@faable/auth-sdk 1.3.14 → 1.3.16

package/dist/api/types.d.ts

@@ -103,14 +103,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Connections in Account
-         * @description List Connections in Account
+         * List Connections
+         * @description List Connections
          */
         get: operations["connection/list"];
         put?: never;
         /**
-         * Create Connection in Account
-         * @description Create Connection in Account
+         * Create Connection
+         * @description Create Connection
          */
         post: operations["connection/create"];
         delete?: never;
@@ -127,21 +127,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Connection in Account
-         * @description Get Connection in Account
+         * Get Connection
+         * @description Get Connection
          */
         get: operations["connection/get"];
         put?: never;
         /**
-         * Update Connections in Account
-         * @description Update Connections in Account
+         * Update Connection
+         * @description Update Connection
          */
         post: operations["connection/update"];
         /**
-         * Delete Connection in Account
-         * @description Delete Connection in Account
+         * Delete Connection
+         * @description Delete Connection
          */
-        delete: operations["connection/remove"];
+        delete: operations["connection/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -155,14 +155,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Clients in Account
-         * @description List Clients in Account
+         * List Clients
+         * @description List Clients
          */
         get: operations["client/list"];
         put?: never;
         /**
-         * Create Client in Account
-         * @description Create Client in Account
+         * Create Client
+         * @description Create Client
          */
         post: operations["client/create"];
         delete?: never;
@@ -179,21 +179,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Client in Account
-         * @description Get Client in Account
+         * Get Client
+         * @description Get Client
          */
         get: operations["client/get"];
         put?: never;
         /**
-         * Update Clients in Account
-         * @description Update Clients in Account
+         * Update Client
+         * @description Update Client
          */
         post: operations["client/update"];
         /**
-         * Delete Client in Account
-         * @description Delete Client in Account
+         * Delete Client
+         * @description Delete Client
          */
-        delete: operations["client/remove"];
+        delete: operations["client/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -227,14 +227,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Users in Account
-         * @description List Users in Account
+         * List Users
+         * @description List Users
          */
         get: operations["user/list"];
         put?: never;
         /**
-         * Create User in Account
-         * @description Create User in Account
+         * Create User
+         * @description Create User
          */
         post: operations["user/create"];
         delete?: never;
@@ -251,21 +251,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get User in Account
-         * @description Get User in Account
+         * Get User
+         * @description Get User
          */
         get: operations["user/get"];
         put?: never;
         /**
-         * Update Users in Account
-         * @description Update Users in Account
+         * Update User
+         * @description Update User
          */
         post: operations["user/update"];
         /**
-         * Delete User in Account
-         * @description Delete User in Account
+         * Delete User
+         * @description Delete User
          */
-        delete: operations["user/remove"];
+        delete: operations["user/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -359,14 +359,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Identitys in Account
-         * @description List Identitys in Account
+         * List Identitys
+         * @description List Identitys
          */
         get: operations["identity/list"];
         put?: never;
         /**
-         * Create Identity in Account
-         * @description Create Identity in Account
+         * Create Identity
+         * @description Create Identity
          */
         post: operations["identity/create"];
         delete?: never;
@@ -383,17 +383,37 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Identity in Account
-         * @description Get Identity in Account
+         * Get Identity
+         * @description Get Identity
          */
         get: operations["identity/get"];
         put?: never;
         post?: never;
         /**
-         * Delete Identity in Account
-         * @description Delete Identity in Account
+         * Delete Identity
+         * @description Delete Identity
          */
-        delete: operations["identity/remove"];
+        delete: operations["identity/delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/identity/{identity_id}/provider-token": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a guaranteed-valid provider access_token
+         * @description Returns the identity's upstream provider `access_token`, refreshing it transparently via the stored `refresh_token` when it is (about to be) expired. Pass `?fresh=true` to force a refresh. Fails with 400 when the token is expired and no `refresh_token` is available (the user must re-authorize).
+         */
+        get: operations["identity/getProviderToken"];
+        put?: never;
+        post?: never;
+        delete?: never;
         options?: never;
         head?: never;
         patch?: never;
@@ -407,14 +427,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Roles in Account
-         * @description List Roles in Account
+         * List Roles
+         * @description List Roles
          */
         get: operations["role/list"];
         put?: never;
         /**
-         * Create Role in Account
-         * @description Create Role in Account
+         * Create Role
+         * @description Create Role
          */
         post: operations["role/create"];
         delete?: never;
@@ -431,21 +451,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Role in Account
-         * @description Get Role in Account
+         * Get Role
+         * @description Get Role
          */
         get: operations["role/get"];
         put?: never;
         /**
-         * Update Roles in Account
-         * @description Update Roles in Account
+         * Update Role
+         * @description Update Role
          */
         post: operations["role/update"];
         /**
-         * Delete Role in Account
-         * @description Delete Role in Account
+         * Delete Role
+         * @description Delete Role
          */
-        delete: operations["role/remove"];
+        delete: operations["role/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -483,14 +503,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Rolemembers in Account
-         * @description List Rolemembers in Account
+         * List Rolemembers
+         * @description List Rolemembers
          */
         get: operations["rolemember/list"];
         put?: never;
         /**
-         * Create Rolemember in Account
-         * @description Create Rolemember in Account
+         * Create Rolemember
+         * @description Create Rolemember
          */
         post: operations["rolemember/create"];
         delete?: never;
@@ -507,17 +527,17 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Rolemember in Account
-         * @description Get Rolemember in Account
+         * Get Rolemember
+         * @description Get Rolemember
          */
         get: operations["rolemember/get"];
         put?: never;
         post?: never;
         /**
-         * Delete Rolemember in Account
-         * @description Delete Rolemember in Account
+         * Delete Rolemember
+         * @description Delete Rolemember
          */
-        delete: operations["rolemember/remove"];
+        delete: operations["rolemember/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -531,14 +551,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Teams in Account
-         * @description List Teams in Account
+         * List Teams
+         * @description List Teams
          */
         get: operations["team/list"];
         put?: never;
         /**
-         * Create Team in Account
-         * @description Create Team in Account
+         * Create Team
+         * @description Create Team
          */
         post: operations["team/create"];
         delete?: never;
@@ -555,21 +575,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Team in Account
-         * @description Get Team in Account
+         * Get Team
+         * @description Get Team
          */
         get: operations["team/get"];
         put?: never;
         /**
-         * Update Teams in Account
-         * @description Update Teams in Account
+         * Update Team
+         * @description Update Team
          */
         post: operations["team/update"];
         /**
-         * Delete Team in Account
-         * @description Delete Team in Account
+         * Delete Team
+         * @description Delete Team
          */
-        delete: operations["team/remove"];
+        delete: operations["team/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -583,14 +603,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Teammembers in Account
-         * @description List Teammembers in Account
+         * List Teammembers
+         * @description List Teammembers
          */
         get: operations["teammember/list"];
         put?: never;
         /**
-         * Create Teammember in Account
-         * @description Create Teammember in Account
+         * Create Teammember
+         * @description Create Teammember
          */
         post: operations["teammember/create"];
         delete?: never;
@@ -607,17 +627,17 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Teammember in Account
-         * @description Get Teammember in Account
+         * Get Teammember
+         * @description Get Teammember
          */
         get: operations["teammember/get"];
         put?: never;
         post?: never;
         /**
-         * Delete Teammember in Account
-         * @description Delete Teammember in Account
+         * Delete Teammember
+         * @description Delete Teammember
          */
-        delete: operations["teammember/remove"];
+        delete: operations["teammember/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -739,14 +759,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Apis in Account
-         * @description List Apis in Account
+         * List Apis
+         * @description List Apis
          */
         get: operations["api/list"];
         put?: never;
         /**
-         * Create Api in Account
-         * @description Create Api in Account
+         * Create Api
+         * @description Create Api
          */
         post: operations["api/create"];
         delete?: never;
@@ -763,21 +783,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Api in Account
-         * @description Get Api in Account
+         * Get Api
+         * @description Get Api
          */
         get: operations["api/get"];
         put?: never;
         /**
-         * Update Apis in Account
-         * @description Update Apis in Account
+         * Update Api
+         * @description Update Api
          */
         post: operations["api/update"];
         /**
-         * Delete Api in Account
-         * @description Delete Api in Account
+         * Delete Api
+         * @description Delete Api
          */
-        delete: operations["api/remove"];
+        delete: operations["api/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -831,14 +851,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Actions in Account
-         * @description List Actions in Account
+         * List Actions
+         * @description List Actions
          */
         get: operations["action/list"];
         put?: never;
         /**
-         * Create Action in Account
-         * @description Create Action in Account
+         * Create Action
+         * @description Create Action
          */
         post: operations["action/create"];
         delete?: never;
@@ -855,17 +875,17 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Action in Account
-         * @description Get Action in Account
+         * Get Action
+         * @description Get Action
          */
         get: operations["action/get"];
         put?: never;
         post?: never;
         /**
-         * Delete Action in Account
-         * @description Delete Action in Account
+         * Delete Action
+         * @description Delete Action
          */
-        delete: operations["action/remove"];
+        delete: operations["action/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -879,14 +899,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Notificationsubscriptions in Account
-         * @description List Notificationsubscriptions in Account
+         * List Notificationsubscriptions
+         * @description List Notificationsubscriptions
          */
         get: operations["notificationsubscription/list"];
         put?: never;
         /**
-         * Create Notificationsubscription in Account
-         * @description Create Notificationsubscription in Account
+         * Create Notificationsubscription
+         * @description Create Notificationsubscription
          */
         post: operations["notificationsubscription/create"];
         delete?: never;
@@ -903,21 +923,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Notificationsubscription in Account
-         * @description Get Notificationsubscription in Account
+         * Get Notificationsubscription
+         * @description Get Notificationsubscription
          */
         get: operations["notificationsubscription/get"];
         put?: never;
         /**
-         * Update Notificationsubscriptions in Account
-         * @description Update Notificationsubscriptions in Account
+         * Update Notificationsubscription
+         * @description Update Notificationsubscription
          */
         post: operations["notificationsubscription/update"];
         /**
-         * Delete Notificationsubscription in Account
-         * @description Delete Notificationsubscription in Account
+         * Delete Notificationsubscription
+         * @description Delete Notificationsubscription
          */
-        delete: operations["notificationsubscription/remove"];
+        delete: operations["notificationsubscription/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -931,8 +951,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Logs in Account
-         * @description List Logs in Account
+         * List Logs
+         * @description List Logs
          */
         get: operations["log/list"];
         put?: never;
@@ -951,8 +971,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Log in Account
-         * @description Get Log in Account
+         * Get Log
+         * @description Get Log
          */
         get: operations["log/get"];
         put?: never;
@@ -991,14 +1011,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List Customdomains in Account
-         * @description List Customdomains in Account
+         * List Customdomains
+         * @description List Customdomains
          */
         get: operations["customdomain/list"];
         put?: never;
         /**
-         * Create Customdomain in Account
-         * @description Create Customdomain in Account
+         * Create Customdomain
+         * @description Create Customdomain
          */
         post: operations["customdomain/create"];
         delete?: never;
@@ -1015,17 +1035,17 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get Customdomain in Account
-         * @description Get Customdomain in Account
+         * Get Customdomain
+         * @description Get Customdomain
          */
         get: operations["customdomain/get"];
         put?: never;
         post?: never;
         /**
-         * Delete Customdomain in Account
-         * @description Delete Customdomain in Account
+         * Delete Customdomain
+         * @description Delete Customdomain
          */
-        delete: operations["customdomain/remove"];
+        delete: operations["customdomain/delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -1577,6 +1597,9 @@ export interface components {
             authorize_params: {
                 [key: string]: string;
             };
+            claims_mapping?: {
+                [key: string]: string;
+            };
             /** @description Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read. */
             readonly is_using_default_credentials: boolean;
             /** @description Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant. */
@@ -1661,6 +1684,9 @@ export interface components {
             authorize_params: {
                 [key: string]: string;
             };
+            claims_mapping?: {
+                [key: string]: string;
+            };
             email_oauth_sync_policy?: "preserve_manual" | "always_sync" | null;
         };
         /** @description Client */
@@ -1980,6 +2006,8 @@ export interface components {
             access_token?: string;
             access_token_secret?: string;
             refresh_token?: string;
+            /** @description ISO 8601 timestamp when the stored provider `access_token` expires. Stamped from the provider `expires_in` on (re-)authorization and refresh. Absent when the provider issues non-expiring tokens. */
+            access_token_expires_at?: string;
             profile_data: unknown;
             /** @description Object is related with this account */
             account: string;
@@ -2285,6 +2313,14 @@ export interface components {
             allow_offline_access: boolean;
             /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
             skip_consent: boolean;
+            /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
+            include_teams_in_access_token: boolean;
+            /** @description When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant. */
+            include_roles_in_access_token: boolean;
+            /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time. */
+            include_teams_in_id_token: boolean;
+            /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`. */
+            include_roles_in_id_token: boolean;
             /** @description Object is related with this account */
             account: string;
             /**
@@ -2337,6 +2373,14 @@ export interface components {
             allow_offline_access?: boolean;
             /** @description When true, skip the consent prompt for first-party clients. */
             skip_consent?: boolean;
+            /** @description When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs. */
+            include_teams_in_access_token?: boolean;
+            /** @description When true, access_tokens issued for this API carry a `roles` claim with the subject role names. */
+            include_roles_in_access_token?: boolean;
+            /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. */
+            include_teams_in_id_token?: boolean;
+            /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. */
+            include_roles_in_id_token?: boolean;
         };
         /** @description Partial update for an Api. `identifier` is immutable and not present here; recreate the API if you need to change it. */
         ApiUpdate: {
@@ -2358,6 +2402,14 @@ export interface components {
             allow_offline_access?: boolean;
             /** @description When true, skip the consent prompt for first-party clients. */
             skip_consent?: boolean;
+            /** @description When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs. */
+            include_teams_in_access_token?: boolean;
+            /** @description When true, access_tokens issued for this API carry a `roles` claim with the subject role names. */
+            include_roles_in_access_token?: boolean;
+            /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. */
+            include_teams_in_id_token?: boolean;
+            /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. */
+            include_roles_in_id_token?: boolean;
         };
         /** @description Action */
         Action: {
@@ -2900,8 +2952,10 @@ export interface components {
             subject_token_type?: string;
             /** @description The device code returned by the authorization server. */
             device_code?: string;
-            /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+            /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are provided they must match. */
             audience?: string;
+            /** @description RFC 8707 Resource Indicator. Absolute URI of the target Api, no fragment. Matched against `Api.identifier` in the tenant. */
+            resource?: string;
         } & {
             [key: string]: unknown;
         };
@@ -2927,8 +2981,10 @@ export interface components {
             /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
             max_age?: number;
             prompt?: string;
-            /** @description Resource Indicator (RFC 8707). Identifier of the Api the client wants to access. Persisted in the auth state so the token issued at /oauth/token targets the matching Api resource and its `aud` claim is set to this value. */
+            /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are sent they must match. Identifier of the Api the client wants to access; persisted in the auth state so the token issued at /oauth/token targets the matching Api resource. */
             audience?: string;
+            /** @description RFC 8707 Resource Indicator. MUST be an absolute URI without fragment. When matched against a registered Api in the tenant the issued access_token gets `aud = <api.identifier>`. */
+            resource?: string;
         };
         LoginCallbackBody: {
             /** @description is always wsignin1.0 */
@@ -3352,12 +3408,12 @@ export interface operations {
     "connection/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `connection_name`, `connection_type`. */
@@ -3369,16 +3425,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Connection"][];
                     };
                 };
@@ -3471,6 +3525,9 @@ export interface operations {
                         authorize_params: {
                             [key: string]: string;
                         };
+                        claims_mapping?: {
+                            [key: string]: string;
+                        };
                         /** @description Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read. */
                         readonly is_using_default_credentials: boolean;
                         /** @description Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant. */
@@ -3544,6 +3601,9 @@ export interface operations {
                         authorize_params: {
                             [key: string]: string;
                         };
+                        claims_mapping?: {
+                            [key: string]: string;
+                        };
                         /** @description Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read. */
                         readonly is_using_default_credentials: boolean;
                         /** @description Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant. */
@@ -3598,6 +3658,9 @@ export interface operations {
                     authorize_params?: {
                         [key: string]: string;
                     };
+                    claims_mapping?: {
+                        [key: string]: string;
+                    };
                     email_oauth_sync_policy?: "preserve_manual" | "always_sync" | null;
                 };
             };
@@ -3643,6 +3706,9 @@ export interface operations {
                         authorize_params: {
                             [key: string]: string;
                         };
+                        claims_mapping?: {
+                            [key: string]: string;
+                        };
                         /** @description Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read. */
                         readonly is_using_default_credentials: boolean;
                         /** @description Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant. */
@@ -3665,7 +3731,7 @@ export interface operations {
             };
         };
     };
-    "connection/remove": {
+    "connection/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -3676,24 +3742,80 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Connection */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description Connection ID */
+                        id: string;
+                        connection_name: string;
+                        /** @enum {unknown} */
+                        connection_type: "database" | "custom" | "github" | "figma" | "google_oauth2" | "oidc" | "passwordless_email";
+                        /** @default null */
+                        authorize_url: string;
+                        /** @default null */
+                        token_url: string;
+                        /** @default null */
+                        userinfo_url: string;
+                        /** @default null */
+                        client_id: string;
+                        /** @default null */
+                        client_secret: string;
+                        /** @default null */
+                        issuer: string;
+                        /** @default null */
+                        jwks_url: string;
+                        /** @default null */
+                        response_type: string;
+                        enabled: boolean;
+                        /** @default null */
+                        enabled_clients: string[] | null;
+                        /** @default [] */
+                        scope: string[];
+                        /**
+                         * @description Authorize params
+                         * @default {}
+                         */
+                        authorize_params: {
+                            [key: string]: string;
+                        };
+                        claims_mapping?: {
+                            [key: string]: string;
+                        };
+                        /** @description Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read. */
+                        readonly is_using_default_credentials: boolean;
+                        /** @description Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant. */
+                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ConnectionMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Connection creation date */
+                        createdAt: string;
+                        /** @description Connection updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
     "client/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `name`, `description`, `client_id`. */
@@ -3705,16 +3827,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Client"][];
                     };
                 };
@@ -3955,7 +4075,7 @@ export interface operations {
             };
         };
     };
-    "client/remove": {
+    "client/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -3966,12 +4086,55 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Client */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description Client ID */
+                        id: string;
+                        name: string;
+                        description: string;
+                        client_id: string;
+                        client_secret: string;
+                        callbacks: string[];
+                        logout_urls: string[];
+                        refresh_token: {
+                            /** @enum {unknown} */
+                            expiration_mode: "expire" | "not-expire";
+                            infinite_token_lifetime: boolean;
+                            token_lifetime: number;
+                        };
+                        client_uri?: string | null;
+                        logo_uri?: string | null;
+                        tos_uri?: string | null;
+                        policy_uri?: string | null;
+                        contacts?: string[];
+                        grant_types?: string[];
+                        response_types?: string[];
+                        token_endpoint_auth_method?: string;
+                        application_type?: string;
+                        software_id?: string | null;
+                        software_version?: string | null;
+                        frontchannel_logout_uri?: string | null;
+                        frontchannel_logout_session_required?: boolean;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ClientMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Client creation date */
+                        createdAt: string;
+                        /** @description Client updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
@@ -4041,12 +4204,12 @@ export interface operations {
     "user/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `name`, `email`, `phone`. */
@@ -4058,16 +4221,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["User"][];
                     };
                 };
@@ -4499,27 +4660,7 @@ export interface operations {
             };
         };
     };
-    "user/remove": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                user_id: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Default Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-        };
-    };
-    "user/changeEmail": {
+    "user/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -4528,85 +4669,204 @@ export interface operations {
             };
             cookie?: never;
         };
-        /** @description Payload for `POST /user/:user_id/change-email`. Triggers the verification flow: a Ticket is created and an email is sent to the new address with a confirmation link. */
-        requestBody: {
-            content: {
-                "application/json": {
-                    /** @description The email address the user wants to switch to. */
-                    new_email: string;
-                    /** @description Override the account-wide policy. Can only raise the bar: passing `old_and_new` forces double verification; `new_only` is ignored if the account requires `old_and_new`. */
-                    verification_mode?: "new_only" | "old_and_new";
-                    /** @description Where to send the user after they click the link in the verification email. The status of the operation is appended as a `?status=applied|pending_old` query param so the calling app can render the right screen. When omitted, the user lands on the auth host's `/flow/email-change-done` fallback. */
-                    redirect_uri?: string;
-                };
-            };
-        };
-        responses: {
-            /** @description Default Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        /** @enum {string} */
-                        status: "verification_sent";
-                        ticket_id: string;
-                        verification_mode: "new_only" | "old_and_new";
-                    };
-                };
-            };
-        };
-    };
-    user_change_email_verify: {
-        parameters: {
-            query: {
-                ticket: string;
-            };
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-        };
-    };
-    "user/verifyEmailStart": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                user_id: string;
-            };
-            cookie?: never;
-        };
-        /** @description Optional payload for `POST /user/:user_id/verify-email/start`. Trigger a verification email send for the given user. */
-        requestBody: {
-            content: {
-                "application/json": {
-                    /** @description Where to send the user after they click the link. The status of the operation is appended as `?status=verified|already_verified|invalid_link|expired` so the calling app can render the right screen. When omitted, the user lands on the auth host's `/flow/verify-email-done` fallback. */
-                    redirect_uri?: string;
-                };
-            };
-        };
-        responses: {
-            /** @description Default Response */
+            /** @description User */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        status: "verification_sent" | "already_verified";
-                        ticket_id?: string;
-                    };
+                        /** @description User ID */
+                        id: string;
+                        /** @description User name */
+                        name?: string | null;
+                        /** @description unique username for this user */
+                        username?: string | null;
+                        /** @description Given name */
+                        given_name?: string | null;
+                        /** @description Family name */
+                        family_name?: string | null;
+                        /** @description Middle name (OIDC §5.1) */
+                        middle_name?: string | null;
+                        /** @description Casual name. Distinct from given_name (e.g. "Mike" vs "Michael"). OIDC §5.1 */
+                        nickname?: string | null;
+                        /** @description User email */
+                        email?: string | null;
+                        /**
+                         * @description true if email is verified
+                         * @default false
+                         */
+                        email_verified: boolean;
+                        /** @description How `email_verified` was last set. `manual` — admin flipped the flag via `POST /user/:id`. `verification_flow` — user clicked the verification link. `passwordless_otp` — user completed passwordless OTP login. `team_invite` — user clicked a team invitation link. `email_change` — user confirmed a self-service email change. `federated` — verified by the external IdP on OAuth callback. `null` — the field was cleared (admin un-verified the email). */
+                        email_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `email_verified` was last flipped to true. */
+                        email_verified_at?: string | null;
+                        /** @description ISO 8601 timestamp of the user's last verified email change. When set, OAuth callbacks will not overwrite `email`/`email_verified` from the federated provider — the manually-chosen email wins. */
+                        email_change_locked_at?: string | null;
+                        /** @description contact phone number */
+                        phone?: string | null;
+                        /** @description phone is verified */
+                        phone_verified: boolean;
+                        /** @description How `phone_verified` was last set. Same enum as `email_verified_method`. */
+                        phone_verified_method?: "manual" | "verification_flow" | "passwordless_otp" | "team_invite" | "email_change" | "federated" | null;
+                        /** @description ISO 8601 timestamp of when `phone_verified` was last flipped to true. */
+                        phone_verified_at?: string | null;
+                        /** @description country iso code */
+                        country_iso?: string | null;
+                        /** @description user birth_date */
+                        birth_date?: string | null;
+                        /** @description User gender (free-form, OIDC §5.1) */
+                        gender?: string | null;
+                        /** @description IANA time-zone name (e.g. "Europe/Madrid"). OIDC §5.1 — used for the `zoneinfo` claim. */
+                        zoneinfo?: string | null;
+                        /** @description user main language */
+                        locale?: string;
+                        /** @description customer region */
+                        region?: string | null;
+                        /** @description URL of the User's personal Web page or blog (OIDC §5.1) */
+                        website?: string | null;
+                        address?: {
+                            /** @description Full mailing address, formatted for display (may contain newlines) */
+                            formatted?: string | null;
+                            street_address?: string | null;
+                            /** @description City or locality */
+                            locality?: string | null;
+                            /** @description State, province, or region */
+                            region?: string | null;
+                            postal_code?: string | null;
+                            /** @description Country name */
+                            country?: string | null;
+                        } | null;
+                        /** @description User picture url */
+                        picture?: string | null;
+                        /** @description Total number of logins this user has performed. */
+                        logins_count: number;
+                        /** @description Last IP address from which this user logged in */
+                        last_ip?: string | null;
+                        /** @description Last date and time this user logged in (ISO_8601 format) */
+                        last_login?: string | null;
+                        /**
+                         * @description User Metadata
+                         * @default {}
+                         */
+                        user_metadata: {
+                            [key: string]: unknown;
+                        };
+                        /**
+                         * @description App Metadata
+                         * @default {}
+                         */
+                        app_metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description UserMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description User creation date */
+                        createdAt: string;
+                        /** @description User updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "user/changeEmail": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Payload for `POST /user/:user_id/change-email`. Triggers the verification flow: a Ticket is created and an email is sent to the new address with a confirmation link. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The email address the user wants to switch to. */
+                    new_email: string;
+                    /** @description Override the account-wide policy. Can only raise the bar: passing `old_and_new` forces double verification; `new_only` is ignored if the account requires `old_and_new`. */
+                    verification_mode?: "new_only" | "old_and_new";
+                    /** @description Where to send the user after they click the link in the verification email. The status of the operation is appended as a `?status=applied|pending_old` query param so the calling app can render the right screen. When omitted, the user lands on the auth host's `/flow/email-change-done` fallback. */
+                    redirect_uri?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "verification_sent";
+                        ticket_id: string;
+                        verification_mode: "new_only" | "old_and_new";
+                    };
+                };
+            };
+        };
+    };
+    user_change_email_verify: {
+        parameters: {
+            query: {
+                ticket: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    "user/verifyEmailStart": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description Optional payload for `POST /user/:user_id/verify-email/start`. Trigger a verification email send for the given user. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Where to send the user after they click the link. The status of the operation is appended as `?status=verified|already_verified|invalid_link|expired` so the calling app can render the right screen. When omitted, the user lands on the auth host's `/flow/verify-email-done` fallback. */
+                    redirect_uri?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        status: "verification_sent" | "already_verified";
+                        ticket_id?: string;
+                    };
                 };
             };
         };
@@ -4634,12 +4894,12 @@ export interface operations {
     "identity/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
@@ -4651,16 +4911,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Identity"][];
                     };
                 };
@@ -4704,6 +4962,8 @@ export interface operations {
                         access_token?: string;
                         access_token_secret?: string;
                         refresh_token?: string;
+                        /** @description ISO 8601 timestamp when the stored provider `access_token` expires. Stamped from the provider `expires_in` on (re-)authorization and refresh. Absent when the provider issues non-expiring tokens. */
+                        access_token_expires_at?: string;
                         profile_data: unknown;
                         /** @description Object is related with this account */
                         account: string;
@@ -4752,6 +5012,8 @@ export interface operations {
                         access_token?: string;
                         access_token_secret?: string;
                         refresh_token?: string;
+                        /** @description ISO 8601 timestamp when the stored provider `access_token` expires. Stamped from the provider `expires_in` on (re-)authorization and refresh. Absent when the provider issues non-expiring tokens. */
+                        access_token_expires_at?: string;
                         profile_data: unknown;
                         /** @description Object is related with this account */
                         account: string;
@@ -4771,7 +5033,7 @@ export interface operations {
             };
         };
     };
-    "identity/remove": {
+    "identity/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -4781,25 +5043,81 @@ export interface operations {
             cookie?: never;
         };
         requestBody?: never;
+        responses: {
+            /** @description Identity */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Identity ID */
+                        id: string;
+                        connection: components["schemas"]["Connection"] | string | unknown;
+                        user: components["schemas"]["User"] | string | unknown;
+                        identity_id: string;
+                        access_token?: string;
+                        access_token_secret?: string;
+                        refresh_token?: string;
+                        /** @description ISO 8601 timestamp when the stored provider `access_token` expires. Stamped from the provider `expires_in` on (re-)authorization and refresh. Absent when the provider issues non-expiring tokens. */
+                        access_token_expires_at?: string;
+                        profile_data: unknown;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description IdentityMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Identity creation date */
+                        createdAt: string;
+                        /** @description Identity updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
+    "identity/getProviderToken": {
+        parameters: {
+            query?: {
+                /** @description Force a refresh against the provider even when the stored token still looks valid. */
+                fresh?: boolean;
+            };
+            header?: never;
+            path: {
+                identity_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
         responses: {
             /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        access_token: string;
+                        access_token_expires_at?: string;
+                        refreshed: boolean;
+                    };
+                };
             };
         };
     };
     "role/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `name`, `description`. */
@@ -4811,16 +5129,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Role"][];
                     };
                 };
@@ -4987,7 +5303,7 @@ export interface operations {
             };
         };
     };
-    "role/remove": {
+    "role/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -4998,12 +5314,37 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Role */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description Role ID */
+                        id: string;
+                        /**
+                         * @description Short, human-readable identifier for the role (e.g. `admin`, `editor`, `billing-manager`). Surfaced in the dashboard role pickers.
+                         * @example admin
+                         */
+                        name: string;
+                        /** @description Free-form explanation of what users in this role are expected to do or have access to. Shown alongside the role in the dashboard. */
+                        description: string;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description RoleMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Role creation date */
+                        createdAt: string;
+                        /** @description Role updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
@@ -5077,12 +5418,12 @@ export interface operations {
     "rolemember/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
@@ -5094,16 +5435,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["RoleMember"][];
                     };
                 };
@@ -5208,7 +5547,7 @@ export interface operations {
             };
         };
     };
-    "rolemember/remove": {
+    "rolemember/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -5219,24 +5558,46 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description RoleMember */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description RoleMember ID */
+                        id: string;
+                        /** @description Role granted to the user. Returned as an id by default; pass `?expand=role` to inline the full Role object. */
+                        role: components["schemas"]["Role"] | string | unknown;
+                        /** @description User the role is granted to. Returned as an id by default; pass `?expand=user` to inline the full User object. */
+                        user: components["schemas"]["User"] | string | unknown;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description RoleMemberMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description RoleMember creation date */
+                        createdAt: string;
+                        /** @description RoleMember updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
     "team/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `name`, `slug`. */
@@ -5248,16 +5609,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Team"][];
                     };
                 };
@@ -5449,7 +5808,7 @@ export interface operations {
             };
         };
     };
-    "team/remove": {
+    "team/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -5460,24 +5819,56 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Team */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description Team ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name of the team. Shown in the dashboard and in team-picker UI.
+                         * @example Acme Engineering
+                         */
+                        name: string;
+                        /**
+                         * @description URL-safe identifier auto-derived from `name`. Unique within the tenant; used in routes that address a team by slug.
+                         * @example acme-engineering
+                         */
+                        slug: string;
+                        /** @description Optional free-form description of the team. */
+                        description: string | null;
+                        /** @description Optional URL of an image used as the team avatar/logo. */
+                        logo_url: string | null;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description TeamMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Team creation date */
+                        createdAt: string;
+                        /** @description Team updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
     "teammember/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
@@ -5489,16 +5880,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["TeamMember"][];
                     };
                 };
@@ -5615,26 +6004,50 @@ export interface operations {
             };
         };
     };
-    "teammember/remove": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                teammember_id: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Default Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-        };
-    };
+    "teammember/delete": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                teammember_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description TeamMember */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description TeamMember ID */
+                        id: string;
+                        /** @description User that belongs to the team. Returned as an id by default; pass `?expand=user` to inline the full User object. */
+                        user: components["schemas"]["User"] | string | unknown;
+                        /** @description Team the user belongs to. Returned as an id by default; pass `?expand=team` to inline the full Team object. */
+                        team: components["schemas"]["Team"] | string | unknown;
+                        /** @description Roles granted to the user *within this team*. Distinct from account-wide RoleMember grants — these only apply in the scope of the team. Each entry is an id by default; pass `?expand=roles` to inline. */
+                        roles: (components["schemas"]["Role"] | string | unknown)[];
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description TeamMemberMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description TeamMember creation date */
+                        createdAt: string;
+                        /** @description TeamMember updated date */
+                        updatedAt?: string;
+                    };
+                };
+            };
+        };
+    };
     "team/listMembers": {
         parameters: {
             query?: {
@@ -5967,12 +6380,12 @@ export interface operations {
     "api/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `name`, `description`, `identifier`, `slug`. */
@@ -5984,16 +6397,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Api"][];
                     };
                 };
@@ -6040,6 +6451,14 @@ export interface operations {
                     allow_offline_access?: boolean;
                     /** @description When true, skip the consent prompt for first-party clients. */
                     skip_consent?: boolean;
+                    /** @description When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs. */
+                    include_teams_in_access_token?: boolean;
+                    /** @description When true, access_tokens issued for this API carry a `roles` claim with the subject role names. */
+                    include_roles_in_access_token?: boolean;
+                    /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. */
+                    include_teams_in_id_token?: boolean;
+                    /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. */
+                    include_roles_in_id_token?: boolean;
                 };
             };
         };
@@ -6081,6 +6500,14 @@ export interface operations {
                         allow_offline_access: boolean;
                         /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
                         skip_consent: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
+                        include_teams_in_access_token: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant. */
+                        include_roles_in_access_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time. */
+                        include_teams_in_id_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`. */
+                        include_roles_in_id_token: boolean;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -6147,6 +6574,14 @@ export interface operations {
                         allow_offline_access: boolean;
                         /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
                         skip_consent: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
+                        include_teams_in_access_token: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant. */
+                        include_roles_in_access_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time. */
+                        include_teams_in_id_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`. */
+                        include_roles_in_id_token: boolean;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -6196,6 +6631,14 @@ export interface operations {
                     allow_offline_access?: boolean;
                     /** @description When true, skip the consent prompt for first-party clients. */
                     skip_consent?: boolean;
+                    /** @description When true, access_tokens issued for this API carry a `teams` claim with the subject team slugs. */
+                    include_teams_in_access_token?: boolean;
+                    /** @description When true, access_tokens issued for this API carry a `roles` claim with the subject role names. */
+                    include_roles_in_access_token?: boolean;
+                    /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. */
+                    include_teams_in_id_token?: boolean;
+                    /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. */
+                    include_roles_in_id_token?: boolean;
                 };
             };
         };
@@ -6237,6 +6680,14 @@ export interface operations {
                         allow_offline_access: boolean;
                         /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
                         skip_consent: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
+                        include_teams_in_access_token: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant. */
+                        include_roles_in_access_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time. */
+                        include_teams_in_id_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`. */
+                        include_roles_in_id_token: boolean;
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -6255,7 +6706,7 @@ export interface operations {
             };
         };
     };
-    "api/remove": {
+    "api/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -6266,12 +6717,66 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Api */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description Api ID */
+                        id: string;
+                        /**
+                         * @description Human-readable name for the API. Shown in the dashboard and consent prompts.
+                         * @example My Backend API
+                         */
+                        name: string;
+                        /** @description URL-safe identifier auto-derived from `name`. Unique within the tenant. */
+                        slug: string;
+                        /**
+                         * @description Audience URL that clients pass as `audience=` when requesting a token for this API. Becomes the `aud` claim in the issued access_token. Immutable after creation and unique within the tenant.
+                         * @example https://api.faable.com
+                         */
+                        identifier: string;
+                        /** @description Optional human-readable description of the API. */
+                        description?: string;
+                        /** @description Set of permissions (scopes) this API exposes. When a token is issued with `audience=identifier`, the requested `scope` is intersected with this list to populate the `permissions` claim. */
+                        permissions: components["schemas"]["Permission"][];
+                        /** @description JWA algorithm used to sign access_tokens issued for this API. Currently only RS256 (the account keystore default) is implemented. */
+                        signing_alg: "RS256";
+                        /** @description Shape of access_tokens issued for this API. `access_token` emits the standard OAuth2 token. `access_token_authz` additionally embeds a `permissions` claim listing the permissions granted to the subject for this API. */
+                        token_dialect: "access_token" | "access_token_authz";
+                        /** @description Access_token lifetime in seconds. Default 86400 (24h). Applied at token issuance time (overrides the generic default). */
+                        token_lifetime: number;
+                        /** @description When true, only scopes that match a permission in `permissions` are forwarded into the access_token. When false, requested scopes are echoed back verbatim with no filtering. */
+                        enforce_policies: boolean;
+                        /** @description When true, the API is eligible to be the target of a `refresh_token` (i.e. clients can request `offline_access` against it). */
+                        allow_offline_access: boolean;
+                        /** @description When true, the consent prompt is skipped for first-party clients (clients owned by the same tenant as the API). */
+                        skip_consent: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `teams` claim listing the slugs of the teams the subject is a member of within the tenant. */
+                        include_teams_in_access_token: boolean;
+                        /** @description When true, access_tokens issued for this API carry a `roles` claim listing the names of the roles the subject holds across their team memberships within the tenant. */
+                        include_roles_in_access_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `teams` claim with the subject team slugs. The id_token only sees the flag when the client requested `audience=` so this API is resolved at issuance time. */
+                        include_teams_in_id_token: boolean;
+                        /** @description When true, id_tokens issued together with an access_token for this API carry a `roles` claim with the subject role names. Same audience caveat as `include_teams_in_id_token`. */
+                        include_roles_in_id_token: boolean;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ApiMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Api creation date */
+                        createdAt: string;
+                        /** @description Api updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
@@ -6340,12 +6845,12 @@ export interface operations {
     "action/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
             };
@@ -6355,16 +6860,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Action"][];
                     };
                 };
@@ -6506,7 +7009,7 @@ export interface operations {
             };
         };
     };
-    "action/remove": {
+    "action/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -6517,24 +7020,62 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Action */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description Action ID */
+                        id: string;
+                        /** @description Action Name */
+                        name: string;
+                        /**
+                         * @description Trigger event name
+                         * @default post-login
+                         * @enum {unknown}
+                         */
+                        trigger: "continue" | "post-login";
+                        /** @description JavaScript Code to execute */
+                        code: string;
+                        /**
+                         * @description Is this action active?
+                         * @default true
+                         */
+                        enabled: boolean;
+                        /**
+                         * @description Execution order
+                         * @default 0
+                         */
+                        order: number;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description ActionMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Action creation date */
+                        createdAt: string;
+                        /** @description Action updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
     "notificationsubscription/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
             };
@@ -6544,16 +7085,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["NotificationSubscription"][];
                     };
                 };
@@ -6860,7 +7399,7 @@ export interface operations {
             };
         };
     };
-    "notificationsubscription/remove": {
+    "notificationsubscription/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -6871,24 +7410,80 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description NotificationSubscription */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description NotificationSubscriptionEmail ID */
+                        id: string;
+                        events: string[];
+                        /** @enum {string} */
+                        channel: "email";
+                        /** @description Whether the subscription is active */
+                        active: boolean;
+                        config: {
+                            recipients: string[];
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description NotificationSubscriptionEmailMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description NotificationSubscriptionEmail creation date */
+                        createdAt: string;
+                        /** @description NotificationSubscriptionEmail updated date */
+                        updatedAt?: string;
+                    } | {
+                        /** @description NotificationSubscriptionWebhook ID */
+                        id: string;
+                        events: string[];
+                        /** @enum {string} */
+                        channel: "webhook";
+                        /** @description Whether the subscription is active */
+                        active: boolean;
+                        config: {
+                            /**
+                             * Format: uri
+                             * @description Webhook URL
+                             */
+                            url: string;
+                            /** @description Secret used to sign the webhook payload */
+                            secret: string;
+                        };
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description NotificationSubscriptionWebhookMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description NotificationSubscriptionWebhook creation date */
+                        createdAt: string;
+                        /** @description NotificationSubscriptionWebhook updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
     "log/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`). */
@@ -6902,16 +7497,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Log"][];
                     };
                 };
@@ -7001,12 +7594,12 @@ export interface operations {
     "customdomain/list": {
         parameters: {
             query?: {
-                /** @description Start from this cursor */
+                /** @description Number of items per page (max 200) */
+                pageSize?: number;
+                /** @description Cursor for next page */
                 cursor?: string;
-                /** @description Start from this cursor */
+                /** @description Cursor returned by the previous page */
                 next?: string;
-                /** @description Size of the results array */
-                pageSize?: number;
                 /** @description Filter using a FaableQL query */
                 query?: string;
                 /** @description Full-text search across: `domain`. */
@@ -7018,16 +7611,14 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description PaginatedResponse */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description next cursor */
                         next: string | null;
-                        /** @description List of results */
                         results: components["schemas"]["Customdomain"][];
                     };
                 };
@@ -7145,7 +7736,7 @@ export interface operations {
             };
         };
     };
-    "customdomain/remove": {
+    "customdomain/delete": {
         parameters: {
             query?: never;
             header?: never;
@@ -7156,12 +7747,43 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description Customdomain */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        /** @description Customdomain ID */
+                        id: string;
+                        domain: string;
+                        token: string;
+                        /** @enum {unknown} */
+                        status: "PENDING" | "VERIFYING" | "ACTIVE" | "FAILED" | "DEGRADED";
+                        attempts: number;
+                        /** Format: date-time */
+                        nextCheck?: string;
+                        /** Format: date-time */
+                        lastCheck?: string;
+                        /** @description User feedback error from last check */
+                        errorLog?: string;
+                        /** Format: date-time */
+                        verifiedAt?: string;
+                        /** @description Object is related with this account */
+                        account: string;
+                        /**
+                         * @description CustomdomainMetadata
+                         * @default {}
+                         */
+                        metadata: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Customdomain creation date */
+                        createdAt: string;
+                        /** @description Customdomain updated date */
+                        updatedAt?: string;
+                    };
+                };
             };
         };
     };
@@ -7389,8 +8011,10 @@ export interface operations {
                 /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
                 max_age?: number;
                 prompt?: string;
-                /** @description Resource Indicator (RFC 8707). Identifier of the Api the client wants to access. Persisted in the auth state so the token issued at /oauth/token targets the matching Api resource and its `aud` claim is set to this value. */
+                /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are sent they must match. Identifier of the Api the client wants to access; persisted in the auth state so the token issued at /oauth/token targets the matching Api resource. */
                 audience?: string;
+                /** @description RFC 8707 Resource Indicator. MUST be an absolute URI without fragment. When matched against a registered Api in the tenant the issued access_token gets `aud = <api.identifier>`. */
+                resource?: string;
             };
             header?: never;
             path?: never;
@@ -7424,8 +8048,10 @@ export interface operations {
                 subject_token_type?: string;
                 /** @description The device code returned by the authorization server. */
                 device_code?: string;
-                /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+                /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are provided they must match. */
                 audience?: string;
+                /** @description RFC 8707 Resource Indicator. Absolute URI of the target Api, no fragment. Matched against `Api.identifier` in the tenant. */
+                resource?: string;
             };
             header?: never;
             path?: never;
@@ -7468,8 +8094,10 @@ export interface operations {
                 subject_token_type?: string;
                 /** @description The device code returned by the authorization server. */
                 device_code?: string;
-                /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+                /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are provided they must match. */
                 audience?: string;
+                /** @description RFC 8707 Resource Indicator. Absolute URI of the target Api, no fragment. Matched against `Api.identifier` in the tenant. */
+                resource?: string;
             };
             header?: never;
             path?: never;
@@ -7492,8 +8120,10 @@ export interface operations {
                     subject_token_type?: string;
                     /** @description The device code returned by the authorization server. */
                     device_code?: string;
-                    /** @description Identifier of the API the client wants to access. Matched against `Api.identifier` in the tenant. */
+                    /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are provided they must match. */
                     audience?: string;
+                    /** @description RFC 8707 Resource Indicator. Absolute URI of the target Api, no fragment. Matched against `Api.identifier` in the tenant. */
+                    resource?: string;
                 } & {
                     [key: string]: unknown;
                 };
@@ -7923,8 +8553,10 @@ export interface operations {
                     /** @description OIDC §3.1.2.1 — maximum allowable elapsed time in seconds since the last End-User authentication. If exceeded, the OP re-authenticates and `auth_time` is REQUIRED in the resulting id_token. */
                     max_age?: number;
                     prompt?: string;
-                    /** @description Resource Indicator (RFC 8707). Identifier of the Api the client wants to access. Persisted in the auth state so the token issued at /oauth/token targets the matching Api resource and its `aud` claim is set to this value. */
+                    /** @description Auth0-compatible alias for `resource` (RFC 8707). When both are sent they must match. Identifier of the Api the client wants to access; persisted in the auth state so the token issued at /oauth/token targets the matching Api resource. */
                     audience?: string;
+                    /** @description RFC 8707 Resource Indicator. MUST be an absolute URI without fragment. When matched against a registered Api in the tenant the issued access_token gets `aud = <api.identifier>`. */
+                    resource?: string;
                 };
             };
         };