@faable/auth-sdk 2.7.36 → 2.7.38
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api/api-types.d.ts +1 -0
- package/dist/api/generated-client.d.ts +45 -0
- package/dist/api/generated-client.js +38 -0
- package/dist/api/types.d.ts +268 -3
- package/dist/version.js +2 -2
- package/package.json +1 -1
- package/spec/openapi.json +827 -76
package/spec/openapi.json
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
"info": {
|
|
4
4
|
"title": "@faablecloud/auth",
|
|
5
5
|
"description": "Auth Platform made by Faable. Manage Users and Roles",
|
|
6
|
-
"version": "2.
|
|
6
|
+
"version": "2.41.0",
|
|
7
7
|
"license": {
|
|
8
8
|
"name": "private",
|
|
9
9
|
"url": "https://faable.com/docs/platform/privacy-policy"
|
|
@@ -1813,6 +1813,69 @@
|
|
|
1813
1813
|
"type": "string"
|
|
1814
1814
|
}
|
|
1815
1815
|
},
|
|
1816
|
+
"grant_types": {
|
|
1817
|
+
"type": "array",
|
|
1818
|
+
"items": {
|
|
1819
|
+
"anyOf": [
|
|
1820
|
+
{
|
|
1821
|
+
"type": "string",
|
|
1822
|
+
"enum": [
|
|
1823
|
+
"authorization_code"
|
|
1824
|
+
]
|
|
1825
|
+
},
|
|
1826
|
+
{
|
|
1827
|
+
"type": "string",
|
|
1828
|
+
"enum": [
|
|
1829
|
+
"client_credentials"
|
|
1830
|
+
]
|
|
1831
|
+
},
|
|
1832
|
+
{
|
|
1833
|
+
"type": "string",
|
|
1834
|
+
"enum": [
|
|
1835
|
+
"refresh_token"
|
|
1836
|
+
]
|
|
1837
|
+
},
|
|
1838
|
+
{
|
|
1839
|
+
"type": "string",
|
|
1840
|
+
"enum": [
|
|
1841
|
+
"password"
|
|
1842
|
+
]
|
|
1843
|
+
},
|
|
1844
|
+
{
|
|
1845
|
+
"type": "string",
|
|
1846
|
+
"enum": [
|
|
1847
|
+
"http://auth0.com/oauth/grant-type/passwordless/otp"
|
|
1848
|
+
]
|
|
1849
|
+
},
|
|
1850
|
+
{
|
|
1851
|
+
"type": "string",
|
|
1852
|
+
"enum": [
|
|
1853
|
+
"urn:ietf:params:oauth:grant-type:token-exchange"
|
|
1854
|
+
]
|
|
1855
|
+
},
|
|
1856
|
+
{
|
|
1857
|
+
"type": "string",
|
|
1858
|
+
"enum": [
|
|
1859
|
+
"urn:ietf:params:oauth:grant-type:device_code"
|
|
1860
|
+
]
|
|
1861
|
+
},
|
|
1862
|
+
{
|
|
1863
|
+
"type": "string",
|
|
1864
|
+
"enum": [
|
|
1865
|
+
"http://auth0.com/oauth/grant-type/mfa-otp"
|
|
1866
|
+
]
|
|
1867
|
+
},
|
|
1868
|
+
{
|
|
1869
|
+
"type": "string",
|
|
1870
|
+
"enum": [
|
|
1871
|
+
"http://auth0.com/oauth/grant-type/mfa-recovery-code"
|
|
1872
|
+
]
|
|
1873
|
+
}
|
|
1874
|
+
],
|
|
1875
|
+
"description": "A grant the client may use at the token endpoint. An empty `grant_types` list allows every grant except `password`, which is always opt-in."
|
|
1876
|
+
},
|
|
1877
|
+
"uniqueItems": true
|
|
1878
|
+
},
|
|
1816
1879
|
"metadata": {
|
|
1817
1880
|
"type": "object",
|
|
1818
1881
|
"properties": {},
|
|
@@ -1823,6 +1886,65 @@
|
|
|
1823
1886
|
"description": "ClientCreate",
|
|
1824
1887
|
"additionalProperties": false
|
|
1825
1888
|
},
|
|
1889
|
+
"ClientGrantType": {
|
|
1890
|
+
"anyOf": [
|
|
1891
|
+
{
|
|
1892
|
+
"type": "string",
|
|
1893
|
+
"enum": [
|
|
1894
|
+
"authorization_code"
|
|
1895
|
+
]
|
|
1896
|
+
},
|
|
1897
|
+
{
|
|
1898
|
+
"type": "string",
|
|
1899
|
+
"enum": [
|
|
1900
|
+
"client_credentials"
|
|
1901
|
+
]
|
|
1902
|
+
},
|
|
1903
|
+
{
|
|
1904
|
+
"type": "string",
|
|
1905
|
+
"enum": [
|
|
1906
|
+
"refresh_token"
|
|
1907
|
+
]
|
|
1908
|
+
},
|
|
1909
|
+
{
|
|
1910
|
+
"type": "string",
|
|
1911
|
+
"enum": [
|
|
1912
|
+
"password"
|
|
1913
|
+
]
|
|
1914
|
+
},
|
|
1915
|
+
{
|
|
1916
|
+
"type": "string",
|
|
1917
|
+
"enum": [
|
|
1918
|
+
"http://auth0.com/oauth/grant-type/passwordless/otp"
|
|
1919
|
+
]
|
|
1920
|
+
},
|
|
1921
|
+
{
|
|
1922
|
+
"type": "string",
|
|
1923
|
+
"enum": [
|
|
1924
|
+
"urn:ietf:params:oauth:grant-type:token-exchange"
|
|
1925
|
+
]
|
|
1926
|
+
},
|
|
1927
|
+
{
|
|
1928
|
+
"type": "string",
|
|
1929
|
+
"enum": [
|
|
1930
|
+
"urn:ietf:params:oauth:grant-type:device_code"
|
|
1931
|
+
]
|
|
1932
|
+
},
|
|
1933
|
+
{
|
|
1934
|
+
"type": "string",
|
|
1935
|
+
"enum": [
|
|
1936
|
+
"http://auth0.com/oauth/grant-type/mfa-otp"
|
|
1937
|
+
]
|
|
1938
|
+
},
|
|
1939
|
+
{
|
|
1940
|
+
"type": "string",
|
|
1941
|
+
"enum": [
|
|
1942
|
+
"http://auth0.com/oauth/grant-type/mfa-recovery-code"
|
|
1943
|
+
]
|
|
1944
|
+
}
|
|
1945
|
+
],
|
|
1946
|
+
"description": "A grant the client may use at the token endpoint. An empty `grant_types` list allows every grant except `password`, which is always opt-in."
|
|
1947
|
+
},
|
|
1826
1948
|
"ClientMetadataCreate": {
|
|
1827
1949
|
"type": "object",
|
|
1828
1950
|
"properties": {},
|
|
@@ -1918,8 +2040,66 @@
|
|
|
1918
2040
|
"grant_types": {
|
|
1919
2041
|
"type": "array",
|
|
1920
2042
|
"items": {
|
|
1921
|
-
"
|
|
1922
|
-
|
|
2043
|
+
"anyOf": [
|
|
2044
|
+
{
|
|
2045
|
+
"type": "string",
|
|
2046
|
+
"enum": [
|
|
2047
|
+
"authorization_code"
|
|
2048
|
+
]
|
|
2049
|
+
},
|
|
2050
|
+
{
|
|
2051
|
+
"type": "string",
|
|
2052
|
+
"enum": [
|
|
2053
|
+
"client_credentials"
|
|
2054
|
+
]
|
|
2055
|
+
},
|
|
2056
|
+
{
|
|
2057
|
+
"type": "string",
|
|
2058
|
+
"enum": [
|
|
2059
|
+
"refresh_token"
|
|
2060
|
+
]
|
|
2061
|
+
},
|
|
2062
|
+
{
|
|
2063
|
+
"type": "string",
|
|
2064
|
+
"enum": [
|
|
2065
|
+
"password"
|
|
2066
|
+
]
|
|
2067
|
+
},
|
|
2068
|
+
{
|
|
2069
|
+
"type": "string",
|
|
2070
|
+
"enum": [
|
|
2071
|
+
"http://auth0.com/oauth/grant-type/passwordless/otp"
|
|
2072
|
+
]
|
|
2073
|
+
},
|
|
2074
|
+
{
|
|
2075
|
+
"type": "string",
|
|
2076
|
+
"enum": [
|
|
2077
|
+
"urn:ietf:params:oauth:grant-type:token-exchange"
|
|
2078
|
+
]
|
|
2079
|
+
},
|
|
2080
|
+
{
|
|
2081
|
+
"type": "string",
|
|
2082
|
+
"enum": [
|
|
2083
|
+
"urn:ietf:params:oauth:grant-type:device_code"
|
|
2084
|
+
]
|
|
2085
|
+
},
|
|
2086
|
+
{
|
|
2087
|
+
"type": "string",
|
|
2088
|
+
"enum": [
|
|
2089
|
+
"http://auth0.com/oauth/grant-type/mfa-otp"
|
|
2090
|
+
]
|
|
2091
|
+
},
|
|
2092
|
+
{
|
|
2093
|
+
"type": "string",
|
|
2094
|
+
"enum": [
|
|
2095
|
+
"http://auth0.com/oauth/grant-type/mfa-recovery-code"
|
|
2096
|
+
]
|
|
2097
|
+
}
|
|
2098
|
+
],
|
|
2099
|
+
"description": "A grant the client may use at the token endpoint. An empty `grant_types` list allows every grant except `password`, which is always opt-in."
|
|
2100
|
+
},
|
|
2101
|
+
"uniqueItems": true,
|
|
2102
|
+
"description": "Grants this client may use at the token endpoint. Empty allows every grant except `password`, which must be listed to be used."
|
|
1923
2103
|
},
|
|
1924
2104
|
"response_types": {
|
|
1925
2105
|
"type": "array",
|
|
@@ -7064,7 +7244,7 @@
|
|
|
7064
7244
|
},
|
|
7065
7245
|
"ErrorCode": {
|
|
7066
7246
|
"type": "string",
|
|
7067
|
-
"description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (401): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `invalid_email` (400): The email address is not valid.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): Dynamic client registration rejected a field (RFC 7591). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.",
|
|
7247
|
+
"description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (401): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `invalid_email` (400): The email address is not valid.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): Dynamic client registration rejected a field (RFC 7591). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.",
|
|
7068
7248
|
"enum": [
|
|
7069
7249
|
"bad_request",
|
|
7070
7250
|
"validation_error",
|
|
@@ -7100,6 +7280,7 @@
|
|
|
7100
7280
|
"login_denied",
|
|
7101
7281
|
"signup_denied",
|
|
7102
7282
|
"client_credentials_denied",
|
|
7283
|
+
"m2m_quota_exceeded",
|
|
7103
7284
|
"signup_disabled",
|
|
7104
7285
|
"email_taken",
|
|
7105
7286
|
"invalid_email",
|
|
@@ -11873,59 +12054,24 @@
|
|
|
11873
12054
|
}
|
|
11874
12055
|
}
|
|
11875
12056
|
},
|
|
11876
|
-
"/
|
|
11877
|
-
"
|
|
11878
|
-
"operationId": "
|
|
11879
|
-
"summary": "
|
|
12057
|
+
"/internal/usage/m2m": {
|
|
12058
|
+
"get": {
|
|
12059
|
+
"operationId": "internal/m2mUsage",
|
|
12060
|
+
"summary": "M2M tokens served per project in a month (platform)",
|
|
11880
12061
|
"tags": [
|
|
11881
12062
|
"account"
|
|
11882
12063
|
],
|
|
11883
|
-
"description": "
|
|
11884
|
-
"requestBody": {
|
|
11885
|
-
"required": true,
|
|
11886
|
-
"content": {
|
|
11887
|
-
"application/json": {
|
|
11888
|
-
"schema": {
|
|
11889
|
-
"type": "object",
|
|
11890
|
-
"required": [
|
|
11891
|
-
"to_project",
|
|
11892
|
-
"reason"
|
|
11893
|
-
],
|
|
11894
|
-
"properties": {
|
|
11895
|
-
"to_project": {
|
|
11896
|
-
"type": "string",
|
|
11897
|
-
"description": "Destination project (`project_<hex>`) or its team id (`team_<hex>`) — both spellings are accepted."
|
|
11898
|
-
},
|
|
11899
|
-
"reason": {
|
|
11900
|
-
"type": "string",
|
|
11901
|
-
"minLength": 3,
|
|
11902
|
-
"maxLength": 500,
|
|
11903
|
-
"description": "Why the tenant is being moved. Recorded in the tenant's log and in ours."
|
|
11904
|
-
},
|
|
11905
|
-
"dry_run": {
|
|
11906
|
-
"type": "boolean",
|
|
11907
|
-
"default": false,
|
|
11908
|
-
"description": "Return the plan (what rides along + blockers) without writing."
|
|
11909
|
-
},
|
|
11910
|
-
"allow_over_cap": {
|
|
11911
|
-
"type": "boolean",
|
|
11912
|
-
"default": false,
|
|
11913
|
-
"description": "Move even if the destination ends up above the per-project cap on Auth Accounts."
|
|
11914
|
-
}
|
|
11915
|
-
},
|
|
11916
|
-
"additionalProperties": false
|
|
11917
|
-
}
|
|
11918
|
-
}
|
|
11919
|
-
}
|
|
11920
|
-
},
|
|
12064
|
+
"description": "Per-project count of successful client_credentials token responses in the given month (cached ones included), read from the monthly counters. Consumed by the billing usage job. Platform token with `read:usage`.",
|
|
11921
12065
|
"parameters": [
|
|
11922
12066
|
{
|
|
11923
12067
|
"schema": {
|
|
11924
|
-
"type": "string"
|
|
12068
|
+
"type": "string",
|
|
12069
|
+
"pattern": "^\\d{4}-\\d{2}$"
|
|
11925
12070
|
},
|
|
11926
|
-
"in": "
|
|
11927
|
-
"name": "
|
|
11928
|
-
"required": true
|
|
12071
|
+
"in": "query",
|
|
12072
|
+
"name": "month",
|
|
12073
|
+
"required": true,
|
|
12074
|
+
"description": "YYYY-MM, UTC."
|
|
11929
12075
|
}
|
|
11930
12076
|
],
|
|
11931
12077
|
"security": [
|
|
@@ -11941,34 +12087,518 @@
|
|
|
11941
12087
|
"schema": {
|
|
11942
12088
|
"type": "object",
|
|
11943
12089
|
"required": [
|
|
11944
|
-
"
|
|
11945
|
-
"
|
|
11946
|
-
"account_name",
|
|
11947
|
-
"slug",
|
|
11948
|
-
"domain",
|
|
11949
|
-
"from_project",
|
|
11950
|
-
"to_project",
|
|
11951
|
-
"target_tenants_before",
|
|
11952
|
-
"moves_with_it",
|
|
11953
|
-
"blockers"
|
|
12090
|
+
"month",
|
|
12091
|
+
"rows"
|
|
11954
12092
|
],
|
|
11955
12093
|
"properties": {
|
|
11956
|
-
"
|
|
11957
|
-
"type": "boolean"
|
|
11958
|
-
},
|
|
11959
|
-
"account_id": {
|
|
11960
|
-
"type": "string"
|
|
11961
|
-
},
|
|
11962
|
-
"account_name": {
|
|
11963
|
-
"type": "string"
|
|
11964
|
-
},
|
|
11965
|
-
"slug": {
|
|
11966
|
-
"type": "string"
|
|
11967
|
-
},
|
|
11968
|
-
"domain": {
|
|
12094
|
+
"month": {
|
|
11969
12095
|
"type": "string"
|
|
11970
12096
|
},
|
|
11971
|
-
"
|
|
12097
|
+
"rows": {
|
|
12098
|
+
"type": "array",
|
|
12099
|
+
"items": {
|
|
12100
|
+
"type": "object",
|
|
12101
|
+
"required": [
|
|
12102
|
+
"team",
|
|
12103
|
+
"tokens"
|
|
12104
|
+
],
|
|
12105
|
+
"properties": {
|
|
12106
|
+
"team": {
|
|
12107
|
+
"type": "string",
|
|
12108
|
+
"description": "The project (`team_<hex>`), or the account id for a legacy account without one."
|
|
12109
|
+
},
|
|
12110
|
+
"tokens": {
|
|
12111
|
+
"type": "integer"
|
|
12112
|
+
}
|
|
12113
|
+
}
|
|
12114
|
+
}
|
|
12115
|
+
}
|
|
12116
|
+
}
|
|
12117
|
+
}
|
|
12118
|
+
}
|
|
12119
|
+
}
|
|
12120
|
+
},
|
|
12121
|
+
"400": {
|
|
12122
|
+
"description": "`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
|
|
12123
|
+
"content": {
|
|
12124
|
+
"application/json": {
|
|
12125
|
+
"schema": {
|
|
12126
|
+
"allOf": [
|
|
12127
|
+
{
|
|
12128
|
+
"$ref": "#/components/schemas/ErrorResponse"
|
|
12129
|
+
},
|
|
12130
|
+
{
|
|
12131
|
+
"type": "object",
|
|
12132
|
+
"properties": {
|
|
12133
|
+
"error_code": {
|
|
12134
|
+
"type": "string",
|
|
12135
|
+
"enum": [
|
|
12136
|
+
"validation_error"
|
|
12137
|
+
]
|
|
12138
|
+
}
|
|
12139
|
+
}
|
|
12140
|
+
}
|
|
12141
|
+
]
|
|
12142
|
+
}
|
|
12143
|
+
}
|
|
12144
|
+
}
|
|
12145
|
+
},
|
|
12146
|
+
"401": {
|
|
12147
|
+
"description": "`unauthorized` — The request carries no valid credentials.",
|
|
12148
|
+
"content": {
|
|
12149
|
+
"application/json": {
|
|
12150
|
+
"schema": {
|
|
12151
|
+
"allOf": [
|
|
12152
|
+
{
|
|
12153
|
+
"$ref": "#/components/schemas/ErrorResponse"
|
|
12154
|
+
},
|
|
12155
|
+
{
|
|
12156
|
+
"type": "object",
|
|
12157
|
+
"properties": {
|
|
12158
|
+
"error_code": {
|
|
12159
|
+
"type": "string",
|
|
12160
|
+
"enum": [
|
|
12161
|
+
"unauthorized"
|
|
12162
|
+
]
|
|
12163
|
+
}
|
|
12164
|
+
}
|
|
12165
|
+
}
|
|
12166
|
+
]
|
|
12167
|
+
}
|
|
12168
|
+
}
|
|
12169
|
+
}
|
|
12170
|
+
},
|
|
12171
|
+
"403": {
|
|
12172
|
+
"description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
|
|
12173
|
+
"content": {
|
|
12174
|
+
"application/json": {
|
|
12175
|
+
"schema": {
|
|
12176
|
+
"allOf": [
|
|
12177
|
+
{
|
|
12178
|
+
"$ref": "#/components/schemas/ErrorResponse"
|
|
12179
|
+
},
|
|
12180
|
+
{
|
|
12181
|
+
"type": "object",
|
|
12182
|
+
"properties": {
|
|
12183
|
+
"error_code": {
|
|
12184
|
+
"type": "string",
|
|
12185
|
+
"enum": [
|
|
12186
|
+
"forbidden",
|
|
12187
|
+
"insufficient_scope",
|
|
12188
|
+
"user_suspended"
|
|
12189
|
+
]
|
|
12190
|
+
}
|
|
12191
|
+
}
|
|
12192
|
+
}
|
|
12193
|
+
]
|
|
12194
|
+
}
|
|
12195
|
+
}
|
|
12196
|
+
}
|
|
12197
|
+
},
|
|
12198
|
+
"404": {
|
|
12199
|
+
"description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
|
|
12200
|
+
"content": {
|
|
12201
|
+
"application/json": {
|
|
12202
|
+
"schema": {
|
|
12203
|
+
"allOf": [
|
|
12204
|
+
{
|
|
12205
|
+
"$ref": "#/components/schemas/ErrorResponse"
|
|
12206
|
+
},
|
|
12207
|
+
{
|
|
12208
|
+
"type": "object",
|
|
12209
|
+
"properties": {
|
|
12210
|
+
"error_code": {
|
|
12211
|
+
"type": "string",
|
|
12212
|
+
"enum": [
|
|
12213
|
+
"account_not_found"
|
|
12214
|
+
]
|
|
12215
|
+
}
|
|
12216
|
+
}
|
|
12217
|
+
}
|
|
12218
|
+
]
|
|
12219
|
+
}
|
|
12220
|
+
}
|
|
12221
|
+
}
|
|
12222
|
+
},
|
|
12223
|
+
"429": {
|
|
12224
|
+
"description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
|
|
12225
|
+
"content": {
|
|
12226
|
+
"application/json": {
|
|
12227
|
+
"schema": {
|
|
12228
|
+
"allOf": [
|
|
12229
|
+
{
|
|
12230
|
+
"$ref": "#/components/schemas/ErrorResponse"
|
|
12231
|
+
},
|
|
12232
|
+
{
|
|
12233
|
+
"type": "object",
|
|
12234
|
+
"properties": {
|
|
12235
|
+
"error_code": {
|
|
12236
|
+
"type": "string",
|
|
12237
|
+
"enum": [
|
|
12238
|
+
"too_many_requests"
|
|
12239
|
+
]
|
|
12240
|
+
}
|
|
12241
|
+
}
|
|
12242
|
+
}
|
|
12243
|
+
]
|
|
12244
|
+
}
|
|
12245
|
+
}
|
|
12246
|
+
}
|
|
12247
|
+
},
|
|
12248
|
+
"500": {
|
|
12249
|
+
"description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
|
|
12250
|
+
"content": {
|
|
12251
|
+
"application/json": {
|
|
12252
|
+
"schema": {
|
|
12253
|
+
"allOf": [
|
|
12254
|
+
{
|
|
12255
|
+
"$ref": "#/components/schemas/ErrorResponse"
|
|
12256
|
+
},
|
|
12257
|
+
{
|
|
12258
|
+
"type": "object",
|
|
12259
|
+
"properties": {
|
|
12260
|
+
"error_code": {
|
|
12261
|
+
"type": "string",
|
|
12262
|
+
"enum": [
|
|
12263
|
+
"internal_error"
|
|
12264
|
+
]
|
|
12265
|
+
}
|
|
12266
|
+
}
|
|
12267
|
+
}
|
|
12268
|
+
]
|
|
12269
|
+
}
|
|
12270
|
+
}
|
|
12271
|
+
}
|
|
12272
|
+
}
|
|
12273
|
+
}
|
|
12274
|
+
}
|
|
12275
|
+
},
|
|
12276
|
+
"/internal/usage/m2m/range": {
|
|
12277
|
+
"get": {
|
|
12278
|
+
"operationId": "internal/m2mUsageRange",
|
|
12279
|
+
"summary": "M2M tokens a project was served in a time range (platform)",
|
|
12280
|
+
"tags": [
|
|
12281
|
+
"account"
|
|
12282
|
+
],
|
|
12283
|
+
"description": "Sum of the hourly client_credentials counters of one project between `from` (first full hour after it) and `to`. At most 40 days back. Platform token with `read:usage`.",
|
|
12284
|
+
"parameters": [
|
|
12285
|
+
{
|
|
12286
|
+
"schema": {
|
|
12287
|
+
"type": "string"
|
|
12288
|
+
},
|
|
12289
|
+
"in": "query",
|
|
12290
|
+
"name": "team",
|
|
12291
|
+
"required": true,
|
|
12292
|
+
"description": "The project to read, as `team_<hex>`."
|
|
12293
|
+
},
|
|
12294
|
+
{
|
|
12295
|
+
"schema": {
|
|
12296
|
+
"type": "string",
|
|
12297
|
+
"format": "date-time"
|
|
12298
|
+
},
|
|
12299
|
+
"in": "query",
|
|
12300
|
+
"name": "from",
|
|
12301
|
+
"required": true,
|
|
12302
|
+
"description": "Start of the range — the subscription period start. Counted from the first full hour after it."
|
|
12303
|
+
},
|
|
12304
|
+
{
|
|
12305
|
+
"schema": {
|
|
12306
|
+
"type": "string",
|
|
12307
|
+
"format": "date-time"
|
|
12308
|
+
},
|
|
12309
|
+
"in": "query",
|
|
12310
|
+
"name": "to",
|
|
12311
|
+
"required": false,
|
|
12312
|
+
"description": "End of the range. Defaults to now."
|
|
12313
|
+
}
|
|
12314
|
+
],
|
|
12315
|
+
"security": [
|
|
12316
|
+
{
|
|
12317
|
+
"bearerAuth": []
|
|
12318
|
+
}
|
|
12319
|
+
],
|
|
12320
|
+
"responses": {
|
|
12321
|
+
"200": {
|
|
12322
|
+
"description": "Default Response",
|
|
12323
|
+
"content": {
|
|
12324
|
+
"application/json": {
|
|
12325
|
+
"schema": {
|
|
12326
|
+
"type": "object",
|
|
12327
|
+
"required": [
|
|
12328
|
+
"team",
|
|
12329
|
+
"from",
|
|
12330
|
+
"to",
|
|
12331
|
+
"tokens"
|
|
12332
|
+
],
|
|
12333
|
+
"properties": {
|
|
12334
|
+
"team": {
|
|
12335
|
+
"type": "string"
|
|
12336
|
+
},
|
|
12337
|
+
"from": {
|
|
12338
|
+
"type": "string"
|
|
12339
|
+
},
|
|
12340
|
+
"to": {
|
|
12341
|
+
"type": "string"
|
|
12342
|
+
},
|
|
12343
|
+
"tokens": {
|
|
12344
|
+
"type": "integer"
|
|
12345
|
+
}
|
|
12346
|
+
}
|
|
12347
|
+
}
|
|
12348
|
+
}
|
|
12349
|
+
}
|
|
12350
|
+
},
|
|
12351
|
+
"400": {
|
|
12352
|
+
"description": "`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
|
|
12353
|
+
"content": {
|
|
12354
|
+
"application/json": {
|
|
12355
|
+
"schema": {
|
|
12356
|
+
"allOf": [
|
|
12357
|
+
{
|
|
12358
|
+
"$ref": "#/components/schemas/ErrorResponse"
|
|
12359
|
+
},
|
|
12360
|
+
{
|
|
12361
|
+
"type": "object",
|
|
12362
|
+
"properties": {
|
|
12363
|
+
"error_code": {
|
|
12364
|
+
"type": "string",
|
|
12365
|
+
"enum": [
|
|
12366
|
+
"validation_error"
|
|
12367
|
+
]
|
|
12368
|
+
}
|
|
12369
|
+
}
|
|
12370
|
+
}
|
|
12371
|
+
]
|
|
12372
|
+
}
|
|
12373
|
+
}
|
|
12374
|
+
}
|
|
12375
|
+
},
|
|
12376
|
+
"401": {
|
|
12377
|
+
"description": "`unauthorized` — The request carries no valid credentials.",
|
|
12378
|
+
"content": {
|
|
12379
|
+
"application/json": {
|
|
12380
|
+
"schema": {
|
|
12381
|
+
"allOf": [
|
|
12382
|
+
{
|
|
12383
|
+
"$ref": "#/components/schemas/ErrorResponse"
|
|
12384
|
+
},
|
|
12385
|
+
{
|
|
12386
|
+
"type": "object",
|
|
12387
|
+
"properties": {
|
|
12388
|
+
"error_code": {
|
|
12389
|
+
"type": "string",
|
|
12390
|
+
"enum": [
|
|
12391
|
+
"unauthorized"
|
|
12392
|
+
]
|
|
12393
|
+
}
|
|
12394
|
+
}
|
|
12395
|
+
}
|
|
12396
|
+
]
|
|
12397
|
+
}
|
|
12398
|
+
}
|
|
12399
|
+
}
|
|
12400
|
+
},
|
|
12401
|
+
"403": {
|
|
12402
|
+
"description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
|
|
12403
|
+
"content": {
|
|
12404
|
+
"application/json": {
|
|
12405
|
+
"schema": {
|
|
12406
|
+
"allOf": [
|
|
12407
|
+
{
|
|
12408
|
+
"$ref": "#/components/schemas/ErrorResponse"
|
|
12409
|
+
},
|
|
12410
|
+
{
|
|
12411
|
+
"type": "object",
|
|
12412
|
+
"properties": {
|
|
12413
|
+
"error_code": {
|
|
12414
|
+
"type": "string",
|
|
12415
|
+
"enum": [
|
|
12416
|
+
"forbidden",
|
|
12417
|
+
"insufficient_scope",
|
|
12418
|
+
"user_suspended"
|
|
12419
|
+
]
|
|
12420
|
+
}
|
|
12421
|
+
}
|
|
12422
|
+
}
|
|
12423
|
+
]
|
|
12424
|
+
}
|
|
12425
|
+
}
|
|
12426
|
+
}
|
|
12427
|
+
},
|
|
12428
|
+
"404": {
|
|
12429
|
+
"description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
|
|
12430
|
+
"content": {
|
|
12431
|
+
"application/json": {
|
|
12432
|
+
"schema": {
|
|
12433
|
+
"allOf": [
|
|
12434
|
+
{
|
|
12435
|
+
"$ref": "#/components/schemas/ErrorResponse"
|
|
12436
|
+
},
|
|
12437
|
+
{
|
|
12438
|
+
"type": "object",
|
|
12439
|
+
"properties": {
|
|
12440
|
+
"error_code": {
|
|
12441
|
+
"type": "string",
|
|
12442
|
+
"enum": [
|
|
12443
|
+
"account_not_found"
|
|
12444
|
+
]
|
|
12445
|
+
}
|
|
12446
|
+
}
|
|
12447
|
+
}
|
|
12448
|
+
]
|
|
12449
|
+
}
|
|
12450
|
+
}
|
|
12451
|
+
}
|
|
12452
|
+
},
|
|
12453
|
+
"429": {
|
|
12454
|
+
"description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
|
|
12455
|
+
"content": {
|
|
12456
|
+
"application/json": {
|
|
12457
|
+
"schema": {
|
|
12458
|
+
"allOf": [
|
|
12459
|
+
{
|
|
12460
|
+
"$ref": "#/components/schemas/ErrorResponse"
|
|
12461
|
+
},
|
|
12462
|
+
{
|
|
12463
|
+
"type": "object",
|
|
12464
|
+
"properties": {
|
|
12465
|
+
"error_code": {
|
|
12466
|
+
"type": "string",
|
|
12467
|
+
"enum": [
|
|
12468
|
+
"too_many_requests"
|
|
12469
|
+
]
|
|
12470
|
+
}
|
|
12471
|
+
}
|
|
12472
|
+
}
|
|
12473
|
+
]
|
|
12474
|
+
}
|
|
12475
|
+
}
|
|
12476
|
+
}
|
|
12477
|
+
},
|
|
12478
|
+
"500": {
|
|
12479
|
+
"description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
|
|
12480
|
+
"content": {
|
|
12481
|
+
"application/json": {
|
|
12482
|
+
"schema": {
|
|
12483
|
+
"allOf": [
|
|
12484
|
+
{
|
|
12485
|
+
"$ref": "#/components/schemas/ErrorResponse"
|
|
12486
|
+
},
|
|
12487
|
+
{
|
|
12488
|
+
"type": "object",
|
|
12489
|
+
"properties": {
|
|
12490
|
+
"error_code": {
|
|
12491
|
+
"type": "string",
|
|
12492
|
+
"enum": [
|
|
12493
|
+
"internal_error"
|
|
12494
|
+
]
|
|
12495
|
+
}
|
|
12496
|
+
}
|
|
12497
|
+
}
|
|
12498
|
+
]
|
|
12499
|
+
}
|
|
12500
|
+
}
|
|
12501
|
+
}
|
|
12502
|
+
}
|
|
12503
|
+
}
|
|
12504
|
+
}
|
|
12505
|
+
},
|
|
12506
|
+
"/account/{account_id}/transfer": {
|
|
12507
|
+
"post": {
|
|
12508
|
+
"operationId": "account/transfer",
|
|
12509
|
+
"summary": "Move an Account to another project",
|
|
12510
|
+
"tags": [
|
|
12511
|
+
"account"
|
|
12512
|
+
],
|
|
12513
|
+
"description": "Re-parents an Auth Account (tenant) under another Faable project. Only `Account.team` changes: the tenant keeps its id, slug, `*.auth.faable.link` domain, clients and secrets, and end-user logins are unaffected. `dry_run` returns the plan (what rides along + blockers) without writing. Platform credentials only. See arch/auth/tenant-project-transfer.md.",
|
|
12514
|
+
"requestBody": {
|
|
12515
|
+
"required": true,
|
|
12516
|
+
"content": {
|
|
12517
|
+
"application/json": {
|
|
12518
|
+
"schema": {
|
|
12519
|
+
"type": "object",
|
|
12520
|
+
"required": [
|
|
12521
|
+
"to_project",
|
|
12522
|
+
"reason"
|
|
12523
|
+
],
|
|
12524
|
+
"properties": {
|
|
12525
|
+
"to_project": {
|
|
12526
|
+
"type": "string",
|
|
12527
|
+
"description": "Destination project (`project_<hex>`) or its team id (`team_<hex>`) — both spellings are accepted."
|
|
12528
|
+
},
|
|
12529
|
+
"reason": {
|
|
12530
|
+
"type": "string",
|
|
12531
|
+
"minLength": 3,
|
|
12532
|
+
"maxLength": 500,
|
|
12533
|
+
"description": "Why the tenant is being moved. Recorded in the tenant's log and in ours."
|
|
12534
|
+
},
|
|
12535
|
+
"dry_run": {
|
|
12536
|
+
"type": "boolean",
|
|
12537
|
+
"default": false,
|
|
12538
|
+
"description": "Return the plan (what rides along + blockers) without writing."
|
|
12539
|
+
},
|
|
12540
|
+
"allow_over_cap": {
|
|
12541
|
+
"type": "boolean",
|
|
12542
|
+
"default": false,
|
|
12543
|
+
"description": "Move even if the destination ends up above the per-project cap on Auth Accounts."
|
|
12544
|
+
}
|
|
12545
|
+
},
|
|
12546
|
+
"additionalProperties": false
|
|
12547
|
+
}
|
|
12548
|
+
}
|
|
12549
|
+
}
|
|
12550
|
+
},
|
|
12551
|
+
"parameters": [
|
|
12552
|
+
{
|
|
12553
|
+
"schema": {
|
|
12554
|
+
"type": "string"
|
|
12555
|
+
},
|
|
12556
|
+
"in": "path",
|
|
12557
|
+
"name": "account_id",
|
|
12558
|
+
"required": true
|
|
12559
|
+
}
|
|
12560
|
+
],
|
|
12561
|
+
"security": [
|
|
12562
|
+
{
|
|
12563
|
+
"bearerAuth": []
|
|
12564
|
+
}
|
|
12565
|
+
],
|
|
12566
|
+
"responses": {
|
|
12567
|
+
"200": {
|
|
12568
|
+
"description": "Default Response",
|
|
12569
|
+
"content": {
|
|
12570
|
+
"application/json": {
|
|
12571
|
+
"schema": {
|
|
12572
|
+
"type": "object",
|
|
12573
|
+
"required": [
|
|
12574
|
+
"moved",
|
|
12575
|
+
"account_id",
|
|
12576
|
+
"account_name",
|
|
12577
|
+
"slug",
|
|
12578
|
+
"domain",
|
|
12579
|
+
"from_project",
|
|
12580
|
+
"to_project",
|
|
12581
|
+
"target_tenants_before",
|
|
12582
|
+
"moves_with_it",
|
|
12583
|
+
"blockers"
|
|
12584
|
+
],
|
|
12585
|
+
"properties": {
|
|
12586
|
+
"moved": {
|
|
12587
|
+
"type": "boolean"
|
|
12588
|
+
},
|
|
12589
|
+
"account_id": {
|
|
12590
|
+
"type": "string"
|
|
12591
|
+
},
|
|
12592
|
+
"account_name": {
|
|
12593
|
+
"type": "string"
|
|
12594
|
+
},
|
|
12595
|
+
"slug": {
|
|
12596
|
+
"type": "string"
|
|
12597
|
+
},
|
|
12598
|
+
"domain": {
|
|
12599
|
+
"type": "string"
|
|
12600
|
+
},
|
|
12601
|
+
"from_project": {
|
|
11972
12602
|
"type": "string"
|
|
11973
12603
|
},
|
|
11974
12604
|
"to_project": {
|
|
@@ -15380,6 +16010,69 @@
|
|
|
15380
16010
|
"type": "string"
|
|
15381
16011
|
}
|
|
15382
16012
|
},
|
|
16013
|
+
"grant_types": {
|
|
16014
|
+
"type": "array",
|
|
16015
|
+
"items": {
|
|
16016
|
+
"anyOf": [
|
|
16017
|
+
{
|
|
16018
|
+
"type": "string",
|
|
16019
|
+
"enum": [
|
|
16020
|
+
"authorization_code"
|
|
16021
|
+
]
|
|
16022
|
+
},
|
|
16023
|
+
{
|
|
16024
|
+
"type": "string",
|
|
16025
|
+
"enum": [
|
|
16026
|
+
"client_credentials"
|
|
16027
|
+
]
|
|
16028
|
+
},
|
|
16029
|
+
{
|
|
16030
|
+
"type": "string",
|
|
16031
|
+
"enum": [
|
|
16032
|
+
"refresh_token"
|
|
16033
|
+
]
|
|
16034
|
+
},
|
|
16035
|
+
{
|
|
16036
|
+
"type": "string",
|
|
16037
|
+
"enum": [
|
|
16038
|
+
"password"
|
|
16039
|
+
]
|
|
16040
|
+
},
|
|
16041
|
+
{
|
|
16042
|
+
"type": "string",
|
|
16043
|
+
"enum": [
|
|
16044
|
+
"http://auth0.com/oauth/grant-type/passwordless/otp"
|
|
16045
|
+
]
|
|
16046
|
+
},
|
|
16047
|
+
{
|
|
16048
|
+
"type": "string",
|
|
16049
|
+
"enum": [
|
|
16050
|
+
"urn:ietf:params:oauth:grant-type:token-exchange"
|
|
16051
|
+
]
|
|
16052
|
+
},
|
|
16053
|
+
{
|
|
16054
|
+
"type": "string",
|
|
16055
|
+
"enum": [
|
|
16056
|
+
"urn:ietf:params:oauth:grant-type:device_code"
|
|
16057
|
+
]
|
|
16058
|
+
},
|
|
16059
|
+
{
|
|
16060
|
+
"type": "string",
|
|
16061
|
+
"enum": [
|
|
16062
|
+
"http://auth0.com/oauth/grant-type/mfa-otp"
|
|
16063
|
+
]
|
|
16064
|
+
},
|
|
16065
|
+
{
|
|
16066
|
+
"type": "string",
|
|
16067
|
+
"enum": [
|
|
16068
|
+
"http://auth0.com/oauth/grant-type/mfa-recovery-code"
|
|
16069
|
+
]
|
|
16070
|
+
}
|
|
16071
|
+
],
|
|
16072
|
+
"description": "A grant the client may use at the token endpoint. An empty `grant_types` list allows every grant except `password`, which is always opt-in."
|
|
16073
|
+
},
|
|
16074
|
+
"uniqueItems": true
|
|
16075
|
+
},
|
|
15383
16076
|
"metadata": {
|
|
15384
16077
|
"type": "object",
|
|
15385
16078
|
"properties": {},
|
|
@@ -16701,8 +17394,66 @@
|
|
|
16701
17394
|
"grant_types": {
|
|
16702
17395
|
"type": "array",
|
|
16703
17396
|
"items": {
|
|
16704
|
-
"
|
|
16705
|
-
|
|
17397
|
+
"anyOf": [
|
|
17398
|
+
{
|
|
17399
|
+
"type": "string",
|
|
17400
|
+
"enum": [
|
|
17401
|
+
"authorization_code"
|
|
17402
|
+
]
|
|
17403
|
+
},
|
|
17404
|
+
{
|
|
17405
|
+
"type": "string",
|
|
17406
|
+
"enum": [
|
|
17407
|
+
"client_credentials"
|
|
17408
|
+
]
|
|
17409
|
+
},
|
|
17410
|
+
{
|
|
17411
|
+
"type": "string",
|
|
17412
|
+
"enum": [
|
|
17413
|
+
"refresh_token"
|
|
17414
|
+
]
|
|
17415
|
+
},
|
|
17416
|
+
{
|
|
17417
|
+
"type": "string",
|
|
17418
|
+
"enum": [
|
|
17419
|
+
"password"
|
|
17420
|
+
]
|
|
17421
|
+
},
|
|
17422
|
+
{
|
|
17423
|
+
"type": "string",
|
|
17424
|
+
"enum": [
|
|
17425
|
+
"http://auth0.com/oauth/grant-type/passwordless/otp"
|
|
17426
|
+
]
|
|
17427
|
+
},
|
|
17428
|
+
{
|
|
17429
|
+
"type": "string",
|
|
17430
|
+
"enum": [
|
|
17431
|
+
"urn:ietf:params:oauth:grant-type:token-exchange"
|
|
17432
|
+
]
|
|
17433
|
+
},
|
|
17434
|
+
{
|
|
17435
|
+
"type": "string",
|
|
17436
|
+
"enum": [
|
|
17437
|
+
"urn:ietf:params:oauth:grant-type:device_code"
|
|
17438
|
+
]
|
|
17439
|
+
},
|
|
17440
|
+
{
|
|
17441
|
+
"type": "string",
|
|
17442
|
+
"enum": [
|
|
17443
|
+
"http://auth0.com/oauth/grant-type/mfa-otp"
|
|
17444
|
+
]
|
|
17445
|
+
},
|
|
17446
|
+
{
|
|
17447
|
+
"type": "string",
|
|
17448
|
+
"enum": [
|
|
17449
|
+
"http://auth0.com/oauth/grant-type/mfa-recovery-code"
|
|
17450
|
+
]
|
|
17451
|
+
}
|
|
17452
|
+
],
|
|
17453
|
+
"description": "A grant the client may use at the token endpoint. An empty `grant_types` list allows every grant except `password`, which is always opt-in."
|
|
17454
|
+
},
|
|
17455
|
+
"uniqueItems": true,
|
|
17456
|
+
"description": "Grants this client may use at the token endpoint. Empty allows every grant except `password`, which must be listed to be used."
|
|
16706
17457
|
},
|
|
16707
17458
|
"response_types": {
|
|
16708
17459
|
"type": "array",
|