@faable/auth-sdk 1.3.11 → 1.3.13

package/dist/api/types.d.ts

@@ -60,7 +60,11 @@ export interface paths {
          */
         get: operations["account/get"];
         put?: never;
-        post?: never;
+        /**
+         * Update an Account
+         * @description Update the Account configuration such as branding (logo and icon URLs).
+         */
+        post: operations["account/update"];
         /**
          * Delete an Account
          * @description Permanently removes an Account and its associated data. This action cannot be undone.
@@ -239,6 +243,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/user/{user_id}/change-email": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start the user's email change flow
+         * @description Initiates the email-change flow for the given user. Validates the new email, ensures it is not already in use in the tenant, revokes any pending change for the same user, creates a Ticket (`type='change_email'`), and sends a verification email to the new address. Re-authentication is not required — an active session/Bearer is enough. The change does NOT take effect until the user clicks the link in the email and confirms via `/change-email-confirm`.
+         */
+        post: operations["user/changeEmail"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/change-email-verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Verify a change-email ticket and apply the change
+         * @description Entry point for the link sent to the new email. Consumes the ticket, applies the email swap (in `new_only` mode) or issues a secondary verification ticket to the old email (in `old_and_new` mode, first step). Redirects to the `redirect_uri` supplied at flow start with `?status=applied|pending_old` appended; falls back to `/flow/email-change-done` on the auth host when no `redirect_uri` was given.
+         */
+        get: operations["user_change_email_verify"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/identity": {
         parameters: {
             query?: never;
@@ -324,7 +368,11 @@ export interface paths {
          */
         get: operations["role/get"];
         put?: never;
-        post?: never;
+        /**
+         * Update Roles in Account
+         * @description Update Roles in Account
+         */
+        post: operations["role/update"];
         /**
          * Delete Role in Account
          * @description Delete Role in Account
@@ -444,7 +492,11 @@ export interface paths {
          */
         get: operations["team/get"];
         put?: never;
-        post?: never;
+        /**
+         * Update Teams in Account
+         * @description Update Teams in Account
+         */
+        post: operations["team/update"];
         /**
          * Delete Team in Account
          * @description Delete Team in Account
@@ -547,6 +599,70 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/team/{team_id}/invite": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List pending invites for a Team
+         * @description Returns all pending (not consumed, not expired) team invites for the given team. Accepts a FaableQL `query` parameter on the `email` field.
+         */
+        get: operations["team/listInvites"];
+        put?: never;
+        /**
+         * Invite a user to a Team by email
+         * @description Invites a user by email. `mode='auto'` (default) adds the user directly when the email already corresponds to a user in this tenant and falls back to a ticketed invite + email otherwise. `mode='invite'` always issues a ticket + email even when the user exists. Re-inviting the same email to the same team invalidates the previous pending invite.
+         */
+        post: operations["team/invite"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/team/{team_id}/invite/{ticket_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Revoke a pending team invite
+         * @description Marks a pending team invite as consumed so it can no longer be accepted. Returns 400 if the invite is already consumed and 404 if it does not exist or belongs to a different team.
+         */
+        delete: operations["team/revokeInvite"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/invite-verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Verify a team-invite ticket and add the user to the team
+         * @description Entry point for the link sent to the invitee. Consumes the ticket, creates the user if needed (with `email_verified=true` — the click proves ownership), and adds them to the team with the invited roles. Then redirects to the `redirect_uri` supplied at invite time with `?status=accepted` appended; falls back to `/flow/team-invite-done` on the auth host when no `redirect_uri` was given. Idempotent if the user is already a member.
+         */
+        get: operations["team_invite_verify"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api": {
         parameters: {
             query?: never;
@@ -584,7 +700,11 @@ export interface paths {
          */
         get: operations["api/get"];
         put?: never;
-        post?: never;
+        /**
+         * Update Apis in Account
+         * @description Update Apis in Account
+         */
+        post: operations["api/update"];
         /**
          * Delete Api in Account
          * @description Delete Api in Account
@@ -595,6 +715,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/account/keys": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get Account signing keys info
+         * @description Returns metadata for the Account signing keys: the current production kid, the kid queued for next rotation, and all kids currently published in the JWK Set. Does not expose private key material.
+         */
+        get: operations["account/getKeys"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/account/keys/rotate": {
         parameters: {
             query?: never;
@@ -1285,7 +1425,10 @@ export interface components {
             logo_src?: string | null;
             icon_src?: string | null;
             callback_hostnames: string[];
+            /** @description Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*\/ES*\/PS*. */
             token_signature: string;
+            /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+            token_signing_alg: "RS256";
             default_connection?: components["schemas"]["Connection"] | string | unknown;
             enabled_locales: string[];
             team?: string | null;
@@ -1296,11 +1439,22 @@ export interface components {
                  */
                 welcome_email_enabled: boolean;
             };
+            /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+            email_change_verification_mode?: "new_only" | "old_and_new";
+            /**
+             * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+             *
+             *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+             *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+             */
+            email_oauth_sync_policy?: "preserve_manual" | "always_sync";
             /** @description AuthAccount creation date */
             createdAt: string;
             /** @description AuthAccount updated date */
             updatedAt?: string;
         };
+        /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+        TokenSigningAlg: "RS256";
         AccountNotificationSettings: {
             /**
              * @description Send the built-in welcome email on user.created
@@ -1308,13 +1462,22 @@ export interface components {
              */
             welcome_email_enabled: boolean;
         };
+        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+        EmailChangeVerificationMode: "new_only" | "old_and_new";
+        /**
+         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+         *
+         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+         */
+        EmailOAuthSyncPolicy: "preserve_manual" | "always_sync";
         /** @description Connection */
         Connection: {
             /** @description Connection ID */
             id: string;
             connection_name: string;
             /** @enum {unknown} */
-            connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc";
+            connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc" | "passwordless_email";
             /** @default null */
             authorize_url: string;
             /** @default null */
@@ -1368,7 +1531,7 @@ export interface components {
         ConnectionCreate: {
             connection_name: string;
             /** @enum {unknown} */
-            connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc";
+            connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc" | "passwordless_email";
             authorize_url?: string;
             client_id?: string;
             client_secret?: string;
@@ -1483,6 +1646,8 @@ export interface components {
              * @default false
              */
             email_verified: boolean;
+            /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+            email_change_locked_at?: string | null;
             /** @description contact phone number */
             phone?: string | null;
             /** @description phone is verified */
@@ -1600,7 +1765,7 @@ export interface components {
             locale?: string;
             /** @description A URI pointing to the user's picture. */
             picture?: string;
-            /** @description Initial password for this user (mandatory only for auth0 connection strategy) */
+            /** @description Initial password for this user. Only used (and required) when the user is being provisioned against a `database` connection; ignored for federated/social connections. */
             password?: string;
             /** @description User Metadata */
             user_metadata?: {
@@ -1704,9 +1869,12 @@ export interface components {
         Role: {
             /** @description Role ID */
             id: string;
-            /** @description Name for this role */
+            /**
+             * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+             * @example admin
+             */
             name: string;
-            /** @description Description of this role */
+            /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
             description: string;
             /** @description Object is related with this account */
             account: string;
@@ -1731,7 +1899,12 @@ export interface components {
         };
         /** @description RoleCreate */
         RoleCreate: {
+            /**
+             * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`).
+             * @example admin
+             */
             name: string;
+            /** @description Free-form explanation of what users in this role are expected to do or have access to. */
             description?: string;
             /** @description Add Metadata */
             metadata?: {
@@ -1742,11 +1915,20 @@ export interface components {
         RoleMetadataCreate: {
             [key: string]: unknown;
         };
+        /** @description Partial update for a Role. Only the supplied fields are modified. */
+        RoleUpdate: {
+            /** @description New human-readable identifier for the role. */
+            name?: string;
+            /** @description New free-form description of what users in this role do. */
+            description?: string;
+        };
         /** @description RoleMember */
         RoleMember: {
             /** @description RoleMember ID */
             id: string;
+            /** @description Role granted to the user. Returned as an id by default; pass `?expand=role` to inline the full Role object. */
             role: components["schemas"]["Role"] | string | unknown;
+            /** @description User the role is granted to. Returned as an id by default; pass `?expand=user` to inline the full User object. */
             user: components["schemas"]["User"] | string | unknown;
             /** @description Object is related with this account */
             account: string;
@@ -1769,16 +1951,33 @@ export interface components {
         RoleMemberMetadata: {
             [key: string]: unknown;
         };
+        /** @description Payload for granting a role to one or more users in a single call. Posted to `POST /role/:role_id/users`. */
         RoleMemberCreate: {
+            /**
+             * @description List of User ids to grant the role to. Existing role memberships are preserved; passing a user that already holds the role is a no-op.
+             * @example [
+             *       "user_6555fd293acc2f0fac0e3452"
+             *     ]
+             */
             users: string[];
         };
         /** @description Team */
         Team: {
             /** @description Team ID */
             id: string;
+            /**
+             * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+             * @example Acme Engineering
+             */
             name: string;
+            /**
+             * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+             * @example acme-engineering
+             */
             slug: string;
+            /** @description Optional free-form description of the team. */
             description: string | null;
+            /** @description Optional URL of an image used as the team avatar/logo. */
             logo_url: string | null;
             /** @description Object is related with this account */
             account: string;
@@ -1803,7 +2002,12 @@ export interface components {
         };
         /** @description TeamCreate */
         TeamCreate: {
+            /**
+             * @description Human-readable name of the team.
+             * @example Acme Engineering
+             */
             name: string;
+            /** @description Optional free-form description of the team. */
             description?: string;
             /** @description Add Metadata */
             metadata?: {
@@ -1814,12 +2018,30 @@ export interface components {
         TeamMetadataCreate: {
             [key: string]: unknown;
         };
+        /** @description Partial update for a Team. Only the supplied fields are modified. `slug` is auto-derived from `name` and is not user-editable. */
+        TeamUpdate: {
+            /** @description New human-readable name for the team. */
+            name?: string;
+            /** @description New free-form description for the team. */
+            description?: string;
+            /** @description Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely. */
+            metadata?: {
+                [key: string]: unknown;
+            };
+        };
+        /** @description Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely. */
+        TeamUpdateMetadata: {
+            [key: string]: unknown;
+        };
         /** @description TeamMember */
         TeamMember: {
             /** @description TeamMember ID */
             id: string;
+            /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
             user: components["schemas"]["User"] | string | unknown;
+            /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
             team: components["schemas"]["Team"] | string | unknown;
+            /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
             roles: (components["schemas"]["Role"] | string | unknown)[];
             /** @description Object is related with this account */
             account: string;
@@ -1842,24 +2064,80 @@ export interface components {
         TeamMemberMetadata: {
             [key: string]: unknown;
         };
+        /** @description Payload for adding one or more users to a team in a single call. Posted to `POST /team/:team_id/member`. */
         TeamMemberCreate: {
+            /**
+             * @description List of User ids to add as members of the team. Users already in the team are skipped.
+             * @example [
+             *       "user_6555fd293acc2f0fac0e3452"
+             *     ]
+             */
             users: string[];
+            /**
+             * @description Role ids to grant to the added members within the scope of this team.
+             * @default []
+             * @example [
+             *       "role_6555fd293acc2f0fac0e3452"
+             *     ]
+             */
+            roles: string[];
         };
+        /** @description A permission exposed by an API: a single value that may end up in the `permissions` claim of an access_token, plus a human-readable description shown in the consent prompt. */
         Permission: {
+            /**
+             * @description Permission identifier as it appears in the `permissions` claim of an access_token (e.g. `read:users`). Use `<verb>:<resource>` by convention.
+             * @example read:users
+             */
             value: string;
+            /** @description Human-readable explanation shown in the consent prompt. */
             description?: string;
         };
+        /** @description Payload for declaring a single permission inside an Api. */
         PermissionCreate: {
+            /**
+             * @description Permission identifier as it will appear in the `permissions` claim (e.g. `read:users`). Convention: `<verb>:<resource>`.
+             * @example read:users
+             */
             value: string;
+            /** @description Human-readable explanation shown in the consent prompt. */
             description?: string;
         };
+        /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+        ApiSigningAlg: "RS256";
+        /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+        ApiTokenDialect: "access_token" | "access_token_authz";
         /** @description Api */
         Api: {
             /** @description Api ID */
             id: string;
+            /**
+             * @description Human-readable name for the API. Shown in the dashboard and consent prompts.
+             * @example My Backend API
+             */
             name: string;
+            /** @description URL-safe identifier auto-derived from `name`. Unique within the tenant. */
+            slug: string;
+            /**
+             * @description Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.
+             * @example https://api.faable.com
+             */
+            identifier: string;
+            /** @description Optional human-readable description of the API. */
             description?: string;
+            /** @description Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim. */
             permissions: components["schemas"]["Permission"][];
+            /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+            signing_alg: "RS256";
+            /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+            token_dialect: "access_token" | "access_token_authz";
+            /** @description Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default). */
+            token_lifetime: number;
+            /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
+            enforce_policies: boolean;
+            /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
+            allow_offline_access: boolean;
+            /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
+            skip_consent: boolean;
             /** @description Object is related with this account */
             account: string;
             /**
@@ -1881,10 +2159,58 @@ export interface components {
         ApiMetadata: {
             [key: string]: unknown;
         };
+        /** @description Payload for creating an Api (a.k.a. Resource Server / Audience). The `identifier` becomes the `aud` claim in tokens issued for this API and cannot be changed after creation. */
         ApiCreate: {
+            /**
+             * @description Human-readable name for the API.
+             * @example My Backend API
+             */
             name: string;
+            /**
+             * @description Audience URL clients pass as `audience=` when requesting a token for this API. Must be unique within the tenant and is immutable after creation.
+             * @example https://api.faable.com
+             */
+            identifier: string;
+            /** @description Optional human-readable description of the API. */
             description?: string;
+            /**
+             * @description Set of permissions (scopes) this API exposes. Tokens issued with `audience=identifier` will only carry these in their `permissions` claim.
+             * @default []
+             */
             permissions: components["schemas"]["PermissionCreate"][];
+            /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+            signing_alg?: "RS256";
+            /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+            token_dialect?: "access_token" | "access_token_authz";
+            /** @description Access_token lifetime in seconds. Defaults to 86400 (24h) if omitted. */
+            token_lifetime?: number;
+            /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
+            enforce_policies?: boolean;
+            /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
+            allow_offline_access?: boolean;
+            /** @description When true, skip the consent prompt for first-party clients. */
+            skip_consent?: boolean;
+        };
+        /** @description Partial update for an Api. `identifier` is immutable and not present here; recreate the API if you need to change it. */
+        ApiUpdate: {
+            /** @description Human-readable name for the API. */
+            name?: string;
+            /** @description Optional human-readable description of the API. */
+            description?: string;
+            /** @description Replaces the full permissions list. Tokens issued AFTER the update will use the new list; tokens already in circulation are unchanged. */
+            permissions?: components["schemas"]["PermissionCreate"][];
+            /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+            signing_alg?: "RS256";
+            /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+            token_dialect?: "access_token" | "access_token_authz";
+            /** @description Access_token lifetime in seconds. */
+            token_lifetime?: number;
+            /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
+            enforce_policies?: boolean;
+            /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
+            allow_offline_access?: boolean;
+            /** @description When true, skip the consent prompt for first-party clients. */
+            skip_consent?: boolean;
         };
         /** @description Action */
         Action: {
@@ -2381,6 +2707,14 @@ export interface components {
         AuthAccountMetadataCreate: {
             [key: string]: unknown;
         };
+        /** @description AuthAccountUpdate */
+        AuthAccountUpdate: {
+            logo_src?: string | null;
+            icon_src?: string | null;
+            callback_hostnames?: string[];
+            default_connection?: string | null;
+            enabled_locales?: string[];
+        };
         OAuthTokenParams: {
             /** @description Grant Type. https://oauth.net/2/grant-types/ */
             grant_type?: "authorization_code" | "client_credentials" | "refresh_token" | "password" | "http://auth0.com/oauth/grant-type/passwordless/otp" | "urn:ietf:params:oauth:grant-type:token-exchange" | "urn:ietf:params:oauth:grant-type:device_code";
@@ -2396,6 +2730,8 @@ export interface components {
             subject_token_type?: string;
             /** @description The device code returned by the authorization server. */
             device_code?: string;
+            /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+            audience?: string;
         } & {
             [key: string]: unknown;
         };
@@ -2421,6 +2757,8 @@ export interface components {
             /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
             max_age?: number;
             prompt?: string;
+            /** @description Resource Indicator (RFC 8707). Identifier of the Api the client wants to access. Persisted in the auth state so the token issued at /oauth/token targets the matching Api resource and its `aud` claim is set to this value. */
+            audience?: string;
         };
         LoginCallbackBody: {
             /** @description is always wsignin1.0 */
@@ -2466,7 +2804,10 @@ export interface operations {
                         logo_src?: string | null;
                         icon_src?: string | null;
                         callback_hostnames: string[];
+                        /** @description Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*\/ES*\/PS*. */
                         token_signature: string;
+                        /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+                        token_signing_alg: "RS256";
                         default_connection?: components["schemas"]["Connection"] | string | unknown;
                         enabled_locales: string[];
                         team?: string | null;
@@ -2477,6 +2818,15 @@ export interface operations {
                              */
                             welcome_email_enabled: boolean;
                         };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -2560,7 +2910,10 @@ export interface operations {
                         logo_src?: string | null;
                         icon_src?: string | null;
                         callback_hostnames: string[];
+                        /** @description Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*\/ES*\/PS*. */
                         token_signature: string;
+                        /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+                        token_signing_alg: "RS256";
                         default_connection?: components["schemas"]["Connection"] | string | unknown;
                         enabled_locales: string[];
                         team?: string | null;
@@ -2571,6 +2924,15 @@ export interface operations {
                              */
                             welcome_email_enabled: boolean;
                         };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -2609,7 +2971,79 @@ export interface operations {
                         logo_src?: string | null;
                         icon_src?: string | null;
                         callback_hostnames: string[];
+                        /** @description Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*\/ES*\/PS*. */
+                        token_signature: string;
+                        /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+                        token_signing_alg: "RS256";
+                        default_connection?: components["schemas"]["Connection"] | string | unknown;
+                        enabled_locales: string[];
+                        team?: string | null;
+                        notification_settings: {
+                            /**
+                             * @description Send the built-in welcome email on user.created
+                             * @default false
+                             */
+                            welcome_email_enabled: boolean;
+                        };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
+                        /** @description AuthAccount creation date */
+                        createdAt: string;
+                        /** @description AuthAccount updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "account/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                account_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description AuthAccountUpdate */
+        requestBody: {
+            content: {
+                "application/json": {
+                    logo_src?: string | null;
+                    icon_src?: string | null;
+                    callback_hostnames?: string[];
+                    default_connection?: string | null;
+                    enabled_locales?: string[];
+                };
+            };
+        };
+        responses: {
+            /** @description AuthAccount */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description AuthAccount ID */
+                        id: string;
+                        name: string;
+                        domain: string;
+                        slug: string;
+                        logo_src?: string | null;
+                        icon_src?: string | null;
+                        callback_hostnames: string[];
+                        /** @description Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*\/ES*\/PS*. */
                         token_signature: string;
+                        /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+                        token_signing_alg: "RS256";
                         default_connection?: components["schemas"]["Connection"] | string | unknown;
                         enabled_locales: string[];
                         team?: string | null;
@@ -2620,6 +3054,15 @@ export interface operations {
                              */
                             welcome_email_enabled: boolean;
                         };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -2667,7 +3110,10 @@ export interface operations {
                         logo_src?: string | null;
                         icon_src?: string | null;
                         callback_hostnames: string[];
+                        /** @description Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*\/ES*\/PS*. */
                         token_signature: string;
+                        /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
+                        token_signing_alg: "RS256";
                         default_connection?: components["schemas"]["Connection"] | string | unknown;
                         enabled_locales: string[];
                         team?: string | null;
@@ -2678,6 +3124,15 @@ export interface operations {
                              */
                             welcome_email_enabled: boolean;
                         };
+                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
+                        email_change_verification_mode?: "new_only" | "old_and_new";
+                        /**
+                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                         *
+                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                         */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -2698,8 +3153,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -2736,7 +3189,7 @@ export interface operations {
                 "application/json": {
                     connection_name: string;
                     /** @enum {unknown} */
-                    connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc";
+                    connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc" | "passwordless_email";
                     authorize_url?: string;
                     client_id?: string;
                     client_secret?: string;
@@ -2773,7 +3226,7 @@ export interface operations {
                         id: string;
                         connection_name: string;
                         /** @enum {unknown} */
-                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc";
+                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc" | "passwordless_email";
                         /** @default null */
                         authorize_url: string;
                         /** @default null */
@@ -2822,10 +3275,7 @@ export interface operations {
     };
     "connection/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 connection_id: string;
@@ -2845,7 +3295,7 @@ export interface operations {
                         id: string;
                         connection_name: string;
                         /** @enum {unknown} */
-                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc";
+                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc" | "passwordless_email";
                         /** @default null */
                         authorize_url: string;
                         /** @default null */
@@ -2923,8 +3373,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -3025,10 +3473,7 @@ export interface operations {
     };
     "client/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 client_id: string;
@@ -3120,8 +3565,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -3172,7 +3615,7 @@ export interface operations {
                     locale?: string;
                     /** @description A URI pointing to the user's picture. */
                     picture?: string;
-                    /** @description Initial password for this user (mandatory only for auth0 connection strategy) */
+                    /** @description Initial password for this user. Only used (and required) when the user is being provisioned against a `database` connection; ignored for federated/social connections. */
                     password?: string;
                     /** @description User Metadata */
                     user_metadata?: {
@@ -3214,6 +3657,8 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+                        email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -3286,10 +3731,7 @@ export interface operations {
     };
     "user/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 user_id: string;
@@ -3326,6 +3768,8 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+                        email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -3469,6 +3913,8 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+                        email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -3559,20 +4005,79 @@ export interface operations {
             };
         };
     };
-    "identity/list": {
+    "user/changeEmail": {
         parameters: {
-            query?: {
-                /** @description Start from this cursor */
-                cursor?: string;
-                /** @description Start from this cursor */
-                next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
-                /** @description Filter using a FaableQL query */
-                query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Payload for `POST /user/:user_id/change-email`. Triggers the verification flow: a Ticket is created and an email is sent to the new address with a confirmation link. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The email address the user wants to switch to. */
+                    new_email: string;
+                    /** @description Override the account-wide policy. Can only raise the bar: passing `old_and_new` forces double verification; `new_only` is ignored if the account requires `old_and_new`. */
+                    verification_mode?: "new_only" | "old_and_new";
+                    /** @description Where to send the user after they click the link in the verification email. The status of the operation is appended as a `?status=applied|pending_old` query param so the calling app can render the right screen. When omitted, the user lands on the auth host's `/flow/email-change-done` fallback. */
+                    redirect_uri?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "verification_sent";
+                        ticket_id: string;
+                        verification_mode: "new_only" | "old_and_new";
+                    };
+                };
+            };
+        };
+    };
+    user_change_email_verify: {
+        parameters: {
+            query: {
+                ticket: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    "identity/list": {
+        parameters: {
+            query?: {
+                /** @description Start from this cursor */
+                cursor?: string;
+                /** @description Start from this cursor */
+                next?: string;
+                /** @description Size of the results array */
+                pageSize?: number;
+                /** @description Filter using a FaableQL query */
+                query?: string;
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "connection")[];
+            };
             header?: never;
             path?: never;
             cookie?: never;
@@ -3654,8 +4159,8 @@ export interface operations {
     "identity/get": {
         parameters: {
             query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "connection")[];
             };
             header?: never;
             path: {
@@ -3730,8 +4235,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -3766,7 +4269,12 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
+                    /**
+                     * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`).
+                     * @example admin
+                     */
                     name: string;
+                    /** @description Free-form explanation of what users in this role are expected to do or have access to. */
                     description?: string;
                     /** @description Add Metadata */
                     metadata?: {
@@ -3785,9 +4293,12 @@ export interface operations {
                     "application/json": {
                         /** @description Role ID */
                         id: string;
-                        /** @description Name for this role */
+                        /**
+                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+                         * @example admin
+                         */
                         name: string;
-                        /** @description Description of this role */
+                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
                         description: string;
                         /** @description Object is related with this account */
                         account: string;
@@ -3809,10 +4320,7 @@ export interface operations {
     };
     "role/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 role_id: string;
@@ -3830,9 +4338,67 @@ export interface operations {
                     "application/json": {
                         /** @description Role ID */
                         id: string;
-                        /** @description Name for this role */
+                        /**
+                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+                         * @example admin
+                         */
+                        name: string;
+                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
+                        description: string;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description RoleMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Role creation date */
+                        createdAt: string;
+                        /** @description Role updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "role/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                role_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Partial update for a Role. Only the supplied fields are modified. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description New human-readable identifier for the role. */
+                    name?: string;
+                    /** @description New free-form description of what users in this role do. */
+                    description?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Role */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Role ID */
+                        id: string;
+                        /**
+                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+                         * @example admin
+                         */
                         name: string;
-                        /** @description Description of this role */
+                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
                         description: string;
                         /** @description Object is related with this account */
                         account: string;
@@ -3915,9 +4481,16 @@ export interface operations {
             };
             cookie?: never;
         };
+        /** @description Payload for granting a role to one or more users in a single call. Posted to `POST /role/:role_id/users`. */
         requestBody: {
             content: {
                 "application/json": {
+                    /**
+                     * @description List of User ids to grant the role to. Existing role memberships are preserved; passing a user that already holds the role is a no-op.
+                     * @example [
+                     *       "user_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
                     users: string[];
                 };
             };
@@ -3943,8 +4516,8 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "role")[];
             };
             header?: never;
             path?: never;
@@ -3975,9 +4548,16 @@ export interface operations {
             path?: never;
             cookie?: never;
         };
+        /** @description Payload for granting a role to one or more users in a single call. Posted to `POST /role/:role_id/users`. */
         requestBody: {
             content: {
                 "application/json": {
+                    /**
+                     * @description List of User ids to grant the role to. Existing role memberships are preserved; passing a user that already holds the role is a no-op.
+                     * @example [
+                     *       "user_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
                     users: string[];
                 };
             };
@@ -3992,7 +4572,9 @@ export interface operations {
                     "application/json": {
                         /** @description RoleMember ID */
                         id: string;
+                        /** @description Role granted to the user. Returned as an id by default; pass `?expand=role` to inline the full Role object. */
                         role: components["schemas"]["Role"] | string | unknown;
+                        /** @description User the role is granted to. Returned as an id by default; pass `?expand=user` to inline the full User object. */
                         user: components["schemas"]["User"] | string | unknown;
                         /** @description Object is related with this account */
                         account: string;
@@ -4015,8 +4597,8 @@ export interface operations {
     "rolemember/get": {
         parameters: {
             query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "role")[];
             };
             header?: never;
             path: {
@@ -4035,7 +4617,9 @@ export interface operations {
                     "application/json": {
                         /** @description RoleMember ID */
                         id: string;
+                        /** @description Role granted to the user. Returned as an id by default; pass `?expand=role` to inline the full Role object. */
                         role: components["schemas"]["Role"] | string | unknown;
+                        /** @description User the role is granted to. Returned as an id by default; pass `?expand=user` to inline the full User object. */
                         user: components["schemas"]["User"] | string | unknown;
                         /** @description Object is related with this account */
                         account: string;
@@ -4086,8 +4670,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -4122,7 +4704,12 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
+                    /**
+                     * @description Human-readable name of the team.
+                     * @example Acme Engineering
+                     */
                     name: string;
+                    /** @description Optional free-form description of the team. */
                     description?: string;
                     /** @description Add Metadata */
                     metadata?: {
@@ -4141,9 +4728,19 @@ export interface operations {
                     "application/json": {
                         /** @description Team ID */
                         id: string;
+                        /**
+                         * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+                         * @example Acme Engineering
+                         */
                         name: string;
+                        /**
+                         * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+                         * @example acme-engineering
+                         */
                         slug: string;
+                        /** @description Optional free-form description of the team. */
                         description: string | null;
+                        /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
                         /** @description Object is related with this account */
                         account: string;
@@ -4165,10 +4762,7 @@ export interface operations {
     };
     "team/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 team_id: string;
@@ -4186,9 +4780,85 @@ export interface operations {
                     "application/json": {
                         /** @description Team ID */
                         id: string;
+                        /**
+                         * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+                         * @example Acme Engineering
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+                         * @example acme-engineering
+                         */
+                        slug: string;
+                        /** @description Optional free-form description of the team. */
+                        description: string | null;
+                        /** @description Optional URL of an image used as the team avatar/logo. */
+                        logo_url: string | null;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description TeamMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Team creation date */
+                        createdAt: string;
+                        /** @description Team updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "team/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                team_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Partial update for a Team. Only the supplied fields are modified. `slug` is auto-derived from `name` and is not user-editable. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description New human-readable name for the team. */
+                    name?: string;
+                    /** @description New free-form description for the team. */
+                    description?: string;
+                    /** @description Arbitrary key/value pairs attached to the team. Replaces the previous metadata entirely. */
+                    metadata?: {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+        };
+        responses: {
+            /** @description Team */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Team ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+                         * @example Acme Engineering
+                         */
                         name: string;
+                        /**
+                         * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+                         * @example acme-engineering
+                         */
                         slug: string;
+                        /** @description Optional free-form description of the team. */
                         description: string | null;
+                        /** @description Optional URL of an image used as the team avatar/logo. */
                         logo_url: string | null;
                         /** @description Object is related with this account */
                         account: string;
@@ -4239,8 +4909,8 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "team" | "roles")[];
             };
             header?: never;
             path?: never;
@@ -4271,10 +4941,25 @@ export interface operations {
             path?: never;
             cookie?: never;
         };
+        /** @description Payload for adding one or more users to a team in a single call. Posted to `POST /team/:team_id/member`. */
         requestBody: {
             content: {
                 "application/json": {
+                    /**
+                     * @description List of User ids to add as members of the team. Users already in the team are skipped.
+                     * @example [
+                     *       "user_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
                     users: string[];
+                    /**
+                     * @description Role ids to grant to the added members within the scope of this team.
+                     * @default []
+                     * @example [
+                     *       "role_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
+                    roles?: string[];
                 };
             };
         };
@@ -4288,8 +4973,11 @@ export interface operations {
                     "application/json": {
                         /** @description TeamMember ID */
                         id: string;
+                        /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
                         user: components["schemas"]["User"] | string | unknown;
+                        /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
                         team: components["schemas"]["Team"] | string | unknown;
+                        /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
                         roles: (components["schemas"]["Role"] | string | unknown)[];
                         /** @description Object is related with this account */
                         account: string;
@@ -4312,8 +5000,8 @@ export interface operations {
     "teammember/get": {
         parameters: {
             query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "team" | "roles")[];
             };
             header?: never;
             path: {
@@ -4332,8 +5020,11 @@ export interface operations {
                     "application/json": {
                         /** @description TeamMember ID */
                         id: string;
+                        /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
                         user: components["schemas"]["User"] | string | unknown;
+                        /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
                         team: components["schemas"]["Team"] | string | unknown;
+                        /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
                         roles: (components["schemas"]["Role"] | string | unknown)[];
                         /** @description Object is related with this account */
                         account: string;
@@ -4416,10 +5107,25 @@ export interface operations {
             };
             cookie?: never;
         };
+        /** @description Payload for adding one or more users to a team in a single call. Posted to `POST /team/:team_id/member`. */
         requestBody: {
             content: {
                 "application/json": {
+                    /**
+                     * @description List of User ids to add as members of the team. Users already in the team are skipped.
+                     * @example [
+                     *       "user_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
                     users: string[];
+                    /**
+                     * @description Role ids to grant to the added members within the scope of this team.
+                     * @default []
+                     * @example [
+                     *       "role_6555fd293acc2f0fac0e3452"
+                     *     ]
+                     */
+                    roles?: string[];
                 };
             };
         };
@@ -4433,8 +5139,11 @@ export interface operations {
                     "application/json": {
                         /** @description TeamMember ID */
                         id: string;
+                        /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
                         user: components["schemas"]["User"] | string | unknown;
+                        /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
                         team: components["schemas"]["Team"] | string | unknown;
+                        /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
                         roles: (components["schemas"]["Role"] | string | unknown)[];
                         /** @description Object is related with this account */
                         account: string;
@@ -4482,8 +5191,11 @@ export interface operations {
                     "application/json": {
                         /** @description TeamMember ID */
                         id: string;
+                        /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
                         user: components["schemas"]["User"] | string | unknown;
+                        /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
                         team: components["schemas"]["Team"] | string | unknown;
+                        /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
                         roles: (components["schemas"]["Role"] | string | unknown)[];
                         /** @description Object is related with this account */
                         account: string;
@@ -4503,6 +5215,182 @@ export interface operations {
             };
         };
     };
+    "team/listInvites": {
+        parameters: {
+            query?: {
+                /** @description FaableQL filter. Supported fields: `email`. Example: `?query=email:foo@bar.com` */
+                query?: string;
+            };
+            header?: never;
+            path: {
+                team_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: {
+                            /** @description TeamInvite ID */
+                            id: string;
+                            /** @description Email address that was invited */
+                            email: string;
+                            /** @description Team the invitee will be added to upon acceptance. */
+                            team: components["schemas"]["Team"] | string | unknown;
+                            /** @description User that created the invitation, if known. */
+                            inviter?: components["schemas"]["User"] | string | unknown;
+                            /** @description Role ids that will be applied to the new TeamMember on acceptance. */
+                            roles: string[];
+                            /** @description `auto` adds the user directly if they already exist in the tenant and only falls back to a ticketed invite when the email is unknown. `invite` always issues a ticket + email regardless of whether the user exists. */
+                            mode: "auto" | "invite";
+                            /** @description URI to redirect the invitee to after a successful accept. */
+                            redirect_uri?: string;
+                            /** @description ISO 8601 timestamp at which the invite stops being valid. */
+                            expires_at: string;
+                            /** @description ISO 8601 timestamp at which the invite was accepted. Absent for pending invites. */
+                            consume_date?: string;
+                            /** @description Object is related with this account */
+                            account: string;
+                            /**
+                             * @description TeamInviteMetadata
+                             * @default {}
+                             */
+                            metadata: {
+                                [key: string]: unknown;
+                            };
+                            /** @description TeamInvite creation date */
+                            createdAt: string;
+                            /** @description TeamInvite updated date */
+                            updatedAt?: string;
+                        }[];
+                    };
+                };
+            };
+        };
+    };
+    "team/invite": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                team_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Payload for inviting a user to a team by email. `mode='auto'` (default) adds the user immediately if they already exist in the tenant and falls back to a ticketed invite otherwise. `mode='invite'` always issues a ticket + email. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Email of the user to invite to the team.
+                     * @example someone@example.com
+                     */
+                    email: string;
+                    /**
+                     * @description Role ids granted to the resulting TeamMember within the scope of this team.
+                     * @default []
+                     */
+                    roles?: string[];
+                    /** @description `auto` adds the user directly if they already exist in the tenant and only falls back to a ticketed invite when the email is unknown. `invite` always issues a ticket + email regardless of whether the user exists. */
+                    mode?: "auto" | "invite";
+                    /** @description Where to redirect the invitee after a successful accept. Defaults to `/`. */
+                    redirect_uri?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description `invited` when a ticket + email was issued, `added` when the user was added directly (auto mode + existing user). */
+                        status: "invited" | "added";
+                        /** @description ID of the issued invite ticket (when status=invited). */
+                        ticket_id?: string;
+                        /** @description TeamMember */
+                        member?: {
+                            /** @description TeamMember ID */
+                            id: string;
+                            /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
+                            user: components["schemas"]["User"] | string | unknown;
+                            /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
+                            team: components["schemas"]["Team"] | string | unknown;
+                            /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
+                            roles: (components["schemas"]["Role"] | string | unknown)[];
+                            /** @description Object is related with this account */
+                            account: string;
+                            /**
+                             * @description TeamMemberMetadata
+                             * @default {}
+                             */
+                            metadata: {
+                                [key: string]: unknown;
+                            };
+                            /** @description TeamMember creation date */
+                            createdAt: string;
+                            /** @description TeamMember updated date */
+                            updatedAt?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    "team/revokeInvite": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                team_id: string;
+                ticket_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "revoked";
+                    };
+                };
+            };
+        };
+    };
+    team_invite_verify: {
+        parameters: {
+            query: {
+                ticket: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     "api/list": {
         parameters: {
             query?: {
@@ -4514,8 +5402,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -4546,12 +5432,39 @@ export interface operations {
             path?: never;
             cookie?: never;
         };
+        /** @description Payload for creating an Api (a.k.a. Resource Server / Audience). The `identifier` becomes the `aud` claim in tokens issued for this API and cannot be changed after creation. */
         requestBody: {
             content: {
                 "application/json": {
+                    /**
+                     * @description Human-readable name for the API.
+                     * @example My Backend API
+                     */
                     name: string;
+                    /**
+                     * @description Audience URL clients pass as `audience=` when requesting a token for this API. Must be unique within the tenant and is immutable after creation.
+                     * @example https://api.faable.com
+                     */
+                    identifier: string;
+                    /** @description Optional human-readable description of the API. */
                     description?: string;
-                    permissions: components["schemas"]["PermissionCreate"][];
+                    /**
+                     * @description Set of permissions (scopes) this API exposes. Tokens issued with `audience=identifier` will only carry these in their `permissions` claim.
+                     * @default []
+                     */
+                    permissions?: components["schemas"]["PermissionCreate"][];
+                    /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                    signing_alg?: "RS256";
+                    /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                    token_dialect?: "access_token" | "access_token_authz";
+                    /** @description Access_token lifetime in seconds. Defaults to 86400 (24h) if omitted. */
+                    token_lifetime?: number;
+                    /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
+                    enforce_policies?: boolean;
+                    /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
+                    allow_offline_access?: boolean;
+                    /** @description When true, skip the consent prompt for first-party clients. */
+                    skip_consent?: boolean;
                 };
             };
         };
@@ -4565,9 +5478,34 @@ export interface operations {
                     "application/json": {
                         /** @description Api ID */
                         id: string;
+                        /**
+                         * @description Human-readable name for the API. Shown in the dashboard and consent prompts.
+                         * @example My Backend API
+                         */
                         name: string;
+                        /** @description URL-safe identifier auto-derived from `name`. Unique within the tenant. */
+                        slug: string;
+                        /**
+                         * @description Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.
+                         * @example https://api.faable.com
+                         */
+                        identifier: string;
+                        /** @description Optional human-readable description of the API. */
                         description?: string;
+                        /** @description Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim. */
                         permissions: components["schemas"]["Permission"][];
+                        /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                        signing_alg: "RS256";
+                        /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                        token_dialect: "access_token" | "access_token_authz";
+                        /** @description Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default). */
+                        token_lifetime: number;
+                        /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
+                        enforce_policies: boolean;
+                        /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
+                        allow_offline_access: boolean;
+                        /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
+                        skip_consent: boolean;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -4588,10 +5526,7 @@ export interface operations {
     };
     "api/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 api_id: string;
@@ -4609,9 +5544,124 @@ export interface operations {
                     "application/json": {
                         /** @description Api ID */
                         id: string;
+                        /**
+                         * @description Human-readable name for the API. Shown in the dashboard and consent prompts.
+                         * @example My Backend API
+                         */
                         name: string;
+                        /** @description URL-safe identifier auto-derived from `name`. Unique within the tenant. */
+                        slug: string;
+                        /**
+                         * @description Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.
+                         * @example https://api.faable.com
+                         */
+                        identifier: string;
+                        /** @description Optional human-readable description of the API. */
                         description?: string;
+                        /** @description Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim. */
                         permissions: components["schemas"]["Permission"][];
+                        /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                        signing_alg: "RS256";
+                        /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                        token_dialect: "access_token" | "access_token_authz";
+                        /** @description Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default). */
+                        token_lifetime: number;
+                        /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
+                        enforce_policies: boolean;
+                        /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
+                        allow_offline_access: boolean;
+                        /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
+                        skip_consent: boolean;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ApiMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Api creation date */
+                        createdAt: string;
+                        /** @description Api updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "api/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                api_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Partial update for an Api. `identifier` is immutable and not present here; recreate the API if you need to change it. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Human-readable name for the API. */
+                    name?: string;
+                    /** @description Optional human-readable description of the API. */
+                    description?: string;
+                    /** @description Replaces the full permissions list. Tokens issued AFTER the update will use the new list; tokens already in circulation are unchanged. */
+                    permissions?: components["schemas"]["PermissionCreate"][];
+                    /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                    signing_alg?: "RS256";
+                    /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                    token_dialect?: "access_token" | "access_token_authz";
+                    /** @description Access_token lifetime in seconds. */
+                    token_lifetime?: number;
+                    /** @description When true, requested scopes are filtered against `permissions` at token issuance. */
+                    enforce_policies?: boolean;
+                    /** @description When true, clients can request `offline_access` and receive a refresh_token for this API. */
+                    allow_offline_access?: boolean;
+                    /** @description When true, skip the consent prompt for first-party clients. */
+                    skip_consent?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Api */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Api ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name for the API. Shown in the dashboard and consent prompts.
+                         * @example My Backend API
+                         */
+                        name: string;
+                        /** @description URL-safe identifier auto-derived from `name`. Unique within the tenant. */
+                        slug: string;
+                        /**
+                         * @description Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.
+                         * @example https://api.faable.com
+                         */
+                        identifier: string;
+                        /** @description Optional human-readable description of the API. */
+                        description?: string;
+                        /** @description Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim. */
+                        permissions: components["schemas"]["Permission"][];
+                        /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                        signing_alg: "RS256";
+                        /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                        token_dialect: "access_token" | "access_token_authz";
+                        /** @description Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default). */
+                        token_lifetime: number;
+                        /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
+                        enforce_policies: boolean;
+                        /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
+                        allow_offline_access: boolean;
+                        /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
+                        skip_consent: boolean;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -4650,6 +5700,33 @@ export interface operations {
             };
         };
     };
+    "account/getKeys": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description kid currently used to sign new tokens */
+                        production_kid: string;
+                        /** @description kid that will be promoted on the next rotation */
+                        next_in_queue_kid: string;
+                        /** @description All kids currently published in the JWK Set */
+                        kids_active: string[];
+                    };
+                };
+            };
+        };
+    };
     "account/rotateKeys": {
         parameters: {
             query?: never;
@@ -4696,8 +5773,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -4800,10 +5875,7 @@ export interface operations {
     };
     "action/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 action_id: string;
@@ -4890,8 +5962,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -5028,10 +6098,7 @@ export interface operations {
     };
     "notificationsubscription/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 notificationsubscription_id: string;
@@ -5249,8 +6316,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -5276,10 +6341,7 @@ export interface operations {
     };
     "log/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 log_id: string;
@@ -5354,8 +6416,6 @@ export interface operations {
                 pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
             };
             header?: never;
             path?: never;
@@ -5441,10 +6501,7 @@ export interface operations {
     };
     "customdomain/get": {
         parameters: {
-            query?: {
-                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `expand=user&expand=team`). */
-                expand?: string[];
-            };
+            query?: never;
             header?: never;
             path: {
                 customdomain_id: string;
@@ -5547,6 +6604,7 @@ export interface operations {
                     email: string;
                     /** @default link */
                     send: string;
+                    connection_id?: string;
                     auth_params?: {
                         [key: string]: string;
                     };
@@ -5600,6 +6658,8 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+                        email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
@@ -5726,6 +6786,8 @@ export interface operations {
                 /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
                 max_age?: number;
                 prompt?: string;
+                /** @description Resource Indicator (RFC 8707). Identifier of the Api the client wants to access. Persisted in the auth state so the token issued at /oauth/token targets the matching Api resource and its `aud` claim is set to this value. */
+                audience?: string;
             };
             header?: never;
             path?: never;
@@ -5759,6 +6821,8 @@ export interface operations {
                 subject_token_type?: string;
                 /** @description The device code returned by the authorization server. */
                 device_code?: string;
+                /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+                audience?: string;
             };
             header?: never;
             path?: never;
@@ -5801,6 +6865,8 @@ export interface operations {
                 subject_token_type?: string;
                 /** @description The device code returned by the authorization server. */
                 device_code?: string;
+                /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+                audience?: string;
             };
             header?: never;
             path?: never;
@@ -5823,6 +6889,8 @@ export interface operations {
                     subject_token_type?: string;
                     /** @description The device code returned by the authorization server. */
                     device_code?: string;
+                    /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+                    audience?: string;
                 } & {
                     [key: string]: unknown;
                 };
@@ -5861,6 +6929,8 @@ export interface operations {
                     client_id: string;
                     /** @description The scope of the access request. */
                     scope?: string;
+                    /** @description Identifier of the API the device wants to access. Resolved against the tenant Api resources (`Api.identifier`) at token issuance. */
+                    audience?: string;
                 };
             };
         };
@@ -6250,6 +7320,8 @@ export interface operations {
                     /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
                     max_age?: number;
                     prompt?: string;
+                    /** @description Resource Indicator (RFC 8707). Identifier of the Api the client wants to access. Persisted in the auth state so the token issued at /oauth/token targets the matching Api resource and its `aud` claim is set to this value. */
+                    audience?: string;
                 };
             };
         };