TenantControllerInitTenantResponses as fg, TenantControllerUpdateTenantData as fh, TenantControllerUpdateTenantResponse as fi, TenantControllerUpdateTenantResponses as fj, TenantEntity as fk, TokenResponse as fl, TransactionData as fm, TrustAuthorityDto as fn, TrustAuthorityEntry as fo, TrustList as fp, TrustListControllerCreateTrustListData as fq, TrustListControllerCreateTrustListResponse as fr, TrustListControllerCreateTrustListResponses as fs, TrustListControllerDeleteTrustListData as ft, TrustListControllerDeleteTrustListResponses as fu, TrustListControllerExportTrustListData as fv, TrustListControllerExportTrustListResponse as fw, TrustListControllerExportTrustListResponses as fx, TrustListControllerGetAllTrustListsData as fy, TrustListControllerGetAllTrustListsResponse as fz, AppControllerGetVersionResponses as g, UserControllerCreateUserData as g0, UserControllerCreateUserResponse as g1, UserControllerCreateUserResponses as g2, UserControllerDeleteUserData as g3, UserControllerDeleteUserResponses as g4, UserControllerGetUserData as g5, UserControllerGetUserResponse as g6, UserControllerGetUserResponses as g7, UserControllerGetUsersData as g8, UserControllerGetUsersResponse as g9, WebhookEndpointEntity as gA, UserControllerGetUsersResponses as ga, UserControllerUpdateUserData as gb, UserControllerUpdateUserResponse as gc, UserControllerUpdateUserResponses as gd, Vct as ge, VerifierOfferControllerGetOfferData as gf, VerifierOfferControllerGetOfferResponse as gg, VerifierOfferControllerGetOfferResponses as gh, VocabularyEntryDto as gi, WebHookAuthConfigHeader as gj, WebHookAuthConfigNone as gk, WebhookConfig as gl, WebhookEndpointControllerCreateData as gm, WebhookEndpointControllerCreateResponses as gn, WebhookEndpointControllerDeleteData as go, WebhookEndpointControllerDeleteErrors as gp, WebhookEndpointControllerDeleteResponses as gq, WebhookEndpointControllerGetAllData as gr, WebhookEndpointControllerGetAllResponse as gs, WebhookEndpointControllerGetAllResponses as gt, WebhookEndpointControllerGetByIdData as gu, WebhookEndpointControllerGetByIdErrors as gv, WebhookEndpointControllerGetByIdResponses as gw, WebhookEndpointControllerUpdateData as gx, WebhookEndpointControllerUpdateErrors as gy, WebhookEndpointControllerUpdateResponses as gz, AttestationBasedPolicy as h, AttributeProviderControllerCreateData as i, AttributeProviderControllerCreateResponses as j, AttributeProviderControllerDeleteData as k, AttributeProviderControllerDeleteErrors as l, AttributeProviderControllerDeleteResponses as m, AttributeProviderControllerGetAllData as n, AttributeProviderControllerGetAllResponses as o, AttributeProviderControllerGetByIdData as p, AttributeProviderControllerGetByIdErrors as q, AttributeProviderControllerGetByIdResponses as r, AttributeProviderControllerUpdateData as s, AttributeProviderControllerUpdateErrors as t, AttributeProviderControllerUpdateResponses as u, AttributeProviderEntity as v, AuditLogControllerGetAuditLogsData as w, AuditLogControllerGetAuditLogsResponse as x, AuditLogControllerGetAuditLogsResponses as y, AuditLogResponseDto as z };
+export type { ChainedAsErrorResponseDto as $, AccessCertificateRefDto as A, AuthControllerGetOAuth2TokenData as B, ClientOptions as C, AuthControllerGetOAuth2TokenErrors as D, AuthControllerGetOAuth2TokenResponse as E, AuthControllerGetOAuth2TokenResponses as F, AuthenticationMethodAuth as G, AuthenticationMethodNone as H, AuthenticationMethodPresentation as I, AuthenticationUrlConfig as J, AuthorizationResponse as K, AuthorizeQueries as L, AwsKmsConfigDto as M, BuiltInAuthorizationServerConfig as N, CacheControllerClearAllCachesData as O, CacheControllerClearAllCachesResponse as P, CacheControllerClearAllCachesResponses as Q, CacheControllerClearStatusListCacheData as R, Session as S, CacheControllerClearStatusListCacheResponse as T, CacheControllerClearStatusListCacheResponses as U, CacheControllerClearTrustListCacheData as V, CacheControllerClearTrustListCacheResponse as W, CacheControllerClearTrustListCacheResponses as X, CacheControllerGetStatsData as Y, CacheControllerGetStatsResponses as Z, CertificateInfoDto as _, AllowListPolicy as a, CredentialConfigControllerGetConfigsResponse as a$, ChainedAsParResponseDto as a0, ChainedAsTokenConfig as a1, ChainedAsTokenRequestDto as a2, ChainedAsTokenResponseDto as a3, ChainedAsVpControllerAuthorizeData as a4, ChainedAsVpControllerAuthorizeError as a5, ChainedAsVpControllerAuthorizeErrors as a6, ChainedAsVpControllerParData as a7, ChainedAsVpControllerParError as a8, ChainedAsVpControllerParErrors as a9, ClientControllerGetClientsResponses as aA, ClientControllerRotateClientSecretData as aB, ClientControllerRotateClientSecretResponse as aC, ClientControllerRotateClientSecretResponses as aD, ClientControllerUpdateClientData as aE, ClientControllerUpdateClientResponse as aF, ClientControllerUpdateClientResponses as aG, ClientCredentialsDto as aH, ClientEntity as aI, ClientSecretResponseDto as aJ, CompleteDeferredDto as aK, CreateAccessCertificateDto as aL, CreateAttributeProviderDto as aM, CreateClientDto as aN, CreateRegistrarConfigDto as aO, CreateStatusListDto as aP, CreateTenantDto as aQ, CreateUserDto as aR, CreateWebhookEndpointDto as aS, CredentialConfig as aT, CredentialConfigControllerDeleteIssuanceConfigurationData as aU, CredentialConfigControllerDeleteIssuanceConfigurationResponse as aV, CredentialConfigControllerDeleteIssuanceConfigurationResponses as aW, CredentialConfigControllerGetConfigByIdData as aX, CredentialConfigControllerGetConfigByIdResponse as aY, CredentialConfigControllerGetConfigByIdResponses as aZ, CredentialConfigControllerGetConfigsData as a_, ChainedAsVpControllerParResponse as aa, ChainedAsVpControllerParResponses as ab, ChainedAsVpControllerTokenData as ac, ChainedAsVpControllerTokenError as ad, ChainedAsVpControllerTokenErrors as ae, ChainedAsVpControllerTokenResponse as af, ChainedAsVpControllerTokenResponses as ag, ChainedAsVpControllerVpCallbackData as ah, ChainedAsVpControllerVpCallbackError as ai, ChainedAsVpControllerVpCallbackErrors as aj, ChainedAuthorizationServerConfig as ak, ClaimFieldDefinitionDto as al, ClaimsQuery as am, ClientControllerCreateClientData as an, ClientControllerCreateClientResponse as ao, ClientControllerCreateClientResponses as ap, ClientControllerDeleteClientData as aq, ClientControllerDeleteClientResponses as ar, ClientControllerGetClientData as as, ClientControllerGetClientResponse as at, ClientControllerGetClientResponses as au, ClientControllerGetClientSecretData as av, ClientControllerGetClientSecretResponse as aw, ClientControllerGetClientSecretResponses as ax, ClientControllerGetClientsData as ay, ClientControllerGetClientsResponse as az, ApiKeyConfig as b, IssuanceConfigWritable as b$, CredentialConfigControllerGetConfigsResponses as b0, CredentialConfigControllerStoreCredentialConfigurationData as b1, CredentialConfigControllerStoreCredentialConfigurationResponse as b2, CredentialConfigControllerStoreCredentialConfigurationResponses as b3, CredentialConfigControllerUpdateCredentialConfigurationData as b4, CredentialConfigControllerUpdateCredentialConfigurationResponse as b5, CredentialConfigControllerUpdateCredentialConfigurationResponses as b6, CredentialConfigCreate as b7, CredentialConfigUpdate as b8, CredentialOfferControllerGetOfferData as b9, ExportEcJwk as bA, ExportRotationPolicyDto as bB, ExternalAuthorizationServerConfig as bC, ExternalTrustListEntity as bD, FailDeferredDto as bE, FederationConfig as bF, FederationTrustAnchorConfig as bG, FieldDisplayDto as bH, FileUploadDto as bI, FrontendConfigResponseDto as bJ, GrafanaConfigDto as bK, HttpAuthBaseConfigDto as bL, HttpKmsConfigDto as bM, IaeActionOpenid4VpPresentation as bN, IaeActionRedirectToWeb as bO, ImportTenantDto as bP, InteractiveAuthorizationCodeResponseDto as bQ, InteractiveAuthorizationErrorResponseDto as bR, InteractiveAuthorizationRequestDto as bS, InternalTrustListEntity as bT, IssuanceConfig as bU, IssuanceConfigControllerGetIssuanceConfigurationsData as bV, IssuanceConfigControllerGetIssuanceConfigurationsResponse as bW, IssuanceConfigControllerGetIssuanceConfigurationsResponses as bX, IssuanceConfigControllerStoreIssuanceConfigurationData as bY, IssuanceConfigControllerStoreIssuanceConfigurationResponse as bZ, IssuanceConfigControllerStoreIssuanceConfigurationResponses as b_, CredentialOfferControllerGetOfferResponse as ba, CredentialOfferControllerGetOfferResponses as bb, CredentialQuery as bc, CredentialSetQuery as bd, CscAuthorizeAuthDataDto as be, CscKmsConfigDto as bf, DbKmsConfigDto as bg, Dcql as bh, DeferredControllerCompleteDeferredData as bi, DeferredControllerCompleteDeferredErrors as bj, DeferredControllerCompleteDeferredResponse as bk, DeferredControllerCompleteDeferredResponses as bl, DeferredControllerFailDeferredData as bm, DeferredControllerFailDeferredErrors as bn, DeferredControllerFailDeferredResponse as bo, DeferredControllerFailDeferredResponses as bp, DeferredCredentialRequestDto as bq, DeferredOperationResponse as br, DeprecateSchemaMetadataDto as bs, Display as bt, DisplayImage as bu, DisplayInfo as bv, DisplayLogo as bw, EcJwk as bx, EcPublic as by, EmbeddedDisclosurePolicy as bz, AppControllerGetFrontendConfigData as c, Oid4VpAuthorizationServerConfig as c$, IssuerMetadataCredentialConfig as c0, IssuerProvidedAttestation as c1, IssuerRegistrationCertificateCache as c2, IssuerRegistrationCertificateConfig as c3, JwksResponseDto as c4, KeyAttestationsRequired as c5, KeyChainControllerCreateData as c6, KeyChainControllerCreateResponses as c7, KeyChainControllerDeleteData as c8, KeyChainControllerDeleteErrors as c9, KeyChainControllerRotateResponses as cA, KeyChainControllerUpdateData as cB, KeyChainControllerUpdateErrors as cC, KeyChainControllerUpdateResponses as cD, KeyChainControllerUpdateTenantKmsConfigData as cE, KeyChainControllerUpdateTenantKmsConfigResponse as cF, KeyChainControllerUpdateTenantKmsConfigResponses as cG, KeyChainCreateDto as cH, KeyChainEntity as cI, KeyChainExportDto as cJ, KeyChainImportDto as cK, KeyChainResponseDto as cL, KeyChainUpdateDto as cM, KmsConfigDto as cN, KmsProviderCapabilitiesDto as cO, KmsProviderInfoDto as cP, KmsProvidersResponseDto as cQ, KmsTenantConfigResponseDto as cR, ManagedAuthorizationServerConfig as cS, ManagedUserDto as cT, MetadataSchemaDto as cU, NoneTrustPolicy as cV, NotificationRequestDto as cW, Object$1 as cX, ObjectWritable as cY, OfferRequestDto as cZ, OfferResponse as c_, KeyChainControllerDeleteResponses as ca, KeyChainControllerDeleteTenantKmsConfigData as cb, KeyChainControllerDeleteTenantKmsConfigResponses as cc, KeyChainControllerExportData as cd, KeyChainControllerExportErrors as ce, KeyChainControllerExportResponse as cf, KeyChainControllerExportResponses as cg, KeyChainControllerGetAllData as ch, KeyChainControllerGetAllResponse as ci, KeyChainControllerGetAllResponses as cj, KeyChainControllerGetByIdData as ck, KeyChainControllerGetByIdErrors as cl, KeyChainControllerGetByIdResponse as cm, KeyChainControllerGetByIdResponses as cn, KeyChainControllerGetProvidersData as co, KeyChainControllerGetProvidersHealthData as cp, KeyChainControllerGetProvidersHealthResponses as cq, KeyChainControllerGetProvidersResponse as cr, KeyChainControllerGetProvidersResponses as cs, KeyChainControllerGetTenantKmsConfigData as ct, KeyChainControllerGetTenantKmsConfigResponse as cu, KeyChainControllerGetTenantKmsConfigResponses as cv, KeyChainControllerImportData as cw, KeyChainControllerImportResponses as cx, KeyChainControllerRotateData as cy, KeyChainControllerRotateErrors as cz, AppControllerGetFrontendConfigResponse as d, RegistrationCertificatePurpose as d$, PaginatedSessionResponseDto as d0, ParResponseDto as d1, Pkcs11KmsConfigDto as d2, PolicyCredential as d3, PresentationAttachment as d4, PresentationConfig as d5, PresentationConfigCreateDto as d6, PresentationConfigUpdateDto as d7, PresentationConfigWritable as d8, PresentationDuringIssuanceConfig as d9, PresentationManagementControllerUpdateConfigurationData as dA, PresentationManagementControllerUpdateConfigurationResponse as dB, PresentationManagementControllerUpdateConfigurationResponses as dC, PresentationRequest as dD, PublicKeyInfoDto as dE, RegistrarConfigResponseDto as dF, RegistrarControllerCreateAccessCertificateData as dG, RegistrarControllerCreateAccessCertificateErrors as dH, RegistrarControllerCreateAccessCertificateResponse as dI, RegistrarControllerCreateAccessCertificateResponses as dJ, RegistrarControllerCreateConfigData as dK, RegistrarControllerCreateConfigErrors as dL, RegistrarControllerCreateConfigResponse as dM, RegistrarControllerCreateConfigResponses as dN, RegistrarControllerDeleteConfigData as dO, RegistrarControllerDeleteConfigResponse as dP, RegistrarControllerDeleteConfigResponses as dQ, RegistrarControllerGetConfigData as dR, RegistrarControllerGetConfigErrors as dS, RegistrarControllerGetConfigResponse as dT, RegistrarControllerGetConfigResponses as dU, RegistrarControllerUpdateConfigData as dV, RegistrarControllerUpdateConfigErrors as dW, RegistrarControllerUpdateConfigResponse as dX, RegistrarControllerUpdateConfigResponses as dY, RegistrationCertificateBody as dZ, RegistrationCertificateDefaults as d_, PresentationManagementControllerConfigurationData as da, PresentationManagementControllerConfigurationResponse as db, PresentationManagementControllerConfigurationResponses as dc, PresentationManagementControllerDeleteConfigurationData as dd, PresentationManagementControllerDeleteConfigurationResponses as de, PresentationManagementControllerGetConfigurationData as df, PresentationManagementControllerGetConfigurationResponse as dg, PresentationManagementControllerGetConfigurationResponses as dh, PresentationManagementControllerListSchemaMetadataCatalogData as di, PresentationManagementControllerListSchemaMetadataCatalogResponses as dj, PresentationManagementControllerReissueRegistrationCertificateData as dk, PresentationManagementControllerReissueRegistrationCertificateErrors as dl, PresentationManagementControllerReissueRegistrationCertificateResponses as dm, PresentationManagementControllerResolveIssuerMetadataData as dn, PresentationManagementControllerResolveIssuerMetadataErrors as dp, PresentationManagementControllerResolveIssuerMetadataResponses as dq, PresentationManagementControllerResolveSchemaMetadataData as dr, PresentationManagementControllerResolveSchemaMetadataErrors as ds, PresentationManagementControllerResolveSchemaMetadataJwtData as dt, PresentationManagementControllerResolveSchemaMetadataJwtErrors as du, PresentationManagementControllerResolveSchemaMetadataJwtResponses as dv, PresentationManagementControllerResolveSchemaMetadataResponses as dw, PresentationManagementControllerStorePresentationConfigData as dx, PresentationManagementControllerStorePresentationConfigResponse as dy, PresentationManagementControllerStorePresentationConfigResponses as dz, AppControllerGetFrontendConfigResponses as e, SessionConfigControllerUpdateConfigResponses as e$, RegistrationCertificateRequest as e0, ResolveIssuerMetadataDto as e1, ResolveSchemaMetadataDto as e2, ResolveSchemaMetadataJwtDto as e3, RoleDto as e4, RootOfTrustPolicy as e5, RotationPolicyCreateDto as e6, RotationPolicyImportDto as e7, RotationPolicyResponseDto as e8, RotationPolicyUpdateDto as e9, SchemaMetadataControllerGetVocabulariesResponse as eA, SchemaMetadataControllerGetVocabulariesResponses as eB, SchemaMetadataControllerPublishSchemaMetadataData as eC, SchemaMetadataControllerPublishSchemaMetadataErrors as eD, SchemaMetadataControllerPublishSchemaMetadataResponses as eE, SchemaMetadataControllerPublishSchemaMetadataVersionData as eF, SchemaMetadataControllerPublishSchemaMetadataVersionErrors as eG, SchemaMetadataControllerPublishSchemaMetadataVersionResponses as eH, SchemaMetadataControllerRemoveData as eI, SchemaMetadataControllerRemoveResponses as eJ, SchemaMetadataControllerSignSchemaMetaConfigData as eK, SchemaMetadataControllerSignSchemaMetaConfigResponses as eL, SchemaMetadataControllerSignVersionSchemaMetaConfigData as eM, SchemaMetadataControllerSignVersionSchemaMetaConfigResponses as eN, SchemaMetadataControllerUpdateData as eO, SchemaMetadataControllerUpdateResponse as eP, SchemaMetadataControllerUpdateResponses as eQ, SchemaMetadataResponseDto as eR, SchemaMetadataVocabulariesDto as eS, SchemaUriEntry as eT, SessionConfigControllerGetConfigData as eU, SessionConfigControllerGetConfigResponse as eV, SessionConfigControllerGetConfigResponses as eW, SessionConfigControllerResetConfigData as eX, SessionConfigControllerResetConfigResponses as eY, SessionConfigControllerUpdateConfigData as eZ, SessionConfigControllerUpdateConfigResponse as e_, SchemaMetaConfig as ea, SchemaMetadataControllerDeprecateVersionData as eb, SchemaMetadataControllerDeprecateVersionResponse as ec, SchemaMetadataControllerDeprecateVersionResponses as ed, SchemaMetadataControllerFindAllData as ee, SchemaMetadataControllerFindAllResponse as ef, SchemaMetadataControllerFindAllResponses as eg, SchemaMetadataControllerFindOneData as eh, SchemaMetadataControllerFindOneResponse as ei, SchemaMetadataControllerFindOneResponses as ej, SchemaMetadataControllerGetJwtData as ek, SchemaMetadataControllerGetJwtResponse as el, SchemaMetadataControllerGetJwtResponses as em, SchemaMetadataControllerGetLatestData as en, SchemaMetadataControllerGetLatestResponse as eo, SchemaMetadataControllerGetLatestResponses as ep, SchemaMetadataControllerGetMineData as eq, SchemaMetadataControllerGetMineResponse as er, SchemaMetadataControllerGetMineResponses as es, SchemaMetadataControllerGetSchemaData as et, SchemaMetadataControllerGetSchemaResponse as eu, SchemaMetadataControllerGetSchemaResponses as ev, SchemaMetadataControllerGetVersionsData as ew, SchemaMetadataControllerGetVersionsResponse as ex, SchemaMetadataControllerGetVersionsResponses as ey, SchemaMetadataControllerGetVocabulariesData as ez, AppControllerGetVersionData as f, TenantControllerUpdateTenantResponse as f$, SessionControllerDeleteSessionData as f0, SessionControllerDeleteSessionResponses as f1, SessionControllerGetAllSessionsData as f2, SessionControllerGetAllSessionsResponse as f3, SessionControllerGetAllSessionsResponses as f4, SessionControllerGetSessionData as f5, SessionControllerGetSessionLogsData as f6, SessionControllerGetSessionLogsResponse as f7, SessionControllerGetSessionLogsResponses as f8, SessionControllerGetSessionResponse as f9, StatusListManagementControllerDeleteListResponses as fA, StatusListManagementControllerGetListData as fB, StatusListManagementControllerGetListResponse as fC, StatusListManagementControllerGetListResponses as fD, StatusListManagementControllerGetListsData as fE, StatusListManagementControllerGetListsResponse as fF, StatusListManagementControllerGetListsResponses as fG, StatusListManagementControllerUpdateListData as fH, StatusListManagementControllerUpdateListResponse as fI, StatusListManagementControllerUpdateListResponses as fJ, StatusListResponseDto as fK, StatusUpdateDto as fL, StorageControllerUploadData as fM, StorageControllerUploadResponse as fN, StorageControllerUploadResponses as fO, TenantControllerDeleteTenantData as fP, TenantControllerDeleteTenantResponses as fQ, TenantControllerGetTenantData as fR, TenantControllerGetTenantResponse as fS, TenantControllerGetTenantResponses as fT, TenantControllerGetTenantsData as fU, TenantControllerGetTenantsResponse as fV, TenantControllerGetTenantsResponses as fW, TenantControllerInitTenantData as fX, TenantControllerInitTenantResponse as fY, TenantControllerInitTenantResponses as fZ, TenantControllerUpdateTenantData as f_, SessionControllerGetSessionResponses as fa, SessionControllerRevokeAllData as fb, SessionControllerRevokeAllResponses as fc, SessionEventsControllerSubscribeToSessionEventsData as fd, SessionEventsControllerSubscribeToSessionEventsResponses as fe, SessionLogEntryResponseDto as ff, SessionStorageConfig as fg, SignSchemaMetaConfigDto as fh, SignVersionSchemaMetaConfigDto as fi, StatusListAggregationDto as fj, StatusListConfig as fk, StatusListConfigControllerGetConfigData as fl, StatusListConfigControllerGetConfigResponse as fm, StatusListConfigControllerGetConfigResponses as fn, StatusListConfigControllerResetConfigData as fo, StatusListConfigControllerResetConfigResponse as fp, StatusListConfigControllerResetConfigResponses as fq, StatusListConfigControllerUpdateConfigData as fr, StatusListConfigControllerUpdateConfigResponse as fs, StatusListConfigControllerUpdateConfigResponses as ft, StatusListImportDto as fu, StatusListManagementControllerCreateListData as fv, StatusListManagementControllerCreateListResponse as fw, StatusListManagementControllerCreateListResponses as fx, StatusListManagementControllerDeleteListData as fy, StatusListManagementControllerDeleteListResponse as fz, AppControllerGetVersionResponses as g, VerifierOfferControllerGetOfferData as g$, TenantControllerUpdateTenantResponses as g0, TenantEntity as g1, TokenResponse as g2, TransactionData as g3, TrustAuthorityDto as g4, TrustAuthorityEntry as g5, TrustList as g6, TrustListControllerCreateTrustListData as g7, TrustListControllerCreateTrustListResponse as g8, TrustListControllerCreateTrustListResponses as g9, UpdateIssuanceDto as gA, UpdateIssuanceDtoWritable as gB, UpdateRegistrarConfigDto as gC, UpdateSchemaMetadataDto as gD, UpdateSessionConfigDto as gE, UpdateStatusListConfigDto as gF, UpdateStatusListDto as gG, UpdateTenantDto as gH, UpdateUserDto as gI, UpdateWebhookEndpointDto as gJ, UpstreamOidcConfig as gK, UserControllerCreateUserData as gL, UserControllerCreateUserResponse as gM, UserControllerCreateUserResponses as gN, UserControllerDeleteUserData as gO, UserControllerDeleteUserResponses as gP, UserControllerGetUserData as gQ, UserControllerGetUserResponse as gR, UserControllerGetUserResponses as gS, UserControllerGetUsersData as gT, UserControllerGetUsersResponse as gU, UserControllerGetUsersResponses as gV, UserControllerUpdateUserData as gW, UserControllerUpdateUserResponse as gX, UserControllerUpdateUserResponses as gY, VaultKmsConfigDto as gZ, Vct as g_, TrustListControllerDeleteTrustListData as ga, TrustListControllerDeleteTrustListResponses as gb, TrustListControllerExportTrustListData as gc, TrustListControllerExportTrustListResponse as gd, TrustListControllerExportTrustListResponses as ge, TrustListControllerGetAllTrustListsData as gf, TrustListControllerGetAllTrustListsResponse as gg, TrustListControllerGetAllTrustListsResponses as gh, TrustListControllerGetTrustListData as gi, TrustListControllerGetTrustListResponse as gj, TrustListControllerGetTrustListResponses as gk, TrustListControllerGetTrustListVersionData as gl, TrustListControllerGetTrustListVersionResponse as gm, TrustListControllerGetTrustListVersionResponses as gn, TrustListControllerGetTrustListVersionsData as go, TrustListControllerGetTrustListVersionsResponse as gp, TrustListControllerGetTrustListVersionsResponses as gq, TrustListControllerUpdateTrustListData as gr, TrustListControllerUpdateTrustListResponse as gs, TrustListControllerUpdateTrustListResponses as gt, TrustListCreateDto as gu, TrustListEntityInfo as gv, TrustListVersion as gw, TrustedAuthorityQuery as gx, UpdateAttributeProviderDto as gy, UpdateClientDto as gz, AttestationBasedPolicy as h, VerifierOfferControllerGetOfferResponse as h0, VerifierOfferControllerGetOfferResponses as h1, VocabularyEntryDto as h2, WebHookAuthConfigHeader as h3, WebHookAuthConfigNone as h4, WebhookConfig as h5, WebhookEndpointControllerCreateData as h6, WebhookEndpointControllerCreateResponses as h7, WebhookEndpointControllerDeleteData as h8, WebhookEndpointControllerDeleteErrors as h9, WebhookEndpointControllerDeleteResponses as ha, WebhookEndpointControllerGetAllData as hb, WebhookEndpointControllerGetAllResponse as hc, WebhookEndpointControllerGetAllResponses as hd, WebhookEndpointControllerGetByIdData as he, WebhookEndpointControllerGetByIdErrors as hf, WebhookEndpointControllerGetByIdResponses as hg, WebhookEndpointControllerUpdateData as hh, WebhookEndpointControllerUpdateErrors as hi, WebhookEndpointControllerUpdateResponses as hj, WebhookEndpointEntity as hk, AttributeProviderControllerCreateData as i, AttributeProviderControllerCreateResponses as j, AttributeProviderControllerDeleteData as k, AttributeProviderControllerDeleteErrors as l, AttributeProviderControllerDeleteResponses as m, AttributeProviderControllerGetAllData as n, AttributeProviderControllerGetAllResponses as o, AttributeProviderControllerGetByIdData as p, AttributeProviderControllerGetByIdErrors as q, AttributeProviderControllerGetByIdResponses as r, AttributeProviderControllerUpdateData as s, AttributeProviderControllerUpdateErrors as t, AttributeProviderControllerUpdateResponses as u, AttributeProviderEntity as v, AuditLogControllerGetAuditLogsData as w, AuditLogControllerGetAuditLogsResponse as x, AuditLogControllerGetAuditLogsResponses as y, AuditLogResponseDto as z };