@faable/auth-sdk 2.7.103 → 2.7.105

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.76.0",
+    "version": "2.78.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -347,6 +347,60 @@
             "additionalProperties": false,
             "description": "Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults."
           },
+          "profile_fields": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": [
+                "key",
+                "type"
+              ],
+              "properties": {
+                "key": {
+                  "type": "string",
+                  "pattern": "^[a-z0-9_]{1,40}$",
+                  "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                },
+                "type": {
+                  "anyOf": [
+                    {
+                      "type": "string",
+                      "enum": [
+                        "string"
+                      ]
+                    },
+                    {
+                      "type": "string",
+                      "enum": [
+                        "enum"
+                      ]
+                    }
+                  ],
+                  "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                },
+                "options": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 200
+                  },
+                  "minItems": 1,
+                  "maxItems": 100,
+                  "description": "The accepted values when `type` is `enum`."
+                },
+                "max_length": {
+                  "type": "integer",
+                  "minimum": 1,
+                  "maximum": 1000,
+                  "description": "Longest accepted value for a `string` field. Default 200."
+                }
+              },
+              "additionalProperties": false
+            },
+            "maxItems": 20,
+            "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+          },
           "login_flow": {
             "type": "string",
             "description": "The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own.",
@@ -1685,6 +1739,60 @@
             "additionalProperties": false,
             "description": "Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults."
           },
+          "profile_fields": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": [
+                "key",
+                "type"
+              ],
+              "properties": {
+                "key": {
+                  "type": "string",
+                  "pattern": "^[a-z0-9_]{1,40}$",
+                  "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                },
+                "type": {
+                  "anyOf": [
+                    {
+                      "type": "string",
+                      "enum": [
+                        "string"
+                      ]
+                    },
+                    {
+                      "type": "string",
+                      "enum": [
+                        "enum"
+                      ]
+                    }
+                  ],
+                  "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                },
+                "options": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 200
+                  },
+                  "minItems": 1,
+                  "maxItems": 100,
+                  "description": "The accepted values when `type` is `enum`."
+                },
+                "max_length": {
+                  "type": "integer",
+                  "minimum": 1,
+                  "maximum": 1000,
+                  "description": "Longest accepted value for a `string` field. Default 200."
+                }
+              },
+              "additionalProperties": false
+            },
+            "maxItems": 20,
+            "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+          },
           "mfa_policy": {
             "type": "object",
             "properties": {
@@ -2463,6 +2571,61 @@
               }
             ]
           },
+          "profile_fields": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": [
+                "key",
+                "type"
+              ],
+              "properties": {
+                "key": {
+                  "type": "string",
+                  "pattern": "^[a-z0-9_]{1,40}$",
+                  "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                },
+                "type": {
+                  "anyOf": [
+                    {
+                      "type": "string",
+                      "enum": [
+                        "string"
+                      ]
+                    },
+                    {
+                      "type": "string",
+                      "enum": [
+                        "enum"
+                      ]
+                    }
+                  ],
+                  "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                },
+                "options": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 200
+                  },
+                  "minItems": 1,
+                  "maxItems": 100,
+                  "description": "The accepted values when `type` is `enum`."
+                },
+                "max_length": {
+                  "type": "integer",
+                  "minimum": 1,
+                  "maximum": 1000,
+                  "description": "Longest accepted value for a `string` field. Default 200."
+                }
+              },
+              "additionalProperties": false
+            },
+            "maxItems": 20,
+            "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+            "nullable": true
+          },
           "mfa_policy": {
             "anyOf": [
               {
@@ -6869,9 +7032,15 @@
                 "enum": [
                   "user"
                 ]
+              },
+              {
+                "type": "string",
+                "enum": [
+                  "password_change"
+                ]
               }
             ],
-            "description": "`admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device."
+            "description": "`admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device. `password_change`: the user set or changed their password, which ends every other session."
           },
           "account": {
             "type": "string",
@@ -7696,6 +7865,61 @@
               }
             ]
           },
+          "profile_fields": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": [
+                "key",
+                "type"
+              ],
+              "properties": {
+                "key": {
+                  "type": "string",
+                  "pattern": "^[a-z0-9_]{1,40}$",
+                  "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                },
+                "type": {
+                  "anyOf": [
+                    {
+                      "type": "string",
+                      "enum": [
+                        "string"
+                      ]
+                    },
+                    {
+                      "type": "string",
+                      "enum": [
+                        "enum"
+                      ]
+                    }
+                  ],
+                  "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                },
+                "options": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 200
+                  },
+                  "minItems": 1,
+                  "maxItems": 100,
+                  "description": "The accepted values when `type` is `enum`."
+                },
+                "max_length": {
+                  "type": "integer",
+                  "minimum": 1,
+                  "maximum": 1000,
+                  "description": "Longest accepted value for a `string` field. Default 200."
+                }
+              },
+              "additionalProperties": false
+            },
+            "maxItems": 20,
+            "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+            "nullable": true
+          },
           "mfa_policy": {
             "anyOf": [
               {
@@ -8243,7 +8467,7 @@
       },
       "ErrorCode": {
         "type": "string",
-        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (401): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `email_sender_domain_not_allowed` (400): The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `invalid_canonical_host` (400): `canonical_host` must be this account's own platform host or one of its verified custom domains.\n- `canonical_host_breaks_passkeys` (400): `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `session_already_revoked` (409): The session was already revoked.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `username_taken` (409): Another user of this database connection already uses that username.\n- `invalid_username` (400): The username is empty, or contains an `@` or whitespace. `message` says which.\n- `invalid_email` (400): The email address is not valid.\n- `invalid_name` (400): The name contains a link. `message` says which field.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): Dynamic client registration rejected a field (RFC 7591). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `no_database_connection` (400): The tenant has no database connection, so there is nowhere to store a password. Create one and retry.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `invalid_saml_request` (400): The SAMLRequest is missing, too large, not well-formed or not a SAML 2.0 AuthnRequest.\n- `saml_sp_mismatch` (400): The AuthnRequest does not match the client's SAML configuration: its Issuer is not the configured entity_id, or it asks for another Assertion Consumer Service URL or binding.\n- `saml_not_enabled` (404): This client does not have SAML enabled.\n- `invalid_saml_sp` (400): The `saml_sp` configuration is invalid: `acs_url` must be an absolute https URL without a fragment.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invalid_invite_url` (400): An invite's `accept_url` or `redirect_uri` is not an http(s) URL at an origin of this tenant's client callbacks or `callback_hostnames`, or it carries a fragment.\n- `invite_email_mismatch` (403): The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.\n- `invite_email_unverified` (403): The accepting user's email matches the invite but is not verified yet.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `consent_options_unavailable` (502): The consent screen could not load the choices from the API being authorized (its `consent_options.url`). Try again in a moment.\n- `consent_choice_invalid` (400): The choice sent with the consent decision is not one the API offered for this user.\n- `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.\n- `invalid_email_domain` (400): Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.\n- `public_email_domain` (400): A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.\n- `organization_domain_not_found` (404): The organization has no such domain.\n- `organization_domain_taken` (409): Another organization of this tenant already verified this domain. A domain belongs to one organization.\n- `organization_domain_unverified` (400): The TXT record was not found or does not hold the expected value yet. `details.record` says what was expected and what resolves now; DNS can take a few minutes to propagate.\n- `plan_unavailable` (503): The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute.\n- `organization_domain_mismatch` (403): This organization's identity provider can only sign in addresses of the organization's verified email domains.\n- `team_not_in_organization` (400): Auto-join can only put people in teams of the same organization. `details.teams` lists the others.\n- `organization_has_no_idp` (400): Requiring SSO needs an identity provider: bind an `oidc` connection to the organization first.\n- `organization_not_found` (404): No organization with that id in this account.\n- `invalid_user` (400): The user does not exist in this account.\n- `not_an_organization_admin` (404): The user is not an admin of the organization.\n- `last_organization_admin` (409): An organization keeps at least one admin. Add another admin before removing this one.\n- `team_id_unavailable` (409): The team id cannot be used in this tenant. Pick another id or let the API generate one.\n- `use_team_member_route` (400): This generic route cannot create memberships. Use `POST /team/{team_id}/member` for team members or `POST /role/{role_id}/users` for role grants.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.\n- `invalid_webhook_event` (400): An event is not in the webhook event catalog. `message` and `details.valid_events` list the valid ones.\n- `invalid_webhook_url` (400): The webhook URL must be an absolute `https` URL.\n- `not_a_webhook` (400): The operation only applies to `webhook` subscriptions.\n- `delivery_not_found` (404): No webhook delivery with that id for this subscription.\n- `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.",
+        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (401): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `email_sender_domain_not_allowed` (400): The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `invalid_canonical_host` (400): `canonical_host` must be this account's own platform host or one of its verified custom domains.\n- `canonical_host_breaks_passkeys` (400): `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `session_already_revoked` (409): The session was already revoked.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `username_taken` (409): Another user of this database connection already uses that username.\n- `invalid_username` (400): The username is empty, or contains an `@` or whitespace. `message` says which.\n- `invalid_email` (400): The email address is not valid.\n- `invalid_name` (400): The name contains a link. `message` says which field.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): Dynamic client registration rejected a field (RFC 7591). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `no_database_connection` (400): The tenant has no database connection, so there is nowhere to store a password. Create one and retry.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `invalid_saml_request` (400): The SAMLRequest is missing, too large, not well-formed or not a SAML 2.0 AuthnRequest.\n- `saml_sp_mismatch` (400): The AuthnRequest does not match the client's SAML configuration: its Issuer is not the configured entity_id, or it asks for another Assertion Consumer Service URL or binding.\n- `saml_not_enabled` (404): This client does not have SAML enabled.\n- `invalid_saml_sp` (400): The `saml_sp` configuration is invalid: `acs_url` must be an absolute https URL without a fragment.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `reauth_required` (403): The operation needs a recent sign-in (and the second factor, when the user has one). Sign in again with `max_age=0` and retry with the new token.\n- `invalid_current_password` (400): The current password is wrong.\n- `email_not_verified` (403): The user's email is not verified, and the operation needs it to be.\n- `invalid_profile_field` (400): A profile field is not declared for this application, or its value does not match the declaration. `message` names the key.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invalid_invite_url` (400): An invite's `accept_url` or `redirect_uri` is not an http(s) URL at an origin of this tenant's client callbacks or `callback_hostnames`, or it carries a fragment.\n- `invite_email_mismatch` (403): The invite is for another email address than the accepting user's. `details.invited_email` shows it masked.\n- `invite_email_unverified` (403): The accepting user's email matches the invite but is not verified yet.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `consent_options_unavailable` (502): The consent screen could not load the choices from the API being authorized (its `consent_options.url`). Try again in a moment.\n- `consent_choice_invalid` (400): The choice sent with the consent decision is not one the API offered for this user.\n- `registration_disabled` (403): Dynamic client registration is turned off for this tenant. Create the client from the dashboard or the Management API, or turn on `dynamic_client_registration_enabled`.\n- `invalid_email_domain` (400): Not an email domain this organization can claim: it must be a plain domain name (`acme.com`), lowercase, without scheme, path or wildcard.\n- `public_email_domain` (400): A public email provider (gmail.com, outlook.com…) cannot belong to an organization: anyone can have an address there.\n- `organization_domain_not_found` (404): The organization has no such domain.\n- `organization_domain_taken` (409): Another organization of this tenant already verified this domain. A domain belongs to one organization.\n- `organization_domain_unverified` (400): The TXT record was not found or does not hold the expected value yet. `details.record` says what was expected and what resolves now; DNS can take a few minutes to propagate.\n- `plan_unavailable` (503): The plan could not be checked right now, and this setting is only for paid plans. Try again in a minute.\n- `organization_domain_mismatch` (403): This organization's identity provider can only sign in addresses of the organization's verified email domains.\n- `team_not_in_organization` (400): Auto-join can only put people in teams of the same organization. `details.teams` lists the others.\n- `organization_has_no_idp` (400): Requiring SSO needs an identity provider: bind an `oidc` connection to the organization first.\n- `organization_not_found` (404): No organization with that id in this account.\n- `invalid_user` (400): The user does not exist in this account.\n- `not_an_organization_admin` (404): The user is not an admin of the organization.\n- `last_organization_admin` (409): An organization keeps at least one admin. Add another admin before removing this one.\n- `team_id_unavailable` (409): The team id cannot be used in this tenant. Pick another id or let the API generate one.\n- `use_team_member_route` (400): This generic route cannot create memberships. Use `POST /team/{team_id}/member` for team members or `POST /role/{role_id}/users` for role grants.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.\n- `invalid_webhook_event` (400): An event is not in the webhook event catalog. `message` and `details.valid_events` list the valid ones.\n- `invalid_webhook_url` (400): The webhook URL must be an absolute `https` URL.\n- `not_a_webhook` (400): The operation only applies to `webhook` subscriptions.\n- `delivery_not_found` (404): No webhook delivery with that id for this subscription.\n- `delivery_in_progress` (409): The delivery is being attempted right now; retry the redeliver in a minute.",
         "enum": [
           "bad_request",
           "validation_error",
@@ -8342,6 +8566,10 @@
           "login_flow_misconfigured",
           "mfa_required",
           "step_up_required",
+          "reauth_required",
+          "invalid_current_password",
+          "email_not_verified",
+          "invalid_profile_field",
           "interaction_required",
           "passkey_login_disabled",
           "mfa_pending",
@@ -8861,6 +9089,60 @@
                       "additionalProperties": false,
                       "description": "Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults."
                     },
+                    "profile_fields": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "key",
+                          "type"
+                        ],
+                        "properties": {
+                          "key": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]{1,40}$",
+                            "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                          },
+                          "type": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "string"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "enum"
+                                ]
+                              }
+                            ],
+                            "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                          },
+                          "options": {
+                            "type": "array",
+                            "items": {
+                              "type": "string",
+                              "minLength": 1,
+                              "maxLength": 200
+                            },
+                            "minItems": 1,
+                            "maxItems": 100,
+                            "description": "The accepted values when `type` is `enum`."
+                          },
+                          "max_length": {
+                            "type": "integer",
+                            "minimum": 1,
+                            "maximum": 1000,
+                            "description": "Longest accepted value for a `string` field. Default 200."
+                          }
+                        },
+                        "additionalProperties": false
+                      },
+                      "maxItems": 20,
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                    },
                     "login_flow": {
                       "type": "string",
                       "description": "The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own.",
@@ -9613,6 +9895,60 @@
                       "additionalProperties": false,
                       "description": "Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults."
                     },
+                    "profile_fields": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "key",
+                          "type"
+                        ],
+                        "properties": {
+                          "key": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]{1,40}$",
+                            "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                          },
+                          "type": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "string"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "enum"
+                                ]
+                              }
+                            ],
+                            "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                          },
+                          "options": {
+                            "type": "array",
+                            "items": {
+                              "type": "string",
+                              "minLength": 1,
+                              "maxLength": 200
+                            },
+                            "minItems": 1,
+                            "maxItems": 100,
+                            "description": "The accepted values when `type` is `enum`."
+                          },
+                          "max_length": {
+                            "type": "integer",
+                            "minimum": 1,
+                            "maximum": 1000,
+                            "description": "Longest accepted value for a `string` field. Default 200."
+                          }
+                        },
+                        "additionalProperties": false
+                      },
+                      "maxItems": 20,
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                    },
                     "login_flow": {
                       "type": "string",
                       "description": "The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own.",
@@ -10602,6 +10938,60 @@
                       "additionalProperties": false,
                       "description": "Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults."
                     },
+                    "profile_fields": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "key",
+                          "type"
+                        ],
+                        "properties": {
+                          "key": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]{1,40}$",
+                            "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                          },
+                          "type": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "string"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "enum"
+                                ]
+                              }
+                            ],
+                            "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                          },
+                          "options": {
+                            "type": "array",
+                            "items": {
+                              "type": "string",
+                              "minLength": 1,
+                              "maxLength": 200
+                            },
+                            "minItems": 1,
+                            "maxItems": 100,
+                            "description": "The accepted values when `type` is `enum`."
+                          },
+                          "max_length": {
+                            "type": "integer",
+                            "minimum": 1,
+                            "maximum": 1000,
+                            "description": "Longest accepted value for a `string` field. Default 200."
+                          }
+                        },
+                        "additionalProperties": false
+                      },
+                      "maxItems": 20,
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                    },
                     "login_flow": {
                       "type": "string",
                       "description": "The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own.",
@@ -11216,6 +11606,61 @@
                       }
                     ]
                   },
+                  "profile_fields": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "required": [
+                        "key",
+                        "type"
+                      ],
+                      "properties": {
+                        "key": {
+                          "type": "string",
+                          "pattern": "^[a-z0-9_]{1,40}$",
+                          "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                        },
+                        "type": {
+                          "anyOf": [
+                            {
+                              "type": "string",
+                              "enum": [
+                                "string"
+                              ]
+                            },
+                            {
+                              "type": "string",
+                              "enum": [
+                                "enum"
+                              ]
+                            }
+                          ],
+                          "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                        },
+                        "options": {
+                          "type": "array",
+                          "items": {
+                            "type": "string",
+                            "minLength": 1,
+                            "maxLength": 200
+                          },
+                          "minItems": 1,
+                          "maxItems": 100,
+                          "description": "The accepted values when `type` is `enum`."
+                        },
+                        "max_length": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 1000,
+                          "description": "Longest accepted value for a `string` field. Default 200."
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "maxItems": 20,
+                    "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+                    "nullable": true
+                  },
                   "mfa_policy": {
                     "anyOf": [
                       {
@@ -11775,6 +12220,60 @@
                       "additionalProperties": false,
                       "description": "Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults."
                     },
+                    "profile_fields": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "key",
+                          "type"
+                        ],
+                        "properties": {
+                          "key": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]{1,40}$",
+                            "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                          },
+                          "type": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "string"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "enum"
+                                ]
+                              }
+                            ],
+                            "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                          },
+                          "options": {
+                            "type": "array",
+                            "items": {
+                              "type": "string",
+                              "minLength": 1,
+                              "maxLength": 200
+                            },
+                            "minItems": 1,
+                            "maxItems": 100,
+                            "description": "The accepted values when `type` is `enum`."
+                          },
+                          "max_length": {
+                            "type": "integer",
+                            "minimum": 1,
+                            "maximum": 1000,
+                            "description": "Longest accepted value for a `string` field. Default 200."
+                          }
+                        },
+                        "additionalProperties": false
+                      },
+                      "maxItems": 20,
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                    },
                     "login_flow": {
                       "type": "string",
                       "description": "The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own.",
@@ -14044,61 +14543,14 @@
         }
       }
     },
-    "/account/{account_id}/transfer": {
-      "post": {
-        "operationId": "account/transfer",
-        "summary": "Move an Account to another project",
+    "/internal/accounts": {
+      "get": {
+        "operationId": "internal/accountsOverview",
+        "summary": "Every tenant with its usage counters (platform)",
         "tags": [
           "account"
         ],
-        "description": "Re-parents an Auth Account (tenant) under another Faable project. Only `Account.team` changes: the tenant keeps its id, slug, `*.auth.faable.link` domain, clients and secrets, and end-user logins are unaffected. `dry_run` returns the plan (what rides along + blockers) without writing. Platform credentials only. See arch/auth/tenant-project-transfer.md.",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "required": [
-                  "to_project",
-                  "reason"
-                ],
-                "properties": {
-                  "to_project": {
-                    "type": "string",
-                    "description": "Destination project (`project_<hex>`) or its team id (`team_<hex>`) — both spellings are accepted."
-                  },
-                  "reason": {
-                    "type": "string",
-                    "minLength": 3,
-                    "maxLength": 500,
-                    "description": "Why the tenant is being moved. Recorded in the tenant's log and in ours."
-                  },
-                  "dry_run": {
-                    "type": "boolean",
-                    "default": false,
-                    "description": "Return the plan (what rides along + blockers) without writing."
-                  },
-                  "allow_over_cap": {
-                    "type": "boolean",
-                    "default": false,
-                    "description": "Move even if the destination ends up above the per-project cap on Auth Accounts."
-                  }
-                },
-                "additionalProperties": false
-              }
-            }
-          }
-        },
-        "parameters": [
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "path",
-            "name": "account_id",
-            "required": true
-          }
-        ],
+        "description": "All accounts on the platform, each with its users, clients, connections, last login, first end-user login and whether it has a verified custom domain. Platform token with `read:accounts`.",
         "security": [
           {
             "bearerAuth": []
@@ -14112,118 +14564,96 @@
                 "schema": {
                   "type": "object",
                   "required": [
-                    "moved",
-                    "account_id",
-                    "account_name",
-                    "slug",
-                    "domain",
-                    "from_project",
-                    "to_project",
-                    "target_tenants_before",
-                    "moves_with_it",
-                    "blockers"
+                    "rows"
                   ],
                   "properties": {
-                    "moved": {
-                      "type": "boolean"
-                    },
-                    "account_id": {
-                      "type": "string"
-                    },
-                    "account_name": {
-                      "type": "string"
-                    },
-                    "slug": {
-                      "type": "string"
-                    },
-                    "domain": {
-                      "type": "string"
-                    },
-                    "from_project": {
-                      "type": "string"
-                    },
-                    "to_project": {
-                      "type": "string"
-                    },
-                    "target_tenants_before": {
+                    "rows": {
                       "type": "array",
                       "items": {
                         "type": "object",
                         "required": [
-                          "id",
-                          "name"
+                          "account_id",
+                          "team",
+                          "name",
+                          "createdAt",
+                          "first_login_at",
+                          "users",
+                          "last_login",
+                          "clients",
+                          "connections",
+                          "custom_domain_verified"
                         ],
                         "properties": {
-                          "id": {
+                          "account_id": {
                             "type": "string"
                           },
+                          "team": {
+                            "anyOf": [
+                              {
+                                "type": "string"
+                              },
+                              {
+                                "type": "null"
+                              }
+                            ],
+                            "description": "The project (`team_<hex>`), or null for a legacy account without one."
+                          },
                           "name": {
                             "type": "string"
-                          }
-                        }
-                      }
-                    },
-                    "moves_with_it": {
-                      "type": "object",
-                      "additionalProperties": {
-                        "type": "number"
-                      }
-                    },
-                    "blockers": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "required": [
-                          "code",
-                          "detail"
-                        ],
-                        "properties": {
-                          "code": {
-                            "type": "string"
                           },
-                          "detail": {
-                            "type": "string"
+                          "createdAt": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "format": "date-time"
+                              },
+                              {
+                                "type": "null"
+                              }
+                            ]
+                          },
+                          "first_login_at": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "description": "When the first end user ever completed a login on this tenant — the integration signal (arch/auth/activation-signal.md)."
+                              },
+                              {
+                                "type": "null"
+                              }
+                            ]
+                          },
+                          "users": {
+                            "type": "integer"
+                          },
+                          "last_login": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "format": "date-time"
+                              },
+                              {
+                                "type": "null"
+                              }
+                            ]
+                          },
+                          "clients": {
+                            "type": "integer"
+                          },
+                          "connections": {
+                            "type": "integer"
+                          },
+                          "custom_domain_verified": {
+                            "type": "boolean"
                           }
                         }
                       }
-                    },
-                    "tenants_left_in_source": {
-                      "type": "number"
-                    },
-                    "tenants_in_target": {
-                      "type": "number"
                     }
                   }
                 }
               }
             }
           },
-          "400": {
-            "description": "`invalid_project_id` — The project id is not of the form `project_<hex>` or `team_<hex>`.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "invalid_project_id",
-                            "validation_error"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
           "401": {
             "description": "`unauthorized` — The request carries no valid credentials.",
             "content": {
@@ -14301,31 +14731,341 @@
               }
             }
           },
-          "409": {
-            "description": "`account_transfer_refused` — The Auth Account cannot be moved to that project. `details.blockers` lists why.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "account_transfer_refused"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/account/{account_id}/transfer": {
+      "post": {
+        "operationId": "account/transfer",
+        "summary": "Move an Account to another project",
+        "tags": [
+          "account"
+        ],
+        "description": "Re-parents an Auth Account (tenant) under another Faable project. Only `Account.team` changes: the tenant keeps its id, slug, `*.auth.faable.link` domain, clients and secrets, and end-user logins are unaffected. `dry_run` returns the plan (what rides along + blockers) without writing. Platform credentials only. See arch/auth/tenant-project-transfer.md.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "to_project",
+                  "reason"
+                ],
+                "properties": {
+                  "to_project": {
+                    "type": "string",
+                    "description": "Destination project (`project_<hex>`) or its team id (`team_<hex>`) — both spellings are accepted."
+                  },
+                  "reason": {
+                    "type": "string",
+                    "minLength": 3,
+                    "maxLength": 500,
+                    "description": "Why the tenant is being moved. Recorded in the tenant's log and in ours."
+                  },
+                  "dry_run": {
+                    "type": "boolean",
+                    "default": false,
+                    "description": "Return the plan (what rides along + blockers) without writing."
+                  },
+                  "allow_over_cap": {
+                    "type": "boolean",
+                    "default": false,
+                    "description": "Move even if the destination ends up above the per-project cap on Auth Accounts."
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "account_id",
+            "required": true
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "moved",
+                    "account_id",
+                    "account_name",
+                    "slug",
+                    "domain",
+                    "from_project",
+                    "to_project",
+                    "target_tenants_before",
+                    "moves_with_it",
+                    "blockers"
+                  ],
+                  "properties": {
+                    "moved": {
+                      "type": "boolean"
+                    },
+                    "account_id": {
+                      "type": "string"
+                    },
+                    "account_name": {
+                      "type": "string"
+                    },
+                    "slug": {
+                      "type": "string"
+                    },
+                    "domain": {
+                      "type": "string"
+                    },
+                    "from_project": {
+                      "type": "string"
+                    },
+                    "to_project": {
+                      "type": "string"
+                    },
+                    "target_tenants_before": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "id",
+                          "name"
+                        ],
+                        "properties": {
+                          "id": {
+                            "type": "string"
+                          },
+                          "name": {
+                            "type": "string"
+                          }
+                        }
+                      }
+                    },
+                    "moves_with_it": {
+                      "type": "object",
+                      "additionalProperties": {
+                        "type": "number"
+                      }
+                    },
+                    "blockers": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "code",
+                          "detail"
+                        ],
+                        "properties": {
+                          "code": {
+                            "type": "string"
+                          },
+                          "detail": {
+                            "type": "string"
+                          }
+                        }
+                      }
+                    },
+                    "tenants_left_in_source": {
+                      "type": "number"
+                    },
+                    "tenants_in_target": {
+                      "type": "number"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_project_id` — The project id is not of the form `project_<hex>` or `team_<hex>`.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_project_id",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "`account_transfer_refused` — The Auth Account cannot be moved to that project. `details.blockers` lists why.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_transfer_refused"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
           "429": {
             "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
             "content": {
@@ -14740,6 +15480,60 @@
                       "additionalProperties": false,
                       "description": "Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults."
                     },
+                    "profile_fields": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "key",
+                          "type"
+                        ],
+                        "properties": {
+                          "key": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]{1,40}$",
+                            "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                          },
+                          "type": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "string"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "enum"
+                                ]
+                              }
+                            ],
+                            "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                          },
+                          "options": {
+                            "type": "array",
+                            "items": {
+                              "type": "string",
+                              "minLength": 1,
+                              "maxLength": 200
+                            },
+                            "minItems": 1,
+                            "maxItems": 100,
+                            "description": "The accepted values when `type` is `enum`."
+                          },
+                          "max_length": {
+                            "type": "integer",
+                            "minimum": 1,
+                            "maximum": 1000,
+                            "description": "Longest accepted value for a `string` field. Default 200."
+                          }
+                        },
+                        "additionalProperties": false
+                      },
+                      "maxItems": 20,
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                    },
                     "login_flow": {
                       "type": "string",
                       "description": "The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own.",
@@ -18931,6 +19725,60 @@
                       "additionalProperties": false,
                       "description": "Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults."
                     },
+                    "profile_fields": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "key",
+                          "type"
+                        ],
+                        "properties": {
+                          "key": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]{1,40}$",
+                            "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                          },
+                          "type": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "string"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "enum"
+                                ]
+                              }
+                            ],
+                            "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                          },
+                          "options": {
+                            "type": "array",
+                            "items": {
+                              "type": "string",
+                              "minLength": 1,
+                              "maxLength": 200
+                            },
+                            "minItems": 1,
+                            "maxItems": 100,
+                            "description": "The accepted values when `type` is `enum`."
+                          },
+                          "max_length": {
+                            "type": "integer",
+                            "minimum": 1,
+                            "maximum": 1000,
+                            "description": "Longest accepted value for a `string` field. Default 200."
+                          }
+                        },
+                        "additionalProperties": false
+                      },
+                      "maxItems": 20,
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                    },
                     "mfa_policy": {
                       "type": "object",
                       "properties": {
@@ -19686,6 +20534,60 @@
                       "additionalProperties": false,
                       "description": "Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults."
                     },
+                    "profile_fields": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "key",
+                          "type"
+                        ],
+                        "properties": {
+                          "key": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]{1,40}$",
+                            "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                          },
+                          "type": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "string"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "enum"
+                                ]
+                              }
+                            ],
+                            "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                          },
+                          "options": {
+                            "type": "array",
+                            "items": {
+                              "type": "string",
+                              "minLength": 1,
+                              "maxLength": 200
+                            },
+                            "minItems": 1,
+                            "maxItems": 100,
+                            "description": "The accepted values when `type` is `enum`."
+                          },
+                          "max_length": {
+                            "type": "integer",
+                            "minimum": 1,
+                            "maximum": 1000,
+                            "description": "Longest accepted value for a `string` field. Default 200."
+                          }
+                        },
+                        "additionalProperties": false
+                      },
+                      "maxItems": 20,
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                    },
                     "mfa_policy": {
                       "type": "object",
                       "properties": {
@@ -20460,6 +21362,61 @@
                       }
                     ]
                   },
+                  "profile_fields": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "required": [
+                        "key",
+                        "type"
+                      ],
+                      "properties": {
+                        "key": {
+                          "type": "string",
+                          "pattern": "^[a-z0-9_]{1,40}$",
+                          "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                        },
+                        "type": {
+                          "anyOf": [
+                            {
+                              "type": "string",
+                              "enum": [
+                                "string"
+                              ]
+                            },
+                            {
+                              "type": "string",
+                              "enum": [
+                                "enum"
+                              ]
+                            }
+                          ],
+                          "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                        },
+                        "options": {
+                          "type": "array",
+                          "items": {
+                            "type": "string",
+                            "minLength": 1,
+                            "maxLength": 200
+                          },
+                          "minItems": 1,
+                          "maxItems": 100,
+                          "description": "The accepted values when `type` is `enum`."
+                        },
+                        "max_length": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 1000,
+                          "description": "Longest accepted value for a `string` field. Default 200."
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "maxItems": 20,
+                    "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit.",
+                    "nullable": true
+                  },
                   "mfa_policy": {
                     "anyOf": [
                       {
@@ -21060,6 +22017,60 @@
                       "additionalProperties": false,
                       "description": "Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults."
                     },
+                    "profile_fields": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "key",
+                          "type"
+                        ],
+                        "properties": {
+                          "key": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]{1,40}$",
+                            "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                          },
+                          "type": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "string"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "enum"
+                                ]
+                              }
+                            ],
+                            "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                          },
+                          "options": {
+                            "type": "array",
+                            "items": {
+                              "type": "string",
+                              "minLength": 1,
+                              "maxLength": 200
+                            },
+                            "minItems": 1,
+                            "maxItems": 100,
+                            "description": "The accepted values when `type` is `enum`."
+                          },
+                          "max_length": {
+                            "type": "integer",
+                            "minimum": 1,
+                            "maximum": 1000,
+                            "description": "Longest accepted value for a `string` field. Default 200."
+                          }
+                        },
+                        "additionalProperties": false
+                      },
+                      "maxItems": 20,
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                    },
                     "mfa_policy": {
                       "type": "object",
                       "properties": {
@@ -21815,6 +22826,60 @@
                       "additionalProperties": false,
                       "description": "Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults."
                     },
+                    "profile_fields": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "key",
+                          "type"
+                        ],
+                        "properties": {
+                          "key": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]{1,40}$",
+                            "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                          },
+                          "type": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "string"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "enum"
+                                ]
+                              }
+                            ],
+                            "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                          },
+                          "options": {
+                            "type": "array",
+                            "items": {
+                              "type": "string",
+                              "minLength": 1,
+                              "maxLength": 200
+                            },
+                            "minItems": 1,
+                            "maxItems": 100,
+                            "description": "The accepted values when `type` is `enum`."
+                          },
+                          "max_length": {
+                            "type": "integer",
+                            "minimum": 1,
+                            "maximum": 1000,
+                            "description": "Longest accepted value for a `string` field. Default 200."
+                          }
+                        },
+                        "additionalProperties": false
+                      },
+                      "maxItems": 20,
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                    },
                     "mfa_policy": {
                       "type": "object",
                       "properties": {
@@ -22571,6 +23636,60 @@
                       "additionalProperties": false,
                       "description": "Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults."
                     },
+                    "profile_fields": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "key",
+                          "type"
+                        ],
+                        "properties": {
+                          "key": {
+                            "type": "string",
+                            "pattern": "^[a-z0-9_]{1,40}$",
+                            "description": "The field key, as it is stored in `user_metadata[\"faable.com/fields\"]`."
+                          },
+                          "type": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "string"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "enum"
+                                ]
+                              }
+                            ],
+                            "description": "`string`: free text up to `max_length`. `enum`: one of `options`."
+                          },
+                          "options": {
+                            "type": "array",
+                            "items": {
+                              "type": "string",
+                              "minLength": 1,
+                              "maxLength": 200
+                            },
+                            "minItems": 1,
+                            "maxItems": 100,
+                            "description": "The accepted values when `type` is `enum`."
+                          },
+                          "max_length": {
+                            "type": "integer",
+                            "minimum": 1,
+                            "maximum": 1000,
+                            "description": "Longest accepted value for a `string` field. Default 200."
+                          }
+                        },
+                        "additionalProperties": false
+                      },
+                      "maxItems": 20,
+                      "description": "Profile fields the user may write on themselves with `PATCH /me` (`fields`), stored in `user_metadata[\"faable.com/fields\"]`. On a Client it replaces the account's list entirely; absent = inherit."
+                    },
                     "mfa_policy": {
                       "type": "object",
                       "properties": {
@@ -60459,9 +61578,15 @@
                           "enum": [
                             "user"
                           ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "password_change"
+                          ]
                         }
                       ],
-                      "description": "`admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device."
+                      "description": "`admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device. `password_change`: the user set or changed their password, which ends every other session."
                     },
                     "account": {
                       "type": "string",
@@ -60794,9 +61919,15 @@
                           "enum": [
                             "user"
                           ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "password_change"
+                          ]
                         }
                       ],
-                      "description": "`admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device."
+                      "description": "`admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device. `password_change`: the user set or changed their password, which ends every other session."
                     },
                     "account": {
                       "type": "string",
@@ -67259,6 +68390,31 @@
               }
             }
           },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
           "404": {
             "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
             "content": {
@@ -67342,7 +68498,7 @@
         "tags": [
           "session"
         ],
-        "description": "Updates the profile of the User behind the current session or bearer token. Only `name`, `company_name` and `country_iso` can be changed; `company_name` is merged into `user_metadata` without touching its other keys. A Bearer token must belong to this Account.",
+        "description": "Updates the profile of the User behind the current session or bearer token. Only `name`, `company_name`, `country_iso` and the custom `fields` the application declares (`profile_fields`) can be changed; `company_name` and `fields` are merged into `user_metadata` without touching its other keys. A Bearer token must belong to this Account.",
         "requestBody": {
           "required": true,
           "content": {
@@ -67362,14 +68518,39 @@
                   "country_iso": {
                     "type": "string",
                     "maxLength": 3
+                  },
+                  "fields": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "required": [
+                        "key",
+                        "value"
+                      ],
+                      "properties": {
+                        "key": {
+                          "type": "string",
+                          "minLength": 1,
+                          "maxLength": 40
+                        },
+                        "value": {
+                          "type": "string",
+                          "maxLength": 1000,
+                          "nullable": true
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "maxItems": 20,
+                    "description": "Custom profile fields, stored in `user_metadata[\"faable.com/fields\"]` and merged by key: keys not named here are kept, `null` removes one. Only the keys the application declares in `profile_fields` (Client, else Account) are accepted; any other key fails the whole request with `invalid_profile_field`."
                   }
                 },
                 "additionalProperties": false,
-                "description": "Profile fields the current User may edit on themselves. `company_name` is stored in `user_metadata`, merged with whatever else is there."
+                "description": "Profile fields the current User may edit on themselves. `company_name` and `fields` are stored in `user_metadata`, merged with whatever else is there."
               }
             }
           },
-          "description": "Profile fields the current User may edit on themselves. `company_name` is stored in `user_metadata`, merged with whatever else is there."
+          "description": "Profile fields the current User may edit on themselves. `company_name` and `fields` are stored in `user_metadata`, merged with whatever else is there."
         },
         "responses": {
           "200": {
@@ -67764,7 +68945,7 @@
             }
           },
           "400": {
-            "description": "`bad_request` — The request is malformed. `message` says what is wrong.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`bad_request` — The request is malformed. `message` says what is wrong.\n\n`invalid_profile_field` — A profile field is not declared for this application, or its value does not match the declaration. `message` names the key.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -67779,6 +68960,7 @@
                           "type": "string",
                           "enum": [
                             "bad_request",
+                            "invalid_profile_field",
                             "validation_error"
                           ]
                         }
@@ -68335,6 +69517,429 @@
         }
       }
     },
+    "/me/credentials": {
+      "get": {
+        "operationId": "session/me_credentials",
+        "summary": "How the current User signs in",
+        "tags": [
+          "session"
+        ],
+        "description": "Whether the User behind the session or bearer token has a password, and which connections they are linked to. A Bearer token must belong to this Account and be a user token.",
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "has_password",
+                    "connections"
+                  ],
+                  "properties": {
+                    "has_password": {
+                      "type": "boolean",
+                      "description": "Whether the user can sign in with a password: they have a `database` credential with a password set."
+                    },
+                    "connections": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "id",
+                          "name",
+                          "type"
+                        ],
+                        "properties": {
+                          "id": {
+                            "type": "string",
+                            "description": "The Connection id (`connection_xxx`)."
+                          },
+                          "name": {
+                            "type": "string",
+                            "description": "The Connection name."
+                          },
+                          "type": {
+                            "type": "string",
+                            "description": "The Connection type: `database`, `google`, `github`, …"
+                          }
+                        },
+                        "additionalProperties": false
+                      },
+                      "description": "Every connection the user is linked to: the database one when they have a password, and each social or enterprise identity. Never the provider tokens or profile."
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`mfa_pending` — A second-factor challenge is pending; answer it before continuing.\n\n`not_logged_in` — There is no signed-in session for this request.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "mfa_pending",
+                            "not_logged_in"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/me/password": {
+      "post": {
+        "operationId": "session/me_password",
+        "summary": "Set or change the current User password",
+        "tags": [
+          "session"
+        ],
+        "description": "Sets the password of the User behind the session or bearer token, creating their `database` credential if they have none (e.g. they signed up with Google). Changing an existing password needs `current_password`. Setting the first one needs a verified email and a recent sign-in: `auth_time` within 5 minutes and, when the User has a second factor, a sign-in that completed it (`acr` = `urn:faable:loa:2`); otherwise `reauth_required`, and the app signs in again with `max_age=0`. The connection's password policy applies. Every other session of the User is revoked, and the User gets a security email. A Bearer token must belong to this Account and be a user token.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "password"
+                ],
+                "properties": {
+                  "password": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 512
+                  },
+                  "current_password": {
+                    "type": "string",
+                    "maxLength": 512
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "revoked_sessions"
+                  ],
+                  "properties": {
+                    "revoked_sessions": {
+                      "type": "number",
+                      "description": "How many other sessions of the user were ended."
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_current_password` — The current password is wrong.\n\n`password_too_weak` — The password does not meet the connection policy. `message` lists each unmet rule.\n\n`no_database_connection` — The tenant has no database connection, so there is nowhere to store a password. Create one and retry.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_current_password",
+                            "password_too_weak",
+                            "no_database_connection",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`mfa_pending` — A second-factor challenge is pending; answer it before continuing.\n\n`not_logged_in` — There is no signed-in session for this request.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "mfa_pending",
+                            "not_logged_in"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`reauth_required` — The operation needs a recent sign-in (and the second factor, when the user has one). Sign in again with `max_age=0` and retry with the new token.\n\n`email_not_verified` — The user's email is not verified, and the operation needs it to be.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "reauth_required",
+                            "email_not_verified"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "`conflict` — The request conflicts with the current state of the resource.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "conflict"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_login_attempts` — Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n\n`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_login_attempts",
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/logout": {
       "get": {
         "operationId": "session/logout",