@faable/auth-sdk 2.7.34 → 2.7.36

package/dist/FaableAuthApi.d.ts

@@ -627,6 +627,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
                 require_number?: boolean | undefined;
                 require_special?: boolean | undefined;
             } | undefined;
+            login_identifier?: "username" | "email" | "email_or_username" | undefined;
             disable_signup?: boolean | undefined;
             account: string;
             metadata: {
@@ -666,6 +667,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
                 require_number?: boolean | undefined;
                 require_special?: boolean | undefined;
             } | undefined;
+            login_identifier?: "username" | "email" | "email_or_username" | undefined;
             disable_signup?: boolean | undefined;
             account: string;
             metadata: {
@@ -708,6 +710,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
                 require_number?: boolean | undefined;
                 require_special?: boolean | undefined;
             } | undefined;
+            login_identifier?: "username" | "email" | "email_or_username" | undefined;
             disable_signup?: boolean | undefined;
             account: string;
             metadata: {
@@ -749,6 +752,7 @@ export declare class FaableAuthApi extends GeneratedFaableAuthApi {
             require_number?: boolean | undefined;
             require_special?: boolean | undefined;
         } | undefined;
+        login_identifier?: "username" | "email" | "email_or_username" | undefined;
         disable_signup?: boolean | undefined;
         account: string;
         metadata: {

package/dist/api/generated-client.d.ts

@@ -1812,6 +1812,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             require_number?: boolean | undefined;
             require_special?: boolean | undefined;
         } | undefined;
+        login_identifier?: "username" | "email" | "email_or_username" | undefined;
         disable_signup?: boolean | undefined;
         account: string;
         metadata: {
@@ -1867,6 +1868,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             require_number?: boolean | undefined;
             require_special?: boolean | undefined;
         } | undefined;
+        login_identifier?: "username" | "email" | "email_or_username" | undefined;
         disable_signup?: boolean | undefined;
         account: string;
         metadata: {
@@ -1923,6 +1925,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             require_number?: boolean | undefined;
             require_special?: boolean | undefined;
         } | undefined;
+        login_identifier?: "username" | "email" | "email_or_username" | undefined;
         disable_signup?: boolean | undefined;
         account: string;
         metadata: {
@@ -1980,6 +1983,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
                 require_number?: boolean | undefined;
                 require_special?: boolean | undefined;
             } | undefined;
+            login_identifier?: "username" | "email" | "email_or_username" | undefined;
             disable_signup?: boolean | undefined;
             account: string;
             metadata: {
@@ -2019,6 +2023,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
                 require_number?: boolean | undefined;
                 require_special?: boolean | undefined;
             } | undefined;
+            login_identifier?: "username" | "email" | "email_or_username" | undefined;
             disable_signup?: boolean | undefined;
             account: string;
             metadata: {
@@ -2061,6 +2066,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
                 require_number?: boolean | undefined;
                 require_special?: boolean | undefined;
             } | undefined;
+            login_identifier?: "username" | "email" | "email_or_username" | undefined;
             disable_signup?: boolean | undefined;
             account: string;
             metadata: {
@@ -2118,6 +2124,7 @@ export declare abstract class GeneratedFaableAuthApi extends FaableApi {
             require_number?: boolean | undefined;
             require_special?: boolean | undefined;
         } | undefined;
+        login_identifier?: "username" | "email" | "email_or_username" | undefined;
         disable_signup?: boolean | undefined;
         account: string;
         metadata: {

package/dist/api/types.d.ts

@@ -4387,6 +4387,8 @@ export interface components {
                 require_number?: boolean;
                 require_special?: boolean;
             };
+            /** @description What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections. */
+            login_identifier?: "email" | "username" | "email_or_username";
             /** @description When true, the public self-service signup endpoint (`POST /dbconnections/signup`) rejects new registrations against this database connection with `403 signup_disabled`. Defaults to false (signup allowed). Only meaningful on `database` connections; mirrors Auth0 `disable_signup`. */
             disable_signup?: boolean;
             /** @description Object is related with this account */
@@ -4449,6 +4451,8 @@ export interface components {
                 require_special?: boolean;
             };
             disable_signup?: boolean;
+            /** @description What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections. */
+            login_identifier?: "email" | "username" | "email_or_username";
             /** @description Add Metadata */
             metadata?: {
                 [key: string]: unknown;
@@ -4492,6 +4496,8 @@ export interface components {
                 require_special?: boolean;
             } | null;
             disable_signup?: boolean;
+            /** @description What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections. */
+            login_identifier?: "email" | "username" | "email_or_username";
         };
         /** @description Presentation metadata for one connection type. Contains no endpoint URLs and no credentials. */
         ConnectionTypeInfo: {
@@ -4535,6 +4541,8 @@ export interface components {
                 require_number?: boolean;
                 require_special?: boolean;
             };
+            /** @description What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections. */
+            login_identifier?: "email" | "username" | "email_or_username";
         };
         /** @description Client */
         Client: {
@@ -6248,6 +6256,9 @@ export interface components {
             code?: string;
             code_verifier?: string;
             username?: string;
+            password?: string;
+            /** @description For `grant_type=password`: the name of the database connection to sign in against. Defaults to the first database connection offered to the client. */
+            realm?: string;
             otp?: string;
             refresh_token?: string;
             /** @description Opaque token returned with a `403 mfa_required` response. Present it here with `grant_type=http://auth0.com/oauth/grant-type/mfa-otp` (or `…/mfa-recovery-code`) and the code, to finish a grant a second-factor policy interrupted. */
@@ -6397,6 +6408,7 @@ export interface components {
          *     - `mfa_invalid_code` (401): The authenticator code did not verify.
          *     - `mfa_invalid_recovery_code` (401): The recovery code did not verify.
          *     - `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.
+         *     - `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.
          *     - `totp_not_allowed` (401): This account does not accept authenticator apps.
          *     - `no_usable_factor` (400): The user has no confirmed second factor to challenge.
          *     - `factor_not_found` (400): No factor with that id belongs to this user.
@@ -6418,7 +6430,7 @@ export interface components {
          *     - `revision_not_found` (404): The revision is not in the flow history.
          * @enum {string}
          */
-        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "plan_required" | "not_logged_in" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "signup_disabled" | "email_taken" | "invalid_email" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found";
+        ErrorCode: "bad_request" | "validation_error" | "unauthorized" | "payment_required" | "forbidden" | "not_found" | "method_not_allowed" | "conflict" | "payload_too_large" | "unsupported_media_type" | "unprocessable_entity" | "too_many_requests" | "internal_error" | "already_exists" | "invalid_id" | "account_not_found" | "invalid_query" | "search_not_supported" | "invalid_expand" | "access_denied" | "insufficient_scope" | "team_required" | "account_limit_reached" | "invalid_project_id" | "account_transfer_refused" | "plan_required" | "not_logged_in" | "invalid_token" | "not_owner" | "user_suspended" | "invalid_credentials" | "login_denied" | "signup_denied" | "client_credentials_denied" | "signup_disabled" | "email_taken" | "invalid_email" | "same_email" | "user_has_no_email" | "password_too_weak" | "invalid_password_hash" | "weak_password_hash" | "invalid_code" | "invalid_phone" | "phone_changed" | "phone_already_verified" | "sms_unavailable" | "sms_failed" | "invalid_state" | "state_mismatch" | "invalid_ticket" | "ticket_used" | "ticket_expired" | "ticket_not_found" | "credential_not_found" | "invalid_link" | "expired_link" | "invalid_otp" | "invalid_client" | "client_not_found" | "client_mismatch" | "invalid_client_metadata" | "invalid_connection" | "connection_required" | "connection_misconfigured" | "passwordless_unavailable" | "ambiguous_connection" | "invalid_redirect_uri" | "origin_not_allowed" | "audience_not_found" | "system_resource" | "invalid_request" | "invalid_device_code" | "provider_error" | "identity_already_linked" | "identity_link_denied" | "identity_conflict" | "identity_orphaned" | "no_provider_token" | "no_refresh_token" | "action_unavailable" | "login_flow_misconfigured" | "mfa_required" | "step_up_required" | "interaction_required" | "passkey_login_disabled" | "mfa_pending" | "mfa_invalid_code" | "mfa_invalid_recovery_code" | "too_many_attempts" | "too_many_login_attempts" | "totp_not_allowed" | "no_usable_factor" | "factor_not_found" | "factor_already_confirmed" | "invalid_factor" | "session_missing" | "passkey_verification_failed" | "no_passkey_enrolled" | "malformed_credential" | "unknown_passkey" | "invalid_passkey" | "invite_not_found" | "invite_used" | "already_member" | "not_a_member" | "role_not_found" | "invalid_role" | "flow_not_found" | "revision_not_found";
         /** @description Every error response has this shape. Branch on `error_code`, never on `message`: the message is written for a person and may change. */
         ErrorResponse: {
             /** @description The HTTP status, repeated. */
@@ -8411,6 +8423,8 @@ export interface operations {
                         require_special?: boolean;
                     };
                     disable_signup?: boolean;
+                    /** @description What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections. */
+                    login_identifier?: "email" | "username" | "email_or_username";
                     /** @description Add Metadata */
                     metadata?: {
                         [key: string]: unknown;
@@ -8475,6 +8489,8 @@ export interface operations {
                             require_number?: boolean;
                             require_special?: boolean;
                         };
+                        /** @description What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections. */
+                        login_identifier?: "email" | "username" | "email_or_username";
                         /** @description When true, the public self-service signup endpoint (`POST /dbconnections/signup`) rejects new registrations against this database connection with `403 signup_disabled`. Defaults to false (signup allowed). Only meaningful on `database` connections; mirrors Auth0 `disable_signup`. */
                         disable_signup?: boolean;
                         /** @description Object is related with this account */
@@ -8644,6 +8660,8 @@ export interface operations {
                             require_number?: boolean;
                             require_special?: boolean;
                         };
+                        /** @description What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections. */
+                        login_identifier?: "email" | "username" | "email_or_username";
                         /** @description When true, the public self-service signup endpoint (`POST /dbconnections/signup`) rejects new registrations against this database connection with `403 signup_disabled`. Defaults to false (signup allowed). Only meaningful on `database` connections; mirrors Auth0 `disable_signup`. */
                         disable_signup?: boolean;
                         /** @description Object is related with this account */
@@ -8797,6 +8815,8 @@ export interface operations {
                         require_special?: boolean;
                     } | null;
                     disable_signup?: boolean;
+                    /** @description What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections. */
+                    login_identifier?: "email" | "username" | "email_or_username";
                 };
             };
         };
@@ -8857,6 +8877,8 @@ export interface operations {
                             require_number?: boolean;
                             require_special?: boolean;
                         };
+                        /** @description What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections. */
+                        login_identifier?: "email" | "username" | "email_or_username";
                         /** @description When true, the public self-service signup endpoint (`POST /dbconnections/signup`) rejects new registrations against this database connection with `403 signup_disabled`. Defaults to false (signup allowed). Only meaningful on `database` connections; mirrors Auth0 `disable_signup`. */
                         disable_signup?: boolean;
                         /** @description Object is related with this account */
@@ -9032,6 +9054,8 @@ export interface operations {
                             require_number?: boolean;
                             require_special?: boolean;
                         };
+                        /** @description What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections. */
+                        login_identifier?: "email" | "username" | "email_or_username";
                         /** @description When true, the public self-service signup endpoint (`POST /dbconnections/signup`) rejects new registrations against this database connection with `403 signup_disabled`. Defaults to false (signup allowed). Only meaningful on `database` connections; mirrors Auth0 `disable_signup`. */
                         disable_signup?: boolean;
                         /** @description Object is related with this account */
@@ -25228,6 +25252,9 @@ export interface operations {
                 code?: string;
                 code_verifier?: string;
                 username?: string;
+                password?: string;
+                /** @description For `grant_type=password`: the name of the database connection to sign in against. Defaults to the first database connection offered to the client. */
+                realm?: string;
                 otp?: string;
                 refresh_token?: string;
                 /** @description Opaque token returned with a `403 mfa_required` response. Present it here with `grant_type=http://auth0.com/oauth/grant-type/mfa-otp` (or `…/mfa-recovery-code`) and the code, to finish a grant a second-factor policy interrupted. */
@@ -25326,6 +25353,9 @@ export interface operations {
                 code?: string;
                 code_verifier?: string;
                 username?: string;
+                password?: string;
+                /** @description For `grant_type=password`: the name of the database connection to sign in against. Defaults to the first database connection offered to the client. */
+                realm?: string;
                 otp?: string;
                 refresh_token?: string;
                 /** @description Opaque token returned with a `403 mfa_required` response. Present it here with `grant_type=http://auth0.com/oauth/grant-type/mfa-otp` (or `…/mfa-recovery-code`) and the code, to finish a grant a second-factor policy interrupted. */
@@ -25356,6 +25386,9 @@ export interface operations {
                     code?: string;
                     code_verifier?: string;
                     username?: string;
+                    password?: string;
+                    /** @description For `grant_type=password`: the name of the database connection to sign in against. Defaults to the first database connection offered to the client. */
+                    realm?: string;
                     otp?: string;
                     refresh_token?: string;
                     /** @description Opaque token returned with a `403 mfa_required` response. Present it here with `grant_type=http://auth0.com/oauth/grant-type/mfa-otp` (or `…/mfa-recovery-code`) and the code, to finish a grant a second-factor policy interrupted. */

package/dist/version.js

@@ -9,13 +9,13 @@
 // login pages could not import the SDK at all. Same pattern as auth-js.
 //
 // The sentinels MUST stay byte-identical to the `from` values in `.releaserc`.
-export const version = "2.7.34";
+export const version = "2.7.36";
 // Short git SHA of the released commit. The version dates a build; this names
 // the exact tree, so a canonical log line or an audit entry leads straight to
 // `git show <sha>`. Deliberately NOT hex: an unreleased build (dev, a local
 // link) cannot be mistaken for a real commit — auth only records values that
 // look like a SHA, and this one never will.
-export const commit = "d8f42bf";
+export const commit = "3f9e3b8";
 // What this SDK writes in `x-faable-client`. Exported for a consumer that
 // builds a strategy on its own (outside `FaableAuthApi`) and still wants the
 // token request attributed — a bare `authClientCredentials` stamps only what

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/auth-sdk",
-  "version": "2.7.34",
+  "version": "2.7.36",
   "author": "Marc Pomar <marc@faable.com>",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.37.2",
+    "version": "2.39.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -741,6 +741,29 @@
             },
             "description": "Password policy enforced when writing a password through this database connection (password reset and admin set-password). `level` is an Auth0-style preset (none/low/fair/good/excellent); the dashboard expands it into the explicit rule fields when saving. The rule fields override the preset baseline. When unset on the connection, the server applies the `good` default. Does not affect login."
           },
+          "login_identifier": {
+            "anyOf": [
+              {
+                "type": "string",
+                "enum": [
+                  "email"
+                ]
+              },
+              {
+                "type": "string",
+                "enum": [
+                  "username"
+                ]
+              },
+              {
+                "type": "string",
+                "enum": [
+                  "email_or_username"
+                ]
+              }
+            ],
+            "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
+          },
           "disable_signup": {
             "type": "boolean",
             "description": "When true, the public self-service signup endpoint (`POST /dbconnections/signup`) rejects new registrations against this database connection with `403 signup_disabled`. Defaults to false (signup allowed). Only meaningful on `database` connections; mirrors Auth0 `disable_signup`."
@@ -914,6 +937,29 @@
           "disable_signup": {
             "type": "boolean"
           },
+          "login_identifier": {
+            "anyOf": [
+              {
+                "type": "string",
+                "enum": [
+                  "email"
+                ]
+              },
+              {
+                "type": "string",
+                "enum": [
+                  "username"
+                ]
+              },
+              {
+                "type": "string",
+                "enum": [
+                  "email_or_username"
+                ]
+              }
+            ],
+            "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
+          },
           "metadata": {
             "type": "object",
             "properties": {},
@@ -1077,6 +1123,29 @@
           },
           "disable_signup": {
             "type": "boolean"
+          },
+          "login_identifier": {
+            "anyOf": [
+              {
+                "type": "string",
+                "enum": [
+                  "email"
+                ]
+              },
+              {
+                "type": "string",
+                "enum": [
+                  "username"
+                ]
+              },
+              {
+                "type": "string",
+                "enum": [
+                  "email_or_username"
+                ]
+              }
+            ],
+            "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
           }
         },
         "description": "Partial update for a Connection. Only the supplied fields are modified. `connection_type` is intentionally excluded — changing it would orphan every identity already linked to this connection.",
@@ -1252,6 +1321,29 @@
                   }
                 },
                 "description": "Password policy enforced when writing a password through this database connection (password reset and admin set-password). `level` is an Auth0-style preset (none/low/fair/good/excellent); the dashboard expands it into the explicit rule fields when saving. The rule fields override the preset baseline. When unset on the connection, the server applies the `good` default. Does not affect login."
+              },
+              "login_identifier": {
+                "anyOf": [
+                  {
+                    "type": "string",
+                    "enum": [
+                      "email"
+                    ]
+                  },
+                  {
+                    "type": "string",
+                    "enum": [
+                      "username"
+                    ]
+                  },
+                  {
+                    "type": "string",
+                    "enum": [
+                      "email_or_username"
+                    ]
+                  }
+                ],
+                "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
               }
             },
             "additionalProperties": false
@@ -6776,6 +6868,13 @@
           "username": {
             "type": "string"
           },
+          "password": {
+            "type": "string"
+          },
+          "realm": {
+            "type": "string",
+            "description": "For `grant_type=password`: the name of the database connection to sign in against. Defaults to the first database connection offered to the client."
+          },
           "otp": {
             "type": "string"
           },
@@ -6965,7 +7064,7 @@
       },
       "ErrorCode": {
         "type": "string",
-        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (401): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `invalid_email` (400): The email address is not valid.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): Dynamic client registration rejected a field (RFC 7591). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.",
+        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (401): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `invalid_email` (400): The email address is not valid.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): Dynamic client registration rejected a field (RFC 7591). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.",
         "enum": [
           "bad_request",
           "validation_error",
@@ -7057,6 +7156,7 @@
           "mfa_invalid_code",
           "mfa_invalid_recovery_code",
           "too_many_attempts",
+          "too_many_login_attempts",
           "totp_not_allowed",
           "no_usable_factor",
           "factor_not_found",
@@ -12541,6 +12641,29 @@
                   "disable_signup": {
                     "type": "boolean"
                   },
+                  "login_identifier": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "email"
+                        ]
+                      },
+                      {
+                        "type": "string",
+                        "enum": [
+                          "username"
+                        ]
+                      },
+                      {
+                        "type": "string",
+                        "enum": [
+                          "email_or_username"
+                        ]
+                      }
+                    ],
+                    "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
+                  },
                   "metadata": {
                     "type": "object",
                     "properties": {},
@@ -12753,6 +12876,29 @@
                       },
                       "description": "Password policy enforced when writing a password through this database connection (password reset and admin set-password). `level` is an Auth0-style preset (none/low/fair/good/excellent); the dashboard expands it into the explicit rule fields when saving. The rule fields override the preset baseline. When unset on the connection, the server applies the `good` default. Does not affect login."
                     },
+                    "login_identifier": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "enum": [
+                            "email"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "username"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "email_or_username"
+                          ]
+                        }
+                      ],
+                      "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
+                    },
                     "disable_signup": {
                       "type": "boolean",
                       "description": "When true, the public self-service signup endpoint (`POST /dbconnections/signup`) rejects new registrations against this database connection with `403 signup_disabled`. Defaults to false (signup allowed). Only meaningful on `database` connections; mirrors Auth0 `disable_signup`."
@@ -13154,6 +13300,29 @@
                       },
                       "description": "Password policy enforced when writing a password through this database connection (password reset and admin set-password). `level` is an Auth0-style preset (none/low/fair/good/excellent); the dashboard expands it into the explicit rule fields when saving. The rule fields override the preset baseline. When unset on the connection, the server applies the `good` default. Does not affect login."
                     },
+                    "login_identifier": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "enum": [
+                            "email"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "username"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "email_or_username"
+                          ]
+                        }
+                      ],
+                      "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
+                    },
                     "disable_signup": {
                       "type": "boolean",
                       "description": "When true, the public self-service signup endpoint (`POST /dbconnections/signup`) rejects new registrations against this database connection with `403 signup_disabled`. Defaults to false (signup allowed). Only meaningful on `database` connections; mirrors Auth0 `disable_signup`."
@@ -13498,6 +13667,29 @@
                   },
                   "disable_signup": {
                     "type": "boolean"
+                  },
+                  "login_identifier": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "email"
+                        ]
+                      },
+                      {
+                        "type": "string",
+                        "enum": [
+                          "username"
+                        ]
+                      },
+                      {
+                        "type": "string",
+                        "enum": [
+                          "email_or_username"
+                        ]
+                      }
+                    ],
+                    "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
                   }
                 },
                 "description": "Partial update for a Connection. Only the supplied fields are modified. `connection_type` is intentionally excluded — changing it would orphan every identity already linked to this connection.",
@@ -13715,6 +13907,29 @@
                       },
                       "description": "Password policy enforced when writing a password through this database connection (password reset and admin set-password). `level` is an Auth0-style preset (none/low/fair/good/excellent); the dashboard expands it into the explicit rule fields when saving. The rule fields override the preset baseline. When unset on the connection, the server applies the `good` default. Does not affect login."
                     },
+                    "login_identifier": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "enum": [
+                            "email"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "username"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "email_or_username"
+                          ]
+                        }
+                      ],
+                      "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
+                    },
                     "disable_signup": {
                       "type": "boolean",
                       "description": "When true, the public self-service signup endpoint (`POST /dbconnections/signup`) rejects new registrations against this database connection with `403 signup_disabled`. Defaults to false (signup allowed). Only meaningful on `database` connections; mirrors Auth0 `disable_signup`."
@@ -14116,6 +14331,29 @@
                       },
                       "description": "Password policy enforced when writing a password through this database connection (password reset and admin set-password). `level` is an Auth0-style preset (none/low/fair/good/excellent); the dashboard expands it into the explicit rule fields when saving. The rule fields override the preset baseline. When unset on the connection, the server applies the `good` default. Does not affect login."
                     },
+                    "login_identifier": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "enum": [
+                            "email"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "username"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "email_or_username"
+                          ]
+                        }
+                      ],
+                      "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
+                    },
                     "disable_signup": {
                       "type": "boolean",
                       "description": "When true, the public self-service signup endpoint (`POST /dbconnections/signup`) rejects new registrations against this database connection with `403 signup_disabled`. Defaults to false (signup allowed). Only meaningful on `database` connections; mirrors Auth0 `disable_signup`."
@@ -55529,6 +55767,23 @@
             "name": "username",
             "required": false
           },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "password",
+            "required": false
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "realm",
+            "required": false,
+            "description": "For `grant_type=password`: the name of the database connection to sign in against. Defaults to the first database connection offered to the client."
+          },
           {
             "schema": {
               "type": "string"
@@ -55836,6 +56091,13 @@
                   "username": {
                     "type": "string"
                   },
+                  "password": {
+                    "type": "string"
+                  },
+                  "realm": {
+                    "type": "string",
+                    "description": "For `grant_type=password`: the name of the database connection to sign in against. Defaults to the first database connection offered to the client."
+                  },
                   "otp": {
                     "type": "string"
                   },
@@ -55987,6 +56249,23 @@
             "name": "username",
             "required": false
           },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "password",
+            "required": false
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "realm",
+            "required": false,
+            "description": "For `grant_type=password`: the name of the database connection to sign in against. Defaults to the first database connection offered to the client."
+          },
           {
             "schema": {
               "type": "string"