@faable/auth-sdk 2.7.22 → 2.7.23

package/dist/api/generated-client.d.ts

@@ -5167,6 +5167,50 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         createdAt: string;
         updatedAt?: string | undefined;
     }>;
+    /**
+     * `DELETE /user/{user_id}/factors/{factor_id}` — operationId: `user/deleteFactor`
+     *
+     * Remove one of a user's second factors
+     *
+     * The support path out of a lockout: with the factor gone, a `required` policy sends the user through enrolment on their next login instead of refusing it.
+     *
+     * @throws {FaableApiError} `factor_not_found` (400) — No factor with that id belongs to this user.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userDeleteFactor(user_id: string, factor_id: string): Promise<{
+        deleted: boolean;
+    }>;
+    /**
+     * `GET /user/{user_id}/factors` — operationId: `user/factors`
+     *
+     * List a user's second factors
+     *
+     * Management view of the security methods a user has enrolled. Carries no secret material — TOTP seeds and recovery-code hashes are redacted by the store, so this endpoint cannot be used to impersonate the user.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userFactors(user_id: string): Promise<{
+        id: string;
+        type: string;
+        name?: string | undefined;
+        confirmed_at?: string | undefined;
+        last_used_at?: string | undefined;
+        remaining?: number | undefined;
+    }[]>;
     /**
      * `GET /user/{user_id}` — operationId: `user/get`
      *
@@ -5496,6 +5540,25 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
         ticket_id: string;
         channel: "email" | "sms" | "whatsapp" | "factor";
     }>;
+    /**
+     * `POST /user/{user_id}/passkey-prompt/reset` — operationId: `user/resetPasskeyPrompt`
+     *
+     * Reset a user's passkey offer counter
+     *
+     * The post-login "create a passkey" offer stops after `login_methods.passkey_promotion_max_prompts` times and snoozes between them. This clears both, so the user is offered a passkey again on their next login — for "why does it keep asking" and "please ask me again" alike.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userResetPasskeyPrompt(user_id: string): Promise<{
+        reset: boolean;
+    }>;
     /**
      * `POST /user/{user_id}/tickets/{ticket_id}/revoke` — operationId: `user/revokeTicket`
      *

package/dist/api/generated-client.js

@@ -1922,6 +1922,48 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("user_id", user_id);
         return this.fetcher.delete(`/user/${user_id}`);
     }
+    /**
+     * `DELETE /user/{user_id}/factors/{factor_id}` — operationId: `user/deleteFactor`
+     *
+     * Remove one of a user's second factors
+     *
+     * The support path out of a lockout: with the factor gone, a `required` policy sends the user through enrolment on their next login instead of refusing it.
+     *
+     * @throws {FaableApiError} `factor_not_found` (400) — No factor with that id belongs to this user.
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userDeleteFactor(user_id, factor_id) {
+        requireId("user_id", user_id);
+        requireId("factor_id", factor_id);
+        return this.fetcher.delete(`/user/${user_id}/factors/${factor_id}`);
+    }
+    /**
+     * `GET /user/{user_id}/factors` — operationId: `user/factors`
+     *
+     * List a user's second factors
+     *
+     * Management view of the security methods a user has enrolled. Carries no secret material — TOTP seeds and recovery-code hashes are redacted by the store, so this endpoint cannot be used to impersonate the user.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userFactors(user_id) {
+        requireId("user_id", user_id);
+        return this.fetcher.get(`/user/${user_id}/factors`);
+    }
     /**
      * `GET /user/{user_id}` — operationId: `user/get`
      *
@@ -2006,6 +2048,26 @@ export class GeneratedFaableAuthApi extends FaableApi {
         requireId("user_id", user_id);
         return this.fetcher.post(`/user/${user_id}/password-setup`, data);
     }
+    /**
+     * `POST /user/{user_id}/passkey-prompt/reset` — operationId: `user/resetPasskeyPrompt`
+     *
+     * Reset a user's passkey offer counter
+     *
+     * The post-login "create a passkey" offer stops after `login_methods.passkey_promotion_max_prompts` times and snoozes between them. This clears both, so the user is offered a passkey again on their next login — for "why does it keep asking" and "please ask me again" alike.
+     *
+     * @throws {FaableApiError} `validation_error` (400) — The body, query or path failed schema validation. `details.issues` lists each failing field.
+     * @throws {FaableApiError} `unauthorized` (401) — The request carries no valid credentials.
+     * @throws {FaableApiError} `forbidden` (403) — The credentials are valid but do not allow this operation.
+     * @throws {FaableApiError} `insufficient_scope` (403) — The token lacks a scope this operation requires. `message` names it.
+     * @throws {FaableApiError} `user_suspended` (403) — The user is suspended and cannot sign in or be modified.
+     * @throws {FaableApiError} `account_not_found` (404) — No Auth Account matches the request (domain, header or token).
+     * @throws {FaableApiError} `too_many_requests` (429) — Rate limit exceeded. Honour the `Retry-After` header.
+     * @throws {FaableApiError} `internal_error` (500) — Unexpected server error. Retry later; the request id is logged.
+     */
+    userResetPasskeyPrompt(user_id) {
+        requireId("user_id", user_id);
+        return this.fetcher.post(`/user/${user_id}/passkey-prompt/reset`, {});
+    }
     /**
      * `POST /user/{user_id}/tickets/{ticket_id}/revoke` — operationId: `user/revokeTicket`
      *

package/dist/api/types.d.ts

@@ -153,7 +153,7 @@ export interface paths {
         };
         /**
          * Find Account by host
-         * @description Looks up the Account that owns the given hostname, checking both the built-in `*.auth.faable.link` slug and any verified custom domains.
+         * @description Looks up the Account that owns the given hostname, checking both the built-in `*.auth.faable.link` slug and any verified custom domains. Returns only its public fields.
          */
         get: operations["account/getByHost"];
         put?: never;
@@ -7600,7 +7600,7 @@ export interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description AuthAccount */
+            /** @description Default Response */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -7614,108 +7614,6 @@ export interface operations {
                         slug: string;
                         logo_src?: string | null;
                         icon_src?: string | null;
-                        callback_hostnames: string[];
-                        /** @description Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*\/ES*\/PS*. */
-                        token_signature: string;
-                        /** @description JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented. */
-                        token_signing_alg: "RS256";
-                        default_connection?: components["schemas"]["Connection"] | string | unknown;
-                        enabled_locales: string[];
-                        /** @description Free-form labels on the account. The dashboard stores the environment as an `env:<name>` tag (e.g. `env:production`, `env:staging`, `env:test`). */
-                        tags?: string[];
-                        team?: string | null;
-                        notification_settings: {
-                            /**
-                             * @description Send the built-in welcome email on user.created
-                             * @default false
-                             */
-                            welcome_email_enabled: boolean;
-                            /**
-                             * @description Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.
-                             * @default false
-                             */
-                            verify_email_auto_send: boolean;
-                        };
-                        /**
-                         * Format: email
-                         * @description Reply-To on every email this tenant sends to its users. Absent = no Reply-To, so a reply goes to the From address — which is a `no-reply@` mailbox nobody reads. Set it to your own support address if you want your users to be able to answer.
-                         */
-                        email_reply_to?: string | null;
-                        welcome_email?: {
-                            /**
-                             * Format: uri
-                             * @description Where the welcome button sends the user. Defaults to `https://<first callback hostname>`. Point it at your app (not your marketing site) so a fresh user lands somewhere useful.
-                             */
-                            cta_url?: string | null;
-                            /** @description Replaces the default one-line body ("Your account on … is ready to go."). Plain text, sent verbatim in every enabled locale. */
-                            body?: string | null;
-                            /** @description Rendered as a "Follow <account>" block after the button — GitHub, LinkedIn, X, YouTube… Empty or absent hides the block. */
-                            social_links?: {
-                                label: string;
-                                /** Format: uri */
-                                url: string;
-                            }[] | null;
-                        } | null;
-                        /** @description Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users. */
-                        email_change_verification_mode?: "new_only" | "old_and_new";
-                        /**
-                         * @description Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).
-                         *
-                         *     - `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.
-                         *     - `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.).
-                         */
-                        email_oauth_sync_policy?: "preserve_manual" | "always_sync";
-                        /** @description Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults. */
-                        login_methods?: {
-                            /** @description Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods(). */
-                            order?: string[];
-                            /** @description Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say "this app does not do Google"; use `enabled_clients` on the connection itself to say "that connection is not for this app". A connection has to pass both. */
-                            disabled_connections?: string[];
-                            /** @description Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false. */
-                            passkey_login_enabled?: boolean;
-                            /** @description Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false. */
-                            identifier_first?: boolean;
-                            /** @description Surface the method the returning user chose last time. Defaults to false. */
-                            remember_last_method?: boolean;
-                            /** @description Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`. */
-                            passkey_promotion?: "off" | "offer";
-                            /** @description Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30. */
-                            passkey_promotion_snooze_days?: number;
-                            /** @description How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3. */
-                            passkey_promotion_max_prompts?: number;
-                            /** @description Show a "Remember me on this device" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days. */
-                            remember_me?: "off" | "optional";
-                            /** @description How long a session lasts when the user ticked "Remember me". Defaults to 30. */
-                            remember_me_days?: number;
-                        };
-                        /** @description The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own. */
-                        login_flow?: string | null;
-                        /** @description Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest. */
-                        mfa_policy?: {
-                            /** @description `off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place. */
-                            mode?: "off" | "optional" | "required";
-                            /** @description Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none. */
-                            allowed_factors?: ("totp" | "webauthn")[];
-                            /** @description How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time. */
-                            remember_device_days?: number;
-                        };
-                        /** @description Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`. */
-                        recovery_channels?: {
-                            /** @description Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it. */
-                            enabled?: ("email" | "sms" | "whatsapp" | "factor")[];
-                            /** @description The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user. */
-                            default?: "email" | "sms" | "whatsapp" | "factor";
-                            /** @description Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision. */
-                            visible?: ("email" | "sms" | "whatsapp" | "factor")[];
-                        };
-                        /** @description ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix. */
-                        default_country_iso?: string | null;
-                        /** @description WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled. */
-                        webauthn_rp_id?: string | null;
-                        /** @description AuthAccount creation date */
-                        createdAt: string;
-                        /** @description AuthAccount updated date */
-                        updatedAt?: string;
                     };
                 };
             };
@@ -12794,6 +12692,36 @@ export interface operations {
                     };
                 };
             };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
             /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
             404: {
                 headers: {
@@ -12871,6 +12799,36 @@ export interface operations {
                     };
                 };
             };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
             /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
             404: {
                 headers: {
@@ -12943,6 +12901,36 @@ export interface operations {
                     };
                 };
             };
+            /** @description `unauthorized` — The request carries no valid credentials. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "unauthorized";
+                    };
+                };
+            };
+            /**
+             * @description `forbidden` — The credentials are valid but do not allow this operation.
+             *
+             *     `insufficient_scope` — The token lacks a scope this operation requires. `message` names it.
+             *
+             *     `user_suspended` — The user is suspended and cannot sign in or be modified.
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"] & {
+                        /** @enum {string} */
+                        error_code?: "forbidden" | "insufficient_scope" | "user_suspended";
+                    };
+                };
+            };
             /** @description `account_not_found` — No Auth Account matches the request (domain, header or token). */
             404: {
                 headers: {

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.7.22";
+export const version = "2.7.23";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "49d06d3";
+export const commit = "e683d71";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.7.22",
+  "version": "2.7.23",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.31.0",
+    "version": "2.31.1",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -10762,7 +10762,7 @@
         "tags": [
           "account"
         ],
-        "description": "Looks up the Account that owns the given hostname, checking both the built-in `*.auth.faable.link` slug and any verified custom domains.",
+        "description": "Looks up the Account that owns the given hostname, checking both the built-in `*.auth.faable.link` slug and any verified custom domains. Returns only its public fields.",
         "parameters": [
           {
             "schema": {
@@ -10775,477 +10775,41 @@
         ],
         "responses": {
           "200": {
-            "description": "AuthAccount",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "required": [
-                    "id",
-                    "name",
-                    "domain",
-                    "slug",
-                    "callback_hostnames",
-                    "token_signature",
-                    "token_signing_alg",
-                    "enabled_locales",
-                    "notification_settings",
-                    "createdAt"
-                  ],
-                  "properties": {
-                    "id": {
-                      "type": "string",
-                      "description": "AuthAccount ID"
-                    },
-                    "name": {
-                      "type": "string"
-                    },
-                    "domain": {
-                      "type": "string"
-                    },
-                    "slug": {
-                      "type": "string"
-                    },
-                    "logo_src": {
-                      "type": "string",
-                      "nullable": true
-                    },
-                    "icon_src": {
-                      "type": "string",
-                      "nullable": true
-                    },
-                    "callback_hostnames": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      }
-                    },
-                    "token_signature": {
-                      "type": "string",
-                      "description": "Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*/ES*/PS*."
-                    },
-                    "token_signing_alg": {
-                      "anyOf": [
-                        {
-                          "type": "string",
-                          "enum": [
-                            "RS256"
-                          ]
-                        }
-                      ],
-                      "description": "JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented."
-                    },
-                    "default_connection": {
-                      "anyOf": [
-                        {
-                          "$ref": "#/components/schemas/Connection"
-                        },
-                        {
-                          "type": "string"
-                        },
-                        {}
-                      ]
-                    },
-                    "enabled_locales": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      }
-                    },
-                    "tags": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "description": "Free-form labels on the account. The dashboard stores the environment as an `env:<name>` tag (e.g. `env:production`, `env:staging`, `env:test`)."
-                    },
-                    "team": {
-                      "type": "string",
-                      "nullable": true
-                    },
-                    "notification_settings": {
-                      "type": "object",
-                      "required": [
-                        "welcome_email_enabled",
-                        "verify_email_auto_send"
-                      ],
-                      "properties": {
-                        "welcome_email_enabled": {
-                          "type": "boolean",
-                          "description": "Send the built-in welcome email on user.created",
-                          "default": false
-                        },
-                        "verify_email_auto_send": {
-                          "type": "boolean",
-                          "description": "Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.",
-                          "default": false
-                        }
-                      },
-                      "additionalProperties": false
-                    },
-                    "email_reply_to": {
-                      "type": "string",
-                      "format": "email",
-                      "maxLength": 320,
-                      "description": "Reply-To on every email this tenant sends to its users. Absent = no Reply-To, so a reply goes to the From address — which is a `no-reply@` mailbox nobody reads. Set it to your own support address if you want your users to be able to answer.",
-                      "nullable": true
-                    },
-                    "welcome_email": {
-                      "type": "object",
-                      "properties": {
-                        "cta_url": {
-                          "type": "string",
-                          "format": "uri",
-                          "maxLength": 500,
-                          "description": "Where the welcome button sends the user. Defaults to `https://<first callback hostname>`. Point it at your app (not your marketing site) so a fresh user lands somewhere useful.",
-                          "nullable": true
-                        },
-                        "body": {
-                          "type": "string",
-                          "maxLength": 600,
-                          "description": "Replaces the default one-line body (\"Your account on … is ready to go.\"). Plain text, sent verbatim in every enabled locale.",
-                          "nullable": true
-                        },
-                        "social_links": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "required": [
-                              "label",
-                              "url"
-                            ],
-                            "properties": {
-                              "label": {
-                                "type": "string",
-                                "minLength": 1,
-                                "maxLength": 40
-                              },
-                              "url": {
-                                "type": "string",
-                                "format": "uri",
-                                "maxLength": 500
-                              }
-                            },
-                            "additionalProperties": false
-                          },
-                          "maxItems": 6,
-                          "description": "Rendered as a \"Follow <account>\" block after the button — GitHub, LinkedIn, X, YouTube… Empty or absent hides the block.",
-                          "nullable": true
-                        }
-                      },
-                      "additionalProperties": false,
-                      "nullable": true
-                    },
-                    "email_change_verification_mode": {
-                      "anyOf": [
-                        {
-                          "type": "string",
-                          "enum": [
-                            "new_only"
-                          ]
-                        },
-                        {
-                          "type": "string",
-                          "enum": [
-                            "old_and_new"
-                          ]
-                        }
-                      ],
-                      "description": "Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users."
-                    },
-                    "email_oauth_sync_policy": {
-                      "anyOf": [
-                        {
-                          "type": "string",
-                          "enum": [
-                            "preserve_manual"
-                          ]
-                        },
-                        {
-                          "type": "string",
-                          "enum": [
-                            "always_sync"
-                          ]
-                        }
-                      ],
-                      "description": "Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).\n\n- `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.\n- `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.)."
-                    },
-                    "login_methods": {
-                      "type": "object",
-                      "properties": {
-                        "order": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
-                        },
-                        "disabled_connections": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
-                        },
-                        "passkey_login_enabled": {
-                          "type": "boolean",
-                          "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
-                        },
-                        "identifier_first": {
-                          "type": "boolean",
-                          "description": "Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false."
-                        },
-                        "remember_last_method": {
-                          "type": "boolean",
-                          "description": "Surface the method the returning user chose last time. Defaults to false."
-                        },
-                        "passkey_promotion": {
-                          "anyOf": [
-                            {
-                              "type": "string",
-                              "enum": [
-                                "off"
-                              ]
-                            },
-                            {
-                              "type": "string",
-                              "enum": [
-                                "offer"
-                              ]
-                            }
-                          ],
-                          "description": "Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`."
-                        },
-                        "passkey_promotion_snooze_days": {
-                          "type": "integer",
-                          "minimum": 0,
-                          "maximum": 365,
-                          "description": "Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30."
-                        },
-                        "passkey_promotion_max_prompts": {
-                          "type": "integer",
-                          "minimum": 0,
-                          "maximum": 10,
-                          "description": "How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3."
-                        },
-                        "remember_me": {
-                          "anyOf": [
-                            {
-                              "type": "string",
-                              "enum": [
-                                "off"
-                              ]
-                            },
-                            {
-                              "type": "string",
-                              "enum": [
-                                "optional"
-                              ]
-                            }
-                          ],
-                          "description": "Show a \"Remember me on this device\" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days."
-                        },
-                        "remember_me_days": {
-                          "type": "integer",
-                          "minimum": 1,
-                          "maximum": 365,
-                          "description": "How long a session lasts when the user ticked \"Remember me\". Defaults to 30."
-                        }
-                      },
-                      "additionalProperties": false,
-                      "description": "Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults."
-                    },
-                    "login_flow": {
-                      "type": "string",
-                      "description": "The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own.",
-                      "nullable": true
-                    },
-                    "mfa_policy": {
-                      "type": "object",
-                      "properties": {
-                        "mode": {
-                          "anyOf": [
-                            {
-                              "anyOf": [
-                                {
-                                  "type": "string",
-                                  "enum": [
-                                    "off"
-                                  ]
-                                },
-                                {
-                                  "type": "string",
-                                  "enum": [
-                                    "optional"
-                                  ]
-                                },
-                                {
-                                  "type": "string",
-                                  "enum": [
-                                    "required"
-                                  ]
-                                }
-                              ]
-                            }
-                          ],
-                          "description": "`off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place."
-                        },
-                        "allowed_factors": {
-                          "type": "array",
-                          "items": {
-                            "anyOf": [
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "totp"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "webauthn"
-                                ]
-                              }
-                            ]
-                          },
-                          "description": "Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none."
-                        },
-                        "remember_device_days": {
-                          "type": "integer",
-                          "minimum": 0,
-                          "maximum": 365,
-                          "description": "How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time."
-                        }
-                      },
-                      "additionalProperties": false,
-                      "description": "Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest."
-                    },
-                    "recovery_channels": {
-                      "type": "object",
-                      "properties": {
-                        "enabled": {
-                          "type": "array",
-                          "items": {
-                            "anyOf": [
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "email"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "sms"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "whatsapp"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "factor"
-                                ]
-                              }
-                            ]
-                          },
-                          "description": "Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it."
-                        },
-                        "default": {
-                          "anyOf": [
-                            {
-                              "anyOf": [
-                                {
-                                  "type": "string",
-                                  "enum": [
-                                    "email"
-                                  ]
-                                },
-                                {
-                                  "type": "string",
-                                  "enum": [
-                                    "sms"
-                                  ]
-                                },
-                                {
-                                  "type": "string",
-                                  "enum": [
-                                    "whatsapp"
-                                  ]
-                                },
-                                {
-                                  "type": "string",
-                                  "enum": [
-                                    "factor"
-                                  ]
-                                }
-                              ]
-                            }
-                          ],
-                          "description": "The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user."
-                        },
-                        "visible": {
-                          "type": "array",
-                          "items": {
-                            "anyOf": [
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "email"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "sms"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "whatsapp"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "factor"
-                                ]
-                              }
-                            ]
-                          },
-                          "description": "Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision."
-                        }
-                      },
-                      "additionalProperties": false,
-                      "description": "Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`."
-                    },
-                    "default_country_iso": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "name",
+                    "domain",
+                    "slug"
+                  ],
+                  "properties": {
+                    "id": {
                       "type": "string",
-                      "minLength": 2,
-                      "maxLength": 2,
-                      "description": "ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix.",
-                      "nullable": true
+                      "description": "AuthAccount ID"
                     },
-                    "webauthn_rp_id": {
-                      "type": "string",
-                      "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
-                      "nullable": true
+                    "name": {
+                      "type": "string"
                     },
-                    "createdAt": {
+                    "domain": {
+                      "type": "string"
+                    },
+                    "slug": {
+                      "type": "string"
+                    },
+                    "logo_src": {
                       "type": "string",
-                      "description": "AuthAccount creation date"
+                      "nullable": true
                     },
-                    "updatedAt": {
+                    "icon_src": {
                       "type": "string",
-                      "description": "AuthAccount updated date"
+                      "nullable": true
                     }
                   },
-                  "description": "AuthAccount"
+                  "additionalProperties": false
                 }
               }
             }
@@ -23754,6 +23318,11 @@
             "required": true
           }
         ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
         "responses": {
           "200": {
             "description": "Default Response",
@@ -23793,6 +23362,58 @@
               }
             }
           },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
           "404": {
             "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
             "content": {
@@ -23897,6 +23518,11 @@
             "required": true
           }
         ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
         "responses": {
           "200": {
             "description": "Default Response",
@@ -23942,6 +23568,58 @@
               }
             }
           },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
           "404": {
             "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
             "content": {
@@ -24038,6 +23716,11 @@
             "required": true
           }
         ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
         "responses": {
           "200": {
             "description": "Default Response",
@@ -24082,6 +23765,58 @@
               }
             }
           },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
           "404": {
             "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
             "content": {