@faable/auth-sdk 2.5.69 → 2.5.71

package/dist/api/types.d.ts

@@ -200,6 +200,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/login-options": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Resolve the login methods for a client
+         * @description Returns the ordered list of login methods the hosted login screen should offer for this client, already filtered by `connection.enabled` and `connection.enabled_clients`. `client_id` is the OAuth client_id; when omitted it falls back to the account's single client if it has exactly one, otherwise no client context is assumed and only unrestricted connections are returned.
+         */
+        get: operations["connection/loginOptions"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/client": {
         parameters: {
             query?: never;
@@ -424,6 +444,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/user/{user_id}/factors": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List a user's second factors
+         * @description Management view of the security methods a user has enrolled. Carries no secret material — TOTP seeds and recovery-code hashes are redacted by the store, so this endpoint cannot be used to impersonate the user.
+         */
+        get: operations["user/factors"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/user/{user_id}/factors/{factor_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Remove one of a user's second factors
+         * @description The support path out of a lockout: with the factor gone, a `required` policy sends the user through enrolment on their next login instead of refusing it.
+         */
+        delete: operations["user/deleteFactor"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/identity": {
         parameters: {
             query?: never;
@@ -1159,68 +1219,577 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /**
-         * List Customdomains
-         * @description List Customdomains
-         */
-        get: operations["customdomain/list"];
-        put?: never;
-        /**
-         * Create Customdomain
-         * @description Create Customdomain
-         */
-        post: operations["customdomain/create"];
+        /**
+         * List Customdomains
+         * @description List Customdomains
+         */
+        get: operations["customdomain/list"];
+        put?: never;
+        /**
+         * Create Customdomain
+         * @description Create Customdomain
+         */
+        post: operations["customdomain/create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/customdomain/{customdomain_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get Customdomain
+         * @description Get Customdomain
+         */
+        get: operations["customdomain/get"];
+        put?: never;
+        post?: never;
+        /**
+         * Delete Customdomain
+         * @description Delete Customdomain
+         */
+        delete: operations["customdomain/delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/passwordless/verify_redirect": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Receive a passwordless token via email link and convert it to a valid session
+         * @description Receive a passwordless token and convert it to a valid session
+         */
+        get: operations["passwordless/verify_redirect"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/passwordless/verify_code": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Verify a passwordless code and establish a session
+         * @description Verifies an emailed passwordless code and establishes the browser `faable_sess` session, returning where to send the user next. Called by the first-party hosted login UI; SPAs on other origins use the `passwordless/otp` grant at `/oauth/token` instead, which returns tokens and no cookie.
+         */
+        post: operations["passwordless/verifyCode"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/passwordless/start": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start Passwordless authentication flow
+         * @description Start Passwordless authentication flow
+         */
+        post: operations["passwordless/start"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/mfa/verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Answer an MFA challenge with a TOTP code
+         * @description Verifies a time-based code against the factors enrolled by the user the challenge belongs to, and resumes the parked login. The state is consumed only on success, so a mistyped code does not destroy the flow.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        state: string;
+                        code: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            redirect_url: string;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/mfa/recovery": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Answer an MFA challenge with a recovery code
+         * @description Consumes one of the one-time recovery codes issued when the user enrolled their first factor.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        state: string;
+                        code: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            redirect_url: string;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/me/factors": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List my second factors
+         * @description The security methods enrolled by the current session's user. Never returns secret material: TOTP seeds and recovery-code hashes are redacted by the store.
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["FactorSummary"][];
+                    };
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/me/factors/totp": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start enrolling an authenticator app
+         * @description Creates an UNCONFIRMED TOTP factor and returns its `otpauth://` URI and secret — the only time either is ever readable. The factor does not satisfy any policy until `POST /me/factors/:id/verify` proves the user can produce a code from it.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        name?: string;
+                        state?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            id: string;
+                            secret: string;
+                            otpauth_uri: string;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/me/factors/{factor_id}/verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Confirm an enrolment
+         * @description Proves the user can produce a code from the seed, which is what makes the factor count. Confirming the first factor also mints the recovery codes — returned once and never again.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    factor_id: string;
+                };
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        code: string;
+                        state?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            id: string;
+                            confirmed_at: string;
+                            recovery_codes?: string[];
+                            redirect_url?: string;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/me/factors/{factor_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /** Remove one of my second factors */
+        delete: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    factor_id: string;
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            deleted: boolean;
+                        };
+                    };
+                };
+            };
+        };
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/me/passkeys/options": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Start registering a passkey
+         * @description Returns the WebAuthn creation options for `navigator.credentials.create()`. Existing credentials are excluded so the authenticator refuses to enrol the same key twice. Pass the `state` of a forced enrolment so the guard knows this is the way through, not a bypass.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        state?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            ceremony_id: string;
+                            options: unknown;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/me/passkeys": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Finish registering a passkey
+         * @description Verifies the attestation and stores the credential as a confirmed second factor. Pass the `state` of a pending challenge to also resume the login it parked.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        ceremony_id: string;
+                        credential: unknown;
+                        name?: string;
+                        state?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            id: string;
+                            redirect_url?: string;
+                        };
+                    };
+                };
+            };
+        };
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/customdomain/{customdomain_id}": {
+    "/mfa/webauthn/options": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /**
-         * Get Customdomain
-         * @description Get Customdomain
-         */
-        get: operations["customdomain/get"];
+        get?: never;
         put?: never;
-        post?: never;
-        /**
-         * Delete Customdomain
-         * @description Delete Customdomain
-         */
-        delete: operations["customdomain/delete"];
+        /** Start answering a challenge with a passkey */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        state: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            ceremony_id: string;
+                            options: unknown;
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/passwordless/verify_redirect": {
+    "/mfa/webauthn/verify": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /**
-         * Receive a passwordless token via email link and convert it to a valid session
-         * @description Receive a passwordless token and convert it to a valid session
-         */
-        get: operations["passwordless/verify_redirect"];
+        get?: never;
         put?: never;
-        post?: never;
+        /** Answer a challenge with a passkey */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        ceremony_id: string;
+                        credential: unknown;
+                        name?: string;
+                        state?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            redirect_url: string;
+                        };
+                    };
+                };
+            };
+        };
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/passwordless/verify_code": {
+    "/passkey/login/options": {
         parameters: {
             query?: never;
             header?: never;
@@ -1230,17 +1799,46 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * Verify a passwordless code and establish a session
-         * @description Verifies an emailed passwordless code and establishes the browser `faable_sess` session, returning where to send the user next. Called by the first-party hosted login UI; SPAs on other origins use the `passwordless/otp` grant at `/oauth/token` instead, which returns tokens and no cookie.
+         * Start a passwordless passkey login
+         * @description Returns authentication options with an EMPTY allowCredentials, so the browser offers whichever discoverable passkey it holds for this Relying Party — the usernameless flow behind conditional autofill.
          */
-        post: operations["passwordless/verifyCode"];
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        client_id: string;
+                        redirect_to?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            ceremony_id: string;
+                            options: unknown;
+                        };
+                    };
+                };
+            };
+        };
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/passwordless/start": {
+    "/passkey/login/verify": {
         parameters: {
             query?: never;
             header?: never;
@@ -1250,10 +1848,41 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * Start Passwordless authentication flow
-         * @description Start Passwordless authentication flow
+         * Finish a passwordless passkey login
+         * @description Verifies the assertion, establishes the session and answers with where to send the browser. A passkey that verified the user (biometric or PIN) is already two factors, so no second-factor challenge follows.
          */
-        post: operations["passwordless/start"];
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        ceremony_id: string;
+                        credential: unknown;
+                        client_id: string;
+                        redirect_to?: string;
+                        state?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Default Response */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            redirect_url: string;
+                        };
+                    };
+                };
+            };
+        };
         delete?: never;
         options?: never;
         head?: never;
@@ -1752,6 +2381,28 @@ export interface components {
              *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
              */
             email_oauth_sync_policy?: "preserve_manual" | "always_sync";
+            /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
+            login_methods?: {
+                /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                order?: string[];
+                /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                passkey_login_enabled?: boolean;
+                /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                identifier_first?: boolean;
+                /** @description Surface the method the returning user chose last time. Defaults to false. */
+                remember_last_method?: boolean;
+            };
+            /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
+            mfa_policy?: {
+                /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                mode?: "off" | "optional" | "required";
+                /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                allowed_factors?: ("totp" | "webauthn")[];
+                /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                remember_device_days?: number;
+            };
+            /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
+            webauthn_rp_id?: string | null;
             /** @description AuthAccount creation date */
             createdAt: string;
             /** @description AuthAccount updated date */
@@ -1953,6 +2604,26 @@ export interface components {
                 url: string;
             };
         };
+        /** @description One method the login screen should offer. Discriminated by `kind`. Connection methods carry only what a login screen needs — never credentials, endpoints or the rest of the Connection document. */
+        LoginOptionMethod: {
+            /** @enum {string} */
+            kind: "passkey";
+        } | {
+            /** @enum {string} */
+            kind: "connection";
+            id: string;
+            connection_type: string;
+            connection_name: string;
+            /** @description Password policy enforced when writing a password through this database connection (password reset and admin set-password). `level` is an Auth0-style preset (none/low/fair/good/excellent); the dashboard expands it into the explicit rule fields when saving. The rule fields override the preset baseline. When unset on the connection, the server applies the `good` default. Does not affect login. */
+            password_policy: {
+                level: "none" | "low" | "fair" | "good" | "excellent";
+                min_length?: number;
+                require_lowercase?: boolean;
+                require_uppercase?: boolean;
+                require_number?: boolean;
+                require_special?: boolean;
+            };
+        };
         /** @description Client */
         Client: {
             /** @description Client ID */
@@ -1988,6 +2659,26 @@ export interface components {
             software_version?: string | null;
             frontchannel_logout_uri?: string | null;
             frontchannel_logout_session_required?: boolean;
+            /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
+            login_methods?: {
+                /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                order?: string[];
+                /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                passkey_login_enabled?: boolean;
+                /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                identifier_first?: boolean;
+                /** @description Surface the method the returning user chose last time. Defaults to false. */
+                remember_last_method?: boolean;
+            };
+            /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
+            mfa_policy?: {
+                /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                mode?: "off" | "optional" | "required";
+                /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                allowed_factors?: ("totp" | "webauthn")[];
+                /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                remember_device_days?: number;
+            };
             /** @description Object is related with this account */
             account: string;
             /**
@@ -2060,6 +2751,24 @@ export interface components {
             software_version?: string | null;
             frontchannel_logout_uri?: string | null;
             frontchannel_logout_session_required?: boolean;
+            login_methods?: {
+                /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                order?: string[];
+                /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                passkey_login_enabled?: boolean;
+                /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                identifier_first?: boolean;
+                /** @description Surface the method the returning user chose last time. Defaults to false. */
+                remember_last_method?: boolean;
+            } | null;
+            mfa_policy?: {
+                /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                mode?: "off" | "optional" | "required";
+                /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                allowed_factors?: ("totp" | "webauthn")[];
+                /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                remember_device_days?: number;
+            } | null;
             /**
              * @description Free-form client metadata. Replaces the whole object — send the full merged value, not a partial delta.
              * @default {}
@@ -2302,6 +3011,14 @@ export interface components {
         UserAppMetadataUpdate: {
             [key: string]: unknown;
         };
+        AdminFactor: {
+            id: string;
+            type: string;
+            name?: string;
+            confirmed_at?: string;
+            last_used_at?: string;
+            remaining?: number;
+        };
         /** @description Identity */
         Identity: {
             /** @description Identity ID */
@@ -3306,10 +4023,37 @@ export interface components {
                  */
                 verify_email_auto_send: boolean;
             };
+            login_methods?: {
+                /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                order?: string[];
+                /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                passkey_login_enabled?: boolean;
+                /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                identifier_first?: boolean;
+                /** @description Surface the method the returning user chose last time. Defaults to false. */
+                remember_last_method?: boolean;
+            } | null;
+            mfa_policy?: {
+                /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                mode?: "off" | "optional" | "required";
+                /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                allowed_factors?: ("totp" | "webauthn")[];
+                /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                remember_device_days?: number;
+            } | null;
+            webauthn_rp_id?: string | null;
+        };
+        FactorSummary: {
+            id: string;
+            type: string;
+            name?: string;
+            confirmed_at?: string;
+            last_used_at?: string;
+            remaining?: number;
         };
         OAuthTokenParams: {
             /** @description Grant Type. https://oauth.net/2/grant-types/ */
-            grant_type?: "authorization_code" | "client_credentials" | "refresh_token" | "password" | "http://auth0.com/oauth/grant-type/passwordless/otp" | "urn:ietf:params:oauth:grant-type:token-exchange" | "urn:ietf:params:oauth:grant-type:device_code";
+            grant_type?: "authorization_code" | "client_credentials" | "refresh_token" | "password" | "http://auth0.com/oauth/grant-type/mfa-otp" | "http://auth0.com/oauth/grant-type/mfa-recovery-code" | "http://auth0.com/oauth/grant-type/passwordless/otp" | "urn:ietf:params:oauth:grant-type:token-exchange" | "urn:ietf:params:oauth:grant-type:device_code";
             client_id?: string;
             client_secret?: string;
             scope?: string;
@@ -3318,6 +4062,10 @@ export interface components {
             username?: string;
             otp?: string;
             refresh_token?: string;
+            /** @description Opaque token returned with a `403 mfa_required` response. Present it here with `grant_type=http://auth0.com/oauth/grant-type/mfa-otp` (or `…/mfa-recovery-code`) and the code, to finish a grant a second-factor policy interrupted. */
+            mfa_token?: string;
+            /** @description One of the user's one-time recovery codes, for `grant_type=http://auth0.com/oauth/grant-type/mfa-recovery-code`. */
+            recovery_code?: string;
             subject_token?: string;
             subject_token_type?: string;
             /** @description The device code returned by the authorization server. */
@@ -3330,7 +4078,7 @@ export interface components {
             [key: string]: unknown;
         };
         /** @description Grant Type. https://oauth.net/2/grant-types/ */
-        OAuthGrantType: "authorization_code" | "client_credentials" | "refresh_token" | "password" | "http://auth0.com/oauth/grant-type/passwordless/otp" | "urn:ietf:params:oauth:grant-type:token-exchange" | "urn:ietf:params:oauth:grant-type:device_code";
+        OAuthGrantType: "authorization_code" | "client_credentials" | "refresh_token" | "password" | "http://auth0.com/oauth/grant-type/mfa-otp" | "http://auth0.com/oauth/grant-type/mfa-recovery-code" | "http://auth0.com/oauth/grant-type/passwordless/otp" | "urn:ietf:params:oauth:grant-type:token-exchange" | "urn:ietf:params:oauth:grant-type:device_code";
         /** @description UsernamepasswordLoginBody */
         UsernamepasswordLoginBody: {
             username: string;
@@ -3432,6 +4180,28 @@ export interface operations {
                          *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
                          */
                         email_oauth_sync_policy?: "preserve_manual" | "always_sync";
+                        /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
+                        login_methods?: {
+                            /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                            order?: string[];
+                            /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                            passkey_login_enabled?: boolean;
+                            /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                            identifier_first?: boolean;
+                            /** @description Surface the method the returning user chose last time. Defaults to false. */
+                            remember_last_method?: boolean;
+                        };
+                        /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
+                        mfa_policy?: {
+                            /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                            mode?: "off" | "optional" | "required";
+                            /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                            allowed_factors?: ("totp" | "webauthn")[];
+                            /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                            remember_device_days?: number;
+                        };
+                        /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
+                        webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -3546,6 +4316,28 @@ export interface operations {
                          *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
                          */
                         email_oauth_sync_policy?: "preserve_manual" | "always_sync";
+                        /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
+                        login_methods?: {
+                            /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                            order?: string[];
+                            /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                            passkey_login_enabled?: boolean;
+                            /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                            identifier_first?: boolean;
+                            /** @description Surface the method the returning user chose last time. Defaults to false. */
+                            remember_last_method?: boolean;
+                        };
+                        /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
+                        mfa_policy?: {
+                            /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                            mode?: "off" | "optional" | "required";
+                            /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                            allowed_factors?: ("totp" | "webauthn")[];
+                            /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                            remember_device_days?: number;
+                        };
+                        /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
+                        webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -3614,6 +4406,28 @@ export interface operations {
                          *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
                          */
                         email_oauth_sync_policy?: "preserve_manual" | "always_sync";
+                        /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
+                        login_methods?: {
+                            /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                            order?: string[];
+                            /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                            passkey_login_enabled?: boolean;
+                            /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                            identifier_first?: boolean;
+                            /** @description Surface the method the returning user chose last time. Defaults to false. */
+                            remember_last_method?: boolean;
+                        };
+                        /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
+                        mfa_policy?: {
+                            /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                            mode?: "off" | "optional" | "required";
+                            /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                            allowed_factors?: ("totp" | "webauthn")[];
+                            /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                            remember_device_days?: number;
+                        };
+                        /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
+                        webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -3655,6 +4469,25 @@ export interface operations {
                          */
                         verify_email_auto_send?: boolean;
                     };
+                    login_methods?: {
+                        /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                        order?: string[];
+                        /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                        passkey_login_enabled?: boolean;
+                        /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                        identifier_first?: boolean;
+                        /** @description Surface the method the returning user chose last time. Defaults to false. */
+                        remember_last_method?: boolean;
+                    } | null;
+                    mfa_policy?: {
+                        /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                        mode?: "off" | "optional" | "required";
+                        /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                        allowed_factors?: ("totp" | "webauthn")[];
+                        /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                        remember_device_days?: number;
+                    } | null;
+                    webauthn_rp_id?: string | null;
                 };
             };
         };
@@ -3704,6 +4537,28 @@ export interface operations {
                          *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
                          */
                         email_oauth_sync_policy?: "preserve_manual" | "always_sync";
+                        /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
+                        login_methods?: {
+                            /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                            order?: string[];
+                            /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                            passkey_login_enabled?: boolean;
+                            /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                            identifier_first?: boolean;
+                            /** @description Surface the method the returning user chose last time. Defaults to false. */
+                            remember_last_method?: boolean;
+                        };
+                        /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
+                        mfa_policy?: {
+                            /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                            mode?: "off" | "optional" | "required";
+                            /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                            allowed_factors?: ("totp" | "webauthn")[];
+                            /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                            remember_device_days?: number;
+                        };
+                        /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
+                        webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -3781,6 +4636,28 @@ export interface operations {
                          *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
                          */
                         email_oauth_sync_policy?: "preserve_manual" | "always_sync";
+                        /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
+                        login_methods?: {
+                            /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                            order?: string[];
+                            /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                            passkey_login_enabled?: boolean;
+                            /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                            identifier_first?: boolean;
+                            /** @description Surface the method the returning user chose last time. Defaults to false. */
+                            remember_last_method?: boolean;
+                        };
+                        /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
+                        mfa_policy?: {
+                            /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                            mode?: "off" | "optional" | "required";
+                            /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                            allowed_factors?: ("totp" | "webauthn")[];
+                            /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                            remember_device_days?: number;
+                        };
+                        /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
+                        webauthn_rp_id?: string | null;
                         /** @description AuthAccount creation date */
                         createdAt: string;
                         /** @description AuthAccount updated date */
@@ -4281,6 +5158,45 @@ export interface operations {
             };
         };
     };
+    "connection/loginOptions": {
+        parameters: {
+            query?: {
+                client_id?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        account: {
+                            id: string;
+                            name: string;
+                            logo_src: string | null;
+                            icon_src: string | null;
+                        };
+                        /** @description The client the methods were resolved for, or `null` when none could be determined (no `client_id` given and the account has zero or several clients). */
+                        client: {
+                            id: string;
+                            client_id: string;
+                            name: string;
+                        } | null;
+                        identifier_first: boolean;
+                        remember_last_method: boolean;
+                        /** @description Already filtered and ordered. Render them in this order; do not re-sort or re-filter client-side. */
+                        methods: components["schemas"]["LoginOptionMethod"][];
+                    };
+                };
+            };
+        };
+    };
     "client/list": {
         parameters: {
             query?: {
@@ -4379,6 +5295,26 @@ export interface operations {
                         software_version?: string | null;
                         frontchannel_logout_uri?: string | null;
                         frontchannel_logout_session_required?: boolean;
+                        /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
+                        login_methods?: {
+                            /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                            order?: string[];
+                            /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                            passkey_login_enabled?: boolean;
+                            /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                            identifier_first?: boolean;
+                            /** @description Surface the method the returning user chose last time. Defaults to false. */
+                            remember_last_method?: boolean;
+                        };
+                        /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
+                        mfa_policy?: {
+                            /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                            mode?: "off" | "optional" | "required";
+                            /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                            allowed_factors?: ("totp" | "webauthn")[];
+                            /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                            remember_device_days?: number;
+                        };
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -4448,6 +5384,26 @@ export interface operations {
                         software_version?: string | null;
                         frontchannel_logout_uri?: string | null;
                         frontchannel_logout_session_required?: boolean;
+                        /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
+                        login_methods?: {
+                            /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                            order?: string[];
+                            /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                            passkey_login_enabled?: boolean;
+                            /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                            identifier_first?: boolean;
+                            /** @description Surface the method the returning user chose last time. Defaults to false. */
+                            remember_last_method?: boolean;
+                        };
+                        /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
+                        mfa_policy?: {
+                            /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                            mode?: "off" | "optional" | "required";
+                            /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                            allowed_factors?: ("totp" | "webauthn")[];
+                            /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                            remember_device_days?: number;
+                        };
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -4512,6 +5468,24 @@ export interface operations {
                     software_version?: string | null;
                     frontchannel_logout_uri?: string | null;
                     frontchannel_logout_session_required?: boolean;
+                    login_methods?: {
+                        /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                        order?: string[];
+                        /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                        passkey_login_enabled?: boolean;
+                        /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                        identifier_first?: boolean;
+                        /** @description Surface the method the returning user chose last time. Defaults to false. */
+                        remember_last_method?: boolean;
+                    } | null;
+                    mfa_policy?: {
+                        /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                        mode?: "off" | "optional" | "required";
+                        /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                        allowed_factors?: ("totp" | "webauthn")[];
+                        /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                        remember_device_days?: number;
+                    } | null;
                     /**
                      * @description Free-form client metadata. Replaces the whole object — send the full merged value, not a partial delta.
                      * @default {}
@@ -4563,6 +5537,26 @@ export interface operations {
                         software_version?: string | null;
                         frontchannel_logout_uri?: string | null;
                         frontchannel_logout_session_required?: boolean;
+                        /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
+                        login_methods?: {
+                            /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                            order?: string[];
+                            /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                            passkey_login_enabled?: boolean;
+                            /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                            identifier_first?: boolean;
+                            /** @description Surface the method the returning user chose last time. Defaults to false. */
+                            remember_last_method?: boolean;
+                        };
+                        /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
+                        mfa_policy?: {
+                            /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                            mode?: "off" | "optional" | "required";
+                            /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                            allowed_factors?: ("totp" | "webauthn")[];
+                            /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                            remember_device_days?: number;
+                        };
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -4632,6 +5626,26 @@ export interface operations {
                         software_version?: string | null;
                         frontchannel_logout_uri?: string | null;
                         frontchannel_logout_session_required?: boolean;
+                        /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
+                        login_methods?: {
+                            /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                            order?: string[];
+                            /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                            passkey_login_enabled?: boolean;
+                            /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                            identifier_first?: boolean;
+                            /** @description Surface the method the returning user chose last time. Defaults to false. */
+                            remember_last_method?: boolean;
+                        };
+                        /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
+                        mfa_policy?: {
+                            /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                            mode?: "off" | "optional" | "required";
+                            /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                            allowed_factors?: ("totp" | "webauthn")[];
+                            /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                            remember_device_days?: number;
+                        };
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -4701,6 +5715,26 @@ export interface operations {
                         software_version?: string | null;
                         frontchannel_logout_uri?: string | null;
                         frontchannel_logout_session_required?: boolean;
+                        /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
+                        login_methods?: {
+                            /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
+                            order?: string[];
+                            /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
+                            passkey_login_enabled?: boolean;
+                            /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
+                            identifier_first?: boolean;
+                            /** @description Surface the method the returning user chose last time. Defaults to false. */
+                            remember_last_method?: boolean;
+                        };
+                        /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
+                        mfa_policy?: {
+                            /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
+                            mode?: "off" | "optional" | "required";
+                            /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
+                            allowed_factors?: ("totp" | "webauthn")[];
+                            /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
+                            remember_device_days?: number;
+                        };
                         /** @description Object is related with this account */
                         account: string;
                         /**
@@ -5519,6 +6553,53 @@ export interface operations {
             };
         };
     };
+    "user/factors": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AdminFactor"][];
+                };
+            };
+        };
+    };
+    "user/deleteFactor": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+                factor_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        deleted: boolean;
+                    };
+                };
+            };
+        };
+    };
     "identity/list": {
         parameters: {
             query?: {
@@ -9192,7 +10273,7 @@ export interface operations {
         parameters: {
             query?: {
                 /** @description Grant Type. https://oauth.net/2/grant-types/ */
-                grant_type?: "authorization_code" | "client_credentials" | "refresh_token" | "password" | "http://auth0.com/oauth/grant-type/passwordless/otp" | "urn:ietf:params:oauth:grant-type:token-exchange" | "urn:ietf:params:oauth:grant-type:device_code";
+                grant_type?: "authorization_code" | "client_credentials" | "refresh_token" | "password" | "http://auth0.com/oauth/grant-type/mfa-otp" | "http://auth0.com/oauth/grant-type/mfa-recovery-code" | "http://auth0.com/oauth/grant-type/passwordless/otp" | "urn:ietf:params:oauth:grant-type:token-exchange" | "urn:ietf:params:oauth:grant-type:device_code";
                 client_id?: string;
                 client_secret?: string;
                 scope?: string;
@@ -9201,6 +10282,10 @@ export interface operations {
                 username?: string;
                 otp?: string;
                 refresh_token?: string;
+                /** @description Opaque token returned with a `403 mfa_required` response. Present it here with `grant_type=http://auth0.com/oauth/grant-type/mfa-otp` (or `…/mfa-recovery-code`) and the code, to finish a grant a second-factor policy interrupted. */
+                mfa_token?: string;
+                /** @description One of the user's one-time recovery codes, for `grant_type=http://auth0.com/oauth/grant-type/mfa-recovery-code`. */
+                recovery_code?: string;
                 subject_token?: string;
                 subject_token_type?: string;
                 /** @description The device code returned by the authorization server. */
@@ -9238,7 +10323,7 @@ export interface operations {
         parameters: {
             query?: {
                 /** @description Grant Type. https://oauth.net/2/grant-types/ */
-                grant_type?: "authorization_code" | "client_credentials" | "refresh_token" | "password" | "http://auth0.com/oauth/grant-type/passwordless/otp" | "urn:ietf:params:oauth:grant-type:token-exchange" | "urn:ietf:params:oauth:grant-type:device_code";
+                grant_type?: "authorization_code" | "client_credentials" | "refresh_token" | "password" | "http://auth0.com/oauth/grant-type/mfa-otp" | "http://auth0.com/oauth/grant-type/mfa-recovery-code" | "http://auth0.com/oauth/grant-type/passwordless/otp" | "urn:ietf:params:oauth:grant-type:token-exchange" | "urn:ietf:params:oauth:grant-type:device_code";
                 client_id?: string;
                 client_secret?: string;
                 scope?: string;
@@ -9247,6 +10332,10 @@ export interface operations {
                 username?: string;
                 otp?: string;
                 refresh_token?: string;
+                /** @description Opaque token returned with a `403 mfa_required` response. Present it here with `grant_type=http://auth0.com/oauth/grant-type/mfa-otp` (or `…/mfa-recovery-code`) and the code, to finish a grant a second-factor policy interrupted. */
+                mfa_token?: string;
+                /** @description One of the user's one-time recovery codes, for `grant_type=http://auth0.com/oauth/grant-type/mfa-recovery-code`. */
+                recovery_code?: string;
                 subject_token?: string;
                 subject_token_type?: string;
                 /** @description The device code returned by the authorization server. */
@@ -9264,7 +10353,7 @@ export interface operations {
             content: {
                 "application/json": {
                     /** @description Grant Type. https://oauth.net/2/grant-types/ */
-                    grant_type?: "authorization_code" | "client_credentials" | "refresh_token" | "password" | "http://auth0.com/oauth/grant-type/passwordless/otp" | "urn:ietf:params:oauth:grant-type:token-exchange" | "urn:ietf:params:oauth:grant-type:device_code";
+                    grant_type?: "authorization_code" | "client_credentials" | "refresh_token" | "password" | "http://auth0.com/oauth/grant-type/mfa-otp" | "http://auth0.com/oauth/grant-type/mfa-recovery-code" | "http://auth0.com/oauth/grant-type/passwordless/otp" | "urn:ietf:params:oauth:grant-type:token-exchange" | "urn:ietf:params:oauth:grant-type:device_code";
                     client_id?: string;
                     client_secret?: string;
                     scope?: string;
@@ -9273,6 +10362,10 @@ export interface operations {
                     username?: string;
                     otp?: string;
                     refresh_token?: string;
+                    /** @description Opaque token returned with a `403 mfa_required` response. Present it here with `grant_type=http://auth0.com/oauth/grant-type/mfa-otp` (or `…/mfa-recovery-code`) and the code, to finish a grant a second-factor policy interrupted. */
+                    mfa_token?: string;
+                    /** @description One of the user's one-time recovery codes, for `grant_type=http://auth0.com/oauth/grant-type/mfa-recovery-code`. */
+                    recovery_code?: string;
                     subject_token?: string;
                     subject_token_type?: string;
                     /** @description The device code returned by the authorization server. */