@faable/auth-sdk 2.7.51 → 2.7.53

package/spec/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "@faablecloud/auth",
     "description": "Auth Platform made by Faable. Manage Users and Roles",
-    "version": "2.47.2",
+    "version": "2.48.0",
     "license": {
       "name": "private",
       "url": "https://faable.com/docs/platform/privacy-policy"
@@ -148,6 +148,17 @@
             "description": "Reply-To on every email this tenant sends to its users. Absent = no Reply-To, so a reply goes to the From address — which is a `no-reply@` mailbox nobody reads. Set it to your own support address if you want your users to be able to answer.",
             "nullable": true
           },
+          "email_from_name": {
+            "type": "string",
+            "maxLength": 100,
+            "description": "Display name on every email this tenant sends to its users. Absent = the account `name`.",
+            "nullable": true
+          },
+          "email_from_address": {
+            "type": "string",
+            "description": "Sender address of every email this tenant sends to its users. Absent = the platform default. Set by Faable only.",
+            "nullable": true
+          },
           "welcome_email": {
             "type": "object",
             "properties": {
@@ -6718,6 +6729,33 @@
           }
         }
       },
+      "AccountEmailSenderParams": {
+        "type": "object",
+        "required": [
+          "account_id"
+        ],
+        "properties": {
+          "account_id": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "AccountEmailSenderBody": {
+        "type": "object",
+        "required": [
+          "address"
+        ],
+        "properties": {
+          "address": {
+            "type": "string",
+            "format": "email",
+            "maxLength": 320,
+            "nullable": true
+          }
+        },
+        "additionalProperties": false
+      },
       "AuthAccountUpdate": {
         "type": "object",
         "properties": {
@@ -6779,6 +6817,12 @@
             "maxLength": 320,
             "nullable": true
           },
+          "email_from_name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 100,
+            "nullable": true
+          },
           "welcome_email": {
             "anyOf": [
               {
@@ -7458,7 +7502,7 @@
       },
       "ErrorCode": {
         "type": "string",
-        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (401): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `invalid_canonical_host` (400): `canonical_host` must be this account's own platform host or one of its verified custom domains.\n- `canonical_host_breaks_passkeys` (400): `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `session_already_revoked` (409): The session was already revoked.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `invalid_email` (400): The email address is not valid.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): Dynamic client registration rejected a field (RFC 7591). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `no_database_connection` (400): The tenant has no database connection, so there is nowhere to store a password. Create one and retry.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.",
+        "description": "Machine-readable error code. One HTTP status per code.\n\n- `bad_request` (400): The request is malformed. `message` says what is wrong.\n- `validation_error` (400): The body, query or path failed schema validation. `details.issues` lists each failing field.\n- `unauthorized` (401): The request carries no valid credentials.\n- `payment_required` (402): The feature is not included in the current plan.\n- `forbidden` (403): The credentials are valid but do not allow this operation.\n- `not_found` (404): The resource does not exist in this account.\n- `method_not_allowed` (405): The HTTP method is not supported on this path.\n- `conflict` (409): The request conflicts with the current state of the resource.\n- `payload_too_large` (413): The request body exceeds the size limit.\n- `unsupported_media_type` (415): The `Content-Type` is not accepted by this endpoint.\n- `unprocessable_entity` (422): The request is well-formed but cannot be processed.\n- `too_many_requests` (429): Rate limit exceeded. Honour the `Retry-After` header.\n- `internal_error` (500): Unexpected server error. Retry later; the request id is logged.\n- `already_exists` (400): A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n- `invalid_id` (400): The id in the path is not a valid id for this resource.\n- `account_not_found` (404): No Auth Account matches the request (domain, header or token).\n- `invalid_query` (400): The `?query=` FaableQL expression could not be parsed.\n- `search_not_supported` (400): This resource does not support `?search=`.\n- `invalid_expand` (400): An `?expand=` path is not allowed on this resource.\n- `access_denied` (401): The caller may not access this row (ownership or machine-to-machine restriction).\n- `insufficient_scope` (403): The token lacks a scope this operation requires. `message` names it.\n- `team_required` (400): An Auth Account must belong to a project (team).\n- `account_limit_reached` (409): The project already has the maximum number of Auth Accounts.\n- `invalid_project_id` (400): The project id is not of the form `project_<hex>` or `team_<hex>`.\n- `account_transfer_refused` (409): The Auth Account cannot be moved to that project. `details.blockers` lists why.\n- `email_sender_domain_not_allowed` (400): The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).\n- `plan_required` (402): The setting requires a higher plan. `message` says which.\n- `invalid_canonical_host` (400): `canonical_host` must be this account's own platform host or one of its verified custom domains.\n- `canonical_host_breaks_passkeys` (400): `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.\n- `not_logged_in` (401): There is no signed-in session for this request.\n- `session_already_revoked` (409): The session was already revoked.\n- `invalid_token` (401): The bearer token is missing, malformed, expired or has no subject.\n- `not_owner` (403): The caller may only perform this operation on their own user.\n- `user_suspended` (403): The user is suspended and cannot sign in or be modified.\n- `invalid_credentials` (400): The email/username or password is incorrect.\n- `login_denied` (401): A post-login Action denied the sign-in. `message` carries the reason it gave. On token grants it is a 403 with `error: invalid_grant`.\n- `signup_denied` (403): A pre-signup Action or an active block denied the sign-up. `message` carries the reason.\n- `client_credentials_denied` (401): An Action denied the client_credentials grant. `message` carries the reason.\n- `m2m_quota_exceeded` (402): The project used the machine-to-machine tokens its plan includes this month. Free is capped; Hobby and Pro are billed per token instead.\n- `signup_disabled` (403): Self-service sign-up is disabled on this connection.\n- `email_taken` (409): Another user in this account already uses that email.\n- `invalid_email` (400): The email address is not valid.\n- `invalid_name` (400): The name contains a link. `message` says which field.\n- `same_email` (400): The new email is the same as the current one.\n- `user_has_no_email` (400): The operation needs an email but the user has none.\n- `password_too_weak` (400): The password does not meet the connection policy. `message` lists each unmet rule.\n- `invalid_password_hash` (400): The imported password hash cannot be read, or its cost is above what a login can afford. `message` names the field.\n- `weak_password_hash` (400): The imported password hash uses a fast digest (MD5, SHA-1, SHA-2) or a cost below the minimum. `message` says which.\n- `invalid_code` (400): The verification code is wrong, expired or already used.\n- `invalid_phone` (400): The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n- `phone_changed` (400): The phone on the user changed after the code was sent. Start again.\n- `phone_already_verified` (409): The user already has a verified phone; the number cannot be swapped from the screen.\n- `sms_unavailable` (409): This account cannot send SMS right now. The suffix says why: `sms_unavailable:plan`, `:quota`, `:provider`.\n- `sms_failed` (409): The SMS provider rejected the message.\n- `invalid_state` (400): The `state` is missing, expired, or does not describe a resumable step.\n- `state_mismatch` (401): The `state` belongs to another account, session, client or ceremony.\n- `invalid_ticket` (400): The ticket does not exist or is not the kind this endpoint accepts.\n- `ticket_used` (400): The ticket was already consumed.\n- `ticket_expired` (400): The ticket is past its expiry.\n- `ticket_not_found` (404): No ticket with that id belongs to this user.\n- `credential_not_found` (404): The user has no password credential on this connection.\n- `invalid_link` (400): The magic link is malformed.\n- `expired_link` (400): The magic link token was not found or has expired.\n- `invalid_otp` (401): The one-time password is wrong or expired.\n- `invalid_client` (400): The `client_id` in the request does not name a client of this account.\n- `client_not_found` (404): No client with that `client_id`.\n- `client_mismatch` (401): The client belongs to a different account.\n- `invalid_client_metadata` (400): Dynamic client registration rejected a field (RFC 7591). `message` names it.\n- `invalid_connection` (400): The connection does not exist, is disabled, or is not of the type this flow needs.\n- `no_database_connection` (400): The tenant has no database connection, so there is nowhere to store a password. Create one and retry.\n- `connection_required` (400): No connection was given and the client has no `default_connection`.\n- `connection_misconfigured` (400): The connection is missing settings needed to talk to its provider.\n- `passwordless_unavailable` (400): No passwordless connection is configured or enabled for this client.\n- `ambiguous_connection` (400): Several connections match; pass `connection_id`.\n- `invalid_redirect_uri` (400): The redirect URI is not registered for the client.\n- `origin_not_allowed` (403): The request `Origin` is not in the client's Allowed Web Origins.\n- `audience_not_found` (403): The `audience` does not name an API registered in this account.\n- `system_resource` (403): The resource is managed by Faable and cannot be modified or deleted.\n- `invalid_request` (400): A required OAuth parameter is missing or two of them are incompatible. `message` says which.\n- `invalid_device_code` (400): The device or user code is invalid or expired.\n- `provider_error` (400): The upstream identity provider returned an error. The suffix is the provider’s own code, when it sent one: `provider_error:bad_refresh_token` (the user must re-authorize), `provider_error:incorrect_client_credentials` (our configuration, the user can do nothing). `details.provider_error_description` carries the provider’s sentence.\n- `identity_already_linked` (409): That external identity is already linked to another user.\n- `identity_link_denied` (409): That external identity cannot be linked to this user.\n- `identity_conflict` (409): The user already has a linked identity for this connection.\n- `identity_orphaned` (400): The identity pointed at a user that no longer exists; it was removed. Sign in again.\n- `no_provider_token` (400): The identity holds no provider access token.\n- `no_refresh_token` (400): The identity holds no provider refresh token, so it cannot be refreshed.\n- `action_unavailable` (401): The Action that paused this login is disabled or belongs elsewhere.\n- `login_flow_misconfigured` (500): The login flow of this account cannot run. `message` carries the node error.\n- `mfa_required` (403): The login needs a second factor that this flow cannot collect, or one is still pending on the session.\n- `step_up_required` (403): Confirm an existing factor before changing your factors.\n- `interaction_required` (403): An Action asked for a redirect on a non-interactive flow.\n- `passkey_login_disabled` (400): Sign in with a passkey is not enabled for this client.\n- `mfa_pending` (401): A second-factor challenge is pending; answer it before continuing.\n- `mfa_invalid_code` (401): The authenticator code did not verify.\n- `mfa_invalid_recovery_code` (401): The recovery code did not verify.\n- `too_many_attempts` (429): Too many wrong codes. Wait a few minutes and try again.\n- `too_many_login_attempts` (429): Too many failed sign-in attempts for this email or username from this network. Wait a few minutes and try again.\n- `totp_not_allowed` (401): This account does not accept authenticator apps.\n- `no_usable_factor` (400): The user has no confirmed second factor to challenge.\n- `factor_not_found` (400): No factor with that id belongs to this user.\n- `factor_already_confirmed` (400): The factor was already confirmed.\n- `invalid_factor` (400): The factor cannot be verified (no secret material).\n- `session_missing` (401): The session that started this login no longer exists.\n- `passkey_verification_failed` (400): The WebAuthn response could not be verified.\n- `no_passkey_enrolled` (400): The user has no passkey to sign in with.\n- `malformed_credential` (400): The WebAuthn credential is malformed.\n- `unknown_passkey` (401): The passkey is not enrolled for this user.\n- `invalid_passkey` (401): The passkey assertion did not verify.\n- `invite_not_found` (404): No invite with that id in this account.\n- `invite_used` (400): The invite was already accepted.\n- `already_member` (400): The user is already a member of the team.\n- `not_a_member` (404): The user is not a member of the team.\n- `role_not_found` (404): No role with that id in this account.\n- `invalid_role` (400): The role belongs to another account.\n- `flow_not_found` (400): The login flow does not exist in this account.\n- `revision_not_found` (404): The revision is not in the flow history.",
         "enum": [
           "bad_request",
           "validation_error",
@@ -7485,6 +7529,7 @@
           "account_limit_reached",
           "invalid_project_id",
           "account_transfer_refused",
+          "email_sender_domain_not_allowed",
           "plan_required",
           "invalid_canonical_host",
           "canonical_host_breaks_passkeys",
@@ -7501,6 +7546,7 @@
           "signup_disabled",
           "email_taken",
           "invalid_email",
+          "invalid_name",
           "same_email",
           "user_has_no_email",
           "password_too_weak",
@@ -7843,6 +7889,17 @@
                       "description": "Reply-To on every email this tenant sends to its users. Absent = no Reply-To, so a reply goes to the From address — which is a `no-reply@` mailbox nobody reads. Set it to your own support address if you want your users to be able to answer.",
                       "nullable": true
                     },
+                    "email_from_name": {
+                      "type": "string",
+                      "maxLength": 100,
+                      "description": "Display name on every email this tenant sends to its users. Absent = the account `name`.",
+                      "nullable": true
+                    },
+                    "email_from_address": {
+                      "type": "string",
+                      "description": "Sender address of every email this tenant sends to its users. Absent = the platform default. Set by Faable only.",
+                      "nullable": true
+                    },
                     "welcome_email": {
                       "type": "object",
                       "properties": {
@@ -8553,6 +8610,17 @@
                       "description": "Reply-To on every email this tenant sends to its users. Absent = no Reply-To, so a reply goes to the From address — which is a `no-reply@` mailbox nobody reads. Set it to your own support address if you want your users to be able to answer.",
                       "nullable": true
                     },
+                    "email_from_name": {
+                      "type": "string",
+                      "maxLength": 100,
+                      "description": "Display name on every email this tenant sends to its users. Absent = the account `name`.",
+                      "nullable": true
+                    },
+                    "email_from_address": {
+                      "type": "string",
+                      "description": "Sender address of every email this tenant sends to its users. Absent = the platform default. Set by Faable only.",
+                      "nullable": true
+                    },
                     "welcome_email": {
                       "type": "object",
                       "properties": {
@@ -8923,7 +8991,7 @@
             }
           },
           "400": {
-            "description": "`team_required` — An Auth Account must belong to a project (team).\n\n`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`team_required` — An Auth Account must belong to a project (team).\n\n`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.\n\n`invalid_name` — The name contains a link. `message` says which field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -8939,7 +9007,8 @@
                           "enum": [
                             "team_required",
                             "already_exists",
-                            "validation_error"
+                            "validation_error",
+                            "invalid_name"
                           ]
                         }
                       }
@@ -9499,6 +9568,17 @@
                       "description": "Reply-To on every email this tenant sends to its users. Absent = no Reply-To, so a reply goes to the From address — which is a `no-reply@` mailbox nobody reads. Set it to your own support address if you want your users to be able to answer.",
                       "nullable": true
                     },
+                    "email_from_name": {
+                      "type": "string",
+                      "maxLength": 100,
+                      "description": "Display name on every email this tenant sends to its users. Absent = the account `name`.",
+                      "nullable": true
+                    },
+                    "email_from_address": {
+                      "type": "string",
+                      "description": "Sender address of every email this tenant sends to its users. Absent = the platform default. Set by Faable only.",
+                      "nullable": true
+                    },
                     "welcome_email": {
                       "type": "object",
                       "properties": {
@@ -10097,6 +10177,12 @@
                     "maxLength": 320,
                     "nullable": true
                   },
+                  "email_from_name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 100,
+                    "nullable": true
+                  },
                   "welcome_email": {
                     "anyOf": [
                       {
@@ -10593,6 +10679,17 @@
                       "description": "Reply-To on every email this tenant sends to its users. Absent = no Reply-To, so a reply goes to the From address — which is a `no-reply@` mailbox nobody reads. Set it to your own support address if you want your users to be able to answer.",
                       "nullable": true
                     },
+                    "email_from_name": {
+                      "type": "string",
+                      "maxLength": 100,
+                      "description": "Display name on every email this tenant sends to its users. Absent = the account `name`.",
+                      "nullable": true
+                    },
+                    "email_from_address": {
+                      "type": "string",
+                      "description": "Sender address of every email this tenant sends to its users. Absent = the platform default. Set by Faable only.",
+                      "nullable": true
+                    },
                     "welcome_email": {
                       "type": "object",
                       "properties": {
@@ -10963,7 +11060,7 @@
             }
           },
           "400": {
-            "description": "`invalid_canonical_host` — `canonical_host` must be this account's own platform host or one of its verified custom domains.\n\n`canonical_host_breaks_passkeys` — `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.\n\n`invalid_id` — The id in the path is not a valid id for this resource.\n\n`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "description": "`invalid_canonical_host` — `canonical_host` must be this account's own platform host or one of its verified custom domains.\n\n`canonical_host_breaks_passkeys` — `canonical_host` is outside the account's current WebAuthn RP ID — every passkey already enrolled would stop working. Set `webauthn_rp_id` in the same request to a suffix that covers both.\n\n`invalid_id` — The id in the path is not a valid id for this resource.\n\n`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.\n\n`invalid_name` — The name contains a link. `message` says which field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -10981,7 +11078,8 @@
                             "canonical_host_breaks_passkeys",
                             "invalid_id",
                             "already_exists",
-                            "validation_error"
+                            "validation_error",
+                            "invalid_name"
                           ]
                         }
                       }
@@ -13338,90 +13436,44 @@
         }
       }
     },
-    "/connection": {
-      "get": {
-        "operationId": "connection/list",
-        "summary": "List Connections",
+    "/account/{account_id}/email_sender": {
+      "post": {
+        "operationId": "account/email_sender",
+        "summary": "Set an Account's sender address",
         "tags": [
-          "connection"
+          "account"
         ],
-        "description": "List Connections",
+        "description": "Sets the From address of every email this Auth Account sends to its users. The address must be in a domain the platform signs email for. `null` returns to the platform default. Platform credentials only.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "address"
+                ],
+                "properties": {
+                  "address": {
+                    "type": "string",
+                    "format": "email",
+                    "maxLength": 320,
+                    "nullable": true
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
         "parameters": [
-          {
-            "schema": {
-              "type": "number",
-              "minimum": 1,
-              "maximum": 200
-            },
-            "in": "query",
-            "name": "pageSize",
-            "required": false,
-            "description": "Number of items per page (max 200)"
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "cursor",
-            "required": false,
-            "description": "Cursor for next page"
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "next",
-            "required": false,
-            "description": "Cursor returned by the previous page"
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "connection_type",
-            "required": false,
-            "description": "Exact match on `connection_type`. Equivalent to `?query=connection_type:<value>`."
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "enabled",
-            "required": false,
-            "description": "Exact match on `enabled`. Equivalent to `?query=enabled:<value>`."
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "in": "query",
-            "name": "category",
-            "required": false,
-            "description": "Exact match on `category`. Equivalent to `?query=category:<value>`."
-          },
           {
             "schema": {
               "type": "string"
             },
-            "in": "query",
-            "name": "query",
-            "required": false,
-            "description": "Filter using a FaableQL query"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "minLength": 1,
-              "maxLength": 200
-            },
-            "in": "query",
-            "name": "q",
-            "required": false,
-            "description": "Full-text search across: `connection_name`, `connection_type`."
+            "in": "path",
+            "name": "account_id",
+            "required": true
           }
         ],
         "security": [
@@ -13431,52 +13483,796 @@
         ],
         "responses": {
           "200": {
-            "description": "Default Response",
+            "description": "AuthAccount",
             "content": {
               "application/json": {
                 "schema": {
                   "type": "object",
                   "required": [
-                    "next",
-                    "results"
+                    "id",
+                    "name",
+                    "domain",
+                    "slug",
+                    "callback_hostnames",
+                    "token_signature",
+                    "token_signing_alg",
+                    "enabled_locales",
+                    "notification_settings",
+                    "createdAt"
                   ],
                   "properties": {
-                    "next": {
+                    "id": {
+                      "type": "string",
+                      "description": "AuthAccount ID"
+                    },
+                    "name": {
+                      "type": "string"
+                    },
+                    "domain": {
+                      "type": "string"
+                    },
+                    "slug": {
+                      "type": "string"
+                    },
+                    "logo_src": {
+                      "type": "string",
+                      "nullable": true
+                    },
+                    "icon_src": {
+                      "type": "string",
+                      "nullable": true
+                    },
+                    "callback_hostnames": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    },
+                    "token_signature": {
+                      "type": "string",
+                      "description": "Shared HMAC secret. Used when token_signing_alg is an HS* algorithm; ignored for RS*/ES*/PS*."
+                    },
+                    "token_signing_alg": {
                       "anyOf": [
                         {
-                          "type": "string"
+                          "type": "string",
+                          "enum": [
+                            "RS256"
+                          ]
+                        }
+                      ],
+                      "description": "JWA algorithm used to sign tokens issued by this Account. Today only RS256 is implemented."
+                    },
+                    "default_connection": {
+                      "anyOf": [
+                        {
+                          "$ref": "#/components/schemas/Connection"
                         },
                         {
-                          "type": "null"
-                        }
+                          "type": "string"
+                        },
+                        {}
                       ]
                     },
-                    "results": {
+                    "enabled_locales": {
                       "type": "array",
                       "items": {
-                        "$ref": "#/components/schemas/Connection"
+                        "type": "string"
                       }
-                    }
-                  },
-                  "additionalProperties": false
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "`invalid_query` — The `?query=` FaableQL expression could not be parsed.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`search_not_supported` — This resource does not support `?search=`.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "allOf": [
-                    {
-                      "$ref": "#/components/schemas/ErrorResponse"
                     },
-                    {
-                      "type": "object",
-                      "properties": {
-                        "error_code": {
-                          "type": "string",
+                    "tags": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Free-form labels on the account. The dashboard stores the environment as an `env:<name>` tag (e.g. `env:production`, `env:staging`, `env:test`)."
+                    },
+                    "team": {
+                      "type": "string",
+                      "nullable": true
+                    },
+                    "notification_settings": {
+                      "type": "object",
+                      "required": [
+                        "welcome_email_enabled",
+                        "verify_email_auto_send"
+                      ],
+                      "properties": {
+                        "welcome_email_enabled": {
+                          "type": "boolean",
+                          "description": "Send the built-in welcome email on user.created",
+                          "default": false
+                        },
+                        "verify_email_auto_send": {
+                          "type": "boolean",
+                          "description": "Send a verification email automatically when a user is created with `email_verified=false` and an email address. The link in the email lands on `GET /verify-email?ticket=...` and flips `email_verified=true` with `email_verified_method=verification_flow`. When `false`, verification emails must be requested explicitly via `POST /user/:id/verify-email/start`.",
+                          "default": false
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "email_reply_to": {
+                      "type": "string",
+                      "format": "email",
+                      "maxLength": 320,
+                      "description": "Reply-To on every email this tenant sends to its users. Absent = no Reply-To, so a reply goes to the From address — which is a `no-reply@` mailbox nobody reads. Set it to your own support address if you want your users to be able to answer.",
+                      "nullable": true
+                    },
+                    "email_from_name": {
+                      "type": "string",
+                      "maxLength": 100,
+                      "description": "Display name on every email this tenant sends to its users. Absent = the account `name`.",
+                      "nullable": true
+                    },
+                    "email_from_address": {
+                      "type": "string",
+                      "description": "Sender address of every email this tenant sends to its users. Absent = the platform default. Set by Faable only.",
+                      "nullable": true
+                    },
+                    "welcome_email": {
+                      "type": "object",
+                      "properties": {
+                        "cta_url": {
+                          "type": "string",
+                          "format": "uri",
+                          "maxLength": 500,
+                          "description": "Where the welcome button sends the user. Defaults to `https://<first callback hostname>`. Point it at your app (not your marketing site) so a fresh user lands somewhere useful.",
+                          "nullable": true
+                        },
+                        "body": {
+                          "type": "string",
+                          "maxLength": 600,
+                          "description": "Replaces the default one-line body (\"Your account on … is ready to go.\"). Plain text, sent verbatim in every enabled locale.",
+                          "nullable": true
+                        },
+                        "social_links": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "required": [
+                              "label",
+                              "url"
+                            ],
+                            "properties": {
+                              "label": {
+                                "type": "string",
+                                "minLength": 1,
+                                "maxLength": 40
+                              },
+                              "url": {
+                                "type": "string",
+                                "format": "uri",
+                                "maxLength": 500
+                              }
+                            },
+                            "additionalProperties": false
+                          },
+                          "maxItems": 6,
+                          "description": "Rendered as a \"Follow <account>\" block after the button — GitHub, LinkedIn, X, YouTube… Empty or absent hides the block.",
+                          "nullable": true
+                        }
+                      },
+                      "additionalProperties": false,
+                      "nullable": true
+                    },
+                    "email_change_verification_mode": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "enum": [
+                            "new_only"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "old_and_new"
+                          ]
+                        }
+                      ],
+                      "description": "Policy for the user email-change flow. `new_only` (default) sends a single confirmation link to the new email. `old_and_new` requires the user to also click a link sent to the previous email before the swap takes effect — stricter, useful for tenants with higher-risk users."
+                    },
+                    "email_oauth_sync_policy": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "enum": [
+                            "preserve_manual"
+                          ]
+                        },
+                        {
+                          "type": "string",
+                          "enum": [
+                            "always_sync"
+                          ]
+                        }
+                      ],
+                      "description": "Controls what happens to `user.email` on subsequent OAuth/federated logins when the user previously changed their email manually through this auth server (i.e. `user.email_change_locked_at` is set).\n\n- `preserve_manual` (default): the manually-set email wins. The federated provider's email is ignored on re-sync; `email` and `email_verified` are not touched. The identity link stays valid via `provider_user_id`, so the user can still log in with Google/etc.\n- `always_sync`: the federated provider's email is always written back, overwriting any manual change. Useful for tenants whose source of truth for identity is the IdP (corporate SSO, etc.)."
+                    },
+                    "login_methods": {
+                      "type": "object",
+                      "properties": {
+                        "order": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "description": "Order in which the hosted login screen renders the available methods. Entries are Connection resource ids (`connection_xxx`) or the literal `passkey`. Methods not listed keep the built-in order (passwordless, database, social) after the listed ones; ids that no longer resolve are ignored. Listing an `oidc` connection here is also the only way to surface it on the login screen — see resolveLoginMethods()."
+                        },
+                        "disabled_connections": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "description": "Connection resource ids (`connection_xxx`) this client does NOT offer. Removing a method here is enforced, not cosmetic: the connection disappears from the login screen AND `/authorize?connection=<id>` is refused for this client, the same as a connection whose `enabled_clients` excludes it. Use it to say \"this app does not do Google\"; use `enabled_clients` on the connection itself to say \"that connection is not for this app\". A connection has to pass both."
+                        },
+                        "passkey_login_enabled": {
+                          "type": "boolean",
+                          "description": "Offer passkey (WebAuthn) as a primary login method on the hosted login screen. Defaults to false."
+                        },
+                        "identifier_first": {
+                          "type": "boolean",
+                          "description": "Ask for the email first and only then reveal the methods that apply to it, instead of showing every method up front. Defaults to false."
+                        },
+                        "remember_last_method": {
+                          "type": "boolean",
+                          "description": "Surface the method the returning user chose last time. Defaults to false."
+                        },
+                        "passkey_promotion": {
+                          "anyOf": [
+                            {
+                              "type": "string",
+                              "enum": [
+                                "off"
+                              ]
+                            },
+                            {
+                              "type": "string",
+                              "enum": [
+                                "offer"
+                              ]
+                            }
+                          ],
+                          "description": "Invite users to create a passkey right after a successful login with another method. `offer` shows a hosted screen once per `passkey_promotion_snooze_days`, at most `passkey_promotion_max_prompts` times, to users who have no second factor yet; it never blocks the login. Requires `passkey_login_enabled`. Defaults to `off`."
+                        },
+                        "passkey_promotion_snooze_days": {
+                          "type": "integer",
+                          "minimum": 0,
+                          "maximum": 365,
+                          "description": "Days to wait before offering a passkey again to a user who dismissed it. Defaults to 30."
+                        },
+                        "passkey_promotion_max_prompts": {
+                          "type": "integer",
+                          "minimum": 0,
+                          "maximum": 10,
+                          "description": "How many times a user is offered a passkey over their lifetime. `0` switches the offer off for this tenant without changing `passkey_promotion`. Defaults to 3."
+                        },
+                        "remember_me": {
+                          "anyOf": [
+                            {
+                              "type": "string",
+                              "enum": [
+                                "off"
+                              ]
+                            },
+                            {
+                              "type": "string",
+                              "enum": [
+                                "optional"
+                              ]
+                            }
+                          ],
+                          "description": "Show a \"Remember me on this device\" checkbox on the password and email-code forms. `optional`: unchecked, the session ends when the browser closes; checked, it lasts `remember_me_days`. `off` (the default): no checkbox, every session lasts the built-in 30 days."
+                        },
+                        "remember_me_days": {
+                          "type": "integer",
+                          "minimum": 1,
+                          "maximum": 365,
+                          "description": "How long a session lasts when the user ticked \"Remember me\". Defaults to 30."
+                        }
+                      },
+                      "additionalProperties": false,
+                      "description": "Which login methods the hosted login screen offers and in what order. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so a client can flip one flag without restating the rest. Absent everywhere = built-in defaults."
+                    },
+                    "login_flow": {
+                      "type": "string",
+                      "description": "The login flow bound to this account (`loginflow_xxx`). Absent = the flow compiled from the settings. A Client may bind its own.",
+                      "nullable": true
+                    },
+                    "mfa_policy": {
+                      "type": "object",
+                      "properties": {
+                        "mode": {
+                          "anyOf": [
+                            {
+                              "anyOf": [
+                                {
+                                  "type": "string",
+                                  "enum": [
+                                    "off"
+                                  ]
+                                },
+                                {
+                                  "type": "string",
+                                  "enum": [
+                                    "optional"
+                                  ]
+                                },
+                                {
+                                  "type": "string",
+                                  "enum": [
+                                    "required"
+                                  ]
+                                }
+                              ]
+                            }
+                          ],
+                          "description": "`off` (default) never challenges. `optional` challenges a user who has enrolled a factor, and lets everyone else in. `required` challenges everyone and sends users with no factor through enrolment during login — it never locks anyone out in place."
+                        },
+                        "allowed_factors": {
+                          "type": "array",
+                          "items": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "totp"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "webauthn"
+                                ]
+                              }
+                            ]
+                          },
+                          "description": "Which kinds of second factor satisfy the policy. Empty or unset means all of them. A user whose only factor is of a kind not listed here is treated as having none."
+                        },
+                        "remember_device_days": {
+                          "type": "integer",
+                          "minimum": 0,
+                          "maximum": 365,
+                          "description": "How long a browser that already passed a challenge may skip the next one. 0 (default) challenges every time."
+                        }
+                      },
+                      "additionalProperties": false,
+                      "description": "Second-factor policy. Set on the Account as the tenant default; the same object on a Client overrides it **field by field**, so one app can require MFA without changing the rest."
+                    },
+                    "recovery_channels": {
+                      "type": "object",
+                      "properties": {
+                        "enabled": {
+                          "type": "array",
+                          "items": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "email"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "sms"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "whatsapp"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "factor"
+                                ]
+                              }
+                            ]
+                          },
+                          "description": "Channels the tenant has turned on. `email` is always on regardless of this list: it is what every other channel falls back to. A channel listed here is still offered only if the platform can send it, the plan allows it and the user has a verified destination for it."
+                        },
+                        "default": {
+                          "anyOf": [
+                            {
+                              "anyOf": [
+                                {
+                                  "type": "string",
+                                  "enum": [
+                                    "email"
+                                  ]
+                                },
+                                {
+                                  "type": "string",
+                                  "enum": [
+                                    "sms"
+                                  ]
+                                },
+                                {
+                                  "type": "string",
+                                  "enum": [
+                                    "whatsapp"
+                                  ]
+                                },
+                                {
+                                  "type": "string",
+                                  "enum": [
+                                    "factor"
+                                  ]
+                                }
+                              ]
+                            }
+                          ],
+                          "description": "The channel used when the user is not asked to choose. Falls back to `email` when it is not available for that user."
+                        },
+                        "visible": {
+                          "type": "array",
+                          "items": {
+                            "anyOf": [
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "email"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "sms"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "whatsapp"
+                                ]
+                              },
+                              {
+                                "type": "string",
+                                "enum": [
+                                  "factor"
+                                ]
+                              }
+                            ]
+                          },
+                          "description": "Channels the recovery screen offers the user to pick from, after they enter their identifier. Empty (the default) keeps today's behaviour: the default channel is used silently and the response never reveals whether the account exists. A non-empty list shows a picker with masked destinations — which does reveal that the account exists and which channels it has, the same trade-off Google and Microsoft make. A tenant decision."
+                        }
+                      },
+                      "additionalProperties": false,
+                      "description": "Password-recovery delivery channels. Set on the Account as the tenant default; the same object on a Client overrides it field by field, like `login_methods` and `mfa_policy`."
+                    },
+                    "default_country_iso": {
+                      "type": "string",
+                      "minLength": 2,
+                      "maxLength": 2,
+                      "description": "ISO 3166-1 alpha-2 country assumed for phone numbers written without an international prefix (`636647460` → `+34…` with `ES`). Needed before SMS can reach anyone: most people type their number without a prefix.",
+                      "nullable": true
+                    },
+                    "webauthn_rp_id": {
+                      "type": "string",
+                      "description": "WebAuthn Relying Party ID for this tenant's passkeys. Defaults to the account domain. Set it to a registrable suffix you own (e.g. `acme.com`) when the login screen is served from more than one host — the RP ID is frozen into every credential at registration, so changing it afterwards invalidates every passkey already enrolled.",
+                      "nullable": true
+                    },
+                    "logout_confirm_required": {
+                      "type": "boolean",
+                      "description": "When true, `/logout` asks the End-User to confirm before ending the session unless the request carries a verified `id_token_hint`. Off by default — a plain link to `/logout` is otherwise enough to sign anyone out (logout CSRF)."
+                    },
+                    "canonical_host": {
+                      "type": "string",
+                      "description": "The one host this tenant's OIDC issuer and discovery document are always minted with, regardless of which host actually served the request — must be the account's own platform host or one of its verified custom domains. `/authorize` and `/logout` 302 here from any other host of the tenant. Unset (the default): every URL uses whatever host served the request, as before this field existed. Changing it can invalidate every WebAuthn passkey already enrolled unless `webauthn_rp_id` already covers the new host.",
+                      "nullable": true
+                    },
+                    "createdAt": {
+                      "type": "string",
+                      "description": "AuthAccount creation date"
+                    },
+                    "updatedAt": {
+                      "type": "string",
+                      "description": "AuthAccount updated date"
+                    }
+                  },
+                  "description": "AuthAccount"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`email_sender_domain_not_allowed` — The sender address is not in a domain this platform signs email for (AUTH_EMAIL_SENDER_DOMAINS).\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "email_sender_domain_not_allowed",
+                            "validation_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "`unauthorized` — The request carries no valid credentials.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "unauthorized"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "`forbidden` — The credentials are valid but do not allow this operation.\n\n`insufficient_scope` — The token lacks a scope this operation requires. `message` names it.\n\n`user_suspended` — The user is suspended and cannot sign in or be modified.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "forbidden",
+                            "insufficient_scope",
+                            "user_suspended"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "`account_not_found` — No Auth Account matches the request (domain, header or token).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "account_not_found"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "`too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "too_many_requests"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "`internal_error` — Unexpected server error. Retry later; the request id is logged.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
+                          "enum": [
+                            "internal_error"
+                          ]
+                        }
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/connection": {
+      "get": {
+        "operationId": "connection/list",
+        "summary": "List Connections",
+        "tags": [
+          "connection"
+        ],
+        "description": "List Connections",
+        "parameters": [
+          {
+            "schema": {
+              "type": "number",
+              "minimum": 1,
+              "maximum": 200
+            },
+            "in": "query",
+            "name": "pageSize",
+            "required": false,
+            "description": "Number of items per page (max 200)"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "cursor",
+            "required": false,
+            "description": "Cursor for next page"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "next",
+            "required": false,
+            "description": "Cursor returned by the previous page"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "connection_type",
+            "required": false,
+            "description": "Exact match on `connection_type`. Equivalent to `?query=connection_type:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "enabled",
+            "required": false,
+            "description": "Exact match on `enabled`. Equivalent to `?query=enabled:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "category",
+            "required": false,
+            "description": "Exact match on `category`. Equivalent to `?query=category:<value>`."
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "in": "query",
+            "name": "query",
+            "required": false,
+            "description": "Filter using a FaableQL query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 200
+            },
+            "in": "query",
+            "name": "q",
+            "required": false,
+            "description": "Full-text search across: `connection_name`, `connection_type`."
+          }
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Default Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "next",
+                    "results"
+                  ],
+                  "properties": {
+                    "next": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "results": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Connection"
+                      }
+                    }
+                  },
+                  "additionalProperties": false
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "`invalid_query` — The `?query=` FaableQL expression could not be parsed.\n\n`invalid_expand` — An `?expand=` path is not allowed on this resource.\n\n`search_not_supported` — This resource does not support `?search=`.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "allOf": [
+                    {
+                      "$ref": "#/components/schemas/ErrorResponse"
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "error_code": {
+                          "type": "string",
                           "enum": [
                             "invalid_query",
                             "invalid_expand",
@@ -20944,7 +21740,7 @@
             }
           },
           "400": {
-            "description": "`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.\n\n`invalid_phone` — The phone number is not E.164 and could not be resolved with the account default country. Include the country code.",
+            "description": "`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.\n\n`invalid_phone` — The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n\n`invalid_name` — The name contains a link. `message` says which field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -20960,7 +21756,8 @@
                           "enum": [
                             "already_exists",
                             "validation_error",
-                            "invalid_phone"
+                            "invalid_phone",
+                            "invalid_name"
                           ]
                         }
                       }
@@ -22166,7 +22963,7 @@
             }
           },
           "400": {
-            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.\n\n`invalid_phone` — The phone number is not E.164 and could not be resolved with the account default country. Include the country code.",
+            "description": "`invalid_id` — The id in the path is not a valid id for this resource.\n\n`already_exists` — A resource with the same unique field already exists (for a user, usually `email`). `details.fields` names the field.\n\n`validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.\n\n`invalid_phone` — The phone number is not E.164 and could not be resolved with the account default country. Include the country code.\n\n`invalid_name` — The name contains a link. `message` says which field.",
             "content": {
               "application/json": {
                 "schema": {
@@ -22183,7 +22980,8 @@
                             "invalid_id",
                             "already_exists",
                             "validation_error",
-                            "invalid_phone"
+                            "invalid_phone",
+                            "invalid_name"
                           ]
                         }
                       }