@faable/auth-sdk 1.3.11 → 1.3.12

package/dist/api/types.d.ts

@@ -60,7 +60,11 @@ export interface paths {
          */
         get: operations["account/get"];
         put?: never;
-        post?: never;
+        /**
+         * Update an Account
+         * @description Update the Account configuration such as branding (logo and icon URLs).
+         */
+        post: operations["account/update"];
         /**
          * Delete an Account
          * @description Permanently removes an Account and its associated data. This action cannot be undone.
@@ -584,7 +588,11 @@ export interface paths {
          */
         get: operations["api/get"];
         put?: never;
-        post?: never;
+        /**
+         * Update Apis in Account
+         * @description Update Apis in Account
+         */
+        post: operations["api/update"];
         /**
          * Delete Api in Account
          * @description Delete Api in Account
@@ -595,6 +603,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/account/keys": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get Account signing keys info
+         * @description Returns metadata for the Account signing keys: the current production kid, the kid queued for next rotation, and all kids currently published in the JWK Set. Does not expose private key material.
+         */
+        get: operations["account/getKeys"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/account/keys/rotate": {
         parameters: {
             query?: never;
@@ -1285,7 +1313,10 @@ export interface components {
             logo_src?: string | null;
             icon_src?: string | null;
             callback_hostnames: string[];
+            /** @description Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*\/ES*\/PS*. */
             token_signature: string;
+            /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+            token_signing_alg: "RS256";
             default_connection?: components["schemas"]["Connection"] | string | unknown;
             enabled_locales: string[];
             team?: string | null;
@@ -1301,6 +1332,8 @@ export interface components {
             /** @description AuthAccount updated date */
             updatedAt?: string;
         };
+        /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+        TokenSigningAlg: "RS256";
         AccountNotificationSettings: {
             /**
              * @description Send the built-in welcome email on user.created
@@ -1314,7 +1347,7 @@ export interface components {
             id: string;
             connection_name: string;
             /** @enum {unknown} */
-            connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc";
+            connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc" | "passwordless_email";
             /** @default null */
             authorize_url: string;
             /** @default null */
@@ -1368,7 +1401,7 @@ export interface components {
         ConnectionCreate: {
             connection_name: string;
             /** @enum {unknown} */
-            connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc";
+            connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc" | "passwordless_email";
             authorize_url?: string;
             client_id?: string;
             client_secret?: string;
@@ -1600,7 +1633,7 @@ export interface components {
             locale?: string;
             /** @description A URI pointing to the user's picture. */
             picture?: string;
-            /** @description Initial password for this user (mandatory only for auth0 connection strategy) */
+            /** @description Initial password for this user. Only used (and required) when the user is being provisioned against a `database` connection; ignored for federated/social connections. */
             password?: string;
             /** @description User Metadata */
             user_metadata?: {
@@ -1704,9 +1737,12 @@ export interface components {
         Role: {
             /** @description Role ID */
             id: string;
-            /** @description Name for this role */
+            /**
+             * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+             * @example admin
+             */
             name: string;
-            /** @description Description of this role */
+            /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
             description: string;
             /** @description Object is related with this account */
             account: string;
@@ -1731,7 +1767,12 @@ export interface components {
         };
         /** @description RoleCreate */
         RoleCreate: {
+            /**
+             * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`).
+             * @example admin
+             */
             name: string;
+            /** @description Free-form explanation of what users in this role are expected to do or have access to. */
             description?: string;
             /** @description Add Metadata */
             metadata?: {
@@ -1746,7 +1787,9 @@ export interface components {
         RoleMember: {
             /** @description RoleMember ID */
             id: string;
+            /** @description Role granted to the user. Returned as an id by default; pass `?expand=role` to inline the full Role object. */
             role: components["schemas"]["Role"] | string | unknown;
+            /** @description User the role is granted to. Returned as an id by default; pass `?expand=user` to inline the full User object. */
             user: components["schemas"]["User"] | string | unknown;
             /** @description Object is related with this account */
             account: string;
@@ -1769,16 +1812,33 @@ export interface components {
         RoleMemberMetadata: {
             [key: string]: unknown;
         };
+        /** @description Payload for granting a role to one or more users in a single call. Posted to `POST /role/:role_id/users`. */
         RoleMemberCreate: {
+            /**
+             * @description List of User ids to grant the role to. Existing role memberships are preserved; passing a user that already holds the role is a no-op.
+             * @example [
+             *       "user_6555fd293acc2f0fac0e3452"
+             *     ]
+             */
             users: string[];
         };
         /** @description Team */
         Team: {
             /** @description Team ID */
             id: string;
+            /**
+             * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+             * @example Acme Engineering
+             */
             name: string;
+            /**
+             * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+             * @example acme-engineering
+             */
             slug: string;
+            /** @description Optional free-form description of the team. */
             description: string | null;
+            /** @description Optional URL of an image used as the team avatar/logo. */
             logo_url: string | null;
             /** @description Object is related with this account */
             account: string;
@@ -1803,7 +1863,12 @@ export interface components {
         };
         /** @description TeamCreate */
         TeamCreate: {
+            /**
+             * @description Human-readable name of the team.
+             * @example Acme Engineering
+             */
             name: string;
+            /** @description Optional free-form description of the team. */
             description?: string;
             /** @description Add Metadata */
             metadata?: {
@@ -1818,8 +1883,11 @@ export interface components {
         TeamMember: {
             /** @description TeamMember ID */
             id: string;
+            /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
             user: components["schemas"]["User"] | string | unknown;
+            /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
             team: components["schemas"]["Team"] | string | unknown;
+            /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
             roles: (components["schemas"]["Role"] | string | unknown)[];
             /** @description Object is related with this account */
             account: string;
@@ -1842,24 +1910,72 @@ export interface components {
         TeamMemberMetadata: {
             [key: string]: unknown;
         };
+        /** @description Payload for adding one or more users to a team in a single call. Posted to `POST /team/:team_id/member`. */
         TeamMemberCreate: {
+            /**
+             * @description List of User ids to add as members of the team. Users already in the team are skipped.
+             * @example [
+             *       "user_6555fd293acc2f0fac0e3452"
+             *     ]
+             */
             users: string[];
         };
+        /** @description A permission exposed by an API: a single value that may end up in the `permissions` claim of an access_token, plus a human-readable description shown in the consent prompt. */
         Permission: {
+            /**
+             * @description Permission identifier as it appears in the `permissions` claim of an access_token (e.g. `read:users`). Use `<verb>:<resource>` by convention.
+             * @example read:users
+             */
             value: string;
+            /** @description Human-readable explanation shown in the consent prompt. */
             description?: string;
         };
+        /** @description Payload for declaring a single permission inside an Api. */
         PermissionCreate: {
+            /**
+             * @description Permission identifier as it will appear in the `permissions` claim (e.g. `read:users`). Convention: `<verb>:<resource>`.
+             * @example read:users
+             */
             value: string;
+            /** @description Human-readable explanation shown in the consent prompt. */
             description?: string;
         };
+        /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+        ApiSigningAlg: "RS256";
+        /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+        ApiTokenDialect: "access_token" | "access_token_authz";
         /** @description Api */
         Api: {
             /** @description Api ID */
             id: string;
+            /**
+             * @description Human-readable name for the API. Shown in the dashboard and consent prompts.
+             * @example My Backend API
+             */
             name: string;
+            /** @description URL-safe identifier auto-derived from `name`. Unique within the tenant. */
+            slug: string;
+            /**
+             * @description Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.
+             * @example https://api.faable.com
+             */
+            identifier: string;
+            /** @description Optional human-readable description of the API. */
             description?: string;
+            /** @description Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim. */
             permissions: components["schemas"]["Permission"][];
+            /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+            signing_alg: "RS256";
+            /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+            token_dialect: "access_token" | "access_token_authz";
+            /** @description Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default). */
+            token_lifetime: number;
+            /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
+            enforce_policies: boolean;
+            /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
+            allow_offline_access: boolean;
+            /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
+            skip_consent: boolean;
             /** @description Object is related with this account */
             account: string;
             /**
@@ -1881,10 +1997,58 @@ export interface components {
         ApiMetadata: {
             [key: string]: unknown;
         };
+        /** @description Payload for creating an Api (a.k.a. Resource Server / Audience). The `identifier` becomes the `aud` claim in tokens issued for this API and cannot be changed after creation. */
         ApiCreate: {
+            /**
+             * @description Human-readable name for the API.
+             * @example My Backend API
+             */
             name: string;
+            /**
+             * @description Audience URL clients pass as `audience=` when requesting a token for this API. Must be unique within the tenant and is immutable after creation.
+             * @example https://api.faable.com
+             */
+            identifier: string;
+            /** @description Optional human-readable description of the API. */
             description?: string;
+            /**
+             * @description Set of permissions (scopes) this API exposes. Tokens issued with `audience=identifier` will only carry these in their `permissions` claim.
+             * @default []
+             */
             permissions: components["schemas"]["PermissionCreate"][];
+            /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+            signing_alg?: "RS256";
+            /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+            token_dialect?: "access_token" | "access_token_authz";
+            /** @description Access_token lifetime in seconds. Defaults to 86400 (24h) if omitted. */
+            token_lifetime?: number;
+            /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
+            enforce_policies?: boolean;
+            /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
+            allow_offline_access?: boolean;
+            /** @description When true, skip the consent prompt for first-party clients. */
+            skip_consent?: boolean;
+        };
+        /** @description Partial update for an Api. `identifier` is immutable and not present here; recreate the API if you need to change it. */
+        ApiUpdate: {
+            /** @description Human-readable name for the API. */
+            name?: string;
+            /** @description Optional human-readable description of the API. */
+            description?: string;
+            /** @description Replaces the full permissions list. Tokens issued AFTER the update will use the new list; tokens already in circulation are unchanged. */
+            permissions?: components["schemas"]["PermissionCreate"][];
+            /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+            signing_alg?: "RS256";
+            /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+            token_dialect?: "access_token" | "access_token_authz";
+            /** @description Access_token lifetime in seconds. */
+            token_lifetime?: number;
+            /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
+            enforce_policies?: boolean;
+            /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
+            allow_offline_access?: boolean;
+            /** @description When true, skip the consent prompt for first-party clients. */
+            skip_consent?: boolean;
         };
         /** @description Action */
         Action: {
@@ -2381,6 +2545,14 @@ export interface components {
         AuthAccountMetadataCreate: {
             [key: string]: unknown;
         };
+        /** @description AuthAccountUpdate */
+        AuthAccountUpdate: {
+            logo_src?: string | null;
+            icon_src?: string | null;
+            callback_hostnames?: string[];
+            default_connection?: string | null;
+            enabled_locales?: string[];
+        };
         OAuthTokenParams: {
             /** @description Grant Type. https://oauth.net/2/grant-types/ */
             grant_type?: "authorization_code" | "client_credentials" | "refresh_token" | "password" | "http://auth0.com/oauth/grant-type/passwordless/otp" | "urn:ietf:params:oauth:grant-type:token-exchange" | "urn:ietf:params:oauth:grant-type:device_code";
@@ -2396,6 +2568,8 @@ export interface components {
             subject_token_type?: string;
             /** @description The device code returned by the authorization server. */
             device_code?: string;
+            /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+            audience?: string;
         } & {
             [key: string]: unknown;
         };
@@ -2421,6 +2595,8 @@ export interface components {
             /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
             max_age?: number;
             prompt?: string;
+            /** @description Resource Indicator (RFC 8707). Identifier of the Api the client wants to access. Persisted in the auth state so the token issued at /oauth/token targets the matching Api resource and its `aud` claim is set to this value. */
+            audience?: string;
         };
         LoginCallbackBody: {
             /** @description is always wsignin1.0 */
@@ -2466,7 +2642,10 @@ export interface operations {
                         logo_src?: string | null;
                         icon_src?: string | null;
                         callback_hostnames: string[];
+                        /** @description Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*\/ES*\/PS*. */
                         token_signature: string;
+                        /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+                        token_signing_alg: "RS256";
                         default_connection?: components["schemas"]["Connection"] | string | unknown;
                         enabled_locales: string[];
                         team?: string | null;
@@ -2560,7 +2739,10 @@ export interface operations {
                         logo_src?: string | null;
                         icon_src?: string | null;
                         callback_hostnames: string[];
+                        /** @description Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*\/ES*\/PS*. */
                         token_signature: string;
+                        /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+                        token_signing_alg: "RS256";
                         default_connection?: components["schemas"]["Connection"] | string | unknown;
                         enabled_locales: string[];
                         team?: string | null;
@@ -2609,7 +2791,70 @@ export interface operations {
                         logo_src?: string | null;
                         icon_src?: string | null;
                         callback_hostnames: string[];
+                        /** @description Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*\/ES*\/PS*. */
+                        token_signature: string;
+                        /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+                        token_signing_alg: "RS256";
+                        default_connection?: components["schemas"]["Connection"] | string | unknown;
+                        enabled_locales: string[];
+                        team?: string | null;
+                        notification_settings: {
+                            /**
+                             * @description Send the built-in welcome email on user.created
+                             * @default false
+                             */
+                            welcome_email_enabled: boolean;
+                        };
+                        /** @description AuthAccount creation date */
+                        createdAt: string;
+                        /** @description AuthAccount updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "account/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                account_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description AuthAccountUpdate */
+        requestBody: {
+            content: {
+                "application/json": {
+                    logo_src?: string | null;
+                    icon_src?: string | null;
+                    callback_hostnames?: string[];
+                    default_connection?: string | null;
+                    enabled_locales?: string[];
+                };
+            };
+        };
+        responses: {
+            /** @description AuthAccount */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description AuthAccount ID */
+                        id: string;
+                        name: string;
+                        domain: string;
+                        slug: string;
+                        logo_src?: string | null;
+                        icon_src?: string | null;
+                        callback_hostnames: string[];
+                        /** @description Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*\/ES*\/PS*. */
                         token_signature: string;
+                        /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+                        token_signing_alg: "RS256";
                         default_connection?: components["schemas"]["Connection"] | string | unknown;
                         enabled_locales: string[];
                         team?: string | null;
@@ -2667,7 +2912,10 @@ export interface operations {
                         logo_src?: string | null;
                         icon_src?: string | null;
                         callback_hostnames: string[];
+                        /** @description Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*\/ES*\/PS*. */
                         token_signature: string;
+                        /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+                        token_signing_alg: "RS256";
                         default_connection?: components["schemas"]["Connection"] | string | unknown;
                         enabled_locales: string[];
                         team?: string | null;
@@ -2698,8 +2946,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -2736,7 +2982,7 @@ export interface operations {
                 "application/json": {
                     connection_name: string;
                     /** @enum {unknown} */
-                    connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc";
+                    connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc" | "passwordless_email";
                     authorize_url?: string;
                     client_id?: string;
                     client_secret?: string;
@@ -2773,7 +3019,7 @@ export interface operations {
                         id: string;
                         connection_name: string;
                         /** @enum {unknown} */
-                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc";
+                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc" | "passwordless_email";
                         /** @default null */
                         authorize_url: string;
                         /** @default null */
@@ -2822,10 +3068,7 @@ export interface operations {
     };
     "connection/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 connection_id: string;
@@ -2845,7 +3088,7 @@ export interface operations {
                         id: string;
                         connection_name: string;
                         /** @enum {unknown} */
-                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc";
+                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc" | "passwordless_email";
                         /** @default null */
                         authorize_url: string;
                         /** @default null */
@@ -2923,8 +3166,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -3025,10 +3266,7 @@ export interface operations {
     };
     "client/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 client_id: string;
@@ -3120,8 +3358,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -3172,7 +3408,7 @@ export interface operations {
                     locale?: string;
                     /** @description A URI pointing to the user's picture. */
                     picture?: string;
-                    /** @description Initial password for this user (mandatory only for auth0 connection strategy) */
+                    /** @description Initial password for this user. Only used (and required) when the user is being provisioned against a `database` connection; ignored for federated/social connections. */
                     password?: string;
                     /** @description User Metadata */
                     user_metadata?: {
@@ -3286,10 +3522,7 @@ export interface operations {
     };
     "user/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 user_id: string;
@@ -3570,8 +3803,8 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "connection")[];
             };
             header?: never;
             path?: never;
@@ -3654,8 +3887,8 @@ export interface operations {
     "identity/get": {
         parameters: {
             query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "connection")[];
             };
             header?: never;
             path: {
@@ -3730,8 +3963,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -3766,7 +3997,12 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
+                    /**
+                     * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`).
+                     * @example admin
+                     */
                     name: string;
+                    /** @description Free-form explanation of what users in this role are expected to do or have access to. */
                     description?: string;
                     /** @description Add Metadata */
                     metadata?: {
@@ -3785,9 +4021,12 @@ export interface operations {
                     "application/json": {
                         /** @description Role ID */
                         id: string;
-                        /** @description Name for this role */
+                        /**
+                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+                         * @example admin
+                         */
                         name: string;
-                        /** @description Description of this role */
+                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
                         description: string;
                         /** @description Object is related with this account */
                         account: string;
@@ -3809,10 +4048,7 @@ export interface operations {
     };
     "role/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 role_id: string;
@@ -3830,9 +4066,12 @@ export interface operations {
                     "application/json": {
                         /** @description Role ID */
                         id: string;
-                        /** @description Name for this role */
+                        /**
+                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+                         * @example admin
+                         */
                         name: string;
-                        /** @description Description of this role */
+                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
                         description: string;
                         /** @description Object is related with this account */
                         account: string;
@@ -3915,9 +4154,16 @@ export interface operations {
             };
             cookie?: never;
         };
+        /** @description Payload for granting a role to one or more users in a single call. Posted to `POST /role/:role_id/users`. */
         requestBody: {
             content: {
                 "application/json": {
+                    /**
+                     * @description List of User ids to grant the role to. Existing role memberships are preserved; passing a user that already holds the role is a no-op.
+                     * @example [
+                     *       "user_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
                     users: string[];
                 };
             };
@@ -3943,8 +4189,8 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "role")[];
             };
             header?: never;
             path?: never;
@@ -3975,9 +4221,16 @@ export interface operations {
             path?: never;
             cookie?: never;
         };
+        /** @description Payload for granting a role to one or more users in a single call. Posted to `POST /role/:role_id/users`. */
         requestBody: {
             content: {
                 "application/json": {
+                    /**
+                     * @description List of User ids to grant the role to. Existing role memberships are preserved; passing a user that already holds the role is a no-op.
+                     * @example [
+                     *       "user_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
                     users: string[];
                 };
             };
@@ -3992,7 +4245,9 @@ export interface operations {
                     "application/json": {
                         /** @description RoleMember ID */
                         id: string;
+                        /** @description Role granted to the user. Returned as an id by default; pass `?expand=role` to inline the full Role object. */
                         role: components["schemas"]["Role"] | string | unknown;
+                        /** @description User the role is granted to. Returned as an id by default; pass `?expand=user` to inline the full User object. */
                         user: components["schemas"]["User"] | string | unknown;
                         /** @description Object is related with this account */
                         account: string;
@@ -4015,8 +4270,8 @@ export interface operations {
     "rolemember/get": {
         parameters: {
             query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "role")[];
             };
             header?: never;
             path: {
@@ -4035,7 +4290,9 @@ export interface operations {
                     "application/json": {
                         /** @description RoleMember ID */
                         id: string;
+                        /** @description Role granted to the user. Returned as an id by default; pass `?expand=role` to inline the full Role object. */
                         role: components["schemas"]["Role"] | string | unknown;
+                        /** @description User the role is granted to. Returned as an id by default; pass `?expand=user` to inline the full User object. */
                         user: components["schemas"]["User"] | string | unknown;
                         /** @description Object is related with this account */
                         account: string;
@@ -4086,8 +4343,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -4122,7 +4377,12 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
+                    /**
+                     * @description Human-readable name of the team.
+                     * @example Acme Engineering
+                     */
                     name: string;
+                    /** @description Optional free-form description of the team. */
                     description?: string;
                     /** @description Add Metadata */
                     metadata?: {
@@ -4141,9 +4401,19 @@ export interface operations {
                     "application/json": {
                         /** @description Team ID */
                         id: string;
+                        /**
+                         * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+                         * @example Acme Engineering
+                         */
                         name: string;
+                        /**
+                         * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+                         * @example acme-engineering
+                         */
                         slug: string;
+                        /** @description Optional free-form description of the team. */
                         description: string | null;
+                        /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
                         /** @description Object is related with this account */
                         account: string;
@@ -4165,10 +4435,7 @@ export interface operations {
     };
     "team/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 team_id: string;
@@ -4186,9 +4453,19 @@ export interface operations {
                     "application/json": {
                         /** @description Team ID */
                         id: string;
+                        /**
+                         * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+                         * @example Acme Engineering
+                         */
                         name: string;
+                        /**
+                         * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+                         * @example acme-engineering
+                         */
                         slug: string;
+                        /** @description Optional free-form description of the team. */
                         description: string | null;
+                        /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
                         /** @description Object is related with this account */
                         account: string;
@@ -4239,8 +4516,8 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "team" | "roles")[];
             };
             header?: never;
             path?: never;
@@ -4271,9 +4548,16 @@ export interface operations {
             path?: never;
             cookie?: never;
         };
+        /** @description Payload for adding one or more users to a team in a single call. Posted to `POST /team/:team_id/member`. */
         requestBody: {
             content: {
                 "application/json": {
+                    /**
+                     * @description List of User ids to add as members of the team. Users already in the team are skipped.
+                     * @example [
+                     *       "user_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
                     users: string[];
                 };
             };
@@ -4288,8 +4572,11 @@ export interface operations {
                     "application/json": {
                         /** @description TeamMember ID */
                         id: string;
+                        /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
                         user: components["schemas"]["User"] | string | unknown;
+                        /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
                         team: components["schemas"]["Team"] | string | unknown;
+                        /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
                         roles: (components["schemas"]["Role"] | string | unknown)[];
                         /** @description Object is related with this account */
                         account: string;
@@ -4312,8 +4599,8 @@ export interface operations {
     "teammember/get": {
         parameters: {
             query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "team" | "roles")[];
             };
             header?: never;
             path: {
@@ -4332,8 +4619,11 @@ export interface operations {
                     "application/json": {
                         /** @description TeamMember ID */
                         id: string;
+                        /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
                         user: components["schemas"]["User"] | string | unknown;
+                        /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
                         team: components["schemas"]["Team"] | string | unknown;
+                        /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
                         roles: (components["schemas"]["Role"] | string | unknown)[];
                         /** @description Object is related with this account */
                         account: string;
@@ -4416,9 +4706,16 @@ export interface operations {
             };
             cookie?: never;
         };
+        /** @description Payload for adding one or more users to a team in a single call. Posted to `POST /team/:team_id/member`. */
         requestBody: {
             content: {
                 "application/json": {
+                    /**
+                     * @description List of User ids to add as members of the team. Users already in the team are skipped.
+                     * @example [
+                     *       "user_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
                     users: string[];
                 };
             };
@@ -4433,8 +4730,11 @@ export interface operations {
                     "application/json": {
                         /** @description TeamMember ID */
                         id: string;
+                        /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
                         user: components["schemas"]["User"] | string | unknown;
+                        /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
                         team: components["schemas"]["Team"] | string | unknown;
+                        /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
                         roles: (components["schemas"]["Role"] | string | unknown)[];
                         /** @description Object is related with this account */
                         account: string;
@@ -4482,8 +4782,11 @@ export interface operations {
                     "application/json": {
                         /** @description TeamMember ID */
                         id: string;
+                        /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
                         user: components["schemas"]["User"] | string | unknown;
+                        /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
                         team: components["schemas"]["Team"] | string | unknown;
+                        /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
                         roles: (components["schemas"]["Role"] | string | unknown)[];
                         /** @description Object is related with this account */
                         account: string;
@@ -4514,8 +4817,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -4546,12 +4847,39 @@ export interface operations {
             path?: never;
             cookie?: never;
         };
+        /** @description Payload for creating an Api (a.k.a. Resource Server / Audience). The `identifier` becomes the `aud` claim in tokens issued for this API and cannot be changed after creation. */
         requestBody: {
             content: {
                 "application/json": {
+                    /**
+                     * @description Human-readable name for the API.
+                     * @example My Backend API
+                     */
                     name: string;
+                    /**
+                     * @description Audience URL clients pass as `audience=` when requesting a token for this API. Must be unique within the tenant and is immutable after creation.
+                     * @example https://api.faable.com
+                     */
+                    identifier: string;
+                    /** @description Optional human-readable description of the API. */
                     description?: string;
-                    permissions: components["schemas"]["PermissionCreate"][];
+                    /**
+                     * @description Set of permissions (scopes) this API exposes. Tokens issued with `audience=identifier` will only carry these in their `permissions` claim.
+                     * @default []
+                     */
+                    permissions?: components["schemas"]["PermissionCreate"][];
+                    /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                    signing_alg?: "RS256";
+                    /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                    token_dialect?: "access_token" | "access_token_authz";
+                    /** @description Access_token lifetime in seconds. Defaults to 86400 (24h) if omitted. */
+                    token_lifetime?: number;
+                    /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
+                    enforce_policies?: boolean;
+                    /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
+                    allow_offline_access?: boolean;
+                    /** @description When true, skip the consent prompt for first-party clients. */
+                    skip_consent?: boolean;
                 };
             };
         };
@@ -4565,9 +4893,34 @@ export interface operations {
                     "application/json": {
                         /** @description Api ID */
                         id: string;
+                        /**
+                         * @description Human-readable name for the API. Shown in the dashboard and consent prompts.
+                         * @example My Backend API
+                         */
                         name: string;
+                        /** @description URL-safe identifier auto-derived from `name`. Unique within the tenant. */
+                        slug: string;
+                        /**
+                         * @description Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.
+                         * @example https://api.faable.com
+                         */
+                        identifier: string;
+                        /** @description Optional human-readable description of the API. */
                         description?: string;
+                        /** @description Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim. */
                         permissions: components["schemas"]["Permission"][];
+                        /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                        signing_alg: "RS256";
+                        /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                        token_dialect: "access_token" | "access_token_authz";
+                        /** @description Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default). */
+                        token_lifetime: number;
+                        /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
+                        enforce_policies: boolean;
+                        /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
+                        allow_offline_access: boolean;
+                        /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
+                        skip_consent: boolean;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -4588,10 +4941,7 @@ export interface operations {
     };
     "api/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 api_id: string;
@@ -4609,9 +4959,124 @@ export interface operations {
                     "application/json": {
                         /** @description Api ID */
                         id: string;
+                        /**
+                         * @description Human-readable name for the API. Shown in the dashboard and consent prompts.
+                         * @example My Backend API
+                         */
+                        name: string;
+                        /** @description URL-safe identifier auto-derived from `name`. Unique within the tenant. */
+                        slug: string;
+                        /**
+                         * @description Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.
+                         * @example https://api.faable.com
+                         */
+                        identifier: string;
+                        /** @description Optional human-readable description of the API. */
+                        description?: string;
+                        /** @description Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim. */
+                        permissions: components["schemas"]["Permission"][];
+                        /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                        signing_alg: "RS256";
+                        /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                        token_dialect: "access_token" | "access_token_authz";
+                        /** @description Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default). */
+                        token_lifetime: number;
+                        /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
+                        enforce_policies: boolean;
+                        /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
+                        allow_offline_access: boolean;
+                        /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
+                        skip_consent: boolean;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ApiMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Api creation date */
+                        createdAt: string;
+                        /** @description Api updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "api/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                api_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Partial update for an Api. `identifier` is immutable and not present here; recreate the API if you need to change it. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Human-readable name for the API. */
+                    name?: string;
+                    /** @description Optional human-readable description of the API. */
+                    description?: string;
+                    /** @description Replaces the full permissions list. Tokens issued AFTER the update will use the new list; tokens already in circulation are unchanged. */
+                    permissions?: components["schemas"]["PermissionCreate"][];
+                    /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                    signing_alg?: "RS256";
+                    /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                    token_dialect?: "access_token" | "access_token_authz";
+                    /** @description Access_token lifetime in seconds. */
+                    token_lifetime?: number;
+                    /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
+                    enforce_policies?: boolean;
+                    /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
+                    allow_offline_access?: boolean;
+                    /** @description When true, skip the consent prompt for first-party clients. */
+                    skip_consent?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Api */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Api ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name for the API. Shown in the dashboard and consent prompts.
+                         * @example My Backend API
+                         */
                         name: string;
+                        /** @description URL-safe identifier auto-derived from `name`. Unique within the tenant. */
+                        slug: string;
+                        /**
+                         * @description Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.
+                         * @example https://api.faable.com
+                         */
+                        identifier: string;
+                        /** @description Optional human-readable description of the API. */
                         description?: string;
+                        /** @description Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim. */
                         permissions: components["schemas"]["Permission"][];
+                        /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                        signing_alg: "RS256";
+                        /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                        token_dialect: "access_token" | "access_token_authz";
+                        /** @description Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default). */
+                        token_lifetime: number;
+                        /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
+                        enforce_policies: boolean;
+                        /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
+                        allow_offline_access: boolean;
+                        /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
+                        skip_consent: boolean;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -4650,6 +5115,33 @@ export interface operations {
             };
         };
     };
+    "account/getKeys": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description kid currently used to sign new tokens */
+                        production_kid: string;
+                        /** @description kid that will be promoted on the next rotation */
+                        next_in_queue_kid: string;
+                        /** @description All kids currently published in the JWK Set */
+                        kids_active: string[];
+                    };
+                };
+            };
+        };
+    };
     "account/rotateKeys": {
         parameters: {
             query?: never;
@@ -4696,8 +5188,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -4800,10 +5290,7 @@ export interface operations {
     };
     "action/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 action_id: string;
@@ -4890,8 +5377,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -5028,10 +5513,7 @@ export interface operations {
     };
     "notificationsubscription/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 notificationsubscription_id: string;
@@ -5249,8 +5731,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -5276,10 +5756,7 @@ export interface operations {
     };
     "log/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 log_id: string;
@@ -5354,8 +5831,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -5441,10 +5916,7 @@ export interface operations {
     };
     "customdomain/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 customdomain_id: string;
@@ -5547,6 +6019,7 @@ export interface operations {
                     email: string;
                     /** @default link */
                     send: string;
+                    connection_id?: string;
                     auth_params?: {
                         [key: string]: string;
                     };
@@ -5726,6 +6199,8 @@ export interface operations {
                 /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
                 max_age?: number;
                 prompt?: string;
+                /** @description Resource Indicator (RFC 8707). Identifier of the Api the client wants to access. Persisted in the auth state so the token issued at /oauth/token targets the matching Api resource and its `aud` claim is set to this value. */
+                audience?: string;
             };
             header?: never;
             path?: never;
@@ -5759,6 +6234,8 @@ export interface operations {
                 subject_token_type?: string;
                 /** @description The device code returned by the authorization server. */
                 device_code?: string;
+                /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+                audience?: string;
             };
             header?: never;
             path?: never;
@@ -5801,6 +6278,8 @@ export interface operations {
                 subject_token_type?: string;
                 /** @description The device code returned by the authorization server. */
                 device_code?: string;
+                /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+                audience?: string;
             };
             header?: never;
             path?: never;
@@ -5823,6 +6302,8 @@ export interface operations {
                     subject_token_type?: string;
                     /** @description The device code returned by the authorization server. */
                     device_code?: string;
+                    /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+                    audience?: string;
                 } & {
                     [key: string]: unknown;
                 };
@@ -5861,6 +6342,8 @@ export interface operations {
                     client_id: string;
                     /** @description The scope of the access request. */
                     scope?: string;
+                    /** @description Identifier of the API the device wants to access. Resolved against the tenant Api resources (`Api.identifier`) at token issuance. */
+                    audience?: string;
                 };
             };
         };
@@ -6250,6 +6733,8 @@ export interface operations {
                     /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
                     max_age?: number;
                     prompt?: string;
+                    /** @description Resource Indicator (RFC 8707). Identifier of the Api the client wants to access. Persisted in the auth state so the token issued at /oauth/token targets the matching Api resource and its `aud` claim is set to this value. */
+                    audience?: string;
                 };
             };
         };