@faable/auth-sdk 1.3.13 → 1.3.15

package/dist/api/types.d.ts

@@ -103,14 +103,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Connections in Account
-         * @description List Connections in Account
+         * List Connections
+         * @description List Connections
          */
         get: operations["connection/list"];
         put?: never;
         /**
-         * Create Connection in Account
-         * @description Create Connection in Account
+         * Create Connection
+         * @description Create Connection
          */
         post: operations["connection/create"];
         delete?: never;
@@ -127,17 +127,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Connection in Account
-         * @description Get Connection in Account
+         * Get Connection
+         * @description Get Connection
          */
         get: operations["connection/get"];
         put?: never;
-        post?: never;
         /**
-         * Delete Connection in Account
-         * @description Delete Connection in Account
+         * Update Connection
+         * @description Update Connection
+         */
+        post: operations["connection/update"];
+        /**
+         * Delete Connection
+         * @description Delete Connection
          */
-        delete: operations["connection/remove"];
+        delete: operations["connection/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -151,14 +155,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Clients in Account
-         * @description List Clients in Account
+         * List Clients
+         * @description List Clients
          */
         get: operations["client/list"];
         put?: never;
         /**
-         * Create Client in Account
-         * @description Create Client in Account
+         * Create Client
+         * @description Create Client
          */
         post: operations["client/create"];
         delete?: never;
@@ -175,17 +179,41 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Client in Account
-         * @description Get Client in Account
+         * Get Client
+         * @description Get Client
          */
         get: operations["client/get"];
         put?: never;
-        post?: never;
         /**
-         * Delete Client in Account
-         * @description Delete Client in Account
+         * Update Client
+         * @description Update Client
+         */
+        post: operations["client/update"];
+        /**
+         * Delete Client
+         * @description Delete Client
+         */
+        delete: operations["client/delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/client/{client_id}/rotate-secret": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Rotate a Client's secret
+         * @description Generates a fresh `client_secret` for the given Client and persists it. The previous secret is invalidated immediately — there is no grace period. Returns the full Client; the dashboard must surface the new secret to the admin once. Existing client_credentials / authorization_code integrations using the old secret will start failing at the token endpoint immediately after this call.
          */
-        delete: operations["client/remove"];
+        post: operations["client/rotateSecret"];
+        delete?: never;
         options?: never;
         head?: never;
         patch?: never;
@@ -199,14 +227,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Users in Account
-         * @description List Users in Account
+         * List Users
+         * @description List Users
          */
         get: operations["user/list"];
         put?: never;
         /**
-         * Create User in Account
-         * @description Create User in Account
+         * Create User
+         * @description Create User
          */
         post: operations["user/create"];
         delete?: never;
@@ -223,21 +251,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get User in Account
-         * @description Get User in Account
+         * Get User
+         * @description Get User
          */
         get: operations["user/get"];
         put?: never;
         /**
-         * Update Users in Account
-         * @description Update Users in Account
+         * Update User
+         * @description Update User
          */
         post: operations["user/update"];
         /**
-         * Delete User in Account
-         * @description Delete User in Account
+         * Delete User
+         * @description Delete User
          */
-        delete: operations["user/remove"];
+        delete: operations["user/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -283,6 +311,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/user/{user_id}/verify-email/start": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start the user's email verification flow
+         * @description Initiates the email-verification flow for the given user. Creates a `verify_email` Ticket and queues the verification email. Idempotent — returns `{status:'already_verified'}` without emitting a ticket if the user is already verified. Re-authentication is not required: an active session/Bearer is enough.
+         */
+        post: operations["user/verifyEmailStart"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/verify-email": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Verify a verify-email ticket and mark the user verified
+         * @description Entry point for the link sent to the user. Consumes the ticket, sets `email_verified=true` with `email_verified_method='verification_flow'`. Redirects to the `redirect_uri` supplied at start with `?status=verified|already_verified` appended; falls back to `/flow/verify-email-done` on the auth host when no `redirect_uri` was given. Invalid/expired tickets redirect to the same fallback with `?status=invalid_link` or `?status=expired`.
+         */
+        get: operations["user_verify_email_confirm"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/identity": {
         parameters: {
             query?: never;
@@ -291,14 +359,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Identitys in Account
-         * @description List Identitys in Account
+         * List Identitys
+         * @description List Identitys
          */
         get: operations["identity/list"];
         put?: never;
         /**
-         * Create Identity in Account
-         * @description Create Identity in Account
+         * Create Identity
+         * @description Create Identity
          */
         post: operations["identity/create"];
         delete?: never;
@@ -315,17 +383,37 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Identity in Account
-         * @description Get Identity in Account
+         * Get Identity
+         * @description Get Identity
          */
         get: operations["identity/get"];
         put?: never;
         post?: never;
         /**
-         * Delete Identity in Account
-         * @description Delete Identity in Account
+         * Delete Identity
+         * @description Delete Identity
+         */
+        delete: operations["identity/delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/identity/{identity_id}/provider-token": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a guaranteed-valid provider access_token
+         * @description Returns the identity's upstream provider `access_token`, refreshing it transparently via the stored `refresh_token` when it is (about to be) expired. Pass `?fresh=true` to force a refresh. Fails with 400 when the token is expired and no `refresh_token` is available (the user must re-authorize).
          */
-        delete: operations["identity/remove"];
+        get: operations["identity/getProviderToken"];
+        put?: never;
+        post?: never;
+        delete?: never;
         options?: never;
         head?: never;
         patch?: never;
@@ -339,14 +427,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Roles in Account
-         * @description List Roles in Account
+         * List Roles
+         * @description List Roles
          */
         get: operations["role/list"];
         put?: never;
         /**
-         * Create Role in Account
-         * @description Create Role in Account
+         * Create Role
+         * @description Create Role
          */
         post: operations["role/create"];
         delete?: never;
@@ -363,21 +451,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Role in Account
-         * @description Get Role in Account
+         * Get Role
+         * @description Get Role
          */
         get: operations["role/get"];
         put?: never;
         /**
-         * Update Roles in Account
-         * @description Update Roles in Account
+         * Update Role
+         * @description Update Role
          */
         post: operations["role/update"];
         /**
-         * Delete Role in Account
-         * @description Delete Role in Account
+         * Delete Role
+         * @description Delete Role
          */
-        delete: operations["role/remove"];
+        delete: operations["role/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -415,14 +503,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Rolemembers in Account
-         * @description List Rolemembers in Account
+         * List Rolemembers
+         * @description List Rolemembers
          */
         get: operations["rolemember/list"];
         put?: never;
         /**
-         * Create Rolemember in Account
-         * @description Create Rolemember in Account
+         * Create Rolemember
+         * @description Create Rolemember
          */
         post: operations["rolemember/create"];
         delete?: never;
@@ -439,17 +527,17 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Rolemember in Account
-         * @description Get Rolemember in Account
+         * Get Rolemember
+         * @description Get Rolemember
          */
         get: operations["rolemember/get"];
         put?: never;
         post?: never;
         /**
-         * Delete Rolemember in Account
-         * @description Delete Rolemember in Account
+         * Delete Rolemember
+         * @description Delete Rolemember
          */
-        delete: operations["rolemember/remove"];
+        delete: operations["rolemember/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -463,14 +551,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Teams in Account
-         * @description List Teams in Account
+         * List Teams
+         * @description List Teams
          */
         get: operations["team/list"];
         put?: never;
         /**
-         * Create Team in Account
-         * @description Create Team in Account
+         * Create Team
+         * @description Create Team
          */
         post: operations["team/create"];
         delete?: never;
@@ -487,21 +575,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Team in Account
-         * @description Get Team in Account
+         * Get Team
+         * @description Get Team
          */
         get: operations["team/get"];
         put?: never;
         /**
-         * Update Teams in Account
-         * @description Update Teams in Account
+         * Update Team
+         * @description Update Team
          */
         post: operations["team/update"];
         /**
-         * Delete Team in Account
-         * @description Delete Team in Account
+         * Delete Team
+         * @description Delete Team
          */
-        delete: operations["team/remove"];
+        delete: operations["team/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -515,14 +603,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Teammembers in Account
-         * @description List Teammembers in Account
+         * List Teammembers
+         * @description List Teammembers
          */
         get: operations["teammember/list"];
         put?: never;
         /**
-         * Create Teammember in Account
-         * @description Create Teammember in Account
+         * Create Teammember
+         * @description Create Teammember
          */
         post: operations["teammember/create"];
         delete?: never;
@@ -539,17 +627,17 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Teammember in Account
-         * @description Get Teammember in Account
+         * Get Teammember
+         * @description Get Teammember
          */
         get: operations["teammember/get"];
         put?: never;
         post?: never;
         /**
-         * Delete Teammember in Account
-         * @description Delete Teammember in Account
+         * Delete Teammember
+         * @description Delete Teammember
          */
-        delete: operations["teammember/remove"];
+        delete: operations["teammember/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -564,7 +652,7 @@ export interface paths {
         };
         /**
          * List Team Members
-         * @description List all Users that belong to the given Team in the current Account.
+         * @description List all Users that belong to the given Team in the current Account. Supports `?expand=user,team,roles` to inline referenced rows.
          */
         get: operations["team/listMembers"];
         put?: never;
@@ -671,14 +759,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Apis in Account
-         * @description List Apis in Account
+         * List Apis
+         * @description List Apis
          */
         get: operations["api/list"];
         put?: never;
         /**
-         * Create Api in Account
-         * @description Create Api in Account
+         * Create Api
+         * @description Create Api
          */
         post: operations["api/create"];
         delete?: never;
@@ -695,21 +783,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Api in Account
-         * @description Get Api in Account
+         * Get Api
+         * @description Get Api
          */
         get: operations["api/get"];
         put?: never;
         /**
-         * Update Apis in Account
-         * @description Update Apis in Account
+         * Update Api
+         * @description Update Api
          */
         post: operations["api/update"];
         /**
-         * Delete Api in Account
-         * @description Delete Api in Account
+         * Delete Api
+         * @description Delete Api
          */
-        delete: operations["api/remove"];
+        delete: operations["api/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -763,14 +851,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Actions in Account
-         * @description List Actions in Account
+         * List Actions
+         * @description List Actions
          */
         get: operations["action/list"];
         put?: never;
         /**
-         * Create Action in Account
-         * @description Create Action in Account
+         * Create Action
+         * @description Create Action
          */
         post: operations["action/create"];
         delete?: never;
@@ -787,17 +875,17 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Action in Account
-         * @description Get Action in Account
+         * Get Action
+         * @description Get Action
          */
         get: operations["action/get"];
         put?: never;
         post?: never;
         /**
-         * Delete Action in Account
-         * @description Delete Action in Account
+         * Delete Action
+         * @description Delete Action
          */
-        delete: operations["action/remove"];
+        delete: operations["action/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -811,14 +899,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Notificationsubscriptions in Account
-         * @description List Notificationsubscriptions in Account
+         * List Notificationsubscriptions
+         * @description List Notificationsubscriptions
          */
         get: operations["notificationsubscription/list"];
         put?: never;
         /**
-         * Create Notificationsubscription in Account
-         * @description Create Notificationsubscription in Account
+         * Create Notificationsubscription
+         * @description Create Notificationsubscription
          */
         post: operations["notificationsubscription/create"];
         delete?: never;
@@ -835,21 +923,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Notificationsubscription in Account
-         * @description Get Notificationsubscription in Account
+         * Get Notificationsubscription
+         * @description Get Notificationsubscription
          */
         get: operations["notificationsubscription/get"];
         put?: never;
         /**
-         * Update Notificationsubscriptions in Account
-         * @description Update Notificationsubscriptions in Account
+         * Update Notificationsubscription
+         * @description Update Notificationsubscription
          */
         post: operations["notificationsubscription/update"];
         /**
-         * Delete Notificationsubscription in Account
-         * @description Delete Notificationsubscription in Account
+         * Delete Notificationsubscription
+         * @description Delete Notificationsubscription
          */
-        delete: operations["notificationsubscription/remove"];
+        delete: operations["notificationsubscription/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -863,8 +951,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Logs in Account
-         * @description List Logs in Account
+         * List Logs
+         * @description List Logs
          */
         get: operations["log/list"];
         put?: never;
@@ -883,8 +971,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Log in Account
-         * @description Get Log in Account
+         * Get Log
+         * @description Get Log
          */
         get: operations["log/get"];
         put?: never;
@@ -923,14 +1011,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Customdomains in Account
-         * @description List Customdomains in Account
+         * List Customdomains
+         * @description List Customdomains
          */
         get: operations["customdomain/list"];
         put?: never;
         /**
-         * Create Customdomain in Account
-         * @description Create Customdomain in Account
+         * Create Customdomain
+         * @description Create Customdomain
          */
         post: operations["customdomain/create"];
         delete?: never;
@@ -947,17 +1035,17 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Customdomain in Account
-         * @description Get Customdomain in Account
+         * Get Customdomain
+         * @description Get Customdomain
          */
         get: operations["customdomain/get"];
         put?: never;
         post?: never;
         /**
-         * Delete Customdomain in Account
-         * @description Delete Customdomain in Account
+         * Delete Customdomain
+         * @description Delete Customdomain
          */
-        delete: operations["customdomain/remove"];
+        delete: operations["customdomain/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -1438,6 +1526,11 @@ export interface components {
                  * @default false
                  */
                 welcome_email_enabled: boolean;
+                /**
+                 * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                 * @default false
+                 */
+                verify_email_auto_send: boolean;
             };
             /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
             email_change_verification_mode?: "new_only" | "old_and_new";
@@ -1461,16 +1554,14 @@ export interface components {
              * @default false
              */
             welcome_email_enabled: boolean;
+            /**
+             * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+             * @default false
+             */
+            verify_email_auto_send: boolean;
         };
         /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
         EmailChangeVerificationMode: "new_only" | "old_and_new";
-        /**
-         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
-         *
-         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
-         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
-         */
-        EmailOAuthSyncPolicy: "preserve_manual" | "always_sync";
         /** @description Connection */
         Connection: {
             /** @description Connection ID */
@@ -1506,6 +1597,13 @@ export interface components {
             authorize_params: {
                 [key: string]: string;
             };
+            claims_mapping?: {
+                [key: string]: string;
+            };
+            /** @description Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read. */
+            readonly is_using_default_credentials: boolean;
+            /** @description Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant. */
+            email_oauth_sync_policy?: "preserve_manual" | "always_sync";
             /** @description Object is related with this account */
             account: string;
             /**
@@ -1549,6 +1647,13 @@ export interface components {
             authorize_params: {
                 [key: string]: string;
             };
+            /**
+             * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+             *
+             *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+             *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+             */
+            email_oauth_sync_policy?: "preserve_manual" | "always_sync";
             /** @description Add Metadata */
             metadata?: {
                 [key: string]: unknown;
@@ -1558,6 +1663,32 @@ export interface components {
         ConnectionMetadataCreate: {
             [key: string]: unknown;
         };
+        /** @description Partial update for a Connection. Only the supplied fields are modified. `connection_type` is intentionally excluded — changing it would orphan every identity already linked to this connection. */
+        ConnectionUpdate: {
+            connection_name?: string;
+            enabled?: boolean;
+            enabled_clients?: string[];
+            scope?: string[];
+            client_id?: string;
+            client_secret?: string;
+            issuer?: string;
+            authorize_url?: string;
+            token_url?: string;
+            userinfo_url?: string;
+            jwks_url?: string;
+            response_type?: string;
+            /**
+             * @description Authorize params
+             * @default {}
+             */
+            authorize_params: {
+                [key: string]: string;
+            };
+            claims_mapping?: {
+                [key: string]: string;
+            };
+            email_oauth_sync_policy?: "preserve_manual" | "always_sync" | null;
+        };
         /** @description Client */
         Client: {
             /** @description Client ID */
@@ -1623,6 +1754,36 @@ export interface components {
         ClientMetadataCreate: {
             [key: string]: unknown;
         };
+        /** @description Partial update for a Client. Only the supplied fields are modified. `client_id` and `client_secret` are not editable through this endpoint to prevent accidental rotation; use a dedicated endpoint when secret rotation is added. */
+        ClientUpdate: {
+            /** @description Human-readable client name shown in consent screens. */
+            name?: string;
+            /** @description Free-form description for internal admin use. */
+            description?: string;
+            /** @description Whitelist of allowed OAuth `redirect_uri` values. */
+            callbacks?: string[];
+            /** @description Whitelist of allowed `post_logout_redirect_uri` values. */
+            logout_urls?: string[];
+            refresh_token?: {
+                /** @enum {unknown} */
+                expiration_mode: "expire" | "not-expire";
+                infinite_token_lifetime: boolean;
+                token_lifetime: number;
+            };
+            client_uri?: string | null;
+            logo_uri?: string | null;
+            tos_uri?: string | null;
+            policy_uri?: string | null;
+            contacts?: string[];
+            grant_types?: string[];
+            response_types?: string[];
+            token_endpoint_auth_method?: string;
+            application_type?: string;
+            software_id?: string | null;
+            software_version?: string | null;
+            frontchannel_logout_uri?: string | null;
+            frontchannel_logout_session_required?: boolean;
+        };
         /** @description User */
         User: {
             /** @description User ID */
@@ -1646,12 +1807,20 @@ export interface components {
              * @default false
              */
             email_verified: boolean;
+            /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
+            email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+            /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
+            email_verified_at?: string | null;
             /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
             email_change_locked_at?: string | null;
             /** @description contact phone number */
             phone?: string | null;
             /** @description phone is verified */
             phone_verified: boolean;
+            /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
+            phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+            /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
+            phone_verified_at?: string | null;
             /** @description country iso code */
             country_iso?: string | null;
             /** @description user birth_date */
@@ -1792,12 +1961,16 @@ export interface components {
             given_name?: string;
             /** @description family name */
             family_name?: string;
-            /** @description contact email */
+            /** @description Contact email. Changing the email to a new value automatically resets `email_verified` to false (and clears `email_verified_method` / `email_verified_at`) unless the same patch sets `email_verified` explicitly. The override is the documented way to import a pre-verified user from another IdP. */
             email?: string;
+            /** @description Flip the email verification flag. Setting `true` marks the email as verified by the admin (`email_verified_method=manual`). Setting `false` clears the verification metadata. */
+            email_verified?: boolean;
             /** @description New password for this user */
             password?: string;
-            /** @description contact phone number */
+            /** @description Contact phone number. Changing it to a new value automatically resets `phone_verified` to false (and clears `phone_verified_method` / `phone_verified_at`) unless the same patch sets `phone_verified` explicitly. */
             phone?: string;
+            /** @description Flip the phone verification flag. Setting `true` marks the phone as verified by the admin (`phone_verified_method=manual`). */
+            phone_verified?: boolean;
             /** @description user country as iso string */
             country_iso?: string;
             /** @description user birth_date */
@@ -1833,6 +2006,8 @@ export interface components {
             access_token?: string;
             access_token_secret?: string;
             refresh_token?: string;
+            /** @description ISO 8601 timestamp when the stored provider `access_token` expires. Stamped from the provider `expires_in` on (re-)authorization and refresh. Absent when the provider issues non-expiring tokens. */
+            access_token_expires_at?: string;
             profile_data: unknown;
             /** @description Object is related with this account */
             account: string;
@@ -2138,6 +2313,14 @@ export interface components {
             allow_offline_access: boolean;
             /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
             skip_consent: boolean;
+            /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
+            include_teams_in_access_token: boolean;
+            /** @description When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant. */
+            include_roles_in_access_token: boolean;
+            /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time. */
+            include_teams_in_id_token: boolean;
+            /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`. */
+            include_roles_in_id_token: boolean;
             /** @description Object is related with this account */
             account: string;
             /**
@@ -2190,6 +2373,14 @@ export interface components {
             allow_offline_access?: boolean;
             /** @description When true, skip the consent prompt for first-party clients. */
             skip_consent?: boolean;
+            /** @description When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs. */
+            include_teams_in_access_token?: boolean;
+            /** @description When true, access_tokens issued for this API carry a `roles` claim with the subject role names. */
+            include_roles_in_access_token?: boolean;
+            /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. */
+            include_teams_in_id_token?: boolean;
+            /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. */
+            include_roles_in_id_token?: boolean;
         };
         /** @description Partial update for an Api. `identifier` is immutable and not present here; recreate the API if you need to change it. */
         ApiUpdate: {
@@ -2211,6 +2402,14 @@ export interface components {
             allow_offline_access?: boolean;
             /** @description When true, skip the consent prompt for first-party clients. */
             skip_consent?: boolean;
+            /** @description When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs. */
+            include_teams_in_access_token?: boolean;
+            /** @description When true, access_tokens issued for this API carry a `roles` claim with the subject role names. */
+            include_roles_in_access_token?: boolean;
+            /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. */
+            include_teams_in_id_token?: boolean;
+            /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. */
+            include_roles_in_id_token?: boolean;
         };
         /** @description Action */
         Action: {
@@ -2559,6 +2758,17 @@ export interface components {
             message?: string;
             /** @description Type-specific structured payload */
             data?: unknown;
+            user?: components["schemas"]["User"] | string | unknown;
+            client?: components["schemas"]["Client"] | string | unknown;
+            connection?: components["schemas"]["Connection"] | string | unknown;
+            team?: components["schemas"]["Team"] | string | unknown;
+            identity?: components["schemas"]["Identity"] | string | unknown;
+            ticket?: string;
+            /**
+             * Format: date-time
+             * @description When this log row will be auto-deleted by the Mongo TTL monitor. Absent on rows recorded without `ttl_seconds`.
+             */
+            expires_at?: string;
             /** @description Object is related with this account */
             account: string;
             /**
@@ -2714,6 +2924,18 @@ export interface components {
             callback_hostnames?: string[];
             default_connection?: string | null;
             enabled_locales?: string[];
+            notification_settings?: {
+                /**
+                 * @description Send the built-in welcome email on user.created
+                 * @default false
+                 */
+                welcome_email_enabled: boolean;
+                /**
+                 * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                 * @default false
+                 */
+                verify_email_auto_send: boolean;
+            };
         };
         OAuthTokenParams: {
             /** @description Grant Type. https://oauth.net/2/grant-types/ */
@@ -2730,8 +2952,10 @@ export interface components {
             subject_token_type?: string;
             /** @description The device code returned by the authorization server. */
             device_code?: string;
-            /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+            /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are provided they must match. */
             audience?: string;
+            /** @description RFC 8707 Resource Indicator. Absolute URI of the target Api, no fragment. Matched against `Api.identifier` in the tenant. */
+            resource?: string;
         } & {
             [key: string]: unknown;
         };
@@ -2757,8 +2981,10 @@ export interface components {
             /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
             max_age?: number;
             prompt?: string;
-            /** @description Resource Indicator (RFC 8707). Identifier of the Api the client wants to access. Persisted in the auth state so the token issued at /oauth/token targets the matching Api resource and its `aud` claim is set to this value. */
+            /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are sent they must match. Identifier of the Api the client wants to access; persisted in the auth state so the token issued at /oauth/token targets the matching Api resource. */
             audience?: string;
+            /** @description RFC 8707 Resource Indicator. MUST be an absolute URI without fragment. When matched against a registered Api in the tenant the issued access_token gets `aud = <api.identifier>`. */
+            resource?: string;
         };
         LoginCallbackBody: {
             /** @description is always wsignin1.0 */
@@ -2817,6 +3043,11 @@ export interface operations {
                              * @default false
                              */
                             welcome_email_enabled: boolean;
+                            /**
+                             * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                             * @default false
+                             */
+                            verify_email_auto_send: boolean;
                         };
                         /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
                         email_change_verification_mode?: "new_only" | "old_and_new";
@@ -2923,6 +3154,11 @@ export interface operations {
                              * @default false
                              */
                             welcome_email_enabled: boolean;
+                            /**
+                             * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                             * @default false
+                             */
+                            verify_email_auto_send: boolean;
                         };
                         /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
                         email_change_verification_mode?: "new_only" | "old_and_new";
@@ -2984,6 +3220,11 @@ export interface operations {
                              * @default false
                              */
                             welcome_email_enabled: boolean;
+                            /**
+                             * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                             * @default false
+                             */
+                            verify_email_auto_send: boolean;
                         };
                         /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
                         email_change_verification_mode?: "new_only" | "old_and_new";
@@ -3021,6 +3262,18 @@ export interface operations {
                     callback_hostnames?: string[];
                     default_connection?: string | null;
                     enabled_locales?: string[];
+                    notification_settings?: {
+                        /**
+                         * @description Send the built-in welcome email on user.created
+                         * @default false
+                         */
+                        welcome_email_enabled?: boolean;
+                        /**
+                         * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                         * @default false
+                         */
+                        verify_email_auto_send?: boolean;
+                    };
                 };
             };
         };
@@ -3053,6 +3306,11 @@ export interface operations {
                              * @default false
                              */
                             welcome_email_enabled: boolean;
+                            /**
+                             * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                             * @default false
+                             */
+                            verify_email_auto_send: boolean;
                         };
                         /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
                         email_change_verification_mode?: "new_only" | "old_and_new";
@@ -3123,6 +3381,11 @@ export interface operations {
                              * @default false
                              */
                             welcome_email_enabled: boolean;
+                            /**
+                             * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
+                             * @default false
+                             */
+                            verify_email_auto_send: boolean;
                         };
                         /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
                         email_change_verification_mode?: "new_only" | "old_and_new";
@@ -3145,14 +3408,16 @@ export interface operations {
     "connection/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Full-text search across: `connection_name`, `connection_type`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -3160,16 +3425,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Connection"][];
                     };
                 };
@@ -3207,6 +3470,13 @@ export interface operations {
                     authorize_params?: {
                         [key: string]: string;
                     };
+                    /**
+                     * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
+                     *
+                     *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
+                     *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
+                     */
+                    email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                     /** @description Add Metadata */
                     metadata?: {
                         [key: string]: unknown;
@@ -3255,6 +3525,13 @@ export interface operations {
                         authorize_params: {
                             [key: string]: string;
                         };
+                        claims_mapping?: {
+                            [key: string]: string;
+                        };
+                        /** @description Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read. */
+                        readonly is_using_default_credentials: boolean;
+                        /** @description Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant. */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -3324,6 +3601,13 @@ export interface operations {
                         authorize_params: {
                             [key: string]: string;
                         };
+                        claims_mapping?: {
+                            [key: string]: string;
+                        };
+                        /** @description Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read. */
+                        readonly is_using_default_credentials: boolean;
+                        /** @description Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant. */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -3342,7 +3626,7 @@ export interface operations {
             };
         };
     };
-    "connection/remove": {
+    "connection/update": {
         parameters: {
             query?: never;
             header?: never;
@@ -3351,68 +3635,229 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
-        responses: {
-            /** @description Default Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
+        /** @description Partial update for a Connection. Only the supplied fields are modified. `connection_type` is intentionally excluded — changing it would orphan every identity already linked to this connection. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    connection_name?: string;
+                    enabled?: boolean;
+                    enabled_clients?: string[];
+                    scope?: string[];
+                    client_id?: string;
+                    client_secret?: string;
+                    issuer?: string;
+                    authorize_url?: string;
+                    token_url?: string;
+                    userinfo_url?: string;
+                    jwks_url?: string;
+                    response_type?: string;
+                    /**
+                     * @description Authorize params
+                     * @default {}
+                     */
+                    authorize_params?: {
+                        [key: string]: string;
+                    };
+                    claims_mapping?: {
+                        [key: string]: string;
+                    };
+                    email_oauth_sync_policy?: "preserve_manual" | "always_sync" | null;
                 };
-                content?: never;
-            };
-        };
-    };
-    "client/list": {
-        parameters: {
-            query?: {
-                /** @description Start from this cursor */
-                cursor?: string;
-                /** @description Start from this cursor */
-                next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
-                /** @description Filter using a FaableQL query */
-                query?: string;
             };
-            header?: never;
-            path?: never;
-            cookie?: never;
         };
-        requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Connection */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
-                        next: string | null;
-                        /** @description List of results */
-                        results: components["schemas"]["Client"][];
-                    };
-                };
-            };
-        };
-    };
-    "client/create": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** @description ClientCreate */
-        requestBody: {
-            content: {
-                "application/json": {
-                    name: string;
-                    description?: string;
-                    callbacks?: string[];
-                    logout_urls?: string[];
-                    /** @description Add Metadata */
-                    metadata?: {
+                        /** @description Connection ID */
+                        id: string;
+                        connection_name: string;
+                        /** @enum {unknown} */
+                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc" | "passwordless_email";
+                        /** @default null */
+                        authorize_url: string;
+                        /** @default null */
+                        token_url: string;
+                        /** @default null */
+                        userinfo_url: string;
+                        /** @default null */
+                        client_id: string;
+                        /** @default null */
+                        client_secret: string;
+                        /** @default null */
+                        issuer: string;
+                        /** @default null */
+                        jwks_url: string;
+                        /** @default null */
+                        response_type: string;
+                        enabled: boolean;
+                        /** @default null */
+                        enabled_clients: string[] | null;
+                        /** @default [] */
+                        scope: string[];
+                        /**
+                         * @description Authorize params
+                         * @default {}
+                         */
+                        authorize_params: {
+                            [key: string]: string;
+                        };
+                        claims_mapping?: {
+                            [key: string]: string;
+                        };
+                        /** @description Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read. */
+                        readonly is_using_default_credentials: boolean;
+                        /** @description Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant. */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ConnectionMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Connection creation date */
+                        createdAt: string;
+                        /** @description Connection updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "connection/delete": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                connection_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Connection */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Connection ID */
+                        id: string;
+                        connection_name: string;
+                        /** @enum {unknown} */
+                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc" | "passwordless_email";
+                        /** @default null */
+                        authorize_url: string;
+                        /** @default null */
+                        token_url: string;
+                        /** @default null */
+                        userinfo_url: string;
+                        /** @default null */
+                        client_id: string;
+                        /** @default null */
+                        client_secret: string;
+                        /** @default null */
+                        issuer: string;
+                        /** @default null */
+                        jwks_url: string;
+                        /** @default null */
+                        response_type: string;
+                        enabled: boolean;
+                        /** @default null */
+                        enabled_clients: string[] | null;
+                        /** @default [] */
+                        scope: string[];
+                        /**
+                         * @description Authorize params
+                         * @default {}
+                         */
+                        authorize_params: {
+                            [key: string]: string;
+                        };
+                        claims_mapping?: {
+                            [key: string]: string;
+                        };
+                        /** @description Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read. */
+                        readonly is_using_default_credentials: boolean;
+                        /** @description Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant. */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ConnectionMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Connection creation date */
+                        createdAt: string;
+                        /** @description Connection updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "client/list": {
+        parameters: {
+            query?: {
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
+                cursor?: string;
+                /** @description Cursor returned by the previous page */
+                next?: string;
+                /** @description Filter using a FaableQL query */
+                query?: string;
+                /** @description Full-text search across: `name`, `description`, `client_id`. */
+                q?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        next: string | null;
+                        results: components["schemas"]["Client"][];
+                    };
+                };
+            };
+        };
+    };
+    "client/create": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** @description ClientCreate */
+        requestBody: {
+            content: {
+                "application/json": {
+                    name: string;
+                    description?: string;
+                    callbacks?: string[];
+                    logout_urls?: string[];
+                    /** @description Add Metadata */
+                    metadata?: {
                         [key: string]: unknown;
                     };
                 };
@@ -3534,7 +3979,103 @@ export interface operations {
             };
         };
     };
-    "client/remove": {
+    "client/update": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                client_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Partial update for a Client. Only the supplied fields are modified. `client_id` and `client_secret` are not editable through this endpoint to prevent accidental rotation; use a dedicated endpoint when secret rotation is added. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Human-readable client name shown in consent screens. */
+                    name?: string;
+                    /** @description Free-form description for internal admin use. */
+                    description?: string;
+                    /** @description Whitelist of allowed OAuth `redirect_uri` values. */
+                    callbacks?: string[];
+                    /** @description Whitelist of allowed `post_logout_redirect_uri` values. */
+                    logout_urls?: string[];
+                    refresh_token?: {
+                        /** @enum {unknown} */
+                        expiration_mode: "expire" | "not-expire";
+                        infinite_token_lifetime: boolean;
+                        token_lifetime: number;
+                    };
+                    client_uri?: string | null;
+                    logo_uri?: string | null;
+                    tos_uri?: string | null;
+                    policy_uri?: string | null;
+                    contacts?: string[];
+                    grant_types?: string[];
+                    response_types?: string[];
+                    token_endpoint_auth_method?: string;
+                    application_type?: string;
+                    software_id?: string | null;
+                    software_version?: string | null;
+                    frontchannel_logout_uri?: string | null;
+                    frontchannel_logout_session_required?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Client */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Client ID */
+                        id: string;
+                        name: string;
+                        description: string;
+                        client_id: string;
+                        client_secret: string;
+                        callbacks: string[];
+                        logout_urls: string[];
+                        refresh_token: {
+                            /** @enum {unknown} */
+                            expiration_mode: "expire" | "not-expire";
+                            infinite_token_lifetime: boolean;
+                            token_lifetime: number;
+                        };
+                        client_uri?: string | null;
+                        logo_uri?: string | null;
+                        tos_uri?: string | null;
+                        policy_uri?: string | null;
+                        contacts?: string[];
+                        grant_types?: string[];
+                        response_types?: string[];
+                        token_endpoint_auth_method?: string;
+                        application_type?: string;
+                        software_id?: string | null;
+                        software_version?: string | null;
+                        frontchannel_logout_uri?: string | null;
+                        frontchannel_logout_session_required?: boolean;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ClientMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Client creation date */
+                        createdAt: string;
+                        /** @description Client updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "client/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -3545,26 +4086,134 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Client */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description Client ID */
+                        id: string;
+                        name: string;
+                        description: string;
+                        client_id: string;
+                        client_secret: string;
+                        callbacks: string[];
+                        logout_urls: string[];
+                        refresh_token: {
+                            /** @enum {unknown} */
+                            expiration_mode: "expire" | "not-expire";
+                            infinite_token_lifetime: boolean;
+                            token_lifetime: number;
+                        };
+                        client_uri?: string | null;
+                        logo_uri?: string | null;
+                        tos_uri?: string | null;
+                        policy_uri?: string | null;
+                        contacts?: string[];
+                        grant_types?: string[];
+                        response_types?: string[];
+                        token_endpoint_auth_method?: string;
+                        application_type?: string;
+                        software_id?: string | null;
+                        software_version?: string | null;
+                        frontchannel_logout_uri?: string | null;
+                        frontchannel_logout_session_required?: boolean;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ClientMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Client creation date */
+                        createdAt: string;
+                        /** @description Client updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "client/rotateSecret": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                client_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Client */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Client ID */
+                        id: string;
+                        name: string;
+                        description: string;
+                        client_id: string;
+                        client_secret: string;
+                        callbacks: string[];
+                        logout_urls: string[];
+                        refresh_token: {
+                            /** @enum {unknown} */
+                            expiration_mode: "expire" | "not-expire";
+                            infinite_token_lifetime: boolean;
+                            token_lifetime: number;
+                        };
+                        client_uri?: string | null;
+                        logo_uri?: string | null;
+                        tos_uri?: string | null;
+                        policy_uri?: string | null;
+                        contacts?: string[];
+                        grant_types?: string[];
+                        response_types?: string[];
+                        token_endpoint_auth_method?: string;
+                        application_type?: string;
+                        software_id?: string | null;
+                        software_version?: string | null;
+                        frontchannel_logout_uri?: string | null;
+                        frontchannel_logout_session_required?: boolean;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ClientMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Client creation date */
+                        createdAt: string;
+                        /** @description Client updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
     "user/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Full-text search across: `name`, `email`, `phone`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -3572,16 +4221,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["User"][];
                     };
                 };
@@ -3657,12 +4304,20 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
+                        email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
                         email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
+                        phone_verified_at?: string | null;
                         /** @description country iso code */
                         country_iso?: string | null;
                         /** @description user birth_date */
@@ -3768,12 +4423,20 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
+                        email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
                         email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
+                        phone_verified_at?: string | null;
                         /** @description country iso code */
                         country_iso?: string | null;
                         /** @description user birth_date */
@@ -3859,12 +4522,16 @@ export interface operations {
                     given_name?: string;
                     /** @description family name */
                     family_name?: string;
-                    /** @description contact email */
+                    /** @description Contact email. Changing the email to a new value automatically resets `email_verified` to false (and clears `email_verified_method` / `email_verified_at`) unless the same patch sets `email_verified` explicitly. The override is the documented way to import a pre-verified user from another IdP. */
                     email?: string;
+                    /** @description Flip the email verification flag. Setting `true` marks the email as verified by the admin (`email_verified_method=manual`). Setting `false` clears the verification metadata. */
+                    email_verified?: boolean;
                     /** @description New password for this user */
                     password?: string;
-                    /** @description contact phone number */
+                    /** @description Contact phone number. Changing it to a new value automatically resets `phone_verified` to false (and clears `phone_verified_method` / `phone_verified_at`) unless the same patch sets `phone_verified` explicitly. */
                     phone?: string;
+                    /** @description Flip the phone verification flag. Setting `true` marks the phone as verified by the admin (`phone_verified_method=manual`). */
+                    phone_verified?: boolean;
                     /** @description user country as iso string */
                     country_iso?: string;
                     /** @description user birth_date */
@@ -3913,12 +4580,139 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
+                        email_verified_at?: string | null;
+                        /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+                        email_change_locked_at?: string | null;
+                        /** @description contact phone number */
+                        phone?: string | null;
+                        /** @description phone is verified */
+                        phone_verified: boolean;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
+                        phone_verified_at?: string | null;
+                        /** @description country iso code */
+                        country_iso?: string | null;
+                        /** @description user birth_date */
+                        birth_date?: string | null;
+                        /** @description User gender (free-form, OIDC §5.1) */
+                        gender?: string | null;
+                        /** @description IANA time-zone name (e.g. "Europe/Madrid"). OIDC §5.1 — used for the `zoneinfo` claim. */
+                        zoneinfo?: string | null;
+                        /** @description user main language */
+                        locale?: string;
+                        /** @description customer region */
+                        region?: string | null;
+                        /** @description URL of the User's personal Web page or blog (OIDC §5.1) */
+                        website?: string | null;
+                        address?: {
+                            /** @description Full mailing address, formatted for display (may contain newlines) */
+                            formatted?: string | null;
+                            street_address?: string | null;
+                            /** @description City or locality */
+                            locality?: string | null;
+                            /** @description State, province, or region */
+                            region?: string | null;
+                            postal_code?: string | null;
+                            /** @description Country name */
+                            country?: string | null;
+                        } | null;
+                        /** @description User picture url */
+                        picture?: string | null;
+                        /** @description Total number of logins this user has performed. */
+                        logins_count: number;
+                        /** @description Last IP address from which this user logged in */
+                        last_ip?: string | null;
+                        /** @description Last date and time this user logged in (ISO_8601 format) */
+                        last_login?: string | null;
+                        /**
+                         * @description User Metadata
+                         * @default {}
+                         */
+                        user_metadata: {
+                            [key: string]: unknown;
+                        };
+                        /**
+                         * @description App Metadata
+                         * @default {}
+                         */
+                        app_metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description UserMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description User creation date */
+                        createdAt: string;
+                        /** @description User updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "user/delete": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description User */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description User ID */
+                        id: string;
+                        /** @description User name */
+                        name?: string | null;
+                        /** @description unique username for this user */
+                        username?: string | null;
+                        /** @description Given name */
+                        given_name?: string | null;
+                        /** @description Family name */
+                        family_name?: string | null;
+                        /** @description Middle name (OIDC §5.1) */
+                        middle_name?: string | null;
+                        /** @description Casual name. Distinct from given_name (e.g. "Mike" vs "Michael"). OIDC §5.1 */
+                        nickname?: string | null;
+                        /** @description User email */
+                        email?: string | null;
+                        /**
+                         * @description true if email is verified
+                         * @default false
+                         */
+                        email_verified: boolean;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
+                        email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
                         email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
+                        phone_verified_at?: string | null;
                         /** @description country iso code */
                         country_iso?: string | null;
                         /** @description user birth_date */
@@ -3985,7 +4779,7 @@ export interface operations {
             };
         };
     };
-    "user/remove": {
+    "user/changeEmail": {
         parameters: {
             query?: never;
             header?: never;
@@ -3994,6 +4788,45 @@ export interface operations {
             };
             cookie?: never;
         };
+        /** @description Payload for `POST /user/:user_id/change-email`. Triggers the verification flow: a Ticket is created and an email is sent to the new address with a confirmation link. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The email address the user wants to switch to. */
+                    new_email: string;
+                    /** @description Override the account-wide policy. Can only raise the bar: passing `old_and_new` forces double verification; `new_only` is ignored if the account requires `old_and_new`. */
+                    verification_mode?: "new_only" | "old_and_new";
+                    /** @description Where to send the user after they click the link in the verification email. The status of the operation is appended as a `?status=applied|pending_old` query param so the calling app can render the right screen. When omitted, the user lands on the auth host's `/flow/email-change-done` fallback. */
+                    redirect_uri?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "verification_sent";
+                        ticket_id: string;
+                        verification_mode: "new_only" | "old_and_new";
+                    };
+                };
+            };
+        };
+    };
+    user_change_email_verify: {
+        parameters: {
+            query: {
+                ticket: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
         requestBody?: never;
         responses: {
             /** @description Default Response */
@@ -4005,7 +4838,7 @@ export interface operations {
             };
         };
     };
-    "user/changeEmail": {
+    "user/verifyEmailStart": {
         parameters: {
             query?: never;
             header?: never;
@@ -4014,15 +4847,11 @@ export interface operations {
             };
             cookie?: never;
         };
-        /** @description Payload for `POST /user/:user_id/change-email`. Triggers the verification flow: a Ticket is created and an email is sent to the new address with a confirmation link. */
+        /** @description Optional payload for `POST /user/:user_id/verify-email/start`. Trigger a verification email send for the given user. */
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description The email address the user wants to switch to. */
-                    new_email: string;
-                    /** @description Override the account-wide policy. Can only raise the bar: passing `old_and_new` forces double verification; `new_only` is ignored if the account requires `old_and_new`. */
-                    verification_mode?: "new_only" | "old_and_new";
-                    /** @description Where to send the user after they click the link in the verification email. The status of the operation is appended as a `?status=applied|pending_old` query param so the calling app can render the right screen. When omitted, the user lands on the auth host's `/flow/email-change-done` fallback. */
+                    /** @description Where to send the user after they click the link. The status of the operation is appended as `?status=verified|already_verified|invalid_link|expired` so the calling app can render the right screen. When omitted, the user lands on the auth host's `/flow/verify-email-done` fallback. */
                     redirect_uri?: string;
                 };
             };
@@ -4035,16 +4864,14 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
-                        /** @enum {string} */
-                        status: "verification_sent";
-                        ticket_id: string;
-                        verification_mode: "new_only" | "old_and_new";
+                        status: "verification_sent" | "already_verified";
+                        ticket_id?: string;
                     };
                 };
             };
         };
     };
-    user_change_email_verify: {
+    user_verify_email_confirm: {
         parameters: {
             query: {
                 ticket: string;
@@ -4067,12 +4894,12 @@ export interface operations {
     "identity/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
@@ -4084,16 +4911,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Identity"][];
                     };
                 };
@@ -4137,6 +4962,8 @@ export interface operations {
                         access_token?: string;
                         access_token_secret?: string;
                         refresh_token?: string;
+                        /** @description ISO 8601 timestamp when the stored provider `access_token` expires. Stamped from the provider `expires_in` on (re-)authorization and refresh. Absent when the provider issues non-expiring tokens. */
+                        access_token_expires_at?: string;
                         profile_data: unknown;
                         /** @description Object is related with this account */
                         account: string;
@@ -4185,6 +5012,8 @@ export interface operations {
                         access_token?: string;
                         access_token_secret?: string;
                         refresh_token?: string;
+                        /** @description ISO 8601 timestamp when the stored provider `access_token` expires. Stamped from the provider `expires_in` on (re-)authorization and refresh. Absent when the provider issues non-expiring tokens. */
+                        access_token_expires_at?: string;
                         profile_data: unknown;
                         /** @description Object is related with this account */
                         account: string;
@@ -4204,7 +5033,7 @@ export interface operations {
             };
         };
     };
-    "identity/remove": {
+    "identity/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -4214,27 +5043,85 @@ export interface operations {
             cookie?: never;
         };
         requestBody?: never;
+        responses: {
+            /** @description Identity */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Identity ID */
+                        id: string;
+                        connection: components["schemas"]["Connection"] | string | unknown;
+                        user: components["schemas"]["User"] | string | unknown;
+                        identity_id: string;
+                        access_token?: string;
+                        access_token_secret?: string;
+                        refresh_token?: string;
+                        /** @description ISO 8601 timestamp when the stored provider `access_token` expires. Stamped from the provider `expires_in` on (re-)authorization and refresh. Absent when the provider issues non-expiring tokens. */
+                        access_token_expires_at?: string;
+                        profile_data: unknown;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description IdentityMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Identity creation date */
+                        createdAt: string;
+                        /** @description Identity updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "identity/getProviderToken": {
+        parameters: {
+            query?: {
+                /** @description Force a refresh against the provider even when the stored token still looks valid. */
+                fresh?: boolean;
+            };
+            header?: never;
+            path: {
+                identity_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
         responses: {
             /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        access_token: string;
+                        access_token_expires_at?: string;
+                        refreshed: boolean;
+                    };
+                };
             };
         };
     };
     "role/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Full-text search across: `name`, `description`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -4242,16 +5129,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Role"][];
                     };
                 };
@@ -4418,7 +5303,7 @@ export interface operations {
             };
         };
     };
-    "role/remove": {
+    "role/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -4429,12 +5314,37 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Role */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description Role ID */
+                        id: string;
+                        /**
+                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+                         * @example admin
+                         */
+                        name: string;
+                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
+                        description: string;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description RoleMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Role creation date */
+                        createdAt: string;
+                        /** @description Role updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
@@ -4508,12 +5418,12 @@ export interface operations {
     "rolemember/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
@@ -4525,16 +5435,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["RoleMember"][];
                     };
                 };
@@ -4639,7 +5547,7 @@ export interface operations {
             };
         };
     };
-    "rolemember/remove": {
+    "rolemember/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -4650,26 +5558,50 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description RoleMember */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description RoleMember ID */
+                        id: string;
+                        /** @description Role granted to the user. Returned as an id by default; pass `?expand=role` to inline the full Role object. */
+                        role: components["schemas"]["Role"] | string | unknown;
+                        /** @description User the role is granted to. Returned as an id by default; pass `?expand=user` to inline the full User object. */
+                        user: components["schemas"]["User"] | string | unknown;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description RoleMemberMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description RoleMember creation date */
+                        createdAt: string;
+                        /** @description RoleMember updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
     "team/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Full-text search across: `name`, `slug`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -4677,16 +5609,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Team"][];
                     };
                 };
@@ -4878,7 +5808,7 @@ export interface operations {
             };
         };
     };
-    "team/remove": {
+    "team/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -4889,24 +5819,56 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Team */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description Team ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+                         * @example Acme Engineering
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+                         * @example acme-engineering
+                         */
+                        slug: string;
+                        /** @description Optional free-form description of the team. */
+                        description: string | null;
+                        /** @description Optional URL of an image used as the team avatar/logo. */
+                        logo_url: string | null;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description TeamMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Team creation date */
+                        createdAt: string;
+                        /** @description Team updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
     "teammember/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
@@ -4918,16 +5880,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["TeamMember"][];
                     };
                 };
@@ -5044,7 +6004,7 @@ export interface operations {
             };
         };
     };
-    "teammember/remove": {
+    "teammember/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -5055,12 +6015,36 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description TeamMember */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description TeamMember ID */
+                        id: string;
+                        /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
+                        user: components["schemas"]["User"] | string | unknown;
+                        /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
+                        team: components["schemas"]["Team"] | string | unknown;
+                        /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
+                        roles: (components["schemas"]["Role"] | string | unknown)[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description TeamMemberMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description TeamMember creation date */
+                        createdAt: string;
+                        /** @description TeamMember updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
@@ -5073,6 +6057,8 @@ export interface operations {
                 next?: string;
                 /** @description Size of the results array */
                 pageSize?: number;
+                /** @description Expand id-only fields in the response. Accepts repeated params (`expand=user&expand=roles`) or comma-separated (`expand=user,roles`). */
+                expand?: ("user" | "team" | "roles")[];
             };
             header?: never;
             path: {
@@ -5394,14 +6380,16 @@ export interface operations {
     "api/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Full-text search across: `name`, `description`, `identifier`, `slug`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -5409,16 +6397,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Api"][];
                     };
                 };
@@ -5465,6 +6451,14 @@ export interface operations {
                     allow_offline_access?: boolean;
                     /** @description When true, skip the consent prompt for first-party clients. */
                     skip_consent?: boolean;
+                    /** @description When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs. */
+                    include_teams_in_access_token?: boolean;
+                    /** @description When true, access_tokens issued for this API carry a `roles` claim with the subject role names. */
+                    include_roles_in_access_token?: boolean;
+                    /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. */
+                    include_teams_in_id_token?: boolean;
+                    /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. */
+                    include_roles_in_id_token?: boolean;
                 };
             };
         };
@@ -5506,6 +6500,14 @@ export interface operations {
                         allow_offline_access: boolean;
                         /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
                         skip_consent: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
+                        include_teams_in_access_token: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant. */
+                        include_roles_in_access_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time. */
+                        include_teams_in_id_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`. */
+                        include_roles_in_id_token: boolean;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5572,6 +6574,14 @@ export interface operations {
                         allow_offline_access: boolean;
                         /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
                         skip_consent: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
+                        include_teams_in_access_token: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant. */
+                        include_roles_in_access_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time. */
+                        include_teams_in_id_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`. */
+                        include_roles_in_id_token: boolean;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5621,6 +6631,14 @@ export interface operations {
                     allow_offline_access?: boolean;
                     /** @description When true, skip the consent prompt for first-party clients. */
                     skip_consent?: boolean;
+                    /** @description When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs. */
+                    include_teams_in_access_token?: boolean;
+                    /** @description When true, access_tokens issued for this API carry a `roles` claim with the subject role names. */
+                    include_roles_in_access_token?: boolean;
+                    /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. */
+                    include_teams_in_id_token?: boolean;
+                    /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. */
+                    include_roles_in_id_token?: boolean;
                 };
             };
         };
@@ -5662,6 +6680,14 @@ export interface operations {
                         allow_offline_access: boolean;
                         /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
                         skip_consent: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
+                        include_teams_in_access_token: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant. */
+                        include_roles_in_access_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time. */
+                        include_teams_in_id_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`. */
+                        include_roles_in_id_token: boolean;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5680,7 +6706,7 @@ export interface operations {
             };
         };
     };
-    "api/remove": {
+    "api/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -5691,12 +6717,66 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Api */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description Api ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name for the API. Shown in the dashboard and consent prompts.
+                         * @example My Backend API
+                         */
+                        name: string;
+                        /** @description URL-safe identifier auto-derived from `name`. Unique within the tenant. */
+                        slug: string;
+                        /**
+                         * @description Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.
+                         * @example https://api.faable.com
+                         */
+                        identifier: string;
+                        /** @description Optional human-readable description of the API. */
+                        description?: string;
+                        /** @description Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim. */
+                        permissions: components["schemas"]["Permission"][];
+                        /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                        signing_alg: "RS256";
+                        /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                        token_dialect: "access_token" | "access_token_authz";
+                        /** @description Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default). */
+                        token_lifetime: number;
+                        /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
+                        enforce_policies: boolean;
+                        /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
+                        allow_offline_access: boolean;
+                        /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
+                        skip_consent: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
+                        include_teams_in_access_token: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant. */
+                        include_roles_in_access_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time. */
+                        include_teams_in_id_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`. */
+                        include_roles_in_id_token: boolean;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ApiMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Api creation date */
+                        createdAt: string;
+                        /** @description Api updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
@@ -5765,12 +6845,12 @@ export interface operations {
     "action/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
             };
@@ -5780,16 +6860,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Action"][];
                     };
                 };
@@ -5931,7 +7009,7 @@ export interface operations {
             };
         };
     };
-    "action/remove": {
+    "action/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -5942,24 +7020,62 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Action */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description Action ID */
+                        id: string;
+                        /** @description Action Name */
+                        name: string;
+                        /**
+                         * @description Trigger event name
+                         * @default post-login
+                         * @enum {unknown}
+                         */
+                        trigger: "continue" | "post-login";
+                        /** @description JavaScript Code to execute */
+                        code: string;
+                        /**
+                         * @description Is this action active?
+                         * @default true
+                         */
+                        enabled: boolean;
+                        /**
+                         * @description Execution order
+                         * @default 0
+                         */
+                        order: number;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ActionMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Action creation date */
+                        createdAt: string;
+                        /** @description Action updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
     "notificationsubscription/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
             };
@@ -5969,16 +7085,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["NotificationSubscription"][];
                     };
                 };
@@ -6285,7 +7399,7 @@ export interface operations {
             };
         };
     };
-    "notificationsubscription/remove": {
+    "notificationsubscription/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -6296,26 +7410,86 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description NotificationSubscription */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description NotificationSubscriptionEmail ID */
+                        id: string;
+                        events: string[];
+                        /** @enum {string} */
+                        channel: "email";
+                        /** @description Whether the subscription is active */
+                        active: boolean;
+                        config: {
+                            recipients: string[];
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description NotificationSubscriptionEmailMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description NotificationSubscriptionEmail creation date */
+                        createdAt: string;
+                        /** @description NotificationSubscriptionEmail updated date */
+                        updatedAt?: string;
+                    } | {
+                        /** @description NotificationSubscriptionWebhook ID */
+                        id: string;
+                        events: string[];
+                        /** @enum {string} */
+                        channel: "webhook";
+                        /** @description Whether the subscription is active */
+                        active: boolean;
+                        config: {
+                            /**
+                             * Format: uri
+                             * @description Webhook URL
+                             */
+                            url: string;
+                            /** @description Secret used to sign the webhook payload */
+                            secret: string;
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description NotificationSubscriptionWebhookMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description NotificationSubscriptionWebhook creation date */
+                        createdAt: string;
+                        /** @description NotificationSubscriptionWebhook updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
     "log/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "client" | "connection" | "team" | "identity")[];
+                /** @description Full-text search across: `message`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -6323,16 +7497,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Log"][];
                     };
                 };
@@ -6341,7 +7513,10 @@ export interface operations {
     };
     "log/get": {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
+                expand?: ("user" | "client" | "connection" | "team" | "identity")[];
+            };
             header?: never;
             path: {
                 log_id: string;
@@ -6367,6 +7542,17 @@ export interface operations {
                         message?: string;
                         /** @description Type-specific structured payload */
                         data?: unknown;
+                        user?: components["schemas"]["User"] | string | unknown;
+                        client?: components["schemas"]["Client"] | string | unknown;
+                        connection?: components["schemas"]["Connection"] | string | unknown;
+                        team?: components["schemas"]["Team"] | string | unknown;
+                        identity?: components["schemas"]["Identity"] | string | unknown;
+                        ticket?: string;
+                        /**
+                         * Format: date-time
+                         * @description When this log row will be auto-deleted by the Mongo TTL monitor. Absent on rows recorded without `ttl_seconds`.
+                         */
+                        expires_at?: string;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -6408,14 +7594,16 @@ export interface operations {
     "customdomain/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
+                /** @description Full-text search across: `domain`. */
+                q?: string;
             };
             header?: never;
             path?: never;
@@ -6423,16 +7611,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Customdomain"][];
                     };
                 };
@@ -6550,7 +7736,7 @@ export interface operations {
             };
         };
     };
-    "customdomain/remove": {
+    "customdomain/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -6561,12 +7747,43 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Customdomain */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description Customdomain ID */
+                        id: string;
+                        domain: string;
+                        token: string;
+                        /** @enum {unknown} */
+                        status: "PENDING" | "VERIFYING" | "ACTIVE" | "FAILED" | "DEGRADED";
+                        attempts: number;
+                        /** Format: date-time */
+                        nextCheck?: string;
+                        /** Format: date-time */
+                        lastCheck?: string;
+                        /** @description User feedback error from last check */
+                        errorLog?: string;
+                        /** Format: date-time */
+                        verifiedAt?: string;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description CustomdomainMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Customdomain creation date */
+                        createdAt: string;
+                        /** @description Customdomain updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
@@ -6658,12 +7875,20 @@ export interface operations {
                          * @default false
                          */
                         email_verified: boolean;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
+                        email_verified_at?: string | null;
                         /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
                         email_change_locked_at?: string | null;
                         /** @description contact phone number */
                         phone?: string | null;
                         /** @description phone is verified */
                         phone_verified: boolean;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
+                        phone_verified_at?: string | null;
                         /** @description country iso code */
                         country_iso?: string | null;
                         /** @description user birth_date */
@@ -6786,8 +8011,10 @@ export interface operations {
                 /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
                 max_age?: number;
                 prompt?: string;
-                /** @description Resource Indicator (RFC 8707). Identifier of the Api the client wants to access. Persisted in the auth state so the token issued at /oauth/token targets the matching Api resource and its `aud` claim is set to this value. */
+                /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are sent they must match. Identifier of the Api the client wants to access; persisted in the auth state so the token issued at /oauth/token targets the matching Api resource. */
                 audience?: string;
+                /** @description RFC 8707 Resource Indicator. MUST be an absolute URI without fragment. When matched against a registered Api in the tenant the issued access_token gets `aud = <api.identifier>`. */
+                resource?: string;
             };
             header?: never;
             path?: never;
@@ -6821,8 +8048,10 @@ export interface operations {
                 subject_token_type?: string;
                 /** @description The device code returned by the authorization server. */
                 device_code?: string;
-                /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+                /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are provided they must match. */
                 audience?: string;
+                /** @description RFC 8707 Resource Indicator. Absolute URI of the target Api, no fragment. Matched against `Api.identifier` in the tenant. */
+                resource?: string;
             };
             header?: never;
             path?: never;
@@ -6865,8 +8094,10 @@ export interface operations {
                 subject_token_type?: string;
                 /** @description The device code returned by the authorization server. */
                 device_code?: string;
-                /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+                /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are provided they must match. */
                 audience?: string;
+                /** @description RFC 8707 Resource Indicator. Absolute URI of the target Api, no fragment. Matched against `Api.identifier` in the tenant. */
+                resource?: string;
             };
             header?: never;
             path?: never;
@@ -6889,8 +8120,10 @@ export interface operations {
                     subject_token_type?: string;
                     /** @description The device code returned by the authorization server. */
                     device_code?: string;
-                    /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+                    /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are provided they must match. */
                     audience?: string;
+                    /** @description RFC 8707 Resource Indicator. Absolute URI of the target Api, no fragment. Matched against `Api.identifier` in the tenant. */
+                    resource?: string;
                 } & {
                     [key: string]: unknown;
                 };
@@ -7320,8 +8553,10 @@ export interface operations {
                     /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
                     max_age?: number;
                     prompt?: string;
-                    /** @description Resource Indicator (RFC 8707). Identifier of the Api the client wants to access. Persisted in the auth state so the token issued at /oauth/token targets the matching Api resource and its `aud` claim is set to this value. */
+                    /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are sent they must match. Identifier of the Api the client wants to access; persisted in the auth state so the token issued at /oauth/token targets the matching Api resource. */
                     audience?: string;
+                    /** @description RFC 8707 Resource Indicator. MUST be an absolute URI without fragment. When matched against a registered Api in the tenant the issued access_token gets `aud = <api.identifier>`. */
+                    resource?: string;
                 };
             };
         };