@faable/auth-sdk 2.7.41 → 2.7.43

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.41.3",
+    "version": "2.43.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -6012,6 +6012,155 @@
         "description": "LogMetadata",
         "default": {}
       },
+      "Session": {
+        "type": "object",
+        "required": [
+          "id",
+          "user",
+          "sid",
+          "status",
+          "last_seen_at",
+          "expires_at",
+          "account",
+          "createdAt"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "description": "Session ID"
+          },
+          "user": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/User"
+              },
+              {
+                "type": "string"
+              },
+              {}
+            ]
+          },
+          "sid": {
+            "type": "string",
+            "description": "OIDC session id. Every id_token minted for this session carries it as the `sid` claim; a back-channel or front-channel logout names the session with it."
+          },
+          "status": {
+            "anyOf": [
+              {
+                "type": "string",
+                "enum": [
+                  "active"
+                ]
+              },
+              {
+                "type": "string",
+                "enum": [
+                  "revoked"
+                ]
+              }
+            ],
+            "description": "`active` or `revoked`. An active session whose `expires_at` is in the past has expired: nothing can refresh it any more, but the row stays for the history."
+          },
+          "ip": {
+            "type": "string",
+            "description": "Client IP at the last authentication."
+          },
+          "user_agent": {
+            "type": "string",
+            "description": "Raw `User-Agent` header at the last authentication."
+          },
+          "client": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/Client"
+              },
+              {
+                "type": "string"
+              },
+              {}
+            ]
+          },
+          "connection": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/Connection"
+              },
+              {
+                "type": "string"
+              },
+              {}
+            ]
+          },
+          "issuer": {
+            "type": "string",
+            "description": "Issuer URL the session was minted on."
+          },
+          "last_seen_at": {
+            "type": "string",
+            "format": "date-time",
+            "description": "Last authentication or token refresh through this session. Each refresh slides `expires_at` 30 days from here."
+          },
+          "expires_at": {
+            "type": "string",
+            "format": "date-time",
+            "description": "When the session stops being usable unless something refreshes it first."
+          },
+          "revoked_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "revoked_reason": {
+            "anyOf": [
+              {
+                "type": "string",
+                "enum": [
+                  "admin"
+                ]
+              },
+              {
+                "type": "string",
+                "enum": [
+                  "logout"
+                ]
+              },
+              {
+                "type": "string",
+                "enum": [
+                  "user"
+                ]
+              }
+            ],
+            "description": "`admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device."
+          },
+          "account": {
+            "type": "string",
+            "description": "Object is related with this account"
+          },
+          "metadata": {
+            "type": "object",
+            "properties": {},
+            "additionalProperties": true,
+            "description": "SessionMetadata",
+            "default": {}
+          },
+          "createdAt": {
+            "type": "string",
+            "description": "Session creation date"
+          },
+          "updatedAt": {
+            "type": "string",
+            "description": "Session updated date"
+          }
+        },
+        "description": "Session"
+      },
+      "SessionMetadata": {
+        "type": "object",
+        "properties": {},
+        "additionalProperties": true,
+        "description": "SessionMetadata",
+        "default": {}
+      },
       "Customdomain": {
         "type": "object",
         "required": [
@@ -7242,7 +7391,7 @@
       },
       "ErrorCode": {
         "type": "string",
-        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (401): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `invalid_email` (400): The email address is not valid.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): Dynamic client registration rejected a field (RFC 7591). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.",
+        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (401): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `session_already_revoked` (409): The session was already revoked.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `invalid_email` (400): The email address is not valid.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): Dynamic client registration rejected a field (RFC 7591). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.",
         "enum": [
           "bad_request",
           "validation_error",
@@ -7271,6 +7420,7 @@
           "account_transfer_refused",
           "plan_required",
           "not_logged_in",
+          "session_already_revoked",
           "invalid_token",
           "not_owner",
           "user_suspended",
@@ -12052,233 +12202,14 @@
         }
       }
     },
-    "/internal/usage/m2m": {
-      "get": {
-        "operationId": "internal/m2mUsage",
-        "summary": "M2M tokens served per project in a month (platform)",
-        "tags": [
-          "account"
-        ],
-        "description": "Per-project count of successful client_credentials token responses in the given month (cached ones included), read from the monthly counters. Consumed by the billing usage job. Platform token with `read:usage`.",
-        "parameters": [
-          {
-            "schema": {
-              "type": "string",
-              "pattern": "^\\d{4}-\\d{2}$"
-            },
-            "in": "query",
-            "name": "month",
-            "required": true,
-            "description": "YYYY-MM, UTC."
-          }
-        ],
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Default Response",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "required": [
-                    "month",
-                    "rows"
-                  ],
-                  "properties": {
-                    "month": {
-                      "type": "string"
-                    },
-                    "rows": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "required": [
-                          "team",
-                          "tokens"
-                        ],
-                        "properties": {
-                          "team": {
-                            "type": "string",
-                            "description": "The project (`team_<hex>`), or the account id for a legacy account without one."
-                          },
-                          "tokens": {
-                            "type": "integer"
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "validation_error"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "`unauthorized` — The request carries no valid credentials.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "unauthorized"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "403": {
-            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "forbidden",
-                            "insufficient_scope",
-                            "user_suspended"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "404": {
-            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "account_not_found"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "429": {
-            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "too_many_requests"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "500": {
-            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "internal_error"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "/internal/usage/m2m/range": {
+    "/internal/usage/sms/range": {
       "get": {
-        "operationId": "internal/m2mUsageRange",
-        "summary": "M2M tokens a project was served in a time range (platform)",
+        "operationId": "internal/smsUsageRange",
+        "summary": "SMS a project sent in a time range (platform)",
         "tags": [
           "account"
         ],
-        "description": "Sum of the hourly client_credentials counters of one project between `from` (first full hour after it) and `to`. At most 40 days back. Platform token with `read:usage`.",
+        "description": "Sum of the hourly counters of SMS and WhatsApp messages one project handed to the provider between `from` (first full hour after it) and `to`. At most 40 days back. Platform token with `read:usage`.",
         "parameters": [
           {
             "schema": {
@@ -12326,7 +12257,7 @@
                     "team",
                     "from",
                     "to",
-                    "tokens"
+                    "sent"
                   ],
                   "properties": {
                     "team": {
@@ -12338,7 +12269,7 @@
                     "to": {
                       "type": "string"
                     },
-                    "tokens": {
+                    "sent": {
                       "type": "integer"
                     }
                   }
@@ -12501,59 +12432,24 @@
         }
       }
     },
-    "/account/{account_id}/transfer": {
-      "post": {
-        "operationId": "account/transfer",
-        "summary": "Move an Account to another project",
+    "/internal/usage/m2m": {
+      "get": {
+        "operationId": "internal/m2mUsage",
+        "summary": "M2M tokens served per project in a month (platform)",
         "tags": [
           "account"
         ],
-        "description": "Re-parents an Auth Account (tenant) under another Faable project. Only `Account.team` changes: the tenant keeps its id, slug, `*.auth.faable.link` domain, clients and secrets, and end-user logins are unaffected. `dry_run` returns the plan (what rides along + blockers) without writing. Platform credentials only. See arch/auth/tenant-project-transfer.md.",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "required": [
-                  "to_project",
-                  "reason"
-                ],
-                "properties": {
-                  "to_project": {
-                    "type": "string",
-                    "description": "Destination project (`project_<hex>`) or its team id (`team_<hex>`) — both spellings are accepted."
-                  },
-                  "reason": {
-                    "type": "string",
-                    "minLength": 3,
-                    "maxLength": 500,
-                    "description": "Why the tenant is being moved. Recorded in the tenant's log and in ours."
-                  },
-                  "dry_run": {
-                    "type": "boolean",
-                    "default": false,
-                    "description": "Return the plan (what rides along + blockers) without writing."
-                  },
-                  "allow_over_cap": {
-                    "type": "boolean",
-                    "default": false,
-                    "description": "Move even if the destination ends up above the per-project cap on Auth Accounts."
-                  }
-                },
-                "additionalProperties": false
-              }
-            }
-          }
-        },
+        "description": "Per-project count of successful client_credentials token responses in the given month (cached ones included), read from the monthly counters. Consumed by the billing usage job. Platform token with `read:usage`.",
         "parameters": [
           {
             "schema": {
-              "type": "string"
+              "type": "string",
+              "pattern": "^\\d{4}-\\d{2}$"
             },
-            "in": "path",
-            "name": "account_id",
-            "required": true
+            "in": "query",
+            "name": "month",
+            "required": true,
+            "description": "YYYY-MM, UTC."
           }
         ],
         "security": [
@@ -12569,86 +12465,31 @@
                 "schema": {
                   "type": "object",
                   "required": [
-                    "moved",
-                    "account_id",
-                    "account_name",
-                    "slug",
-                    "domain",
-                    "from_project",
-                    "to_project",
-                    "target_tenants_before",
-                    "moves_with_it",
-                    "blockers"
+                    "month",
+                    "rows"
                   ],
                   "properties": {
-                    "moved": {
-                      "type": "boolean"
-                    },
-                    "account_id": {
-                      "type": "string"
-                    },
-                    "account_name": {
-                      "type": "string"
-                    },
-                    "slug": {
-                      "type": "string"
-                    },
-                    "domain": {
-                      "type": "string"
-                    },
-                    "from_project": {
-                      "type": "string"
-                    },
-                    "to_project": {
+                    "month": {
                       "type": "string"
                     },
-                    "target_tenants_before": {
-                      "type": "array",
-                      "items": {
-                        "type": "object",
-                        "required": [
-                          "id",
-                          "name"
-                        ],
-                        "properties": {
-                          "id": {
-                            "type": "string"
-                          },
-                          "name": {
-                            "type": "string"
-                          }
-                        }
-                      }
-                    },
-                    "moves_with_it": {
-                      "type": "object",
-                      "additionalProperties": {
-                        "type": "number"
-                      }
-                    },
-                    "blockers": {
+                    "rows": {
                       "type": "array",
                       "items": {
                         "type": "object",
                         "required": [
-                          "code",
-                          "detail"
+                          "team",
+                          "tokens"
                         ],
                         "properties": {
-                          "code": {
-                            "type": "string"
+                          "team": {
+                            "type": "string",
+                            "description": "The project (`team_<hex>`), or the account id for a legacy account without one."
                           },
-                          "detail": {
-                            "type": "string"
+                          "tokens": {
+                            "type": "integer"
                           }
                         }
                       }
-                    },
-                    "tenants_left_in_source": {
-                      "type": "number"
-                    },
-                    "tenants_in_target": {
-                      "type": "number"
                     }
                   }
                 }
@@ -12656,7 +12497,7 @@
             }
           },
           "400": {
-            "description": "`invalid_project_id` — The project id is not of the form `project_<hex>` or `team_<hex>`.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -12670,7 +12511,6 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "invalid_project_id",
                             "validation_error"
                           ]
                         }
@@ -12758,31 +12598,6 @@
               }
             }
           },
-          "409": {
-            "description": "`account_transfer_refused` — The Auth Account cannot be moved to that project. `details.blockers` lists why.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
-                    },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
-                          "enum": [
-                            "account_transfer_refused"
-                          ]
-                        }
-                      }
-                    }
-                  ]
-                }
-              }
-            }
-          },
           "429": {
             "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
             "content": {
@@ -12836,90 +12651,43 @@
         }
       }
     },
-    "/connection": {
+    "/internal/usage/m2m/range": {
       "get": {
-        "operationId": "connection/list",
-        "summary": "List Connections",
+        "operationId": "internal/m2mUsageRange",
+        "summary": "M2M tokens a project was served in a time range (platform)",
         "tags": [
-          "connection"
+          "account"
         ],
-        "description": "List Connections",
+        "description": "Sum of the hourly client_credentials counters of one project between `from` (first full hour after it) and `to`. At most 40 days back. Platform token with `read:usage`.",
         "parameters": [
-          {
-            "schema": {
-              "type": "number",
-              "minimum": 1,
-              "maximum": 200
-            },
-            "in": "query",
-            "name": "pageSize",
-            "required": false,
-            "description": "Number of items per page (max 200)"
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "cursor",
-            "required": false,
-            "description": "Cursor for next page"
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "next",
-            "required": false,
-            "description": "Cursor returned by the previous page"
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "connection_type",
-            "required": false,
-            "description": "Exact match on `connection_type`. Equivalent to `?query=connection_type:<value>`."
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "enabled",
-            "required": false,
-            "description": "Exact match on `enabled`. Equivalent to `?query=enabled:<value>`."
-          },
           {
             "schema": {
               "type": "string"
             },
             "in": "query",
-            "name": "category",
-            "required": false,
-            "description": "Exact match on `category`. Equivalent to `?query=category:<value>`."
+            "name": "team",
+            "required": true,
+            "description": "The project to read, as `team_<hex>`."
           },
           {
             "schema": {
-              "type": "string"
+              "type": "string",
+              "format": "date-time"
             },
             "in": "query",
-            "name": "query",
-            "required": false,
-            "description": "Filter using a FaableQL query"
+            "name": "from",
+            "required": true,
+            "description": "Start of the range — the subscription period start. Counted from the first full hour after it."
           },
           {
             "schema": {
               "type": "string",
-              "minLength": 1,
-              "maxLength": 200
+              "format": "date-time"
             },
             "in": "query",
-            "name": "q",
+            "name": "to",
             "required": false,
-            "description": "Full-text search across: `connection_name`, `connection_type`."
+            "description": "End of the range. Defaults to now."
           }
         ],
         "security": [
@@ -12935,34 +12703,31 @@
                 "schema": {
                   "type": "object",
                   "required": [
-                    "next",
-                    "results"
+                    "team",
+                    "from",
+                    "to",
+                    "tokens"
                   ],
                   "properties": {
-                    "next": {
-                      "anyOf": [
-                        {
-                          "type": "string"
-                        },
-                        {
-                          "type": "null"
-                        }
-                      ]
+                    "team": {
+                      "type": "string"
                     },
-                    "results": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/components/schemas/Connection"
-                      }
+                    "from": {
+                      "type": "string"
+                    },
+                    "to": {
+                      "type": "string"
+                    },
+                    "tokens": {
+                      "type": "integer"
                     }
-                  },
-                  "additionalProperties": false
+                  }
                 }
               }
             }
           },
           "400": {
-            "description": "`invalid_query` — The `?query=` FaableQL expression could not be parsed.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`search_not_supported` — This resource does not support `?search=`.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -12976,9 +12741,6 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "invalid_query",
-                            "invalid_expand",
-                            "search_not_supported",
                             "validation_error"
                           ]
                         }
@@ -13117,14 +12879,16 @@
             }
           }
         }
-      },
+      }
+    },
+    "/account/{account_id}/transfer": {
       "post": {
-        "operationId": "connection/create",
-        "summary": "Create Connection",
+        "operationId": "account/transfer",
+        "summary": "Move an Account to another project",
         "tags": [
-          "connection"
+          "account"
         ],
-        "description": "Create Connection",
+        "description": "Re-parents an Auth Account (tenant) under another Faable project. Only `Account.team` changes: the tenant keeps its id, slug, `*.auth.faable.link` domain, clients and secrets, and end-user logins are unaffected. `dry_run` returns the plan (what rides along + blockers) without writing. Platform credentials only. See arch/auth/tenant-project-transfer.md.",
         "requestBody": {
           "required": true,
           "content": {
@@ -13132,180 +12896,46 @@
               "schema": {
                 "type": "object",
                 "required": [
-                  "connection_name",
-                  "connection_type"
+                  "to_project",
+                  "reason"
                 ],
                 "properties": {
-                  "connection_name": {
-                    "type": "string"
-                  },
-                  "connection_type": {
-                    "enum": [
-                      "database",
-                      "custom",
-                      "github",
-                      "figma",
-                      "google_oauth2",
-                      "microsoft",
-                      "oidc",
-                      "passwordless_email"
-                    ]
-                  },
-                  "authorize_url": {
-                    "type": "string"
-                  },
-                  "client_id": {
-                    "type": "string"
-                  },
-                  "client_secret": {
-                    "type": "string"
-                  },
-                  "issuer": {
-                    "type": "string"
-                  },
-                  "jwks_url": {
-                    "type": "string"
-                  },
-                  "scope": {
-                    "type": "array",
-                    "items": {
-                      "type": "string"
-                    }
-                  },
-                  "enabled": {
-                    "type": "boolean"
-                  },
-                  "claims_mapping": {
-                    "type": "object",
-                    "additionalProperties": {
-                      "type": "string"
-                    }
-                  },
-                  "authorize_params": {
-                    "type": "object",
-                    "description": "Authorize params",
-                    "default": {},
-                    "additionalProperties": {
-                      "type": "string"
-                    }
-                  },
-                  "email_oauth_sync_policy": {
-                    "anyOf": [
-                      {
-                        "type": "string",
-                        "enum": [
-                          "preserve_manual"
-                        ]
-                      },
-                      {
-                        "type": "string",
-                        "enum": [
-                          "always_sync"
-                        ]
-                      }
-                    ],
-                    "description": "Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).\n\n- `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.\n- `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.)."
-                  },
-                  "password_policy": {
-                    "type": "object",
-                    "required": [
-                      "level"
-                    ],
-                    "properties": {
-                      "level": {
-                        "anyOf": [
-                          {
-                            "type": "string",
-                            "enum": [
-                              "none"
-                            ]
-                          },
-                          {
-                            "type": "string",
-                            "enum": [
-                              "low"
-                            ]
-                          },
-                          {
-                            "type": "string",
-                            "enum": [
-                              "fair"
-                            ]
-                          },
-                          {
-                            "type": "string",
-                            "enum": [
-                              "good"
-                            ]
-                          },
-                          {
-                            "type": "string",
-                            "enum": [
-                              "excellent"
-                            ]
-                          }
-                        ]
-                      },
-                      "min_length": {
-                        "type": "integer",
-                        "minimum": 1,
-                        "maximum": 128
-                      },
-                      "require_lowercase": {
-                        "type": "boolean"
-                      },
-                      "require_uppercase": {
-                        "type": "boolean"
-                      },
-                      "require_number": {
-                        "type": "boolean"
-                      },
-                      "require_special": {
-                        "type": "boolean"
-                      }
-                    },
-                    "description": "Password policy enforced when writing a password through this database connection (password reset and admin set-password). `level` is an Auth0-style preset (none/low/fair/good/excellent); the dashboard expands it into the explicit rule fields when saving. The rule fields override the preset baseline. When unset on the connection, the server applies the `good` default. Does not affect login."
+                  "to_project": {
+                    "type": "string",
+                    "description": "Destination project (`project_<hex>`) or its team id (`team_<hex>`) — both spellings are accepted."
                   },
-                  "disable_signup": {
-                    "type": "boolean"
+                  "reason": {
+                    "type": "string",
+                    "minLength": 3,
+                    "maxLength": 500,
+                    "description": "Why the tenant is being moved. Recorded in the tenant's log and in ours."
                   },
-                  "login_identifier": {
-                    "anyOf": [
-                      {
-                        "type": "string",
-                        "enum": [
-                          "email"
-                        ]
-                      },
-                      {
-                        "type": "string",
-                        "enum": [
-                          "username"
-                        ]
-                      },
-                      {
-                        "type": "string",
-                        "enum": [
-                          "email_or_username"
-                        ]
-                      }
-                    ],
-                    "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
+                  "dry_run": {
+                    "type": "boolean",
+                    "default": false,
+                    "description": "Return the plan (what rides along + blockers) without writing."
                   },
-                  "metadata": {
-                    "type": "object",
-                    "properties": {},
-                    "additionalProperties": true,
-                    "description": "Add Metadata"
+                  "allow_over_cap": {
+                    "type": "boolean",
+                    "default": false,
+                    "description": "Move even if the destination ends up above the per-project cap on Auth Accounts."
                   }
                 },
-                "description": "ConnectionCreate",
                 "additionalProperties": false
               }
             }
-          },
-          "description": "ConnectionCreate"
+          }
         },
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "account_id",
+            "required": true
+          }
+        ],
         "security": [
           {
             "bearerAuth": []
@@ -13313,251 +12943,100 @@
         ],
         "responses": {
           "200": {
-            "description": "Connection",
+            "description": "Default Response",
             "content": {
               "application/json": {
                 "schema": {
                   "type": "object",
                   "required": [
-                    "id",
-                    "connection_name",
-                    "connection_type",
-                    "authorize_url",
-                    "token_url",
-                    "userinfo_url",
-                    "client_id",
-                    "client_secret",
-                    "issuer",
-                    "jwks_url",
-                    "response_type",
-                    "enabled",
-                    "enabled_clients",
-                    "scope",
-                    "authorize_params",
-                    "is_using_default_credentials",
-                    "account",
-                    "createdAt"
+                    "moved",
+                    "account_id",
+                    "account_name",
+                    "slug",
+                    "domain",
+                    "from_project",
+                    "to_project",
+                    "target_tenants_before",
+                    "moves_with_it",
+                    "blockers"
                   ],
                   "properties": {
-                    "id": {
-                      "type": "string",
-                      "description": "Connection ID"
+                    "moved": {
+                      "type": "boolean"
                     },
-                    "connection_name": {
+                    "account_id": {
                       "type": "string"
                     },
-                    "connection_type": {
-                      "enum": [
-                        "database",
-                        "custom",
-                        "github",
-                        "figma",
-                        "google_oauth2",
-                        "microsoft",
-                        "oidc",
-                        "passwordless_email"
-                      ]
-                    },
-                    "authorize_url": {
-                      "type": "string",
-                      "default": null
-                    },
-                    "token_url": {
-                      "type": "string",
-                      "default": null
-                    },
-                    "userinfo_url": {
-                      "type": "string",
-                      "default": null
-                    },
-                    "client_id": {
-                      "type": "string",
-                      "default": null
-                    },
-                    "client_secret": {
-                      "type": "string",
-                      "default": null
-                    },
-                    "issuer": {
-                      "type": "string",
-                      "default": null
+                    "account_name": {
+                      "type": "string"
                     },
-                    "jwks_url": {
-                      "type": "string",
-                      "default": null
+                    "slug": {
+                      "type": "string"
                     },
-                    "response_type": {
-                      "type": "string",
-                      "default": null
+                    "domain": {
+                      "type": "string"
                     },
-                    "enabled": {
-                      "type": "boolean"
+                    "from_project": {
+                      "type": "string"
                     },
-                    "enabled_clients": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "default": null,
-                      "nullable": true
+                    "to_project": {
+                      "type": "string"
                     },
-                    "scope": {
+                    "target_tenants_before": {
                       "type": "array",
                       "items": {
-                        "type": "string"
-                      },
-                      "default": []
-                    },
-                    "authorize_params": {
-                      "type": "object",
-                      "description": "Authorize params",
-                      "default": {},
-                      "additionalProperties": {
-                        "type": "string"
+                        "type": "object",
+                        "required": [
+                          "id",
+                          "name"
+                        ],
+                        "properties": {
+                          "id": {
+                            "type": "string"
+                          },
+                          "name": {
+                            "type": "string"
+                          }
+                        }
                       }
                     },
-                    "claims_mapping": {
+                    "moves_with_it": {
                       "type": "object",
                       "additionalProperties": {
-                        "type": "string"
+                        "type": "number"
                       }
                     },
-                    "is_using_default_credentials": {
-                      "type": "boolean",
-                      "readOnly": true,
-                      "description": "Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read."
-                    },
-                    "email_oauth_sync_policy": {
-                      "anyOf": [
-                        {
-                          "type": "string",
-                          "enum": [
-                            "preserve_manual"
-                          ]
-                        },
-                        {
-                          "type": "string",
-                          "enum": [
-                            "always_sync"
-                          ]
-                        }
-                      ],
-                      "description": "Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant."
-                    },
-                    "password_policy": {
-                      "type": "object",
-                      "required": [
-                        "level"
-                      ],
-                      "properties": {
-                        "level": {
-                          "anyOf": [
-                            {
-                              "type": "string",
-                              "enum": [
-                                "none"
-                              ]
-                            },
-                            {
-                              "type": "string",
-                              "enum": [
-                                "low"
-                              ]
-                            },
-                            {
-                              "type": "string",
-                              "enum": [
-                                "fair"
-                              ]
-                            },
-                            {
-                              "type": "string",
-                              "enum": [
-                                "good"
-                              ]
-                            },
-                            {
-                              "type": "string",
-                              "enum": [
-                                "excellent"
-                              ]
-                            }
-                          ]
-                        },
-                        "min_length": {
-                          "type": "integer",
-                          "minimum": 1,
-                          "maximum": 128
-                        },
-                        "require_lowercase": {
-                          "type": "boolean"
-                        },
-                        "require_uppercase": {
-                          "type": "boolean"
-                        },
-                        "require_number": {
-                          "type": "boolean"
-                        },
-                        "require_special": {
-                          "type": "boolean"
-                        }
-                      },
-                      "description": "Password policy enforced when writing a password through this database connection (password reset and admin set-password). `level` is an Auth0-style preset (none/low/fair/good/excellent); the dashboard expands it into the explicit rule fields when saving. The rule fields override the preset baseline. When unset on the connection, the server applies the `good` default. Does not affect login."
-                    },
-                    "login_identifier": {
-                      "anyOf": [
-                        {
-                          "type": "string",
-                          "enum": [
-                            "email"
-                          ]
-                        },
-                        {
-                          "type": "string",
-                          "enum": [
-                            "username"
-                          ]
-                        },
-                        {
-                          "type": "string",
-                          "enum": [
-                            "email_or_username"
-                          ]
+                    "blockers": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "code",
+                          "detail"
+                        ],
+                        "properties": {
+                          "code": {
+                            "type": "string"
+                          },
+                          "detail": {
+                            "type": "string"
+                          }
                         }
-                      ],
-                      "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
-                    },
-                    "disable_signup": {
-                      "type": "boolean",
-                      "description": "When true, the public self-service signup endpoint (`POST /dbconnections/signup`) rejects new registrations against this database connection with `403 signup_disabled`. Defaults to false (signup allowed). Only meaningful on `database` connections; mirrors Auth0 `disable_signup`."
-                    },
-                    "account": {
-                      "type": "string",
-                      "description": "Object is related with this account"
-                    },
-                    "metadata": {
-                      "type": "object",
-                      "properties": {},
-                      "additionalProperties": true,
-                      "description": "ConnectionMetadata",
-                      "default": {}
+                      }
                     },
-                    "createdAt": {
-                      "type": "string",
-                      "description": "Connection creation date"
+                    "tenants_left_in_source": {
+                      "type": "number"
                     },
-                    "updatedAt": {
-                      "type": "string",
-                      "description": "Connection updated date"
+                    "tenants_in_target": {
+                      "type": "number"
                     }
-                  },
-                  "description": "Connection"
+                  }
                 }
               }
             }
           },
           "400": {
-            "description": "`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_project_id` — The project id is not of the form `project_<hex>` or `team_<hex>`.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -13571,7 +13050,7 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "already_exists",
+                            "invalid_project_id",
                             "validation_error"
                           ]
                         }
@@ -13659,6 +13138,31 @@
               }
             }
           },
+          "409": {
+            "description": "`account_transfer_refused` — The Auth Account cannot be moved to that project. `details.blockers` lists why.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_transfer_refused"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
           "429": {
             "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
             "content": {
@@ -13712,24 +13216,476 @@
         }
       }
     },
-    "/connection/{connection_id}": {
+    "/connection": {
       "get": {
-        "operationId": "connection/get",
-        "summary": "Get Connection",
+        "operationId": "connection/list",
+        "summary": "List Connections",
         "tags": [
           "connection"
         ],
-        "description": "Get Connection",
+        "description": "List Connections",
         "parameters": [
+          {
+            "schema": {
+              "type": "number",
+              "minimum": 1,
+              "maximum": 200
+            },
+            "in": "query",
+            "name": "pageSize",
+            "required": false,
+            "description": "Number of items per page (max 200)"
+          },
           {
             "schema": {
               "type": "string"
             },
-            "in": "path",
-            "name": "connection_id",
-            "required": true
+            "in": "query",
+            "name": "cursor",
+            "required": false,
+            "description": "Cursor for next page"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "next",
+            "required": false,
+            "description": "Cursor returned by the previous page"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "connection_type",
+            "required": false,
+            "description": "Exact match on `connection_type`. Equivalent to `?query=connection_type:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "enabled",
+            "required": false,
+            "description": "Exact match on `enabled`. Equivalent to `?query=enabled:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "category",
+            "required": false,
+            "description": "Exact match on `category`. Equivalent to `?query=category:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "query",
+            "required": false,
+            "description": "Filter using a FaableQL query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 200
+            },
+            "in": "query",
+            "name": "q",
+            "required": false,
+            "description": "Full-text search across: `connection_name`, `connection_type`."
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "next",
+                    "results"
+                  ],
+                  "properties": {
+                    "next": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "results": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Connection"
+                      }
+                    }
+                  },
+                  "additionalProperties": false
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_query` — The `?query=` FaableQL expression could not be parsed.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`search_not_supported` — This resource does not support `?search=`.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_query",
+                            "invalid_expand",
+                            "search_not_supported",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
           }
+        }
+      },
+      "post": {
+        "operationId": "connection/create",
+        "summary": "Create Connection",
+        "tags": [
+          "connection"
         ],
+        "description": "Create Connection",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "connection_name",
+                  "connection_type"
+                ],
+                "properties": {
+                  "connection_name": {
+                    "type": "string"
+                  },
+                  "connection_type": {
+                    "enum": [
+                      "database",
+                      "custom",
+                      "github",
+                      "figma",
+                      "google_oauth2",
+                      "microsoft",
+                      "oidc",
+                      "passwordless_email"
+                    ]
+                  },
+                  "authorize_url": {
+                    "type": "string"
+                  },
+                  "client_id": {
+                    "type": "string"
+                  },
+                  "client_secret": {
+                    "type": "string"
+                  },
+                  "issuer": {
+                    "type": "string"
+                  },
+                  "jwks_url": {
+                    "type": "string"
+                  },
+                  "scope": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "enabled": {
+                    "type": "boolean"
+                  },
+                  "claims_mapping": {
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  },
+                  "authorize_params": {
+                    "type": "object",
+                    "description": "Authorize params",
+                    "default": {},
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  },
+                  "email_oauth_sync_policy": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "preserve_manual"
+                        ]
+                      },
+                      {
+                        "type": "string",
+                        "enum": [
+                          "always_sync"
+                        ]
+                      }
+                    ],
+                    "description": "Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).\n\n- `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.\n- `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.)."
+                  },
+                  "password_policy": {
+                    "type": "object",
+                    "required": [
+                      "level"
+                    ],
+                    "properties": {
+                      "level": {
+                        "anyOf": [
+                          {
+                            "type": "string",
+                            "enum": [
+                              "none"
+                            ]
+                          },
+                          {
+                            "type": "string",
+                            "enum": [
+                              "low"
+                            ]
+                          },
+                          {
+                            "type": "string",
+                            "enum": [
+                              "fair"
+                            ]
+                          },
+                          {
+                            "type": "string",
+                            "enum": [
+                              "good"
+                            ]
+                          },
+                          {
+                            "type": "string",
+                            "enum": [
+                              "excellent"
+                            ]
+                          }
+                        ]
+                      },
+                      "min_length": {
+                        "type": "integer",
+                        "minimum": 1,
+                        "maximum": 128
+                      },
+                      "require_lowercase": {
+                        "type": "boolean"
+                      },
+                      "require_uppercase": {
+                        "type": "boolean"
+                      },
+                      "require_number": {
+                        "type": "boolean"
+                      },
+                      "require_special": {
+                        "type": "boolean"
+                      }
+                    },
+                    "description": "Password policy enforced when writing a password through this database connection (password reset and admin set-password). `level` is an Auth0-style preset (none/low/fair/good/excellent); the dashboard expands it into the explicit rule fields when saving. The rule fields override the preset baseline. When unset on the connection, the server applies the `good` default. Does not affect login."
+                  },
+                  "disable_signup": {
+                    "type": "boolean"
+                  },
+                  "login_identifier": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "email"
+                        ]
+                      },
+                      {
+                        "type": "string",
+                        "enum": [
+                          "username"
+                        ]
+                      },
+                      {
+                        "type": "string",
+                        "enum": [
+                          "email_or_username"
+                        ]
+                      }
+                    ],
+                    "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
+                  },
+                  "metadata": {
+                    "type": "object",
+                    "properties": {},
+                    "additionalProperties": true,
+                    "description": "Add Metadata"
+                  }
+                },
+                "description": "ConnectionCreate",
+                "additionalProperties": false
+              }
+            }
+          },
+          "description": "ConnectionCreate"
+        },
         "security": [
           {
             "bearerAuth": []
@@ -13981,7 +13937,7 @@
             }
           },
           "400": {
-            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -13995,8 +13951,7 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "invalid_id",
-                            "invalid_expand",
+                            "already_exists",
                             "validation_error"
                           ]
                         }
@@ -14060,7 +14015,7 @@
             }
           },
           "404": {
-            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
             "content": {
               "application/json": {
                 "schema": {
@@ -14074,7 +14029,6 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "not_found",
                             "account_not_found"
                           ]
                         }
@@ -14136,197 +14090,16 @@
             }
           }
         }
-      },
-      "post": {
-        "operationId": "connection/update",
-        "summary": "Update Connection",
+      }
+    },
+    "/connection/{connection_id}": {
+      "get": {
+        "operationId": "connection/get",
+        "summary": "Get Connection",
         "tags": [
           "connection"
         ],
-        "description": "Update Connection",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "properties": {
-                  "connection_name": {
-                    "type": "string"
-                  },
-                  "enabled": {
-                    "type": "boolean"
-                  },
-                  "enabled_clients": {
-                    "type": "array",
-                    "items": {
-                      "type": "string"
-                    }
-                  },
-                  "scope": {
-                    "type": "array",
-                    "items": {
-                      "type": "string"
-                    }
-                  },
-                  "client_id": {
-                    "type": "string"
-                  },
-                  "client_secret": {
-                    "type": "string"
-                  },
-                  "issuer": {
-                    "type": "string"
-                  },
-                  "authorize_url": {
-                    "type": "string"
-                  },
-                  "token_url": {
-                    "type": "string"
-                  },
-                  "userinfo_url": {
-                    "type": "string"
-                  },
-                  "jwks_url": {
-                    "type": "string"
-                  },
-                  "response_type": {
-                    "type": "string"
-                  },
-                  "authorize_params": {
-                    "type": "object",
-                    "description": "Authorize params",
-                    "default": {},
-                    "additionalProperties": {
-                      "type": "string"
-                    }
-                  },
-                  "claims_mapping": {
-                    "type": "object",
-                    "additionalProperties": {
-                      "type": "string"
-                    }
-                  },
-                  "email_oauth_sync_policy": {
-                    "anyOf": [
-                      {
-                        "type": "string",
-                        "enum": [
-                          "preserve_manual"
-                        ]
-                      },
-                      {
-                        "type": "string",
-                        "enum": [
-                          "always_sync"
-                        ]
-                      },
-                      {
-                        "type": "null"
-                      }
-                    ]
-                  },
-                  "password_policy": {
-                    "anyOf": [
-                      {
-                        "type": "object",
-                        "required": [
-                          "level"
-                        ],
-                        "properties": {
-                          "level": {
-                            "anyOf": [
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "none"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "low"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "fair"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "good"
-                                ]
-                              },
-                              {
-                                "type": "string",
-                                "enum": [
-                                  "excellent"
-                                ]
-                              }
-                            ]
-                          },
-                          "min_length": {
-                            "type": "integer",
-                            "minimum": 1,
-                            "maximum": 128
-                          },
-                          "require_lowercase": {
-                            "type": "boolean"
-                          },
-                          "require_uppercase": {
-                            "type": "boolean"
-                          },
-                          "require_number": {
-                            "type": "boolean"
-                          },
-                          "require_special": {
-                            "type": "boolean"
-                          }
-                        },
-                        "description": "Password policy enforced when writing a password through this database connection (password reset and admin set-password). `level` is an Auth0-style preset (none/low/fair/good/excellent); the dashboard expands it into the explicit rule fields when saving. The rule fields override the preset baseline. When unset on the connection, the server applies the `good` default. Does not affect login."
-                      },
-                      {
-                        "type": "null"
-                      }
-                    ]
-                  },
-                  "disable_signup": {
-                    "type": "boolean"
-                  },
-                  "login_identifier": {
-                    "anyOf": [
-                      {
-                        "type": "string",
-                        "enum": [
-                          "email"
-                        ]
-                      },
-                      {
-                        "type": "string",
-                        "enum": [
-                          "username"
-                        ]
-                      },
-                      {
-                        "type": "string",
-                        "enum": [
-                          "email_or_username"
-                        ]
-                      }
-                    ],
-                    "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
-                  }
-                },
-                "description": "Partial update for a Connection. Only the supplied fields are modified. `connection_type` is intentionally excluded — changing it would orphan every identity already linked to this connection.",
-                "additionalProperties": false
-              }
-            }
-          },
-          "description": "Partial update for a Connection. Only the supplied fields are modified. `connection_type` is intentionally excluded — changing it would orphan every identity already linked to this connection."
-        },
+        "description": "Get Connection",
         "parameters": [
           {
             "schema": {
@@ -14588,7 +14361,7 @@
             }
           },
           "400": {
-            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -14603,7 +14376,7 @@
                           "type": "string",
                           "enum": [
                             "invalid_id",
-                            "already_exists",
+                            "invalid_expand",
                             "validation_error"
                           ]
                         }
@@ -14744,13 +14517,620 @@
           }
         }
       },
-      "delete": {
-        "operationId": "connection/delete",
-        "summary": "Delete Connection",
+      "post": {
+        "operationId": "connection/update",
+        "summary": "Update Connection",
         "tags": [
           "connection"
         ],
-        "description": "Delete Connection",
+        "description": "Update Connection",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "connection_name": {
+                    "type": "string"
+                  },
+                  "enabled": {
+                    "type": "boolean"
+                  },
+                  "enabled_clients": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "scope": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "client_id": {
+                    "type": "string"
+                  },
+                  "client_secret": {
+                    "type": "string"
+                  },
+                  "issuer": {
+                    "type": "string"
+                  },
+                  "authorize_url": {
+                    "type": "string"
+                  },
+                  "token_url": {
+                    "type": "string"
+                  },
+                  "userinfo_url": {
+                    "type": "string"
+                  },
+                  "jwks_url": {
+                    "type": "string"
+                  },
+                  "response_type": {
+                    "type": "string"
+                  },
+                  "authorize_params": {
+                    "type": "object",
+                    "description": "Authorize params",
+                    "default": {},
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  },
+                  "claims_mapping": {
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  },
+                  "email_oauth_sync_policy": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "preserve_manual"
+                        ]
+                      },
+                      {
+                        "type": "string",
+                        "enum": [
+                          "always_sync"
+                        ]
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "password_policy": {
+                    "anyOf": [
+                      {
+                        "type": "object",
+                        "required": [
+                          "level"
+                        ],
+                        "properties": {
+                          "level": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "none"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "low"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "fair"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "good"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "excellent"
+                                ]
+                              }
+                            ]
+                          },
+                          "min_length": {
+                            "type": "integer",
+                            "minimum": 1,
+                            "maximum": 128
+                          },
+                          "require_lowercase": {
+                            "type": "boolean"
+                          },
+                          "require_uppercase": {
+                            "type": "boolean"
+                          },
+                          "require_number": {
+                            "type": "boolean"
+                          },
+                          "require_special": {
+                            "type": "boolean"
+                          }
+                        },
+                        "description": "Password policy enforced when writing a password through this database connection (password reset and admin set-password). `level` is an Auth0-style preset (none/low/fair/good/excellent); the dashboard expands it into the explicit rule fields when saving. The rule fields override the preset baseline. When unset on the connection, the server applies the `good` default. Does not affect login."
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "disable_signup": {
+                    "type": "boolean"
+                  },
+                  "login_identifier": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "enum": [
+                          "email"
+                        ]
+                      },
+                      {
+                        "type": "string",
+                        "enum": [
+                          "username"
+                        ]
+                      },
+                      {
+                        "type": "string",
+                        "enum": [
+                          "email_or_username"
+                        ]
+                      }
+                    ],
+                    "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
+                  }
+                },
+                "description": "Partial update for a Connection. Only the supplied fields are modified. `connection_type` is intentionally excluded — changing it would orphan every identity already linked to this connection.",
+                "additionalProperties": false
+              }
+            }
+          },
+          "description": "Partial update for a Connection. Only the supplied fields are modified. `connection_type` is intentionally excluded — changing it would orphan every identity already linked to this connection."
+        },
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "connection_id",
+            "required": true
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Connection",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "connection_name",
+                    "connection_type",
+                    "authorize_url",
+                    "token_url",
+                    "userinfo_url",
+                    "client_id",
+                    "client_secret",
+                    "issuer",
+                    "jwks_url",
+                    "response_type",
+                    "enabled",
+                    "enabled_clients",
+                    "scope",
+                    "authorize_params",
+                    "is_using_default_credentials",
+                    "account",
+                    "createdAt"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string",
+                      "description": "Connection ID"
+                    },
+                    "connection_name": {
+                      "type": "string"
+                    },
+                    "connection_type": {
+                      "enum": [
+                        "database",
+                        "custom",
+                        "github",
+                        "figma",
+                        "google_oauth2",
+                        "microsoft",
+                        "oidc",
+                        "passwordless_email"
+                      ]
+                    },
+                    "authorize_url": {
+                      "type": "string",
+                      "default": null
+                    },
+                    "token_url": {
+                      "type": "string",
+                      "default": null
+                    },
+                    "userinfo_url": {
+                      "type": "string",
+                      "default": null
+                    },
+                    "client_id": {
+                      "type": "string",
+                      "default": null
+                    },
+                    "client_secret": {
+                      "type": "string",
+                      "default": null
+                    },
+                    "issuer": {
+                      "type": "string",
+                      "default": null
+                    },
+                    "jwks_url": {
+                      "type": "string",
+                      "default": null
+                    },
+                    "response_type": {
+                      "type": "string",
+                      "default": null
+                    },
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "enabled_clients": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "default": null,
+                      "nullable": true
+                    },
+                    "scope": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "default": []
+                    },
+                    "authorize_params": {
+                      "type": "object",
+                      "description": "Authorize params",
+                      "default": {},
+                      "additionalProperties": {
+                        "type": "string"
+                      }
+                    },
+                    "claims_mapping": {
+                      "type": "object",
+                      "additionalProperties": {
+                        "type": "string"
+                      }
+                    },
+                    "is_using_default_credentials": {
+                      "type": "boolean",
+                      "readOnly": true,
+                      "description": "Derived: true when the connection_type has shared Faable defaults AND the tenant has not set its own client_id/client_secret. Read-only — set by the server on every read."
+                    },
+                    "email_oauth_sync_policy": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "enum": [
+                            "preserve_manual"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "always_sync"
+                          ]
+                        }
+                      ],
+                      "description": "Per-connection override of `Account.email_oauth_sync_policy`. When set on a Connection, takes precedence over the Account-level setting for logins through this IdP. When unset (default), the Account-level policy applies. Use this to allow `always_sync` for a trusted IdP (e.g. corporate SSO) while keeping `preserve_manual` for others within the same tenant."
+                    },
+                    "password_policy": {
+                      "type": "object",
+                      "required": [
+                        "level"
+                      ],
+                      "properties": {
+                        "level": {
+                          "anyOf": [
+                            {
+                              "type": "string",
+                              "enum": [
+                                "none"
+                              ]
+                            },
+                            {
+                              "type": "string",
+                              "enum": [
+                                "low"
+                              ]
+                            },
+                            {
+                              "type": "string",
+                              "enum": [
+                                "fair"
+                              ]
+                            },
+                            {
+                              "type": "string",
+                              "enum": [
+                                "good"
+                              ]
+                            },
+                            {
+                              "type": "string",
+                              "enum": [
+                                "excellent"
+                              ]
+                            }
+                          ]
+                        },
+                        "min_length": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 128
+                        },
+                        "require_lowercase": {
+                          "type": "boolean"
+                        },
+                        "require_uppercase": {
+                          "type": "boolean"
+                        },
+                        "require_number": {
+                          "type": "boolean"
+                        },
+                        "require_special": {
+                          "type": "boolean"
+                        }
+                      },
+                      "description": "Password policy enforced when writing a password through this database connection (password reset and admin set-password). `level` is an Auth0-style preset (none/low/fair/good/excellent); the dashboard expands it into the explicit rule fields when saving. The rule fields override the preset baseline. When unset on the connection, the server applies the `good` default. Does not affect login."
+                    },
+                    "login_identifier": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "enum": [
+                            "email"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "username"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "email_or_username"
+                          ]
+                        }
+                      ],
+                      "description": "What users of this database connection sign in with: `email`, `username`, or `email_or_username` (email first, then username). The login looks up only the matching field, and the hosted login screen asks for it — validating the address format under `email`. New database connections default to `email`; a connection created before this setting existed behaves as `email_or_username`. Only meaningful on `database` connections."
+                    },
+                    "disable_signup": {
+                      "type": "boolean",
+                      "description": "When true, the public self-service signup endpoint (`POST /dbconnections/signup`) rejects new registrations against this database connection with `403 signup_disabled`. Defaults to false (signup allowed). Only meaningful on `database` connections; mirrors Auth0 `disable_signup`."
+                    },
+                    "account": {
+                      "type": "string",
+                      "description": "Object is related with this account"
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": true,
+                      "description": "ConnectionMetadata",
+                      "default": {}
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "Connection creation date"
+                    },
+                    "updatedAt": {
+                      "type": "string",
+                      "description": "Connection updated date"
+                    }
+                  },
+                  "description": "Connection"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_id",
+                            "already_exists",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "not_found",
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      },
+      "delete": {
+        "operationId": "connection/delete",
+        "summary": "Delete Connection",
+        "tags": [
+          "connection"
+        ],
+        "description": "Delete Connection",
         "parameters": [
           {
             "schema": {
@@ -48290,14 +48670,765 @@
                       },
                       "description": "NotificationSubscriptionWebhook"
                     }
-                  ],
-                  "description": "NotificationSubscription"
+                  ],
+                  "description": "NotificationSubscription"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_id",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "not_found",
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/log": {
+      "get": {
+        "operationId": "log/list",
+        "summary": "List Logs",
+        "tags": [
+          "log"
+        ],
+        "description": "List Logs",
+        "parameters": [
+          {
+            "schema": {
+              "type": "number",
+              "minimum": 1,
+              "maximum": 200
+            },
+            "in": "query",
+            "name": "pageSize",
+            "required": false,
+            "description": "Number of items per page (max 200)"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "cursor",
+            "required": false,
+            "description": "Cursor for next page"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "next",
+            "required": false,
+            "description": "Cursor returned by the previous page"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "type",
+            "required": false,
+            "description": "Exact match on `type`. Equivalent to `?query=type:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "status",
+            "required": false,
+            "description": "Exact match on `status`. Equivalent to `?query=status:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "origin",
+            "required": false,
+            "description": "Exact match on `origin`. Equivalent to `?query=origin:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "action",
+            "required": false,
+            "description": "Exact match on `action`. Equivalent to `?query=action:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "user",
+            "required": false,
+            "description": "Exact match on `user`. Equivalent to `?query=user:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "client",
+            "required": false,
+            "description": "Exact match on `client`. Equivalent to `?query=client:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "connection",
+            "required": false,
+            "description": "Exact match on `connection`. Equivalent to `?query=connection:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "team",
+            "required": false,
+            "description": "Exact match on `team`. Equivalent to `?query=team:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "identity",
+            "required": false,
+            "description": "Exact match on `identity`. Equivalent to `?query=identity:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "ticket",
+            "required": false,
+            "description": "Exact match on `ticket`. Equivalent to `?query=ticket:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "since",
+            "required": false,
+            "description": "Exact match on `since`. Equivalent to `?query=since:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "until",
+            "required": false,
+            "description": "Exact match on `until`. Equivalent to `?query=until:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "expires_before",
+            "required": false,
+            "description": "Exact match on `expires_before`. Equivalent to `?query=expires_before:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "expires_after",
+            "required": false,
+            "description": "Exact match on `expires_after`. Equivalent to `?query=expires_after:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "query",
+            "required": false,
+            "description": "Filter using a FaableQL query"
+          },
+          {
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "enum": [
+                  "user",
+                  "client",
+                  "connection",
+                  "team",
+                  "identity"
+                ],
+                "description": "Allowed expand paths on `log`: `user`, `client`, `connection`, `team`, `identity`."
+              },
+              "maxItems": 5
+            },
+            "in": "query",
+            "name": "expand",
+            "required": false,
+            "description": "Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`)."
+          },
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 200
+            },
+            "in": "query",
+            "name": "q",
+            "required": false,
+            "description": "Full-text search across: `message`."
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "next",
+                    "results"
+                  ],
+                  "properties": {
+                    "next": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "results": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Log"
+                      }
+                    }
+                  },
+                  "additionalProperties": false
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_query` — The `?query=` FaableQL expression could not be parsed.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`search_not_supported` — This resource does not support `?search=`.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_query",
+                            "invalid_expand",
+                            "search_not_supported",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/log/{log_id}": {
+      "get": {
+        "operationId": "log/get",
+        "summary": "Get Log",
+        "tags": [
+          "log"
+        ],
+        "description": "Get Log",
+        "parameters": [
+          {
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "enum": [
+                  "user",
+                  "client",
+                  "connection",
+                  "team",
+                  "identity"
+                ],
+                "description": "Allowed expand paths on `log`: `user`, `client`, `connection`, `team`, `identity`."
+              },
+              "maxItems": 5
+            },
+            "in": "query",
+            "name": "expand",
+            "required": false,
+            "description": "Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`)."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "log_id",
+            "required": true
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Log",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "type",
+                    "status",
+                    "account",
+                    "createdAt"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string",
+                      "description": "Log ID"
+                    },
+                    "type": {
+                      "type": "string",
+                      "description": "Log type, e.g. email.user.created"
+                    },
+                    "status": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "enum": [
+                            "success"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "failed"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "skipped"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "info"
+                          ]
+                        }
+                      ],
+                      "description": "Log status"
+                    },
+                    "message": {
+                      "type": "string",
+                      "description": "Optional log message"
+                    },
+                    "data": {
+                      "description": "Type-specific structured payload"
+                    },
+                    "user": {
+                      "anyOf": [
+                        {
+                          "$ref": "#/components/schemas/User"
+                        },
+                        {
+                          "type": "string"
+                        },
+                        {}
+                      ]
+                    },
+                    "client": {
+                      "anyOf": [
+                        {
+                          "$ref": "#/components/schemas/Client"
+                        },
+                        {
+                          "type": "string"
+                        },
+                        {}
+                      ]
+                    },
+                    "connection": {
+                      "anyOf": [
+                        {
+                          "$ref": "#/components/schemas/Connection"
+                        },
+                        {
+                          "type": "string"
+                        },
+                        {}
+                      ]
+                    },
+                    "team": {
+                      "anyOf": [
+                        {
+                          "$ref": "#/components/schemas/Team"
+                        },
+                        {
+                          "type": "string"
+                        },
+                        {}
+                      ]
+                    },
+                    "identity": {
+                      "anyOf": [
+                        {
+                          "$ref": "#/components/schemas/Identity"
+                        },
+                        {
+                          "type": "string"
+                        },
+                        {}
+                      ]
+                    },
+                    "ticket": {
+                      "type": "string"
+                    },
+                    "expires_at": {
+                      "type": "string",
+                      "format": "date-time",
+                      "description": "When this log row will be auto-deleted by the Mongo TTL monitor. Absent on rows recorded without `ttl_seconds`."
+                    },
+                    "account": {
+                      "type": "string",
+                      "description": "Object is related with this account"
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": true,
+                      "description": "LogMetadata",
+                      "default": {}
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "Log creation date"
+                    },
+                    "updatedAt": {
+                      "type": "string",
+                      "description": "Log updated date"
+                    }
+                  },
+                  "description": "Log"
                 }
               }
             }
           },
           "400": {
-            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -48312,6 +49443,7 @@
                           "type": "string",
                           "enum": [
                             "invalid_id",
+                            "invalid_expand",
                             "validation_error"
                           ]
                         }
@@ -48453,14 +49585,14 @@
         }
       }
     },
-    "/log": {
+    "/session": {
       "get": {
-        "operationId": "log/list",
-        "summary": "List Logs",
+        "operationId": "session/list",
+        "summary": "List Sessions",
         "tags": [
-          "log"
+          "session"
         ],
-        "description": "List Logs",
+        "description": "List Sessions",
         "parameters": [
           {
             "schema": {
@@ -48491,42 +49623,6 @@
             "required": false,
             "description": "Cursor returned by the previous page"
           },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "type",
-            "required": false,
-            "description": "Exact match on `type`. Equivalent to `?query=type:<value>`."
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "status",
-            "required": false,
-            "description": "Exact match on `status`. Equivalent to `?query=status:<value>`."
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "origin",
-            "required": false,
-            "description": "Exact match on `origin`. Equivalent to `?query=origin:<value>`."
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "action",
-            "required": false,
-            "description": "Exact match on `action`. Equivalent to `?query=action:<value>`."
-          },
           {
             "schema": {
               "type": "string"
@@ -48559,27 +49655,18 @@
               "type": "string"
             },
             "in": "query",
-            "name": "team",
-            "required": false,
-            "description": "Exact match on `team`. Equivalent to `?query=team:<value>`."
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "identity",
+            "name": "status",
             "required": false,
-            "description": "Exact match on `identity`. Equivalent to `?query=identity:<value>`."
+            "description": "Exact match on `status`. Equivalent to `?query=status:<value>`."
           },
           {
             "schema": {
               "type": "string"
             },
             "in": "query",
-            "name": "ticket",
+            "name": "sid",
             "required": false,
-            "description": "Exact match on `ticket`. Equivalent to `?query=ticket:<value>`."
+            "description": "Exact match on `sid`. Equivalent to `?query=sid:<value>`."
           },
           {
             "schema": {
@@ -48599,24 +49686,6 @@
             "required": false,
             "description": "Exact match on `until`. Equivalent to `?query=until:<value>`."
           },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "expires_before",
-            "required": false,
-            "description": "Exact match on `expires_before`. Equivalent to `?query=expires_before:<value>`."
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "expires_after",
-            "required": false,
-            "description": "Exact match on `expires_after`. Equivalent to `?query=expires_after:<value>`."
-          },
           {
             "schema": {
               "type": "string"
@@ -48634,29 +49703,16 @@
                 "enum": [
                   "user",
                   "client",
-                  "connection",
-                  "team",
-                  "identity"
+                  "connection"
                 ],
-                "description": "Allowed expand paths on `log`: `user`, `client`, `connection`, `team`, `identity`."
+                "description": "Allowed expand paths on `session`: `user`, `client`, `connection`."
               },
-              "maxItems": 5
+              "maxItems": 3
             },
             "in": "query",
             "name": "expand",
             "required": false,
             "description": "Expand id-only fields in the response. Pass one path per entry (e.g. `?expand=user`)."
-          },
-          {
-            "schema": {
-              "type": "string",
-              "minLength": 1,
-              "maxLength": 200
-            },
-            "in": "query",
-            "name": "q",
-            "required": false,
-            "description": "Full-text search across: `message`."
           }
         ],
         "security": [
@@ -48689,7 +49745,7 @@
                     "results": {
                       "type": "array",
                       "items": {
-                        "$ref": "#/components/schemas/Log"
+                        "$ref": "#/components/schemas/Session"
                       }
                     }
                   },
@@ -48856,14 +49912,14 @@
         }
       }
     },
-    "/log/{log_id}": {
+    "/session/{session_id}": {
       "get": {
-        "operationId": "log/get",
-        "summary": "Get Log",
+        "operationId": "session/get",
+        "summary": "Get Session",
         "tags": [
-          "log"
+          "session"
         ],
-        "description": "Get Log",
+        "description": "Get Session",
         "parameters": [
           {
             "schema": {
@@ -48873,13 +49929,11 @@
                 "enum": [
                   "user",
                   "client",
-                  "connection",
-                  "team",
-                  "identity"
+                  "connection"
                 ],
-                "description": "Allowed expand paths on `log`: `user`, `client`, `connection`, `team`, `identity`."
+                "description": "Allowed expand paths on `session`: `user`, `client`, `connection`."
               },
-              "maxItems": 5
+              "maxItems": 3
             },
             "in": "query",
             "name": "expand",
@@ -48891,7 +49945,7 @@
               "type": "string"
             },
             "in": "path",
-            "name": "log_id",
+            "name": "session_id",
             "required": true
           }
         ],
@@ -48902,67 +49956,70 @@
         ],
         "responses": {
           "200": {
-            "description": "Log",
+            "description": "Session",
             "content": {
               "application/json": {
                 "schema": {
                   "type": "object",
                   "required": [
                     "id",
-                    "type",
+                    "user",
+                    "sid",
                     "status",
+                    "last_seen_at",
+                    "expires_at",
                     "account",
                     "createdAt"
                   ],
                   "properties": {
                     "id": {
                       "type": "string",
-                      "description": "Log ID"
-                    },
-                    "type": {
-                      "type": "string",
-                      "description": "Log type, e.g. email.user.created"
+                      "description": "Session ID"
                     },
-                    "status": {
+                    "user": {
                       "anyOf": [
                         {
-                          "type": "string",
-                          "enum": [
-                            "success"
-                          ]
+                          "$ref": "#/components/schemas/User"
                         },
                         {
-                          "type": "string",
-                          "enum": [
-                            "failed"
-                          ]
+                          "type": "string"
                         },
+                        {}
+                      ]
+                    },
+                    "sid": {
+                      "type": "string",
+                      "description": "OIDC session id. Every id_token minted for this session carries it as the `sid` claim; a back-channel or front-channel logout names the session with it."
+                    },
+                    "status": {
+                      "anyOf": [
                         {
                           "type": "string",
                           "enum": [
-                            "skipped"
+                            "active"
                           ]
                         },
                         {
                           "type": "string",
                           "enum": [
-                            "info"
+                            "revoked"
                           ]
                         }
                       ],
-                      "description": "Log status"
+                      "description": "`active` or `revoked`. An active session whose `expires_at` is in the past has expired: nothing can refresh it any more, but the row stays for the history."
                     },
-                    "message": {
+                    "ip": {
                       "type": "string",
-                      "description": "Optional log message"
+                      "description": "Client IP at the last authentication."
                     },
-                    "data": {
-                      "description": "Type-specific structured payload"
+                    "user_agent": {
+                      "type": "string",
+                      "description": "Raw `User-Agent` header at the last authentication."
                     },
-                    "user": {
+                    "client": {
                       "anyOf": [
                         {
-                          "$ref": "#/components/schemas/User"
+                          "$ref": "#/components/schemas/Client"
                         },
                         {
                           "type": "string"
@@ -48970,10 +50027,10 @@
                         {}
                       ]
                     },
-                    "client": {
+                    "connection": {
                       "anyOf": [
                         {
-                          "$ref": "#/components/schemas/Client"
+                          "$ref": "#/components/schemas/Connection"
                         },
                         {
                           "type": "string"
@@ -48981,10 +50038,279 @@
                         {}
                       ]
                     },
-                    "connection": {
+                    "issuer": {
+                      "type": "string",
+                      "description": "Issuer URL the session was minted on."
+                    },
+                    "last_seen_at": {
+                      "type": "string",
+                      "format": "date-time",
+                      "description": "Last authentication or token refresh through this session. Each refresh slides `expires_at` 30 days from here."
+                    },
+                    "expires_at": {
+                      "type": "string",
+                      "format": "date-time",
+                      "description": "When the session stops being usable unless something refreshes it first."
+                    },
+                    "revoked_at": {
+                      "type": "string",
+                      "format": "date-time"
+                    },
+                    "revoked_reason": {
                       "anyOf": [
                         {
-                          "$ref": "#/components/schemas/Connection"
+                          "type": "string",
+                          "enum": [
+                            "admin"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "logout"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "user"
+                          ]
+                        }
+                      ],
+                      "description": "`admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device."
+                    },
+                    "account": {
+                      "type": "string",
+                      "description": "Object is related with this account"
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": true,
+                      "description": "SessionMetadata",
+                      "default": {}
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "Session creation date"
+                    },
+                    "updatedAt": {
+                      "type": "string",
+                      "description": "Session updated date"
+                    }
+                  },
+                  "description": "Session"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "invalid_id",
+                            "invalid_expand",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`not_found` — The resource does not exist in this account.\n\n`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "not_found",
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/session/{session_id}/revoke": {
+      "post": {
+        "operationId": "session/revoke",
+        "summary": "Revoke a session",
+        "tags": [
+          "session"
+        ],
+        "description": "Ends the session for good: the browser cookie behind it stops working, every refresh token issued through it is refused on its next use (`invalid_grant`), and the relying parties that took part in it are notified. Access and id tokens already issued keep working until they expire. The row stays, marked `revoked`, for the device history.",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "path",
+            "name": "session_id",
+            "required": true
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Session",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "user",
+                    "sid",
+                    "status",
+                    "last_seen_at",
+                    "expires_at",
+                    "account",
+                    "createdAt"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string",
+                      "description": "Session ID"
+                    },
+                    "user": {
+                      "anyOf": [
+                        {
+                          "$ref": "#/components/schemas/User"
                         },
                         {
                           "type": "string"
@@ -48992,10 +50318,39 @@
                         {}
                       ]
                     },
-                    "team": {
+                    "sid": {
+                      "type": "string",
+                      "description": "OIDC session id. Every id_token minted for this session carries it as the `sid` claim; a back-channel or front-channel logout names the session with it."
+                    },
+                    "status": {
                       "anyOf": [
                         {
-                          "$ref": "#/components/schemas/Team"
+                          "type": "string",
+                          "enum": [
+                            "active"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "revoked"
+                          ]
+                        }
+                      ],
+                      "description": "`active` or `revoked`. An active session whose `expires_at` is in the past has expired: nothing can refresh it any more, but the row stays for the history."
+                    },
+                    "ip": {
+                      "type": "string",
+                      "description": "Client IP at the last authentication."
+                    },
+                    "user_agent": {
+                      "type": "string",
+                      "description": "Raw `User-Agent` header at the last authentication."
+                    },
+                    "client": {
+                      "anyOf": [
+                        {
+                          "$ref": "#/components/schemas/Client"
                         },
                         {
                           "type": "string"
@@ -49003,10 +50358,10 @@
                         {}
                       ]
                     },
-                    "identity": {
+                    "connection": {
                       "anyOf": [
                         {
-                          "$ref": "#/components/schemas/Identity"
+                          "$ref": "#/components/schemas/Connection"
                         },
                         {
                           "type": "string"
@@ -49014,13 +50369,46 @@
                         {}
                       ]
                     },
-                    "ticket": {
-                      "type": "string"
+                    "issuer": {
+                      "type": "string",
+                      "description": "Issuer URL the session was minted on."
+                    },
+                    "last_seen_at": {
+                      "type": "string",
+                      "format": "date-time",
+                      "description": "Last authentication or token refresh through this session. Each refresh slides `expires_at` 30 days from here."
                     },
                     "expires_at": {
                       "type": "string",
                       "format": "date-time",
-                      "description": "When this log row will be auto-deleted by the Mongo TTL monitor. Absent on rows recorded without `ttl_seconds`."
+                      "description": "When the session stops being usable unless something refreshes it first."
+                    },
+                    "revoked_at": {
+                      "type": "string",
+                      "format": "date-time"
+                    },
+                    "revoked_reason": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "enum": [
+                            "admin"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "logout"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "user"
+                          ]
+                        }
+                      ],
+                      "description": "`admin`: revoked through the Management API. `logout`: the user signed out. `user`: the user revoked it from another device."
                     },
                     "account": {
                       "type": "string",
@@ -49030,25 +50418,25 @@
                       "type": "object",
                       "properties": {},
                       "additionalProperties": true,
-                      "description": "LogMetadata",
+                      "description": "SessionMetadata",
                       "default": {}
                     },
                     "createdAt": {
                       "type": "string",
-                      "description": "Log creation date"
+                      "description": "Session creation date"
                     },
                     "updatedAt": {
                       "type": "string",
-                      "description": "Log updated date"
+                      "description": "Session updated date"
                     }
                   },
-                  "description": "Log"
+                  "description": "Session"
                 }
               }
             }
           },
           "400": {
-            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -49062,8 +50450,6 @@
                         "error_code": {
                           "type": "string",
                           "enum": [
-                            "invalid_id",
-                            "invalid_expand",
                             "validation_error"
                           ]
                         }
@@ -49152,6 +50538,31 @@
               }
             }
           },
+          "409": {
+            "description": "`session_already_revoked` — The session was already revoked.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "session_already_revoked"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
           "429": {
             "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
             "content": {
@@ -55718,6 +57129,284 @@
         }
       }
     },
+    "/me/sessions": {
+      "get": {
+        "operationId": "session/meSessions",
+        "summary": "List the current user's active sessions",
+        "tags": [
+          "session"
+        ],
+        "description": "Every active session of the user behind the request (cookie or bearer), newest first; `current_session_id` names the one this request came through.",
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "results",
+                    "current_session_id"
+                  ],
+                  "properties": {
+                    "results": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Session"
+                      }
+                    },
+                    "current_session_id": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "The id of the session this request came through: the cookie, or the session the bearer token was issued in. Null when the token predates session ids."
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`mfa_pending` — A second-factor challenge is pending; answer it before continuing.\n\n`not_logged_in` — There is no signed-in session for this request.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "mfa_pending",
+                            "not_logged_in"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/me/sessions/revoke-others": {
+      "post": {
+        "operationId": "session/meRevokeOtherSessions",
+        "summary": "Sign the current user out everywhere else",
+        "tags": [
+          "session"
+        ],
+        "description": "Revokes every active session of the user except the one this request came through. Refresh tokens issued in the revoked sessions are refused on their next use; access and id tokens already issued keep working until they expire.",
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "revoked"
+                  ],
+                  "properties": {
+                    "revoked": {
+                      "type": "number",
+                      "description": "How many sessions were ended."
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`mfa_pending` — A second-factor challenge is pending; answer it before continuing.\n\n`not_logged_in` — There is no signed-in session for this request.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "mfa_pending",
+                            "not_logged_in"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/logout": {
       "get": {
         "operationId": "session/logout",